From 22a16358ff66c085d7667302dc937cbef174cc10 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Fri, 14 Jul 2017 15:08:39 -0700 Subject: [PATCH 01/54] updates --- .../windows-defender-exploit-guard.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md new file mode 100644 index 0000000000..e69de29bb2 From 8f9dfc1a8818e8cb263fb064cfbdcb2f049b133f Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Sat, 15 Jul 2017 20:55:50 -0700 Subject: [PATCH 02/54] initial commit --- .../attack-surface-reduction-exploit.guard.md | 92 +++++++++ .../controlled-folders-exploit-guard.md.md | 176 ++++++++++++++++++ .../exploit-protection-exploit-guard.md | 176 ++++++++++++++++++ .../images/cfa-allow-app.png | Bin 0 -> 79336 bytes .../images/cfa-gp-enable.png | Bin 0 -> 20492 bytes .../images/cfa-on.png | Bin 0 -> 23229 bytes .../images/cfa-prot-folders.png | Bin 0 -> 48367 bytes .../images/ep-prog.png | Bin 0 -> 267565 bytes .../network-protection-exploit-guard.md | 92 +++++++++ .../windows-defender-exploit-guard.md | 92 +++++++++ 10 files changed, 628 insertions(+) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit.guard.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-gp-enable.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-on.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-prot-folders.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/ep-prog.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit.guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit.guard.md new file mode 100644 index 0000000000..51488cd9a3 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit.guard.md @@ -0,0 +1,92 @@ +--- +title: Use Windows Defender Exploit Guard to protect your corporate network +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + + +# Windows Defender Exploit Guard + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center app + + +Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. + +You can use Windows Defender EG to: + +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) + +Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) + +You can also [enable audit mode](audit-mode-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. + +Windows Defender EG is a component of the new Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. Other components of Windows Defender Advanced Threat Protection include: + - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) +- [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) + - [Windows Defender SmartScreen] + - [Windows Defender Device Guard] + - [Windows Defender Application Control] + + Each of the features in Windows Defender EG have slightly different requirements: + + Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license + -|-|-|- + Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console + Attack surface reduction | 16232 | Must be enabled | Required + Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console + Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console + +> [!NOTE] +> Each feature's requirements are further described in the individual topics in this library. + + The way in which the features can be managed, configured, and reported on also varies: + + Feature | Configuration available with | Reporting available with + -|-|- + Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs + Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + + + ## In this library + +Topic | Description +---|--- +[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. +[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. +[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. +[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. + + diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md new file mode 100644 index 0000000000..0557074a2c --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md @@ -0,0 +1,176 @@ +--- +title: Use Windows Defender Exploit Guard to protect your corporate network +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + + +# Protect important folders with Controlled Folder Access + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center app + + +Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. + + +All apps (any executable file, including .exe, .scr, .dll files and others )are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. + +A notification will appear on the machine where the app attempted to make changes to a protected folder. + +Controlled folder access monitors the changes that apps make to files in certain protected folders. +If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt. + +The protected folders include common system folders, and you can additional folders. You can also allow or whitelist apps to give them access to the protected folders. + +## Requirements + +The following requirements must be met before controlled folder access will work: + +Windows 10 version | Windows Defender Antivirus +Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled + + +**Use the Windows Defender Security app to enable controlled folder access:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Set the switch for the feature to **On** + + ![](images/cfa-on.png) + +**Use Group Policy to enable controlled folder access:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + + + + ## Protect additional folders + + Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. + +Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. + +You can add additional folders to be protected, but you cannot remove the default folders in the default list. + + + +Click Protected folders in the Controlled folder access area and enter the full path of the folder you want to monitor. + +You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. + +**Use the Windows Defender Security app to protect additional folders:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + + + **Use Group Policy to protect additional folders:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? + + +> [!IMPORTANT] +> Environment variables and wildcards are not supported. + + ## Allow specifc apps to make changes to controlled folders + +You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the controlled folder access feature. + + +**Use the Windows Defender Security app to whitelist specific apps:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** + +4. Click **Add an allowed app** and follow the prompts to add apps. + + ![](images/cfa-allow-app.png) + + **Use Group Policy to whitelist specific apps:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? + + +## Review event logs for controlled folder access + +How do you see these event logs? Are they under specific codes/areas? + +Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md new file mode 100644 index 0000000000..0557074a2c --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md @@ -0,0 +1,176 @@ +--- +title: Use Windows Defender Exploit Guard to protect your corporate network +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + + +# Protect important folders with Controlled Folder Access + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center app + + +Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. + + +All apps (any executable file, including .exe, .scr, .dll files and others )are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. + +A notification will appear on the machine where the app attempted to make changes to a protected folder. + +Controlled folder access monitors the changes that apps make to files in certain protected folders. +If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt. + +The protected folders include common system folders, and you can additional folders. You can also allow or whitelist apps to give them access to the protected folders. + +## Requirements + +The following requirements must be met before controlled folder access will work: + +Windows 10 version | Windows Defender Antivirus +Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled + + +**Use the Windows Defender Security app to enable controlled folder access:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Set the switch for the feature to **On** + + ![](images/cfa-on.png) + +**Use Group Policy to enable controlled folder access:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + + + + ## Protect additional folders + + Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. + +Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. + +You can add additional folders to be protected, but you cannot remove the default folders in the default list. + + + +Click Protected folders in the Controlled folder access area and enter the full path of the folder you want to monitor. + +You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. + +**Use the Windows Defender Security app to protect additional folders:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + + + **Use Group Policy to protect additional folders:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? + + +> [!IMPORTANT] +> Environment variables and wildcards are not supported. + + ## Allow specifc apps to make changes to controlled folders + +You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the controlled folder access feature. + + +**Use the Windows Defender Security app to whitelist specific apps:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** + +4. Click **Add an allowed app** and follow the prompts to add apps. + + ![](images/cfa-allow-app.png) + + **Use Group Policy to whitelist specific apps:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? + + +## Review event logs for controlled folder access + +How do you see these event logs? Are they under specific codes/areas? + +Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app.png new file mode 100644 index 0000000000000000000000000000000000000000..6b078ec9d5cc63f1c80beeb967b192b513f4ea4c GIT binary patch literal 79336 zcmYg&1yogSw=Uh%4U&?Q8<6hqM!F>|TDn_MQVHn>X$(rbL0U0DT2dM*fiwC4bH}-k zfgcEdd+oJmJoOr@qosTchZ+Y73F(%qih>>z5-J}O60$HB3jF@!1XUfrf$X8DEQeG* zO1lAHpgGEF$|51vCE)(EL5HugT~$mxkdW}ZZ$6OwUCQi{kgkhW6=V&3EVr}K0}PaB z`kXJ`yUcwmey5YyTP)Jc@vc$7Qlxk8zrTcJT*L0DxSlK}?&b!*-grP#iI&_UAuX0I zeln6FAmErI>T%*AEEm#C(j{p>Q*EJ-G284Fcl7tq&-*o&hSAA0_dg%51SXZn zbp=W1=w-{&K(a!qBU`EAxI^Rky{TB_dk|?4!3lOJ&!+I$b7sB|$IYH^6uD zt2Q`&JHte1A6me>iY6?cbg!>AXlEA}wbZ?^J6t)EO_72&z93?%7Vw)(j7=*nSd z#1JuK;7IaD+_@B}FY-P7{pCSz;>Tv*E;c#$0ZZb4;`XMRon3>CxW`tpK*e!TZT-Sn^9Uym$*k>z=Le$4qD?&QW)>8oIDo2KnpqQ%iF zB$OO8Z`7v^cyo~_$k#aMS<7w=C!`v`Oioin1WAdd92HJ0ejjXoMB$mmK4sgRY>>wL zn$B-$`u<_@?T(q5w4;U2@ai|Ad99Y8{66^|yIZw%G_ofCsgy8MA*^1rZpT9=LU{9R$zlx^g~#7i*i6+Of987##8PqN| zt*mb!UFdJy6^-UfCxp|AdB&J^M-$W-Rs9G-MjfzfbVZJ&#cs6cD*M?Ud@X}(E+fD_ zY5wu)+~3`KZOZjOe>COs?)D>n9B)vLxPIII2J5^iiYq3KALp9_+XiF#cSDY8iIlYP zbV_u7J#MOIO-@YRqL;NMnvL=Qw9a42CJ-eC73;})88Ry3`IpJ%QwK`Lgb23;Y-!cf zv2Katd9RP>Kl%BglHz4(mD$Iye1n?y{N5%x15o?4yl_wZ;HhmGLunH}nka}&NJwaJ zzy9(5QTb$@opJ@2Nqt1XREcI&Py33Fd^CP^fjLmf08RH8rN?P!(m#fR*RsN(+^E_dJI;gJ zkdg5lG~q}{o3+nT;-YO5v+^^)@9Hm=38=zZ8f&cl(D13IdCCTs7G3?RFkiL>UU0hX zyEaD0A1;T#e7_y?gPv?Z90m(z+B7$6Hn~dp&YMvSG96vV$NG^52((M{&5&aC%-3>1 zSjMV!X3gk2AJ8rZU0-@5oF|KPW6$N4ZoedAj(RH+67KnT`+Jl4)7i!{-NLrRQSp_- zwXrd7^YkZapM)NLt;Dv_8T%gm)}VZ{$-~iJ9+uO;*)YzO!#YKcV?mzfXBsf8Xc5JBG-ANn4wsOCuc&NjNeudd5^ znZ(x3L9LyinBohAbwBNnYO;>rCqJ*SMiI9qhHkz^1!m=!BZ-XNyzT!ErnIFE-x|H( zFznz5ZJxjyw@ji<7}pL80>{k?sZ1P&+1hWDt{&FPT{{^D zqh`;I&T!0J3Eu-4zdt_t3rF@SE7(J^m^XVmhhyCOT4~aqg9JY{Sz{#~cC7j4-h+|! zeObpESF|OmHKjFLsTRIm%4Y*P|M`G{R#)ely<2Z8fd(aNQg5Fv=9TK*^_V0fLeyP! z%<@O1q?TQ?!NU*EGO;;N*j;d5EwYaWaZ}^Z{aKyBJ^bm?&aGd9N8_|PUEU-SeAPNs zs2Hbo-c2A4Z&))>#B+VT$zx6I*|thfRm$a2X>QQcJ8iVX%ai%t?+wxJS`z~loCYzi z9eLB0CMoWwHr_k)?ZG`UM8|X|jc&^@D#ol86X>#sxy?Rkyt(&hn74ge0Sa(xW`@Ea z0VPzn?z>1N|F`}6G9i_2^B6ZOYCxWMi)Q>M+#E5zB9(YWC{lbp;_ERrya+Vf)1%Dl#gxb&(Du3{d3fctI(V;sN^XPptR2nvnE$dQ>`Zh9j%E0^xR!SDYvb|76;KMoHC z))O-ZtAo*^hkOK$H;R_c%AW@H583W%=*Xn^g8rStBqVW_|JQS}jeUz+uw%)lJIY2( zcXhH@y~S(mp6`J@lXjS4ATpZnH`ur1GPU;{M$&Z)m7dHt>K2C3ebSsR(WJ3Gw`h5m zL@(-Y4|jx8=*Ln$poDiKen(CRNYR_KO&&0O2MBJ9rN&n36%WBZr;>G$LyRF4jV_^m zbb0;c8%N?7dL+@97^}RV#suZ2ee{H5T!W>>1OrDd6;T07!xBYA=Xp(@*#Mt5r!RgC zp=+9G`|9^5{|+~mI_LhEw?*(%Mq&t8^$XJa_^E3a-JzSmyuHtsa98(b%f`2!rC#23 zJ(#y}lSBeeU1_5a@NbLN65WS&Cy`U|Dh8uRgsq&m()9iF2XR-g?%u!m_#0t@JQ;ON zP-|Fa+f5_W=ieeqsfUmpx6 zuLAgiftt?;vv$nm+VARS@INT}`{Hr9G9H!eN zRFt9T@afp*8|A(@TOcxjcCa!Cw<`E#&Kvgq@yUra;H?iZ22&(cCuBqLQ9mu16)N4j zovf0=qHgroi2HIeX!tdE`_=iQmr^T>3iz9N`-|PtBrIyAl72@pm$Rh;#o&$6hU?@A zI!}IYa4eLt>57QAfKI1Mh5O*X$*EtW0WUzoV;)0^dGPpqeecWLG}&WR36zKzxQ8|I z3yW$Ur$nxPZ}U|Oqo+3%u$bkW8eTVW>(f0hx>eir{oJF2If@HP7X~?Q{%fg+Edgil zonh$5q%F=|ou0oBrD9)GPe za~w(?{P~kcxo;T?J`I2;TyyK?-=9)aQnPAr?mfBscP9E;;9;XE4%HOQSH_e(s>JWm z1E;n!m|O>PV(_zg_5}B=2bJZ6%YC+ za+WV2U9rc~&m1+v#QxuvU?Sl$yJmmhFmBy>kI!e%`rbJTIu6{BNW#mWSQ3TDaQEin zmI25DDBhXhq0k8UnajM9&qhCu$D%|lyFxldG0$gzNo+Iq?){hVf-cXqZi_Hinl$`w z7?WCdTG`qf?hG|Eknq|how#b*ZTtED(S0?~fLfmtYaCJ!KUyQabWgp{1K|t%x1Z-| z{FeA2fhFkD#*IgzixJJR`dUz@+AfJ`;kBBG%)po@tx)!&;LjFs7X+FRouooe^VpfO z{XU@tyU|IyNaxcu@-f=4gIqbHvs!(0n8;mT1ufR9V_i$_oqz0m{CXq@EmX3_-sgCj z8b@G-ednQP`%6I@O97wo!TQ&UC-poKndvg6MRoWw){Tx!2~jsM`|S z)BBCCiy9e-#UV@rx+1dHL~{OELXTB%eHNYYhR%OdmB?0RBsa!L)#bQa@y+ZejdZ3*nVN6s!Tg0IfjlwZq$_>6U zImm+>Tl48}X1p(~T{rVhhtVvmH|27SE5iPNw_zI(u(|3?Czo5b2ek)Xu5--&J6%rT zKz3=r{P6MP#{&jfFwo=(vq*8T^jcq4RnvzN59l(81v!w2QI4Bk?LlQe1|y z5&!U3I-cIi3$_S{(HuKDiX1J6wQi=K#b=1KuWY#i1>CChx_c@zd=Wyw2^?ZR!RqNR z(E(*Kq#w)dIBSb3-_P{=Ni7+CCDEl2@$;h#+qi;E zuopd+(S_$`xi! zC97{n%0*zk2%y|BL-u|;|4FxDUPEbJMMh?UW-|e~FU`hFETe>kV4Q{ObEt%TWQC%V zx(S~*M+B)??7hz!nS5(_pJE*BRlIONkE9TxI(3t=Ct)0lP%voZ4}}J?Bt4LMF7b;s znS4BaMZT@&De%D(TnEAtOr)VgqmO7j$ljqpCTrKjUr=BZG2MSd?z;B+(HQPF;~~j9 zsW;_$u;hZQwWr|D!JUq>Ki?aacj?63{%)I)-yM}DyTzhoAs`$Q@bkkHB3CWG_c~?t zBJQ7K%uppFraZU5O$e?TM5ZI$nJ;xQeTRfvfNHzW5v)&_lX%8>PZDZ{xSy&<+m`B6 zM~)gv%;HlCVR|JE6|dupQ8B%9qxiZq8SqJ~#_|(k_#d5O*69`sY;Bs;N6V<^j3tq{ z6!p0A^wL4uxEe*Xk%1|xRm#ENBh6}gbq36n5v!S^CCDy&fB#0Qe5+-*H!6Wil20B$?WB(?>T?czPVj>vNern`{!>K?`K z0V{tTOo?g%boeRID`00m?&gkw(zX*6&;d{O;xVCJj&dOyDZI-E&hr&N1mP(efxzxkcd?^-Q~{Sjz&6jn#lf*PFQJKyxNe7+~(eM3L`NlQ+S@szFG0*SFSh*@`H zYdNIM_6;tSG^_O_1#7Gq+@HHq@$?i>d{rCm$au&A#pz#c=&CdYv zJ{W!-dAKL~$w@7~GKC^Zs9H6o6}k`>x_)HysXpwnMzbnYA<5(pqQJmF8fdrc4HECO zI>kmAERl?KJe2NFJ@z~P`NeJV*Xjn0Tf`x;p%R#yiSkKozq%mS`C5S5;E-{4Ol28h;M1x&?94VD z{{Fmdl!17V?k^GbRXvU8h2y$<1ni$sy3wW^bxis-uay>K$tE*b211{+30uJnVy$tQt8b0#n9e9@w72Z3W&dfU0XtzXP9)|> z>mFK#p1dP(xlk=tZ!pBICX+`_!9cK9j678mPm1WYM^bB4#31OK@M4!mW#QSE(c|~6 zoU~g5<)q=xQ8^1Wd(m@#Y}etH2V?MRt|kZU289DOpWkWa$aS#zE%1}bb>@v6N&ni2 zmjbNp3T800jCFM?dn_dY0at5BeYiM3S9(GH#o{QJfn0Y;1m*rdiM*hUQsrT4B4@As z7=B}k*j0L7f_obU<%uZOZ4A7WHp=~^km?bosahL(=tTfFMJh>5pbaZ0c+)V@yl^T= zXMH0rFT6R&KdE#GduIOHmBCxeO~n6iC7lRkVM?fetc*p6MfQ{9RN3>~b+-`37#VH6 zbRr8ex65;{&px$$W47sPJ@GW~#y|>7q4&|K61{hRdiwasyK4fuu-M)Y;h6b6abcd=uKD?a>Sm?G5w>HWy1TeYO3)!Ht!C9JmUh%o@yD*Y6-=(n$xITgV+m z20KyxwfVNjD30gZ?RmW%rncjOIPBSC+)JErlszzM?Kyiq@*U5bUa0Q?FdPqAZ*9chW|iXDdW zgukY7`V9|k+Z;QYVpdVM7Pu<_F>!QuDn9ED*i7lWd0t<{74hl3p#oIIYAKvAaN<1Y$ zLpZx`!9ve(3e_7dF7(i#2e^}AfkG_U28FWn=I>G6 z#b|ohG}vXJD-vA}CbLWt5VNYK-q<`M(Luh4{q(_iZiDI*3bd7irxof4ycheS)L3ho zxQ8%aqqN2kfwe%}ldm-bk9y}c!TxV0MVm?aWkBz7@q6>+z85qU^aV^C<7SiBj%r* zoS)j9;qHWb-NXAa$@0+3|BsM)#CM@!f-LFaAkHO0AU2Hhsz2U21Bol={JpH}Mz#}% zH!WvbwWYnjXMMR+JfQJU;VPU!DqYwmCuvrcdGfIizkJzo2`N`-~T-dy!g9l zzus@~*s|HPJV49pzx%@42_>T)cy%`oF@11&DF0`FIdq<5vKcO_h)Q_h-2J%p^ttefCi5t*Qz{Y3yo};}z~Kuy`jV_C!>2qx zTU8$!Fjj3Mp%FKDTJ) ze9=9@Y=mDCQ+ISoluCkUjhz9nnX*~)lJQ<@O8)Mim<5Bj;uOw9(T1s`i{19IRma>w zBXIpLDY?z#wEp3ZPB8^A?!VLc8_)2t=Q{l{Ylni?^)1)@Hq~Ax145;2yamglbjhQ3 zWXuQc;ij`QKsTqwKPamxosSyOT}I7Ka1}TL1AoVTr4BGR{*SFJ5;aU9q7^2 z&XwX;nr#d82eb?-E$rBW8;5{}E^pWJozM5Znv^-OKuRWx34tnQCQ#qDLjW;2Ocg!P zIa+XioOwPamhdEP_`aoYZ=lWoWQV|Bu-^8!I(hndnF!b-Odg#)YrFAuY(XT;E5Y&a?a@7_kbD zr)MC*S=%`ytaYi+6_X|~Qp5?LbEHSxaI>04t;lj^ z?a%I{*_GR!RyhN*J>%$M89oixZ+;C#YEpT)RX~{BvMS%0AH+-UIjOK{!QHU9xi}Q_SEf+8NBqN$@GQ8FV zPgXj2fhUrfkVHRD{d|}kuOu;Ej725ZBUJPd3Aa23LxZWfH2o;-l2JQi{*VQ z_qnYfE;};Jc+uX`3!QAYA0F@l@rib37J!W~2`dteXO%#4Wb9UF(grCleyrN9mqfs-6 zk>CFLu?DIX=0>5{b}8*@90l*rm$wv>e|~*x@%Df zkh_4_=DBAs9Z~%UGcwo1(LZL$qBQYXjs8Lle~+2tPv7?+)WfU*@}DZ2F6zOWMsx46 zwIx-cfMiG)m4L%K5w$h#Xa8>nB(&`8gV-YUB;hIfWvs!ZpurTW*9 z_rpi*W28(B$@+?=Yr0I54kfSnao*q0Y!Qq;unwd!)Z#=}Nk+_z)R97(r0)!e`hb~oax_O5G@@m+wyhjsMm>6$6UXp<-;NsDjm(%s~!1K<-T|k>s;IMre1@lINE(2 zGdike?T}Uv+i$k%L55k==IxM5y@9;)De0^az z$motloa3Mm0LT%rIpQA#?;tP5Kp*ETD!dtcuYSJ|i?2=mC71Ul7zny59d2 z?TnB?<5#P%fYjpF*4>W`iJ5#ha^PkR3bbTWO0r+5)C&B`DvS0*)`QDm0cy z^G?<$>_7=w?oV)36Is>$R-*X^3>A)f$SM2|X<6~|3;BjrD$(1nu)d^zkc7{`Xf)_d7oBg^+WbI_d2XXl08fO)_6*u)T19 zcCSr~PPmt%T*!Iyj#|u?b0lA`gnHa2E#KfD@k z3Gbw}HO_Fo^Gj(E7xkhpxmV!7pnJ>y{|WzBUWhPr{6PDo+d>K0VGq1V(MN6RSjfq* z#l8#A2Nd$EAe1YV!vt<)7W}~nm*WArftq8oB^S^JzUncnI1_4ciXv2E4ncq^eviU5c>v!GjP8cvFhk79)bdJUm%>Rb% z{YFj!6Kx*2F|c*N?bw-X+2>of7kNwfb*sG4*OfPVs?e2;4%{lx_sg1}?UK-$)6z-@ zwZcv}&tyAo+=x37{P&zX?aURy>_dm#&?ntTVOREL^QMCvbKJbqwa&ITvE01L9R|{#*1wB?XNNwHpfRj{enSCl18nDN2yH3E68o3| zjs>?N@&`EEo?BmUQL$;7Mg&HLr2Lt0zXmYuGYC4|ioH)18U%LKv8g0kqO*RFP_@T?v*yp`cJZQjBk%Gu@)1Jq1Be*FS%zR;*&|C(rYu=_m!{4fksebte6eSH>fS|$cM0*s}sc?mzTY*%jF zsjLiw36QH&k^LgEC7s5tusmY#>@ejHX9{hd?k^wfa=d)+y=#e3+2oz^{_`W!5pqeg zWNx>cT~`K(4nzAP2e+zSuXBkWkHLC*zEwlQs*%`^FgpK<(i|n}&}eDkBlewy5rPb` zBfq_K)`!&EVmz492>F{}#}9U^cTT$X_JadyoQ617vQpq+;ZpF7Wr^ZI2n=-&L&HAW@;ta_+K+u>i9lE* zk0cai(9t)-+BrmbjkxqWbjHas5^jrs08{O>fZ77C8CuZn{lmx)beXBX9UTv_f;j~^J55{zV|5BEQb2R5&-5 zLN{{}|D*G-&0qz$D4dS8>*4!HGdJn5>L{&>m~>1$N*OwWDE+{IfSydaJcaP93W7-9 zxo2mo*4ya)1X6urucpCCOc4Edz$pOwkCY9ErGpuVFfBZYZ~ zgIpGs>J?2HcWm9hGiE9=DvqRDNM>HMfMqJ3hcn^3bKLk+cZ7gEYgSjTU_g91m2!#= z^}w5n`-I$O<0EMLks+MPL*7m5j8vMfm?NIlI!ui<7KsGt=v5*t&cjsG!!tyQk&TTK z*aIp?{~Y&&GX|A1*$?>I*Hw*;I&Ds6DiU5cAvkSYj}5=YcU6Jz|D zZGyr1m0h+3Ou_lUliL$!kT^IN2r04#;HKcuqLyk+Vdt-w&d2!10)kuL8EU~S!Mm=u%7gm!_Zt^@(eRGA=WuH= znq3#WdYaHS&ETR*5Wf302~iNxynJp97X2GR{Dr{H3$Bz(Y9)LGO)8^hjDPr!bjP$ZC;3{}?m1 z&&f)5XiVI5(MT`%=J;Zc0cE#-}dlRVIXdaEXS$Yg*}=y_}aTZ-F9?6Lakc>-e-G8RQ17m$^qWUDLLwZOr6_uruzv6ai=)d+_SZ- zyOjH|aX7AXg;B5wT(G{+^YcqbUd1D=W#noF)2h#ApY$DiAettc5>yWh?^0=3(zJbhD z*;i7o?ZRbg3e?oZSOUK?1p*buYz_aX4t8}h&2|&Ru2XF6M~&TvtWz`rJ@^j|IdwRG zxNOGh2@grIc?DkU+;ghqtf`!CLn)5D3TV~2A^Inl zMtF>yU*2wobAF=6jkf_={~kSWmd9m!ygfU>&nuWolD|r2JI;Po*VI7z&GF)ROPMz- zHxfK&klLGJY)zZV8oR@0nL~j{hu~|hnceFtcHB5uoHZPw+;Wkb19>DbhMRE+Q5Ik) zEkIJv4pu#QK1R#DlOLLVNhRt3i2}v(e&D7yIH2C3 zWSx}PGHV~Gv z^$E#Qo`fC{89f=M4%P&fHt&!xhANaGp-FrWBQ>Pz;Gko%MU!djk_@Cr?l9sHn{pzM zLRoq&|8S^dwSI_11pID9*ZpJYsM#;o*$VnUNpdBb7#m0U8#6W3)?%Gt{uSv{{{Lk$dAXnSH~V?)&EN}sf$`2v%1k1VP`DC2WiSJzV0q7;)r%~Nz- zIRWoc_yZ;`_=Bl4{`GlAU7j#pzb$F`Xd?u>wCjQl1gEAWekpL9)USY$JzzhUa|x1k z#Pb+rH92&_%XuI3-K~m8>`ib=qP;yB){G|=`=X3B!7j|2T-W8kTP`lUP!laR^w#ZH zIiBZ78-^Cf@0^Gt6Q-J*m-jQ5y5~)&?Uq>&$h&vmQf7;@4mql=!zU#o)Y5oyVA^QPKe=mMuwuvF`d8#61 zn6i47YIVZTz|+NO$lPZNIul3M=NpvkK}Mo@0u1tu-0nr<&}(bd_jt345J)n2r9clo ztUd@+L-S6;-6`!U8G6}@ znT8@f`^9`gPcvOT49 zyOowsEI`aE)>l`L&(?Awofa*VTjZ1M0W` zc~=6Q?}4*7=E3X~;?K6hzDTr@z)lT5e6)qKJjE;Cn%^8P)Tq8vPz&1HgUYBA3ch=jvJZMbh-K~vM11X}BHzg_op zF)~{J4|SOJ1~GK}c8gt+ieUz_9&qdiZx<`;88aM0GDp3w@Pe8wSrYPrm7Uy2kH|Vr z3`%u$L!KH|8tcYcu^cVIEH5CIX@5@6J;Yu08oZf;j4##nJ?L93?mAziQ{yVHT8 zM-6m9;#&>JhTn)2d7VqI2x~Y97^$%qc9nh^eRiR4NGEAM=6Y#82R{ch(wlJ#Kjkeh zmphEgYD@hIHT$KsVSw$)yS|llMB{~L@mfh8SVLlTq%umyI>7W2G!rt38+?y=bZih{DP${DqV(R%60u>TO6 zv^ec;0w9GuR2YpF$vVJ{B&$NqG^K-7pcqI&$V#-d;k~U>poj~|@WFx0r(^QFDMT`= z0A;B79}-2nNeE99n5cXUNyojaGHEEWN19c}F$so4OZI})3U@Vd3ekF9)g_s9Y?l`B z^Io9YD8+x>2=nXI&CJG7#UOMCO##0PLb6PmC5nwv_yzF)aCl5Ppr4(=f=X%3#EOAq zIPMA0!?3y^KNIl+`wZ6h*J=y1uag`o{73pk$;lFPHhmLgEQbT*x>$20;Vto>R9nuM zQXt04Tv%R*WrZcgMDhly;bL+9K;oYnm2WBLiicPPHS&YhrT)osLpFBa=x5wA-UEFs z)sGK4bZ8i~vAtCJZ?fIziiixhzeU`m%xJtZs;?fC0Q=WKl&G~ggcDMcy?8%6X{z`9 zo?7Eu&e3Uud@=G#j>a|!Hq0J7@vtXOFeK^;hUs&pmnwGHXU5GPpbERC8( z&__@wMJl_puF4E8@y`pP8Cyr(XqfxSu_Icz3;l(KPKJ={1QfTQt;FFmSEjbSUBNH8&pLwrZF>gFrAS!Mh4mALqv zbV#BkCBr=bQl`5M$P5&+ugiZD!{~PC#5`{pblP*|PBQG!-@eiv_8eYpXoa$Ggi8w|LG}f1_0nrTj0-cb@Id1?vw~` ze4zj=K|ymul;KN@5gq`MP@vFS5Ul}`@2%n6zi>>XgMsmauLYc0P~pjD;H;S!42X9Z zVD(PmbdpAXYXI36mTZ!+=I*yTW&n_2h0Qm6-R=Jc5?8v}RH=6GTDCX5xssU4u`yl< z7rx>&oV2)kU9udaj57v2Vq^tj(2xisR}AUGD5U~?!1@O8aB~Kw+vt3-6&6A;L{b6B z(!-#H6)&Rul3Iup6p`h=7vXvwvJM>~$bcW|_-z$n@iCgmJceF}rI01)tOv(lIQoA> z_(coO#>s|b_?6EADngH9OOh0(?8C!ZtI9)Di$&oH&#Oq}k0fv&fbaIolo4eh4a2a`pH0Lcum1IqcKOLQ}udVgbB^pw20Q9wgRD1JZq8%c} zJ;O+|YqVJrkHfyXxU7xFR{vMs=@$~@r|se=S95pq7$w%n`|~G#69WPo@yk1d*=h&MEtFL{dFt;v5v-W z5_+VsI_i8eHUapj0<^BU{jZ;K7nPXbQp5>*0}HU zDXQyl?k;Ag*87f+zWyC%Aa>#$zuYx%^0*{U!{o(0wZK|OJo_B+CHf@>S{5#r$g|^v zk2jegF2P#U`Et-;DTrxE-RG@Nw;mz&>Y=hI-Eb3;mg{jFFvc zHv-qPfs$E=%s&KJ$(hn|JWtkKkD|b&(UtL_0El`CWbZ5lBamJ|o8=CJ+Q0QE>?VE* zZd}^Sj@_GdIR2?4RAcUo{Dx^7W&D78{%f!OQel8OvG%6hsnc`9h7MU!VLTB@jyNd46%BZ`)S>1PU9B3dbHG zTdG4U1sTtd4c$C(E?4dvRuq}=kr!k=)r(8bm&XVmpXt+6A)%(l$lB3&hqHFgO;bQK({&M(v*5+2+!Oou$nwe_M*-yTUS~BH1hx=|?naVEcS$J3?FSizgw-U12 zSH=9J&|JqsMNHb5D8!r~Op~z+u6&Of*@T8_P5w3ZiW;_-Rt#jNP5^`uVzzyO^~g=! zN*Em_e)J+xJ_^s~39n_Vu~mPJ#_q3AgF3e*`B-rlna!!_Bc-63!|~!}L^X5a(Mwj6 z6QRAGh|qh2a*sf0Q9|5x~`PJlsCQ&7Gb+;b=%aBKygu*xZ-Ns6AtBAb6+i z&(|s%&D!T>zshu(xxJbNTz*N2psXI@4&^<1r*1J4?g_!V7ZM?6>aREz$vPICVken9 zmJGHiW4quK3b3OH*$zr0@l5`N7Gp*37&_u2#S-~vlMj^A@sdri-)RZku!s$a=%d`? zZ%vIm=MRySA%k!ArF3$j!XIOj_)5U1M9hAw+bkg}=PbYXk2tV=vrrHiZal8Af zS_#Ij8@2g_INCHqQ^BX|Dra7ti+LQU@v|&qPepZn(so+UHi71G%FHPG>?f~<+z`e` z2`(bf?vBsNJ-ui0xX7o%JmOg9x$=_WDSO&!T^pN`8UIdoyEWTtH8%SK(IqnLdso}T zQiGT}q=DMd<(5faLIi^b213u`@JVo`*j!hBKEeAiWYfn(-9)C8AuNt4lCNr=5@+cb@7^~E`Pnh^FwUEv>LpN?>!iRYw>&o7;p z)3c2yo|_qafLuu&S1xu~fX$M?No}aSLZg8k*iXkbGau>{@rr_y=f|si&#+hx1k_t% z7Ky1P->EjV;oe73Dv91>F60*udO(Ch#3)xNxzWtkJ@*uC)&>D1#dGbq;@6(6Kw-0Z z%b;zokn5_D0?msjpJ;uWTfM|roVG2Ctj+1^QJPu$Q4Z|xa3GsA*{Prn{E2UU=bZnL z%D=;ef`P+5A6t*x^c5DR64{Sp#&WNRdFESa3=AwK7GIIPInoS^CK=wKH#6TdeXT^J zvyewD#=aWX@TlGh6VT?l4C_l{We-I^EUU~9?oKF7bOl7Wc_NHLESNDl<_dcLte0P z$Ux?%S$-JB`^|u3T6hR`In76cCnh(ET5@RNoYY;WgCc2$hdVg(_MR>`nQzs;opT?a z7JXJA1lR^&k1{5?R~6rw0S|9cCX|YyAmI*fh2p0*-!0Q!^GhT)QP(E(snGGdWyn}a zEToVyuCx`es>8|Og(DE!m(onFjo>6wF9;>hCgD)7N+CtE#l!O2$Zn2DdLMsjP&%vd zOiP82TabJZdZA-;bmbXuweX;Hx(_lvyZ+h z5`>f$nBCwQ@n@AmxUbduF6r`WVa#^uL)NTU6Szz4E%qdjH=Yo45F;0I8b^8$QlXq7 zL^jy7BzzG=btx?oY#^Y}fZH-0RZ?djT?nxf4Txcx3HBs8g4W2zII0Ynrby|u>fyOs z)Mr}I1oGW`m-!q;IJhKtv~@;=OH&8bJKq(QK0NffnSLTJ39+tKh=5LO($mvdt_DPO zz-pyL>%M}G14j`g4#31IT;>!1!I$8^^Wou_=Sqw_pnu}gOJ#+U9lFPj>Ls<%3OK)o zUGABYascO`(uue#bqg_kqjUou3Bc>qClU}ukRlGK>i`tO0Sd_69z#-F27?7FhIjL8 zmAbr>o$)&F7g1ILp||&IN-SO`!VeZPb@$GJY^VpW83(%wNJ-f&^4Oo=NC!)OTF#OJ z>!=TzYI}v;pZN6xQatw|(|wy2s$y&s*73k5WIswY{MKof<<(V1?n)sAXK3t9-ky7q zX-WN}&Y2U2U=W&p={34p9AP*#)D!#jopZNd=LAR38hhu2n^SsZY8N>03z0~-8W~ss zIM_ut1hIEAbL5k?K7$94I?gjpMqO0xn7d+_Qzk7x1Ym?+tr+@-P7Kloi2=I5UfPERlXx3zDvfo# zRR!(yZ)nuT&)X14?spzE>fjD+z|T1q(t8o zDaRV~87Wgq;Nx!~2xW-|s7?hEakWw7cM$h1eerhQ5?9gB-e&unN%5`_<%VkzZ4R1@+3q8FuoQRssy`h|uPGc}~;z8%s(;-@!B}cyMv2(&X)H z2d~{H!7XO>ZQop@hd;}h{RG!XNCWQ<*&hI-U(xic^35VLNb0)P-gxhDyUe>ZYBIqp zw%!0+XF90>#!v(te|buQd#U){R~GbL$QG~H6ioXtVuF3GSVZU=6r1@gV6DCG#CGq7<_p&(f|Ihz@;>gf~fYiPwYgh_z+&2SN5NvK8Uxe$~?ygrm< zKyMM&RptX+q)#XmJL&U4ECAS$z@@4p0RP%crxcYK6*VY>{i6Bfu48N>$qHUf_kCZ3 z_)+K&8&IUd$BhXD@nDi4ePQdR;i3CrhaQG{g?tZ$q~TwXeSZ1*^HsJu`!ASM_XNJf z_No)lK;9V#@iRHX=4IT8V<7Z&Zi7t)dH`Fr{v#E<=eLOm?%x*+z*ajh!$^;3ndmFf zm(6mhvQr8k%Gil_ z?;iNA`nI&-AGLTX9hXLyUD&^PBn@2P&Zk67@i&7kfm7w~@koU4pJU(q^FNbesp_*I z#&ZcsY{m%j??3NgXBPJ5N?Y;^MO1(NVlY*?4S$%)3H1=o`lp;(9o$L{DW7@(n1Hpu zv?~gTJ?s8ZO*d>K=-WZT`1xpe7Q87Zz)`_-N7ieUE7ki#$q~LQ=^ATV+&H+sz~|Bi z3mXVxvG^zru`6Be!d>BQKBX_X-eA|^ zjI>}ayc-VY$nwif3#r0ZkR|01t2Wb5O;sAB$G1fHYDK*6vY38^5{k-`m zEvNDV&;>_)6RVB{Q5M5)!ibjI18{vv0WdvXs$*5W@5Y^~smABF`cY1872d)M*nOY0 z%kptUIFxhSK6BqL^Y$s2mXT7IyrL#kl29Av{y@crSlLA2+^D2vNal>*HUuS3#>~CP zc2gu>_aoOPINhrz<&f?g5ul3&;eHLTK7X``a4(%BgY(m259`SD%Bdrp#JFGC-*z#? zXh4TR`=81RQ^WzynSjsBg^Vv?Q->D?^r}ghVOIs6)U2c%SKw*vH7H!GY4F9?ieSMW z-fc=PPv_AfJ*d!4>zki%gO%tD-xx@4%YJ_R?ygiFBY4D~ zIe(7+5HPB|j@yt3(g-qa=Q@{LB>FE-e_WmcEt*BWT^`ksM(5p|AfYk)y^*47&ccHw z_5uqMZ6PocZ=0@?{Qw+_&<(UYs)4|Q$`9-yH*kegec)sRL%vRAvT~c$1E(^jUr_g^ zW&v6P_%%AT9N;i`7&Y#LiP8e^4}xuX>k`0ep6g&Tz>!&6Ie1}n^mw*l;*%Dhko(vH z#b1!7-y^dZ(wh`93b^(=0PB@;1Jhdu=IV14pg5}HVjoskO3(uiYyqIPPsvbwYNs4Z zG|8jcQk>U8(sQS7?16m4?Kix38&2rAPe?V@PI}3>dT1i?rmwzNLQbbW>cnE3c;tt<7=BMe{GwRY1G-N*y#m559B9KY@ImjvZf_eon_vs9l3LB7Cu;tPDKU zv7WI>x_VROwQ;hkclW#F=Ru@*Od_`-~6gmhGN z6{{GP8|HS#UAHNTDoU5Ia*MD`@0p82H@CKEMM36eP5DN4$_dS0QmK3lGWRpLFZR?m zt64M7d8D?|+Ji0K593B4%#)S2m){v7Eo6~H^0g}6*gn1HeE11vfNdsc61fz=@#UA* zh}>a&L-UTO)TK782l`njB~K?7_GSq5WN?BS#Ua;E>i5i#xh` zLGiI9wBXHsTK32QXFT9xpqyM?1G?CqnB%C}56s$@;aVJs=hFBt=Z~0na5;V#_&8 zM%&HwXZiws2rpLKO(wF}P)+r48xP0yTt$NI!y%5~HPtFG*#gEgp?5@cKNpjwyF$945QU1Sk$y$6S`3lCuc``f<<#GfFKFCSuNyb zoqH1 zs0V$5Uua8-?*zg(4Vx_G3FHDORwf0g*LLb;M;RpS zaxGq^kAPNI96TIibP_-+M7M%evZ%nI^HP~E`m4of@C!4@Ko|lzB_TNK30QxtuFuym z!E5VT$OM~b0)NQdFgUWZj)09QTLPT+>K_=egdt*tVd)WMe!+z4q@mQ8Up5HMz?XSP zgY;zx%-B&E*4p7KUo0t#M$Eg5?ab3YmeE|O{_I;S9y(lh!|bKKq@?6g4+-pNTI?Iq zh@)gQ?$VKK1{+0<%-56EsApxkxQa@cGWlMKAN8z)@6u^u*8)l=V4LMHAzOp^i5yMA zPZ&!Cw-OnJ?FF^iU!OI~FT0sP`vu^RV4$8Sp8ev$F$ot>LtF93f@Vpz{yS)nrN5sT zI{rC6JfYd-Q1o-8%LWImGoS|bi%e@&@MhJ)Y_Zp*0&wi4E7Ube6XAsF_=m;(H%KEe zZWG8s2FT>fKrScN_M+$dT%9sN=d(WLL%$_P-hOQ)l?N8_a$dZY5@rQg0ngu&)y+@ftDolisq~}Nh8cgQDT8qZWpYo&0S%zx9wTL z>y$#ssGaV^PbV}$r-V#VixpG#lBR*tx`Nz87G$M~3ozU>$o6&%C4$OIK(dTw#Nhu5HNtJ4S>f>_elwcy59wRNkvhL4R=(| z8fA-mCQ8(3KZ8PSj$I_IlaTO8m^vacEm6j67jv0#mU?%j2GABMoFVHez_lcX;ZM7s zKbKR$Nf#^LN(N0{zCpf*BMcE1)B9o+Z$0u0CE>zFUQJ9?vF#mcTeN=`k+T4 zSzt%w`ZW!5hG2*kkPz=f!=6X7tbcfpXx`}O#)4_&kGnLc1HK#xN2V;I#LV9+Cb_T7 z5eyqIqgbW58~?!2Kibcrv=yb(s5)7oI2($d!99s3TMIfPF5V{`9yjvk_79gI{zOmT zz`g3lC#?;WWd?E;gL>OCZ&j(>A_7FZ5&Nc0eV9r#heH0pDO zdkab0w&x=YLYC(olvVgpCK$S}vgbHuXo3{!Arbt9Pds%%Pgg<&+!|D$u4M;mVSuIR zovFzE0Sr)p zrgs)-SB->rL1!eD25XK$2$j6gY7am-?V5xRY4XBA2Oh&qoOM=q_UbAK@KEogR@~KK z?l*}8%mFJk<6WNi|06Su z`S08K(EhjetZ~xvHJ=YUNaVb*80!0Z@^y^beVNTeidx4Pb$xezmnMI&49c%m3grg5 zPFHvN9Ik8W&!MKc&Zgx%^!n~~1%4L&87W%dATwv>0p@}*W$qM#F#?dF1&e}>CV$p} zdEeU@5on3^7s|Qkr8xPt5m`AkBek!aW3u^<&dpwT^y**7tjMh9W&&1m38v~xCG@oX z7>hFfEPV$m?jo(5?^Kb^3&X?iP=%$mpmzv+uDmz}5hj&->`SndH37_rQSbIsBRmmo z0KDsHe_j#>>AjS{HgWJ+i7f8CS8JDkJ2c^u#l$RO{OpEkY*s75Py82~xHffwm z(_njmK*Ye^839JNa7agR20bHwku&(9uy>weSMpr!Ks9HJ18CLI##Zxeh?GQ6V(~{n zz5zqk0nRpfk*9KqR0Lb{q1IGN&JhC{7DHA@`DQgtGh4`v_jIe&W`cX68-+o6hXaWE z9eknSc>lt^-vu#rQxIDAm|O4wAd_bJMX>$?GZdEPSOEJ*uOy7b3b(%$z1T{&{ep#Q zySx!<*u8uApiNpsN)l9Fpb=HTbpbzwA7$%_-!weUc$GcC3@7A|0M>*uRSwT%`t(oX znH-Qsp8>CN9;jyMEu~*fi~$7G1emMW0%<5Pk&V#Nynezf%R&@`@zKRvL#c*ZN`7Vn zjMqt+c0gRhx~gLNLm+==^*sT|_9P8I_JuIqSFHY&=J*=*mSuS)Po@%+5{cz1jKSxH z=A42UI@-zl#uy9iWh%cv$~e=5cn&Pv>Rc4koOEfzg1m!AZW28-@Kq}*TAD%XS;Buz zd5{axr$sYp?oXL){&z2@m{q?E&j7oO8^7Oe+zI$I zHU<-PJhaJcOfQ3SzGmtMh^l2=M!rDHhuvzKMH#SE+u}&=C$8f|MOAhV8IxCdY|D7h z6R;|zW!jbz=Tg-opTnFTa2D2*lS`Hg4BmNX7lCv71OoCr0B45cZxyoRqO=sClPEe5 zCmT^6LMO?vDjtp~iXk|dZ4joofBHS={7)9{b~DmN=jpshWu{`=XhxNftTrHS(ljxl zD9M5mApI9iT)N~3MQ7V_-1L0NOa&=e5VC!FI5zy?P7|v`@xO%BZX`WS(if78F64i@Q)@S&cwsWd*5$(=~u z$T>i9m?eIhiRKe*<nXVeUakjtHarF(nVdM zYmWBOZ5TkR6h|JzP7b%Lyoq=6K|UvZ#VUh z$;l4Xke~A*XA+Y)ukrYfD2&W>*Sb>`vi-kB7j^%G$o}8!`2STz`~S!^sM3}KPkl>% z1CZ6nI{}bxMEAtXn^gH#^N$s(hyP)(c$q1;*uq}L{yV+`pOvS0knB!-%E;013uJ0KfC1oA09=~tIRjcY@p!uVtD9Ybp(K2ECT>`y_gjQTw(Og2#h>n zzz0{Mh%{cwD@6j*p6GpV#I6Ri>|5Ip zegs&V>Y45^{l(pTl2W4Y*{B*La{I_?s_kmclLOuaWUY=D)E?^B7{-LCP#nRN?8>Y@BYwz#yX>k5Y8k>AT$k_v3&mgzee_5o z0F?kXUNd+j&vXrpV}NG4I5;?DA+=4wp9!>4MHeDS8kZ>0%uM?b{Z>OT_wvi*_1)gS zp$9g~Fw}a%lp+{$Hdoj7=+Dr7ef0oVL&GoIqq7*0(ZozpWex7%HLvEJJ05o_293 z`h-)(|r4DrI)u((tQ&@6Ik3kfw|SVn$Bf+GM{0|GQg zvYCJmfe$nTKyIt`9?Ywh_E{O^PsF0~u^7&LmZP z0cPb$zvi{Daj{!m5RW-%Mm+cn87@H*Us43U5e$0lFO z>@dv$7b0Rl+j>%1GG}KW0btVWx(R7Apnl~7|5nbkI`dy`Pnakjp(L2nrOO&IQWVF* z2=eRX#5}5$njVToj={tEedQk0DGaG$9}f59+V zXIS;#hxj$C9xvvrNWiUvCBo>L(Kg_A^BE>?gP8r!(T@6k@Jx~pn#P{u^E3g**EC;< zlOhbr*iH>|n%20yUGN)3;39my8xl{R0>P)x!sV7h6&iU6#zPMP-k%>Wj*ln!eG+hC zDFI}olu7U7KllS+8a82O`QkE~4mM@FJlNVrc_ZEzpOv-+f#-jbFV_?EcsJ*7Kw5qm zs5(7~k^kPBjR4LMTTd7yz(rVyB3An3e1$b!6zrhg2=z(=78+5xo+j1^MW~79@ERep zNHag62_sBK53#x7iDW(wG<+~!y)lm|W+114nJC6)!hD!&8s(k--4x0?EN@O!y+v(p z^67LDPox+r&WY<2J?Q=x6h4a2e%mpT9gxn@Do=T5odkZ=v$H^J0*(=a22^PIfHFImNZc~y$e=7u^2LMN4s2X8; z$e4!aMXS^jH+sTo9{@Wi#BQYOd2n0I4{zD+Eg*N!%SJkVWR1KkqRFB&^SPfM5_7Mz zykpFXPm@j;j~NGj!w6>p#>0@S5SRnb2gKD{$5@bsj!@1!Ww=nMu5}T3uU-~or%&^> z=8Fhg_fj)RBk76P!iT;)tGdgaWeKBH_zjscGCK*+IBpe*&`5G@Sz~vGy{Cnjd+9DE zytgvyaUMZ2_t*id4~akX0A#d}+vrh6QL)8Vj?inD8$Gxrjc&Cb4N0eNF&=5uEN1tr z_O@NKqYIdl4Hld0_uPaLo*>243R8FGb{G|vu09X9n6va%s--o$jql%ju8}sIs-yS~ z7?a(Ou!UOUp_A*5#j)jWJsRdV8 zJ3MCvF@UbhJ~~%LsX&+B_znck9dmX?MniamSy?;9q!Yi9%o(2+71>vr!t@u)m4Xw# zM49qo3j6?PgCO%M0UF{Lf4&;rO)jquWpp^3-P>d>rGx~bJ#B%FP_Hk!lJzUxWra|@ zV}D+s)b_`*(A~1hg2BYnjae7i=d{QZ)y8%sw)D04$*6Ze1Vp5v=xf9KDWf87Tas~a z{=rs6P*`m9NSDA+3m3s3{IQrvU$@wPU7bQ&PrAZDS*kI7!~;*^q_($L0Coz<1vg(a zF7b$l;;iH)1*6hDSA4=$OCFh$?LA`Cg*ZJ;UXN1GuT+IHU(gB^4lB5_D_BT} zzN!t%Wmq}Y0_DuA%>~Yhe2w#V{oT7{X}+A(89AUd*kg$M z`KmyXUfw>PLe#lHRd^M{}NLlZIu><eC8}0zdK&p&NY{ z4-HDhUkXBG*5hOu1z7{a71y9GIzYk)H^ct0HvrB!BDC-IJRcEmQFDMwP9@f zRj99t3|S{0PL!Liu@u!!5>Zfct5OE_m#(w&I5)uhVsyNMy75a_^a+eaBm8dDuk$se zBHrP;ySr6%qtFUy_IjQPo)dg$scMB|eWodboXqvx2Qk|m{7y9bx_wBX%D0G<^gP^7 zWoj@4@tZDZorp;DIC~pWi17yq9mB6w%%PDl6yb&H;I6C8!{x!K!}_>~Fmfod#<<#t z{thXta2^Pp_lW&rP5E z%&YyvFfRv>EFT6pzb@-{QT+kGL~Va~kF7K7gFu>qY68S+lyNXoa9O_3!Jci5U_;`? zZtg;DnRn;i1zPkTiydMwL`o!-Y_eBthEeJoy){~f5fNz%+^5=cbu-7JH*X*U z%$KTMW%)-HOp`BY=L*in?+Q|<>1c2DxZs8va$o3bd&vP}Pg88@vPP-t5-(QpD$BZ7 zQ_q<`OW6dKa(sN;sOfovSJ_Cl7)-AVL<%&Y#lsb`-2-fP5F!FHm|nfN0$=TTer#Hg z^``po!$s+k4a76vE2XznN}Sup=%yNDitvFM`911_ASNKZ${?-G`_j?`+4rx}31LAc#oeQuvU|;Z1>U zSQKn^Q7Mj9u-}N3Ui}D6splckOsLdf1j*@m&&ua`0a8o7nJ)}~p56I*BQyyST$N<- z!TSJ~Ye^A+#&sdsr5zx!k*Gfq{{QFn6!I58cXFkVJdl_4f*JWMWVP*>FnB(P*%s#J z1E?R_Vm9286aY#VO4xS-!DNPIAk~9(#3q0>;kCXGV=2Qk{F?;p4NON#^k-=>*7e;> zqF1_(H%Bvw*ui~!+jmXRB|ZpF(mH?)E*RZm{?8IJ3r~lU`;5w61>zO9vt^jiPHFSZ z-4K5@`A1wfjAzma!t-H{vD=$KYVMF3W zfcy+6XZKTsidY}I#B%E$2W?U=btmXdZ@9#D z&0nSu&l0{EO*i9T-;j|4o3T3V6ZDYdqvXGBsE?1AIj#qy4WC$;1BfaB-Rq!KP>k85 zC&E9&EWN0={{3*&2F&ZXJ}*z|rAF{*3YI8?O&m5zVKai;z<9zZ`e(~JWNG|@CJm`+ zWtDCO;Tmurn3WS-2rNVqbibMB;OQj-xl}l>#{hH7z?VYQHAa#kERr(@UcEj+Y|=;( zyKgGlbdS2a!Htf4pJ#09J0;HaqViPgs6xi!f<|cy>A3jN2V4yo)3D??TWH4U)4V`E zZ$)M1yjq1E7h-2X{!{0}6?OZ>ir(Ptx|=kd7J z0rC6a#@_LSH&(zpB)@u&bzW5;OdcI*pOp`BJR}!7=KVvy%{k=!L#T_I^R~9x-TzhA zMJ6=oPSd&XrOJO^v^CsQ>%KXg7{8i`Orvt+`eL^xH|?v-!N&cgB;2<^LHvA=M}u6;ul|V@5yxjktNiWl804`mM!{ z3DpZNk-AyFIVudgo&G;RP=~+%c3c=5Tr_=WWQ6#97tmAVhK1RTAR1;?bO|+B*BkylWjNGQvro|-KCYS* zp+1>W-5R38R6q{rme>61+6mDeKa*AU^a^F6wdnTKwKFf9Fu{|t+LAjgwvl|AEG+`7 zbhCTT((`v8(zb`@O)TMRGnc4c8qOQuUN!r+E$*TH`XMJOTVWp`MseAAL+{_)@-GH^ zY<>aZm%WTRg8nMYhH}k8(@*Cn?og|ly8mfW?t9K3jU#sUIpM8{@XO7LLZ&zV>b@aV zI71{awNat!{rlAwcQg}f?LqT~2_}K!sr99{S1auS+mCQKe>jkCnYx_;<+FB!;2Vd+ zXqzxild3(W3dg6U&^noc+8V-NjmYnTc)JEvRB)CBx$3Nb_P0E_`#|sjYKED5gcTY4 zZqHll+v=%8uX3<23`1rXMmF!e}dPu!AU_FJGOJ^_5kyU zquCPxf+lKG3!%PS+C!SyQ@g$F7ZVz%>F2Txh^q0#u2cj*joilg;de;IaJ6(NKKia7 z%cDkWP!*+Tn++A~tlYVa)4_V;yUeob+qAYxxfa#T6-zzrKec;=oNig*`(t{}WUglP zGq&qD(xg|g60BXY97Wuew{_yFPG_3G)Frhsp|xLE|^_RmAn z%A3!OAMp@!jIXTRPo-2qc~iam@#Dw21MC{ifj*L78z(@#IN#v#3gf-dxCUx}NHcul z*h{#%RtPD}y|`FU%W+Al(7-3!VUB+SQ4hO)Hy{BLhu3m%0Ba8MCom@EU~N|*E<^M> zl-#Nr`6&sQ2BC7e6d404H&VsKlng?AApADd_)W+~iN6UsJ$4?2#AlnEE>c<8OXze! zaY{WUoE`yqG13U?4H`~mYs}mk2#W-~8TucV+|HyEe9w!F(>)9zt$qJ2NU{RsyeaIG z2_ISd{guyS>n5xNw{gxcccAMYXmWRGCU=?kneNQVMvRI%szwaWEOq#wZ7~q#rP&UD z+5>1shl|B@zW_z+G309r#cVIclTxwtcr*r2N$|yCuek{c6*~mr8Sb^JUX7>rKr=yr11Iz~*hqk=~zO z8F_Htw;(X+<`C5gi9ow#685f`_?S}@5Uifp2@FfjCIEK~fahR30((i&xlVwMP6Ivr z9n67Lj4;pWl1h_c21vw=by>am=rq~;JTAYut5~ZW#)xZh;(Ei*7W>k}Om?m-*nbAZ z-dD-{AhBM9@wH8TB6%ANu{MtG*o>IW5!E^5TtVI$@fJm0#!Wag(&I{ng_UIlALN;N zOV2Zbp|NXC|7eOgA{rq(CMHGl-j#nh+?gZSV8vbW+Je*!Ec5ADdaCenO=MIdQPd{M zp^6f##7>-1GM3OCX{D-E8hlnmvWOF7n0lM651+Mg5J_$LTxrn$M)d>0@%U&1d2y;m zF_VUe!UBmb7iR&`zE(smrEVzD-wpv2p^}u&ov!F}=(YQdIT|iuW~hH8Dni}}fO5R-*1Edy(euE@Z-g&eTTX)?&BrHnEohmIR!83{#AAc&GZipfx;qpyTwj@X-aCPJ_!=+_T5%)`6XjB!* zyqf3{-dVOtj!$r#(2`H9^rp&G9GY=eNcN4s&+3C@NG_##9+8XEP>YywY$mF{h+7Kx zN$)X5NTw&U2Thaq^S*^s9mg1P{s~Sz#1(;m!i?iOyyokZ{(?KfC+?69^`7d^h|E0I z8Rt!-XG~7inl9snLG|x~2oF}n!?=w7Qtj@eZ8uJ^J(K>|!k5ny?fu9@w+k$hH^sTg z^_kv&OmnFn`2vmsxbSs=M8O8Mr6U^}3IPC)kBYAM6dzhKo!d{ktV9~$XDwAGW)aX_ zW@B)CfoAOC`zP)uLIlCYn@8;!mG}+#|9N7L$CNtmXul)JttW|$ge_oEvRKUwJI71% zaXx&2>J9k^60`{u`@-W#Q@12UIiGMMwfBVK4Jqdcz>_mCsM@n@jrKgaT z8Z@N-+1PPMb&jG54YQ_)^B_25FwD)NmG%Pra4qDD79*- z%_IJ>zhK5UGh@bAKUWZ$tb8@LtfMwGQ#oQn%$tIRY&|rxTHt;oG9va%w|)X4(a&e? zBWIXU|8gftBR+6-`iM4uc~frCMu-wxab4f-(W4rTo2wB2U>bjQ?J$ya(@Aultt%e8 zBw!M+>PbR@3S%O|h`C{u=1`@=>)Z|g@kl~1A{T<|)f7e}EE1!u1DoXe1c|sBHP0Lt z;qeq~7Wmc(1YE2Gn<=O{+DFtZLq@PV?d2%)DlHt{Vt7!C%5Li-Va|*-m+-dNKYTDF(Ey?d3uWHp&Q32)Ri#hOA~#o z5-7weKOVmw5}!+6C4D)xGF#tKDPN66Am4%D`+g~H*xofxHle5mOv(#Wv*5`ybJdc1 zI^x2Xn>=dI`w8^F5a&f+*Jdx0ARHqKjggv->>8`q`YHD^;9^p~;C~(9QefDAZP85_ zh4j=Q9r(3BgyKJ>yS;pLK8StTJ&(pd$hq$g<#9vTIZfQnHP-gni%Y0xT*BhW)YW4?SDq%HI?iTl#!=j*LuxQZ5a20>b|A>&CLPf=f1T8b z2%W2uNpNVzNngpIzM79p#M#uol;BGd@i&<2VcTH5(SszuC{nyZoaLn((W98=uf%$_ zI4pBE-e383Bu=_htN6+L2{cDd=>-Ap?leuAVDyFSEgL&?Suz*G3edu%Wi( z^wSx146=@hZg@6N+_sHW*SuZ6NB7kD4b!)6+ajw2()a6)HdWuP|D8v~)RRmshtzFk zejiZQk(7S>k8biJcK_`${R^!)iP3S-i5kW;4%F+lqhbL3NzxEOR7U@y@*uQqc$84+v%5zI^n&p?sN^MIMXRc{Jvz~ zYmS^s3KQ)x)o@ELdh>#ryirT+JTk(ADb1=+W7fv(!<{JD*LvUP`#F!yOjle82)HT@Q%DHFbKEcgf#I> zQGOQ{TZ%-6#skUcDA;g{TZqaB>1m%S81h|BugYv^~8FggNyrHZQP?R&X6=Zd z1)|chaj6CA9s9*{@NHO1<^l1GL9TY1T)D3whwAS$!+%om`z@bG1l5!NrQ})FXh%+s z4SyI})#x ztd3(axin9FCw(h6|Cyf4KQunY_NARMJ8?}F(=Kq!#kwCT0x%Ul_J=gV=0~$i!4pz7 zQig@*4u+(`{FAt%&zYH%Qbx-yC0i z-##5EGi4!|gT>rt4o&MVQ@@U{fT$;ZQ>7nnlDvPBJWJ9^Iy>}sCNL#4y(f_LU^(D) zwh%>-9Gfr_x^>y@?Rd-=kzZBIz7Crq2^6t|?NM!`qlvY<)vA4ULI=iv&!5)Nxo*BF z6H_H_=|4}Tq-LMFZ?$brdfY~(u@JbjRG_Doyu$(JED#iH-Bl|rc~D3FSn08OlSxtJ zepu%{$J-z!O3#sQzSxS(;4&lBl(+MW<)@v`rA54EGJ4Q!COJW#b})4@bI0EKNx*3P z!LvLPX-iNdluc-#wNJf=E?2Qf@CxGSZb&nLnq6Q@lslYrf=DjOO$MVD4BBqlNfK(d%sC4b*nzje8MG6Svdx;y65v~UzL~#G-U!{@UBeMsvf*(o8aRBe)eTEKEovnhRdtvz{bQzC6O|{1N{`>edpnX zI`|8V)M-9}qxL&KmKw-fS&4UGM*b=$;&Qaim-Es!MOuuCP{5W$+L>6It*rl~_&Wep za1s=))4)_>*%j9EzzH``NRf5S?sV zCC|Pi$A%9i<2?TTdo~Bi#FAq8)RCWiuM_+_)fD>#cZwtfsEI}l3zaMvWeFjbs{%iR z0#U6+&S#PUQPd?AISb_9rTFUZK0&Chw~QmF0zg$*RVA-1>zgQZtABUvk1 zk63a+k31pr%8u6kHMl5^G9MKoCSxT0lA}O4Wg^3CiaI@NlK1>IuJ*z$y^a*p4?z`? zBLh1B#~1g%NGb{N?SW!LF*pq^V24G`g>P5A6km)o|4z!)?&-nlWp6{>3Zq5DK}h2?l6Wr zSvgAN5{kJ@ydBL|KcGld1VxHvhh_J@(99=_X-@%KS+itv$FUju8culC4ju0d2V!iL$(M+fp_t=_FOz{$p_}=wEel(FS zfgPM0wbMAn#=Ty|A*~zfgTrQX6*E;|xhx<%`+NQ5A|gB!e6bq$ZIc%2WZ1si239%y zV()G;I=~3bsn7deRO|tC2llkO+ovBld(>wAr0xWh8w# zo=V%jFR^E_GaN&rR;6@I%dRm!<~9_KpUb^*W0cN98adae!6I6Ln=~Oa9NT3$pJANP zNZTqq$9BPU%E5+5tumL{%k!2GL5a-KRnB7Biajk?t&^k7Oite%szPjZ;_yXeLSqCl zx^^|7)ey7SjXd*!Bu;*O36W+1k{lbqW3C71gatA;+&^ZgGW0D<9a=pWcyk@j1+X?i z((kBW*$&XQC*)X{%ti?-hr2QHFYDRyT|n_3)V_|wJ}-Nj-@75~!ulkVTP|7TN#Ud|u;IqvaTe>>po%EO3F)`hRn4Z*^Ue%48EQoe0N}Fr82Aa1xc;Zw> zu1XDGXPpobK2z+yX%ks@Wzg03=1wKC0g79toOj4S;mzR11vSpo5pHt&-q0!DHYPYz zRxug9p*%QRNQcuyh5bFC8|!DGa@>^bnqXtwkqkAHLOzy>h~JP>%j|urUNm4opi7>) zbH;xFC+{(ZYbs$Jf(T8;He?HWR&cmp&HfB6y7aRbrSzF9r(m{{i-x=pdkSVGN9m88 z2qH{4P0Mn(1c}vTOp%LwsX%vR&GB ztctg<#e*S#HFi4t5a}3~h_;v}Vq>zJC;Ak$7l1uWL=x09;G@y>HijO@&41w-X&@i_shV+bYj{$~r zUS>Ygk`SJ}l*H>d9nn;2_8orZKnH=uL``y<1k5w~R%3>;( z>T8K914K{>GF}M`%@Kw$-l6I{r_1sUg!%>dvpz+J@Uwn9J7!m7cYjH|=n)O+={v_A z_TbZUX^rA|;>RZkrbK(rj7Hqm(Yi_J&Sb#P_YkejhY`1EgwF+g$%6^tc;a4Ku!N^g zN5oFNdX<6=Z+(8}r&64ur7j?K)E$oGvc(NTBM&c}XFV`C?+oyCzCe3k%epb{g(+f2 zdZms4$QQ$!h7&9~j!Emn_BicCBSFTz)l0e_rEUpq5%0O31P)Wz?(oCMmp^1&SFO0-LSA8``mnbm+V$5jX({#32_S_Iv^! z3@q1gwm=ZhEjK+3DnRgBSFK!$y67mc?_rTs_8y|Z34>`~9vQ6c#!9~@JaM+R5Y8v^ z;R>q}%JN8CXe{6V`Re-_4EPv6+$bv8pZEGs&yvXgRhJD52Kd`d$mkIQ^_ZQW9@f4{ zOzlUT+@3NY zaC@&1#=H@@BJptU)2c{bjQK%lNy~K<>(?*3K#vI;7a&E!C{PPe@PH|?CS zRPvZAg2N;}jHE>vf(Qk4i%ZaC;b@H5ZUx)D30c>-#x6Tqf4+O!<0*S1`CLq{^ z5ftv(s3&uY1&WLasyWM5Fk!@1XF3{!R!}hvZa|jM#~7}AMH0P5U_$y}$7>T({5iS} zB<6>Skmc(3FztU1_$VtN1`LC9^R~7ikf-L$->m=KaTBgIl-xCsxMH0tVED9jc?>mO zrYP+Cr~N>l4F8lyB4fX?1yQHPJveG2I;(E}GHY8;xyaOvUHCAEg)I2nbn&-puE(N$ ztvyxPSD>7oBX*9o&}J!63AIgc;bo--Z|II~cx)24dnMsCV(&;*08_^i&_%KZ!;uPzqB~!{k7z-{rkSE|z5Y729 zXaT=ND)x8mg!0Rnrw?+3Sf6WxYfp*R@)yEQEq@>;}zU_z@=xhB~{Rhh(Sgom7Hy5qjEv z+hI6=l+=}US^e&U&-_=j_+9z+O%u{a6wdEV7?`WkJ&{wdD8Lpei`OV#BrG_m@T@2? zgiMyNsyuS8`qAFY-d<%(9dquKTnar`p2Y$%EqCAMP9ukSl~j79@rOJ5;F`m$#t#y3 zIB26C{y(`Kx1PC7C=I(FV(+4dC&5QMd?gFSM~MPu-_^9;N-0dTNNaqof+=1zKUqvu z4Ly;yW6d<3U?VyaFp>guB5;@xpiQI%?qena4;A2-!1T}0&2qvWf!J<_t+HySLDWgn z=)vVWlh&O-)Q)*Zcxw@c1yUwMFi<^t2XAYj)cUNyg8}#D!wZ+Adj2>ThCF5}d`@IX z7<#r{Weu?%bAD7N05p|SZ-5BWQl;`5GU|3Lx(fh;We!skL4+ZfSyZ95v45GffZLmE zR^cbSy5e6uiSs>@K0!4H^=CAx+#C=lO^ik2Mg?msh%FKI6n(KiVNPwA<6)qEe9=Dx zV+mgwr*emVol=KmlNk&_l$K+${Q2`|lYNN42}{{rX)k>A=+PUVr-7dqv#2N^Dzg%( zrh5&V8*BY~ZpXUildV58-f?(`A6Uwl=|zeYtLBr%Nle0LZ!*cGRu_Rnrwpp)yg&pw1e0S!kdJpTF=FOc{30%0rDbiha+v>`dj$Dfsee7O&4$p>q}#p#?(Z zX8cD@cSm@f%RD5^N{H+9$Eld76C@vNN-5$l@TMbpfm5;uo1@- z&97cO=8A%aApUNd+wdYD0oYgW`5*}m+1p=M zL2*+G0%z)zrB^^|_j9+rBn~|sWX@EhH|&MeLe*zs`dS7}07%-5gP|kovhvDm#-hS( zPd+}#RR0afcNSxRG1?C`fSNE)X72H2W<637D1SaXpkPa25GLFzCZln#oxN!TLsf1^ zsf6PWTxhL@cED0jS?+<=eW&4W+$rrv5Y(guYgTwv@Z`rr(r+Oo#Ia)nVk$cLZ|;iO zfn@E+N8C!|HPHA(1o`PZUmYd^9sGoN7rhRcKz;!i*gimMFGnap16?&^P2znFCD^_* z4VZ{%7J-LChwYGOhbdU(&~q56#cuj~b1>h!nuWdI64mfT&Fy+dEI0sfFJ$Ntz z+h=PPEnLR9y)h_(r(ltosRr7=nW%SnMCxfG=lfn=Z2Omwa0(iO29GK*y>poFKB5A+ zH%6Ps;8*I~RsHuz=DA}`#G+7{XGPW}4>mTu+!e+}C!u3>E960AwKd8fiMm!usj22@ zwRggFPLi1VzbO05sI1zk3mByvrCUn6ySuwlLb{QZ4(XN#>244a5D-PW5fDLA6qHs( zKtUwWx}W!b&p3b17~i*t<8kPNaPPgZYh7#2HP@WVgG(4b$b6a!pm?P`su;J2KNhl~B&%Qq*5kvBPJ*dz<9`HcT* zwT`&0v*D1E(LhwpNgdV`WU^D3VVdCPX2MD}M|%*XQ$byUJqs_QHP5sN!(a2tMVFC+c(^p+31D8wdZB04Su0BQ=aZMnGmg1V~=ry#do%| z+lPn}s5lg-U;-nm@K5Cr6JfvaMzJGwp@+!q$+|cjKAL_l$me!a<+5*7#$nD)yTK`; zj zXkfRYM0;)8=WdV90c@BT^=JW!Gi8we9~?F>>-aL?nt9GQkg{V+8*sEbuFD(?&>9kM z2R>QmyUSc;g{A9kW;A@vV^lW-HTM{}CB^a(&^L#P8MDivB(aFGC3a#DnLKK==i#TY zj9wj|b9kdJ#r(ZC##lom*X0R+Ie{R((r&aR@$n4%S*lquj*5lBio;MIN@u2K2SMBu zJbP8*b8GqD_8t(pJsyh7L;hTuq?x?vaz}*W@FONK4TU--F;FHYgLX6Hmdw)0Nd-1c zG=~-&O$8M!@Eqk58rZDbT}d0TULn(@U>rP3s9|tU=vJ*&Af)tBBDK}>SHfe-t4==x zLte>#D(0bKtiJ6wWxg?s)i@qLZQn>r8=V#@u#!EXW^9sSN0lapnp1%u(i*)mLNB5*{|wY&lX8s`NJ0 z8TS1#i>@>ZE|RMa#-|`_ct$>EC&kPm#QZ(O)rCxJQAo9h#+qSX`-@tG@*7Xu3Y+J9 zU6C5j_xA_O^7}FIdPrRP_^E^Zi1Rx5mPi;~8q8x1K?xsuV+v(DhLc*9IW3w>cDw2A z)JMk3E{!RagX45xkdpm=j{jU z2pHG(`A|fOBk)GE;f+~oO}b|GkJ)V8>6yV~3ccEF)i0aKQ{FDwGZp2i@&iPCD#3k~ zX>lfz4QO}JFfegb6nIjS4VPR%e4AiO{P_u=Zcd1^&*^8zxAc(MpV9TH9?=%zmHNCX zFdf18_~;(m$WJlGjPFfz!stUtTeS1&>>0@d6%=WtoRZ^gehtUY`mbO!4bpSzG~9i` z5~a|dtk7PqY3$u#jKM||GDE1YF=;`3ApTlQ|7oO|5wQ^_PH6Hntv^bwv`(D`6Td-Z zrsKj#{Dz4>y^;f4xtV)xq zQ=MaE{E;!2MfY`q9>+afug-@JYP8Y~3Y^fhS;(VzQ9;U!Wb~tAw`H!%jG#xZHsI0w zj7MKD5G5{F_{J4i4{m?VtKN+0B{({OJQA(lsjC$Bj)>>|C?@sH^j0o*RXIXTW+Q!! zvdH!--TDgEv|FO%sz)x0G@DxmW}X88xBxZCaY67^#JiiD#~u!5-U_@h3sX5A^#CdyMV!A~NKak8N%uGj%B4ix^BSWy?!tM1S;l zi^QII#ekGy6guum>YYMnd}I*hL5O020+KDI92q2mz^`6A+6Q_h%nCL@)p1B-&glVX z`Px&UjDx86Q4>+x4XNW zP(|>Z-982(+GchGsttgwuw6}R!mQnitIWN<6VZqzP;~5p92e3sayC7BAWaisDyG;# zpUSRiPZ-1V^BXvwdar?sJ-O?oqLN1YoZQga7Dk|W9FXy*!EQyX285hoWTGOiQ)x1f z|9+#1JVWDD5erPI8^qHs7CeW6&5dI zj7LKaR7uBY=btnpQGEx)0ZN(-VEU z8VBJq5urgTplkld@+o9{)a**Y;ID^{VR}42bXF0P5LjDq+TQ_3Huz!yLT307`lp19 z&UUq=1~8ZRr(eNgd=DSPEGF8XB6+Z3hLaG{L!3z@>P&tId{A)pF103(GZsQCluJd3 zBx>w(Nx@t=;RLvEDnEykis(#FM;&SzYhyAgx2Waj+jnBnfdMu886mzwLNJH`u<-7x zTiN6JuD_v_Gl?01H5L*S)WUBq^&G^ZTVPqQI@tKs%f32;abXHJM)qKQeEyE5n%sCB z`^|v;C4L~oGo2Jr=yeK(T?XPsJb}QH%GaLvkZRakP3c8L0$qM5B>oCV0QWmwve!dn z6NrU>Ftyz9jP^mmYg4V3q+IZATNJ2hvB$A_KLuo2*lj7@d%;S{M&#!#J6j=Mn`W1r z4&b3SxaImEi8g_}N**98K3J{ zLRBaTjJUwvnQ}-}4c9U;=mmUYB9**kx<%hjCs)2aWgE4sXO6Al8{=t?`tcf@GY0Qy z1;*7TORx80J(pa;^>(_}EMfpm?OGmLTjuaTs5wg|I*U@n6aZb(rkHj;>{J-+xV5O4 ziawJHz#DC4tuU0aY#nEzB7RxdlYL>oq$MA3p0VP4Qp_E)dt1wzvVIYtO#*5w`g~e zUeei3d08H_%sRhU@?0m}Oz!UyBSp$vm}qsT<^GCplKgapiUnad5rN;(mb6GR3qPQ2>KMr@N5W&G%giZRn?T2qS{xtmK6MQ(qqJ* ze9#_{#=`aQd$jLV%&L|iv0)Bj8LRUTPu(rsbKDs4e72U-_FQU~Cwz7-g}dOGINJpv z^xm-b^gW7kq*?C_$y!epBFbYoisY&#G=gYr3|H{Z=x5gGWTKDlrN0+fOt{eXf-9tP z-int{?NJ#NU)-xP87l~Pkt*2`dm|fjf%VEX8OGJ>{QXD=vuu9i`3eR_M;Z2wK)l32L0O`Po!{5VZ`!8(g3>j$G(C5jv@GOJ zP4w%UlFno~>Vvy%c6Ir8w{dBmX!lsIk;3(3#e|yipB%Hh*VA& zZHL<8l>*n`-AXo(ZUQ{NLX$#XZ<{5WJ~Un2X2l5HsixoD&0 zgYCupK0Xy=+>@_^)H&sroxBQED=Az9lF+u=CUq5iw2Ae_P7X~;BIMLfkxuvaYnB3J zU6rZ9GC6 z7!8NmphuCs&D07R0YLaOi;Iiz-|N1&y8WidMfaBkOx8Vy&V`Z_3CuE!LQmm8L>siw zq#rR3vL~*;i_pXY`5|Xo&v>jq1rLFMQmm9C;%EU>^iBO;Y2UtUK8{ia4l+d2B)Irn=-?&nr z6^eSwz|08r3dR)e;ch8lT@WskYa#5WT7Ud_27)Jq^e;iA>Tw|GF{}WDs2E-p%l=h} zDopk%Vs=ggWC^ghE%^Sn8$CIGAJ7OqfYSSYmRO5dH56)BjspHv}?IR*pxVj%Ym~t{4F~ zIfT{@;v$@AMh3&#|1M>=jb1eSbCE#^t1KGXb#Quap8Sjl*d^?|)I^}y^I;F~DU3gW z;28A0q{A-7azXBe7IG29Yxw*GMm?Zqun+hS!f}0jl5*$Ork?^j^0-3;4;BiW2gz>c19z5i181e;B4{{#(m!{BUfD||HSCp@U21F|(@NkBv zLzd{8_Y(!vYR@FJkw6t9R6Q|}DTEdDz)${FL>yKmjPPXiyJ=Jb@~sc~(-i=7@Zo9M zf^X;9Oja_kd^DvJxMJi*1sUN6gwO#9rG14F%*=8oJs$c9|9M{gJCt}cf71m`VIC9G zE<0!q)*#e77PvhqU-0Ea{E)mzbvN*MQ{ROWlwHSQsz&}G0P%9T6ete`yIz(D?ELNY zc`}9ah0HIWqzyeCLM}o!6IPZ({1j*%Amluu{R;&EpeAMjO?QB5I?+)3ojZMQ_Yq^-<013w0saV&d!%!&LuGA$VZVR-qTxm` zPr*)tyVYIv;X<-WlBTDpXPhJ`^beUQ@Ke(EV_M_Z<}80CwENhcqy-}}Fvuvc@(N2B zsk=(zm^f_Wq^@JqGO~OQk9s9O6eFW-moOo8 zNp<}S>t~Sn1NABQsOh3)=5|}z4s1J$xq3rZo+G?HLNFcMn-=fUcyM0qB_cmmZIjwRz7l=0Y3-yK4f< zoulhLn{!)#cQboju!28;q=+P}#fe$Fpbbisq*OjR5k4vwd@@~{bYP|JL%nmgTM1*5 z8re`8!XW?+ruX|b**AxSx1m&^lMZe}5e|rDMN`~s)U?b6#axf2W(FH25L`mc7;Pfb zW_Zc-O%{a%@Jff$=+@r9_k@Z7A^ZbE{qU<03`+oCs%(b-HFUK>xDG*kXbA$v$o;FB z*_ijxOoh;S4{$%oaX~d!++ZL9xI|C6OfyvwcAU^6L6I5ggy|~4DDSt#%0-+(nZbcF zsHUJ;AnChH5J@PA&_Jxnf&owhBYvf&N#u&~n``)P6gOx~NGG5hMPEAlBqQJXV;< ziMhf|ErNeJLK?^&5LwME zmZ|<|OaNN}meu%3G|ylK`YupEph^c*(Wp_h4 zA9c>@RyvgI<}MITu!F}6vH5PNBjxIfqb<1$Im@xzgiOQWH3P}l9e@F`^b)N91SX%g z0Y(lFj`2GO^mj^%;YH?hmtuog8Hw$#O)o3T5^x!h1u>F7!!+&fAesi73bmo z^G8q5vgxxQu_5PgQij_)*jj~$hyN*+4(R}d0cMiF@p#aShG_f(UqRUC!OdyS_$`{W zvSBnVR?vL-2%H>`4(twvVVkO8J(5=ICm&S65pfchoA_MQD6KN>mJi-`p|6sw-2aBy z01zUai#3D4z&`764@HTuv+R}#LP4p>hf0)D?oyt?Z+Q`D1{ZU>vao+SLF#Hqk>rsm zh^|9#;x3ad4<-8_0)%}}a#xI@5(f@1mMV})w1)Jcq(zrL*ZvKw7m*5rEjVE$2_fx0 zeYJ>I*squCg`Pc$a2!F#l^}w3wkZ+l4x|BZ`W0na+T>WsMK=$CNDCAcjj^Z_sGzSQ zC_(6DwcJ~2=Oj(6bG`z^;A2P#9IHyVWAS>U9Nh`Q6U%f!3(2NF2*;Rm zK;9Azx5_@6xF=jr+kJOezd2-cj8Mf7vcWv1Lsg}*Isw~2im#smxzLxi?u&o`L?}P8 zNGYvSh?lbwYuaj`NWssTA_A0O1(?A6-lkw41Cw3IIgZ*EBRXhUWDwId(MA+1F4i9Z zy|XcLyih4`*1w_eeEtxTZX6LQn5P-|e}!PvqTXT(`LHc4a<_UnT_9B0^V;40oiJZQ z6mSsEoGP8&EeSskqAAm?9)tCZNdO_@Tzq`vywR`^9uP=*%hmKy{&XwF5iSuH`V&#J ze5Q>xw#z1C_(iF)DmWi|CY+c%gK8s%NMi(^m-^@)eSh_vzG|j% zwdee|kqZQ+tI58y6B1<*yW3HFr-CziF_s9kmS8M-nBbZ@&GM48p@!KqX~)VDupTDJKbWx zSBgO}1kohd`zdskAH~+6EP1EKBF^%$-R>T1ZVU=u7PekQqXRvOk8@gW4hKqQmRX&0 zTE3bwa&}(e7@H{7SlL?gAPC48zbFWjdztXoR>oD|LZ3t%)oEQhDZ>7biH=|jzFLX6 zPn-~F!4GBg$9dnM$|s^s<3N{QHU3Nb8(pI_F5zCMGWTa=?)pcLpi@fb+%ky4v`5}9 zgtD56A&fbr?!<1d=As-xIOkj!fFU2RpOc6EKl^yu>vZ4Loow3TcDhZ7KrH=`C~gNw zrQrp6I{ymg^7J1iR6z(nDN@vwK{3)Ion>dd$dr8irp*_-FC*ge9v90mdO3SyZ11J= zL{jqJ9ZYcUpy0}KI~h8?dqUKE!w< zQO>D;r$X>w$2dm}xY5|M^Bj{hGV&&orsWMsmcT;>v4Ep26wRYgakDr?AYAYNyS|kNHbzX|u>m2+|K0;)@nJDY@zMLp{(97Z=gG1&2%!AWS5mHj z&>c${1SN^*YbI~MpC=wzdqX4uQUF3b4H9`Z#$T5XiopN*?|OpyH4-`BmfhgWU>gEZ z;;UQI6u^@_IXRIA>d8NZH>h{PJVh;-ObU}|7_GY0j`k(7a4nD9UmmlDg5Z2OP`~ApyCU%%_+Dz|z0a*`0 z8Dn`~47<_D|K7>KH~GLJVu4r(U{2iy@{to{73Q)?5LDejB?FiO2rOtD)VATyyy_7e zr~h4n6tt(emVu!(70n;15Ws^qY1jfLFvR2RbRsrdj|p~bu7x6{2ELyF1s43}m*AvF zWaL#Sh(q(yrW%S~Y>66*f{DBUFX?VO26E?<5=x=5&blM@G|aXU3;{TqXoZ|-K(3|e z)t^V3(ezjHUwf`r848cO0k=w_;8z$4;S!ou)bb*i#(`%e1*TOO14s0$&U!B*d2R%& z^y=@CjR*!n6|+rr6{*sdlV)E+@+cbA>I(P~RxNhIFkWvVU<)+;hbwLM;F$DGv0rgO zHwG|o(0$$n_?HQ0@4DKXNo^ z5Zm%ejzNu%SX1a(iNVVuGcjces_6hj{)xNkE%=gok3P zfi+dlVbV#0h6~@UiVWbx>dgMh1!mF!qP^Oi{V|gP#9=#{d0hZJ;K+UNDE?0ZbQP zfIZLQ(b3mgDd=CEAow$L;7(lfQ=3$p)(kDS>)&Wx*NWlba~?6T+~PBk%i#oiQ_vkG zTA}OP$lgd{*PvSo+)ks&dNMJ{k6B6i|whCEcgaFX*amcLu1SMQZ+5^)}4tX7nnoB>U@TdoY_C{SQ4wVnjVTw?adEv zoyvA~noQ$RlExAjgAU^>p~pJ(l`W)IG(ee?AB=kRO*2Ziosn#zI>#zkCnnyXTE)X#e#0WHz8##_vYWswI&r^?xUyex1J~o~`&xaN4&w!<<4Z!X= z5SXr@u>rCW-#`(lGiFWu@A5Bj$03Gb^7C&nQx+^{;AgeA&v>VGGo}B0Ko@{gxw$Mq zg&uq1PtfU!8F_JPH)z2<_S-1H<-b2;aIk@-ED}CK^eF?O6%1*@MOzi~qk z4o#(bNWJq|=>}?{)~9a17^idP+PSXEBT_@9%mgGgNiGRB(4#v6aZ}=S{%A8jwaiCk z20ro(?(*fSNK{b?W1!^zH%0UdJ$)q_vIY>c4#!zbK>#-Dtpq7aBu7*<{Gh&iXo0Hu zc7^_XG_+}Fs~~52RZX*nQ2hiA<7U@+4v$2hqPvMm{sxTE4#|7uWp5$5gU#0u?Y7U# z@^Z@P3svyME_-h-dI781%|R}3p!Fh$U4VF42o5)@)H(JtE(UAAyq4P%U{6q}GL};? zA3EmpSja#j4rKXV1KTP!qVy|h<6z#VCFxZR0!$A4+P8os){cpE+5z3L!3(Ic8=WcrB12_i26v90V(u4I0RY2p*2X4DPz?1RF*R*FMGibMM2(A;(Ebk&Mk`4pfSq7srm8b`eZ8Fo{h$9$11dEVcRCO!ClX}8vKcHki)%i85Cp-Z3FK)`0qh6^jzMthT#cj+A<6te}DGk8cqOE{DqC91A0>*Ci^4y29E*N za<&3`x-@1S^!c6vP=aLy*b<};TB=Y2P%x{AHS^~Rjw!1j@yPvX8(ReoBq`OdoXML{ zU80<0f>@M~3vUlWLFLNjG9}8bv8dU8{_4ws+nb0-(mIZ9;h;$iZC}*)qoao=apX2` zDipHf07lySI-MPUZIm3r_vAII(*qF3n@O6(F2N+Nkqb878_;3|UEn4#Y<=ZCyttVA zat=gRbq}XL(hnwhYYkN9-C9NE$G-ryPX7ytH6MS!%kvkcwt!P-6#ZfzgyNjdkO7Qv z{ZN4}tw3sH2%Y=axD-L$$VOjJJ28KtKcvKQ%-8u~I4}X;zkGR)Ei*Bciew0fA8*=w zG?`kQv49*-**_X?XOM^lLfhV(A{60ZQYADr$x$|>3?!KSeq#bPV9SA{ z1c4onkO$8XCEU|ER6X3|V=E*#UON%(LkA{hyN!tPgL z;<6IM_A_t%&Y0L`-{pPd0m~E6nbSk}*y1^dmocy~a6N<}0*o;GNgbqkiC34_{W45~ zyOsa?Qm3Nx93lH^QxHdS%kh$sFANgSOMUsnE7OtF_SFnQex!iJl%pMnhMu@2aaXZ; zmmtfb*x;BY5AttkG=iz-{+G&onbLU{F>?r`2U0?+W=v~}ep^s4Use8FX3BT3WsTsp zMYYxGnUbO0T4Een-4vfPVW^tp7V>PJMWCQ>V*5JdO0#%58h&CF1Nlgl^;8R3Hb3vZyLc1A@Pw}|VMG#@zwK3a>b#gza z4m;xZ+!4g4bX5lWTV+)+Q{!rM%oPt?dmRr=ch`tmD9MZ_1WNt~R5RKY-+{D1O>T_s zP0Ma0%CJc7`L^H0R5!V**kep|`(w052RVD$G6p{c`9es^p6enp zk3Z4N6@mbdyy&5Hs)^D+7$6}ndBHQ6Bd}Us`=Fs0356lsh=zq=>!nt+4?I>5dD`@H zvPh~8IVPruEh!Pn%WG{eSttUGp6Hdqcc!r2fb}iu6G_CAFGE7~PN2{+k-v({ybgOD z*e98bQH+^`f5p7j<=*u-3IloHDKeLbp14fJBrTeyR`FJ+*I!^`t`9-19+-xx9AzWk z^CWz@mKK?kYAH-iY$TBw^T5XiUoDFTU+Vhi=V#2f_lDbL!aT!7|E(F>O{R$EkPwHY zbyI7)@plY;snl;FH`0^erwU2wwjQ?B+rL9Pl!Rl8%EjhyNB;gMNjCp*Kz2wzq zre+*A*jVcg3|nZJ-l5B@`c{Gd$^BI^SMPchZt!HWZ4!HxnPao*oy>mGRWC(Lwx5*M ztiEV?-q`wCL0O@OKMTe*v7}~|zH=6mTlne=t20e)iA!$T0|UQdGI^IUc(I0( z<=l*i+7~U&3#0#qQLibpyo0TDw*i;CEq$(Y66qxH_mrq-;w7q<#Lu=lkJno{8ObGi zqo%bhFwS?j{66foR`!bB2YK-U$AFdwbz9;QE^+rxNysd=!z-_QljK&R-k+9uW-Gtn z9HoU9g&e#-$-TqOQzw>GBT7;UX=gc|xYpM+Ma$0t*jZk|g>zfwT#cJh#E{W6slisF&+?TE$vRfW6F#CqYCes0Xm0W}= z@@>zfm1p;PYqz#fn5-p(j5O64F0psNb{(!zj4RZZ1UDc}FgcY3Z9^R~z6L0(x5gV{ zV$o|H&c=1eL~?-ou5O2)DF%2ia}ZdX=<6S$+t@PM2N_rDaJ7Fl=$uBzr14ty9u2CI z-OjU1l{y{+^OrTB-na)jX}7ZIBnbtiGh12r;bnQkLG+>i@V&r0uJbI*EX=I_YH{|! ze_Oe%FK}uq9(eVmw^~B1e9Cz_;-#$P@ie?T@V<5%%!0);JW#|uaPVobwncmMZQ>~P`o?yBu_N<>w)6R`asorro>7I~4~vQ7#nEjt3m$+Sff{Z~ z`qu`e=~K6hP?%dHV~twYCRnCX68<*6oR(;LjxG32R88)l54b&GEtK9|I)&6g#WXA| z@Q3T=qyUD51JQs4nBeSaUKO9BP79rUG^`x^TKt*=i;{WyiL>c zitch9Gbq+jZamviM?K9yA8VDQbBs1*pAc7bh%s8Uv+`!`<{}(YpODkZS|WkJcOr}Z zSN7nrQ_^ngI*`b|CExFv{uKT{HM){KkSdxYO$?s!;eI|Ej;SE?7yqW zzJ@l`KU+b|+%^iv>)U8=T?AyL%3>1L-3&s&wAcoo1J~LViUY5|f(wN$WA-rWV@sp4 z2K5QI5wW1i_?FRRpaZVjXK8QeJJDJWMMOlSk=#E%bD-f;n-Z*ionslim+x4>9$PCV z4ekq>4K@@0H0djJ`j! z8(X%CzfR1H&5#rBaV|y+auBk#uvj28tf_h6j+41^DiN=6`Bc})mQ|4 zCdD*JJ`swxX82>C&39WZCh{68r2@$5>YjI zAfxkL5p-Pq#q!8%x5eqtkg5B}hIW+eMNO(Xp6RPq2O2ye{ewRn&xiIV%}e5)8CR&kMvVVVQ>q0 zx)lQc5wWq9%Q{lQv(542Oj>x1>gT@aH-sbwI-jZhP@0K@AXg5@UDNuci8q= z*o_s8*5|2jrzS-o< z($Sta{R;crwRzvv;VDVxN2GkSlUX_^`GL!C=~VZqduudL8nwE?BQz93PB-gK^Ue@goAs-x0lp0|ezLE&G5b}RzF z#_kk6Y`TPQoc@A|9lmco@(gee-hb2B(~~={ezSJu1DMnWmzFbg&+hq&3SpX?aowOfzj6E$8fxjt``^NGO0cwMdm4U@FzFCEw+vn zP-TYuOHfmR}>@|!=m=i+r=^^T80zfv}c@pSNDp|LC)4d*`xC-hB#-U zda;hc)6W&7#>rLLa#sdb7{+xbFbzp!S4~B(|BMm!`vV-U?3ouBtdhApC>mUhFkn_k zAtHjO{w5Sg+z;M_AW<-~63xz;`Ui%hf8*J4qo(UlVmb_JdL? zkdHZuZNnib7Y+F*n{Z+no*iuZ3JnF-k30{*LVhzDuWh7Eot11%4mUlmC2z8tDs%2k z2+ojV`D2nDy(i~q8??ymDm9pFP8h02!mjM1GgT95&qi4EGFZzxMZ%T(d~0<21n(X$ z_O%@y0|Nl)@ftm1q8nLufp}67os($zg};QU?NB-uWo(T_6>z53?RMalG&FAG6H6zU zeIZ3>bb0&>vWL{)Y44b*-ChIJ%Wb9xwWN*DD#F3*#NC$ zG(#W}h9TQ6dxI|@LMPa3mlXCer_G)mlPZom%}ffms}JJxSDg(6D4Ipx3H+AGN}wm; zq4kWQ#x~$}_&YnT<=ZVWkBXP|Jt%*?OZco{FwxNQrmz?V3iOku_>BWuo_+R>pR^7N9V zq$FMx;tgs6^-=vt>ZlqPy5H3?v`*E(#Ec1X4uK}Y;8zVCmIo_x=IkjLD&kCrioPuD zl0-bm>HDS$W8p`!=AVi*pw!QogHy=0fd}L_z$bQtG$J&a4-Xxb|ID)Qy@A zso#^31HD^M(9zT{pGwxRb{ldOo<)^DC3Er{iJ%~hmcM$}XH@2!`WcH$JCy(KCz>ac z!-VH{{=tknbBtN%X#DL(uG!rgiS+mFu<`c-lI{I*nXsrfHSHORLx=|PMV8ikuYdG5 zxj$B{tDE4joM2oTr!>$yMWk1NBt`L;ArT-FOTe z+E(5y&M7k-h$Tav|@9p`bw3sO?j8zGk2G%n5_=Rk>4SZiLbB!xQZyN0N8$a;|rW)Ghu z5EJ&sB$AQKUzo$XXlI{b9^KS2-yw;;=IrWM_!{sAfZiJ1K7X&!f5io|{qKH@7NReF z1~fSk*L8|Mw&^f=EV*SM16_9t@vd4)@15UoOX83Fe55LJ;!nag%L?CaI5L=zEkAtG zz1{ZDOu;E=%TOP#BhO@wF^(Prq1Q$-x!4m=_)}(icqcUmTgEl7xg$fqns43R(;<*U zNuAn-m}6vg*;PT*n#79}Ye%Y4uD{ZxQbvq*N!?4qx$f9AW!Pha@wII0OlM=!oAbX< z)_wFE+w?bTwt?ZzPb){nH$YsW-e*o<(iv=~Jb{({-?v5l?WNDzY7E!SlDS=|6;VUo z|6XSg5MTQ=96#WDeJxMhjDqBTv*PankN@r*@gEuT5zVpVa{GVGeaDmzVeH@GFfnm& zp9jKa%};|xGKF_||LRUK_g1P|t(!$;4VN!bil&d5AL2J5#O{wiS04)|2Pc{QD<4h} z=f)Wox~{kWb_!)%HS!eQ^7;Bk>3Pf_Np9JL7q!XX|HS^Cv_w2McyR3_wQm^)QTd_= znq(jbL8=z~)c9V|!Rs9bbR3sJ__Y2|bp!c%GrnU`hoz7AA~!b(#`a|)^SWo|QteWc zzfInIHcaC)*|OjIZu=KBjOq!=p=|sH2V~l0TG*dTs4jMHe#_pxg!5tZeS^~RFu9c! za@_l0VyUxtis!kA=+QPNn~+t5pQ+vci7B)X4%s$ahxhjsNrb&m?T$#x(wW zaTE=SnAb*%=rtVC#dC|6AwSQ5y!Zuh-}RRY+I{zzQzD21^*8`kKYc)uMM&!E&m3ey zJQc(pB&(snr`Q$;aC!G#g9u~W9{(;}TlE^mw+h~4cB_BO6asxd%S(&ouKOv+S27j;5eeh@; zXqMS8wxj`O2cy{!6hN!VP^JC%8M3vq=vy4Jma)~+=ew0ty=wn0d&K)248+bqwz5nv zzf%@zKM9eGx96jNAy zR-44^%&3U;LckvKNh|+l2gQMkczl4AW|v%Qi?uSW+Eky+iuI8t-}J+y`9v& z;`*!@76ia1y^!WcBqnWMz?Yx^zz3RJLT_tzp-nA)^5}B!SawvbsyhdSg~j=wmQPK- z<2fKG$&uV0OSYo$?ebP(u09kJS_D)j`w#NS^SRQ4H$R%bx^CT}D0ww_OR{VrOGjca ziL)tiR-JV?6HY0_^@106G)^uDJ`*an*y)m8NLw>JRS-=vzllIbZOh1ngxSyzo_$6s z-`eV102h|#0gs3#efnblH{qhvORr)?DI4(FkG!J(B|w^abC9a))`Z3_B^F&l2C8bH zIIPhKYgkx%>8Z%EDC8wX@2ZboDg(ERDfv@ERorqa(3BU zRAtXUl*vcW4)QiSBfvQOO!ctK4LYC>>aixp<+wNZW2{|#`Ktrl_Zvy45SV+k0l(_Q zGVE`_M-)qnwol3lY;+)>G}5fXA1nmp3vv@{9Psd$y-oa(g+o0BtRpD*FjAeV01hJOjFM9WC3b#j9|M!6C={XDa9J|J!xuiF~fKNOw$=a7+ zmngdr!sA9=S`0B zB9#b?pDalYugq`6ga+>xUH{J_hgHrZp%Ax>c4vpqZodTS*Pe5`8fmsa)s4_3h01)< zo6oIjA3mJ$n`Ekw_9RvKwf*1y#N|<7o2ovG)u}Cx;BL26PT6?pH5EB@ywI?5NhjYr z$NaVd?>z}saKV-KE{&6H(5_hh|Hkqa+izE6t^f1hD{N8ZneG24m_Rt;=U{mDe|MKe zs321Fv-0mJnc!C^Ru{c17tPP7ZvOq+;N@xW*%T_d83{_nxN$)o+5cUk0xT{!t!Ec> z9o;9kpUmHPbYE$G`cx@<-u$z;qhs;Y$`@zv*0jA9Oss{FU>Vno!;PC{_nQ~}eV0yS zA?|jUe?2a|qc-gAWUkv2w#k3Wo;*9+xYW5K$6;w{PJC}Wcs4Zq>kL}Iy^H7VpHgv4 zkyTOzWj214&h#A(F=5o++1+!#dRdl|sS|8Q+)=r4X@zWf`H=J;WGb(Xg(Tdkb<%MP z0$TiQL#iq&zG)6JRm!-AOyU2)xLp6`PWSf9=`}T7stc?AlF4Z4uYXuC&qF?`{tWkP z@!M$F`sIK9qPV3!tK;-$^@b$phGpH{{7c5;%-&g*k2I1zuh1mStk7+ZN7Zpl)6MT{ zm35-7NPSOt?yF8+Fj0$|KBT`V2FU^QuOCQY2K>A3hEE?6=>gj{eg`9{Vk)GV&8 z^7F(;mVy07Vo~L}40>#s_WB&2Vy&UJO*4()BE#etq_Hw1c0nz4vA|uw8f{d?noTVMv$qidxSLk5}EY zHCM9HSMhJJN+;HOX_<*5RaAe;GNRmJ#orBw2GB9*zdIIIIJWMiTT+{DP%C;js*tZ{ypMSY$je`TTf^R1r7dlC8u{0k z(~D&QM=P^krq!>RfH%EGJ;Pt`_U>rpj@&S;^2!T_RbkEn7>525& zdNdqLJKV2U1wh6O!lVe@>0@l=BSaQ_GJhXh-`f5H`_;LY=k{b{Ol@*3Qv{>mG+X?E zgYq_TGedQPj+c%aFu+g%dNm3}L7Hq<%GH8nGo=L@-Meo}dal(Nm! z?gz}8ap>*;2sjV#)rKv6jjeTD*@PPQcG%$=P2gw2=V|QoF@HxxC!0n>mrh5XxYPA~ z(RsHb`@xO+d^Qg@4?+Ir-=y;xiMICcKS%Y?p5K3{(sQBz=~H-ki0_l<+Hz{K2P^GA zAivx49ZDc%Fz2vELlFQj@4p{bH%UzlqJeppMO(9CoK2afy#khcBphu}P4qw~=;P-< zBzzd^8iV|bY@)@Rfgkl%8FY1YCHAW3bR@Y21h}NDr5^75DpSPkD;k4yitji*h<_SV z27>$*=2{< zZv?|I0EeYm;j{Ow9O0ZA^&mw>}JDB`USsq(#iIq?% zG%AlUS~Iej`pMnyOW2QJo}CV*=Ve!eQ><%lKSaI$Sm}1X zzR1Wuk=Q$b{Jzs=r;_(`)gpWC=RafZimIHSud|vz*L$}2tgMNbKAun4uKMuV|C4q@ zW&~i613)*Sfm{!|G!I)}e!NR;5%zCul*T7{&InyP<}M$|3~BOq|Ctnguk`Y;ida|b z2$&L!x?e>;xm9Xu#5U|>vlh|+dZ#Bqe;v?=j0ychVQAwBy{YU5pGAw%qv14}bGA2? zBI&g|&`rwW1eF1fc~!c{zMX^u-qYec&T2hSYBbM5t3|UzSmR4}JHqOlDOvqIP3#-i zIidD3yPLtLU7GavcfghqU`)xg&-DalVI#;rUFh6w^N_@6>3uq^pEyNAT@5Z0 z*3bFE;gcS)Jv(j~X^R*1@G+D}Ki;z&y5Bx(nbHc_DGqqFti8EiJw&wBG)dOIz!UbK zyME30-jH^Ic^vYASneu4%C{Vt$w;7lX^wLvcdzbSYsY+>O2~do{QB>em3#}l;n97A z$d+WAw~uv}2>AK!7&sZZP#g&f2n8Qpe%_10e|2RtEG19Yx4#Mf5@Vy2yr_olZamuo zipo6sPf!hBtopp)b8;fPU&qXrhIv4E;-a<+QAxbEzP$=F6ok{&0v(VoytK~r{3-IMx8qIF>*$O4^w*Ix zk2u?Jte&K&$g9d63dK0OKiX9evEVzbFsBPX+#_eA9;p1ZQsVxQI`v6gJ3h^4|M|PT zr2!Xqg(qU)Td&jJG(?U2{QSFxh9PdGp+Rc2QeC1-8^rYbZjgqeYt{=tjquI?eEMci z7cnU0CJf59)m03tNE%IQ{HYkb)QvZ*-&Kui@q+-K;w^Es=O1$Hne~X)-&F|zz8S`$J?7Hz@OMUC#WQOG?GVB zu5?Bq;HN;EQTFZ`R{GRawy^qaKnSv;%8jr--;&%fd$TUO3E-(mCSwjmb&M2LK0pf~ z42QPpEPB3$=Udi_T@#R+g5e~+{|Ny`w%YmU!g z;oh(6+aIM3aWl2G844^iyHlOOtFd^`++8_2!mMi}RkA>V*{9$xU-HA)dQ1u=TP6>w zZv`vt!CaIwtL`6=UFR)+Hxw^Ct9*s7JZ-?p^R`ms_KR_ABs?2d^Tb(B1oef^1x^@20vgHJ7H0=|{GaJvyu%Reg z4V+gPp9+IKvRcpS^~!~X%vE!iTp&_+HUDVyO68I#Z##NqWOAFIbL>cJM{b$uK=?}J z|3lYb##P;I-~X^kNK3bLOLup7H_{DC2_gv6-67rG9fBg=N=q4}AfSSXAcFt7&-tD2 z{pjA$u9sf8_vW+Knsdze7%NYlDUg_aJ~@8&sFLKJ%FA9}v-22AtqGy7w1Bcn1+tPE zs?CT<92fMOXAYLF^tZ#Dn$@sf+-PRQ#6J+AgcLiufOhVMN+n0dIj3n66h)M>B#+E! zqsT~Q9uUbLGx|Qo<9jzokb}92FHyUw)xmP0u_OxG)B0Ff2iqe)Gj#H7#VlbvrGRCB zLs$Kw#ce!3Hps61|JLs<;Ur>cDTaFs6Du5Yf{VW|BmnR zbp*^|*^$d*XdSTsFf&y%GoJ9QNvpqCVX1SjC)=T3voQKdPNSeTk=kC-dW4<4?^ekG z<32}1+|^fGd^_TBPAe^9M^shb7;jrHHXTGI84heThC-P_SRLZ%s;2UUn|&gct7 zOxa8I(Vo+>DpuZS)(wWk$GjkatN5#c;nN@P>#D?$g6l`IPlXb)X~pDnv+vM9A_?uF zcg{Dp7(qQI$r{Uk(m+skR53Q^tK@<=MX=!LqW0?-*(`7!IQQNDWf+SDIVJ1YEfBbe zlte1+L}HSSvx&#)yK`~qihv z1!rc@n=yj+yd#QXU9!($5HEXp;-yBI(F zJPbu4ym0uC=uL>AG({c;()Ln}m{CaJo9cUDIkj+b@o!|WiSaLckE>G{TRrQjLLd5t z{0UL3dlMot(bGnEGbYe0^%qcW$Mn__ePh~E{5ccq;JY2NFpnM;eF+lbesH5&BwQw5z|{_ZQE3+_!0s5(w`TK^bQ zavV;&F7;&l*#BeTtA@lVq^3@f?%y@SQerO|4uf{0{(d^;r<3^wOlZaqYq&~rOzM#+ zp!}jEhGPOUsY->6O$cqN(YWs?8oE9Gu;Ry~<%Ya+4%0)0k^D-7GOsfR$@!eHQ2xh| z5E|SE`&EX$VoY-oi-&3xTYjZZ-Qrb{+yG;w8ZSdxdcx5tqmW96__yw|uk@(V@wDcZ zMhcnajdR?AS@Yuz7{*^&to5$Lcp#|sslwiK;(PW;Jit0qBvf?rdmbxC~lEmRvwFor-Ubh z{Aj0j%n>FJ0{h7$-deXN3KzSV>9+b z02jEJO|%!ME#k# z?DWeO3}q@W6kMB(W7$}iJBMR4j?;n(s+cQ>1W%zzjvrI70IC2S<$9eA0W|*|yb*bh9JH zC*iZoiNV$!A^CLwOU(1nPGR4@-oD-yui_y~^TYK=U+3o#?)V_b66(Cr{MzKju1}k} zR~KU-_9m`+La7B_cKLB_z$&+qP!*aalHs!D0|G8KIXsT)(1$khtxHDc2lmg2eTB)< z1$s^E%VL2g%P!FQ5nuCA^6eT+#6ed;_s~G!_q!P{6;*-}tN_hWL+b9zPm~i_fo}HLiL&P0KU0q%L%Dq4z%t@5K5}y}X;! zcIVZ``E>SqGQ;EGi-ACzzJHCQlrZZaT3howd^Q&PV&iH!@EAoaB;aMPr;c7wm4%g7 zg>DT`j)9pjvfc;e7h+~O`;1v)L_{8{#V+ct80e}V*SiEM8T3rUNk2nS>iCvZy{is{ z)znar=O^4f#w6~rh>|FDiwbU*G7dgn6xHfz>?#`NF(x-1Wu|cWNbAKTAxmq4a#p@z zQ6RC4E}$uxf=zi=#lok9jXX>rA>t_r`sV$41(xsvM+4JCTP1!qUMWcjyTeTvA_~fN zs$UAk0TE>=>}fSyI;CbGvmMg~zMx9dI~wpNQ0u$dFBLDOys^#v+{}Je5}{IdLrjquQ2Xnh6}pZgw$AC?7D2RuKid+TZ*q& z<;?|1wP!}ytK7Ay+T&HZbSZHZ=~SmuE9OY>?C1EARoAw9P4l<3tI=K-g<2CKq4_jS z-;Ufs@vfSaFN+JonUVmDUuJa6RsO^p^EXR3Bp*``pHdWH1(`A_Tgs5%Fw ztPDRSNlhFMf5zp$?_rf>l%xL0@H_J*SS%;zx3)8MZji@MBBvShU zMQrpGhnd!z zN7%6#A~Q`ilU5l`I^$f9WV>E3Q(xMt@jk%>`)#TQIkEV!op$}y7;>e@m@1*_rMedJ zg_S29?+8+2vu|&_oKKohve6Mrjw4gHb^S_}9mcDepy8gxps5hmH%oj6Im=|W-9@W- zoQS_Y&x^}zs;0*z^LM38D|SLMY9&_`an7w@2hNG8S3(LU#BJvxM&#Zy^6sqP^dFRd z5a9L^jmu=X+>@ds->giAkqbLfc~96$lB9zks}sV~nQ7pVik@FZu~&8(J8 zed5`T|7A%UJ)a$v zR$m4g(~qRi{&@s$&qsfZO9}XxioNl``}x0(rth!IRQe?Mj*Ztg`Z4Rs!YGR=`TB2`V<`c{6WSpuDsux;vK4GP0Qy6k`4qA#}(Qu+?*I8zo{o;&3E&T43#T%Wpecwoe>(nRH_3lhNR}%{K&^D61*L~<;)GzygzS1WOOYF=jE{6U)sYd4&vH!F zuIIp)W9{@$dA7mub2Qr&I?eZmSL;SNXM|A{2=#*T- zD)zZVqRQVQ5-XykDy?L>P*EoPcB$FWWPA>pjbfvK0QSb@S4YdzNlEse9rqm6v42zZ z*ms&uHD)kI(1~XK-niqwhzm-7q^|kX+qJnZ2$3}*dq>=o=FfTMvlpNK{c(~w?Eg;U z@oaIQ+5O&nfBL`8>~rp{j@O3F|5Vw_%>Us8-yFN4;lBFwEt-bxX0oo~E-#K3Y3IY4 z<)VJ7pT9eKAAM=c)E3##@Di&?Ynhua4E5EYPY+sLOgW>V*W)Xm%&<3BW9T;H2mrpQ zV!S=R6PwL>(m(8G#qML;S;emw&O1-_9ODAW&9%lbvM86P+h&OF9zCjb_p;W&W*$xR z?qDOqiz!!U!VOhjuTzdUAoh=GsY)N%A_<-U#7H=!!#Fss7LoVZxW@yR<3`EDNJ!E* z$w#r;<6-PYUXNIV3m((VZ6gz1A9sD3{#Cnqk;i^=3)eC#c?G)jzR_4C@s9m|M&;Xm zk+$*+C(K*uWFHreNYojoa`lf1B0j^&$)!;pO(+n%Bu77Cj`_2|)i9fCRca_U(fpRm z4p=wbW8b)VC8kwgY2727K2z?o6T{${kfc_Z=}#mg&1Lnp4B;^11_+$?c+Qi zT@-0PZSsHPa9mX1-EUT8`uaNfPOs~Cuft9I2CMkTbv-@TRh#VO!u#el9j`2d)jPxE zUaf15tgVvOybbtrUs*K>bwW+GSTn<&X)57S#tmc}AUt1}wKE_E`_BlzXB1APmVBA> z9W;OaKj~ZyMbt6&vQ=lAr={^+lm1x+LXj0C_M>}!T6sm1#FrW$GzMBipR4y^I)(sQ z`n2n&WS^_|sP*bwZxIkbAd!3omFH@hQ2VI=-wi0*@#Ud8zbBTPY$SmpD8V=As64K2 zrC?_N6D}vRn4oVq%MYVKz%*5!q_65TPw^!-J(1~IRAsi7p(uR{I`Ck2 z-+HA_f%~I^Q6p2cW(zYW9jn{>Gv2l$uTk<&<)_cDV-2gE+XwlRE)+13)m8-OAO4v~ z`DE!jnTO9B+j+-~Rz5BHGN=b*oo^^Fkk3(Amd-c7Jw;K~Y1*e8rJ<{7%Q}Ir&-Exa z3|$(g?|#K-Nb+Ku#zF0PrW|fxMqvcV-4C1kl`lzjk6!(@xuU5L z`l84&*>KQ!-0ijg@zJ&2#JTxwh~3Ab_OrbN2(lE7`vuI>dL^E~BLdV{OWff-|BV6V0ujQ1`~wiR9425oQTWax zyS9jI=mP7qE0~E}-bbp&?P5{bac=7`tWJ(iox;Cb+LJ%VD`Ks?<{ z6DuP-`wZqOcqoT%8NW(773rnuXZJn;*o+GjVJ8MwQXoPY9X}bPX-X|Bxvh5k=#$9E z+ZE)BNrLglW*LfryEcA+c0yF?us@~h*;a1@SEnC(-K6mH$Ygj#lw>{5dD<)2 zbsfdRldW{q+=wXhvmb+LyPs(DzAfr&J4A(&NSc3;;fkT&ZVPQgnI_~4_WB7UX?((h zp0ja=WE0%HRS#B+m3}QQ6aT%O5eg9g?NgG zJjU_b7Y^R4MB->X<*JqPoQ8(*&$IbpuoO<-mORf$Afe83`3Hdvsp>~Q;&(0%Fj`>}25 zXiT9Uw=0%icW8#NEGL~pGaBNW)hJW-8Vx8sy!0Pgbdb<0;f-oZ!2<@?8KntoBasRi3JC#O$uk1Q;$ehh4*cEaJL$S{lgSz0B)U2g z-nrvW#?G_uUYSgk&u1X6OMl%g>=@e)dePzeeNv?g-Xx%?w}Z-si1?>u>6Qlz4FogS z)#zRy$C>q$g`HWmOE?4symu(!&3h8?D|XL~mX>u~0gjWhoQ*9>9gehK#l2?a~@)7$=8=seuw%X151OjCw8FUL4F z&wH*XP%T)DACGpxA+?@R(u^(B`Qz>!$%A9iEk@0{t6M`GQpLkovrOI)Iz=S++g51u zBXO6MP+u)xQn{k@M&L_)u2=wcip`q!o#hAd#i2 zeyaWx*3`qFfei+##cHpg)_aWlhS7haGxYlPWQJ|k$T4Fdye5SNx6_ylW&5es>`fX+ z#Dl#=9f&dAcq7Y9r`1Eqw+t=~7G27W=(WsP>Km&kOZvXv*P|c7(w(?qd#n{HrxK9+ z>16VqMULWSiPapvO!CW2!8mgJ#=cXv<<=S9{bBu;IdMDA`!qi>_|ThLus=8H>sQSq z=OE^W)GDIoEKL})J;Xlu>%LZ}`cjPO-*;oPliy<2sU-1KusCS_=02M&mHXb0-cg*q z6{b8nsnpo-9H%^+^<4dGYwRu})QUc!h7H}c>z_*~ma`+zv?${{s6IVnJOYfA1AF^s;dvMH%$P;E*KQ z47;1XIQ?0&QkzJ3Gfp0vu*pZRgh}d`HtDg%k%bdZN^**WJ!<7bXkXHXqER|Iq~t1n z?WY3#T0JvGNiB=QG z_if{CY@Y-BI~CpCO3x`1O@Bi2A=Dm5`eskWdCR}?)MC4AX@b(92SvL>yFP{mX3h2TD*!!GQ22<9barw0jZI6J_Vh>dp{`jO! ziTY}X+eK^81ILvHwKdJc56UYQ`6zW6wPJz9TNBQg{-=d|`b4Vi)xNeEn@%RyF<8sH zIcc|eb6x@52&JO>16SmB;0+p~WQ< z)z9nTB0O$GCR)i+lk9yPL}K!b+dA~cDXHGVyhcoGVZ{$mB9R7}j6_(ma-3Wp^VTfl za&8ffyRrYQ4HN&~*M>P`mgSZwa2}uc*-ml4a-Lr8AbDVqm`cGYf}BkxG9}00%>j|8 zK9;*s)RI4&4Sqn9C*jcN-j1Q;ddCOeCgP||rTp2e?0;5i{&k=U8n&M>w!gu(A=AFh zt6ThPOf*wRUDsN<-v5h#zY>q8*0V;gfPa>?W23^C{oI0|1SO6eJwoS4YRy{TN2pnT zvXyjZ&al?KVO*El*Ql+o8zUid*;Y~azoY3jp@z}%JSOeBX@GRjGZW2mA?mTIRC$D1 zuxW2Y=bD;C~j9&bkQr8Vy4}|YIfU9@KDb2GC1W#kQ8T{BsKTO z6_LMnpZc1yoh0*7QZY{`5)q8PF45ISIa5inbo4_;B9f~MEr4-}*(nnzJ=tjc^)ojv zl)1H4>7#NX0o;hB{y|$>rxBF*?Z0C%h_E>0_IXXrP4d%%K8M~x;mKz%SHqmAWnlIz zE=W*}jk?ElyYi<(gha~>o(&R?YSa`#q|ok$Z$HocjZ+lcMmATE*O^=QcXzWBB0`(? zXpay3EjBB~g!Kk~sg^TnYvUquo@-%tSiBl0*%Ql%*w!b#4mgkPL(M&KH?P}<2VYUnvYx`RvgO!+ik&NMp8a6XP`WVNmQULt#>rgp5h{p3{7 znj;KPMaHzxp2I5F`Aqs z;7J?YyS*E!W__Hn&|3U)T5Nv~YhDg-4@LLa2P$XIb2~l5suNdtU3D<+k#>2bPO)u#IAT2;g*tXkmeJK>=2Z<% zQ@4T-=HAZB7>rnt#q6HP;_MpHAJj(O@L5)&PFl!ZKxB{PPKx~b$H4F5ccr@hzke*C zHojdo5^ur2z{`MD(r<$6BK#{`;GDk+TlgG$o^eXSgjzD@wG=ty|g_ z9&(qcYxCBdq^UcgO9~uL_hER4Za(E>q`WKRP2U%|2SNi`4S%PIl@xQMTV}u3ce|V>@ft=BQ z9R|85#AV>M_6& zvi=&J!TiS`POU!RtDc_qgXtRxoUZ`u1cTAut?VH_B_t&SuKN^*R0nL*-y~#1ui@g< zHFzt}`I0CEC-EQr%_jo{2OckX5y>W~X$&;8Z$Q;Xyfi*vWF&L^e9ED52sm;8wD&qW zf&iQYB@LWcpnCbW_Ob<_JS;^)-dY&%Aan~st)pD|^ZytJ>(|GHK|s)c%mRA=1RzBb z7QD&t&whV^dzxwOXo4?naK=tw82<0uloFTPWl(1gX*hx^+R{1{br0Bn@Xt&hK*}!y zXeTzd@M`E-hOaLV?&I?Y*4_dvwNCk7XmRPJ?z`K47?|jAZ~IURyB{vK1X&Zv1ikIj zq}V9#M_?}q0I%vDT&kFqOzFGE|NEt_o~TA(*F5e2B^>TkdktS3#H{!(85)0p)B`E^ zYg4x!=8(n9>arv=FsXo_Q^2Ed2RLnaoLszC%~ z^5-*gsL2CcTH5cWwso0@B#Prt@it*Zs%YdkQPPF{5Vsxw1`!*&7j8GqzSTUT`EobZ z{E{}ok^dw?WZC7$S&-*=;hS}{hc#v4pqj($X!41EJ(rm6)-AzlRRviCX^0>8B~d`+ zV#Sj;3jLDbX>&Tg6SXkZdp^ZU38;KW`!QaXLyX-T>db;}nUd(L-hK z8~+0jU;Nq9muf{pZPKrZ2t~ew&`1y>3aA_*@KiQ74`RZ1@5)tS79JX@s-g3SPKURz zR&{)~#;X*O#<(Bx<(9kbrrz=3JI|13nlZfJ(TVDDx!H z9`;|KBOrf`c@n*`VJe?ou=Xd3Y{l^Dgt#C-wb%2>)K(wT!rS$D>hl{zTM786@!P)ne8KA|O!lv$q@qEVoM@TB~5+AH-&818deXgqUb~ zby)CG30PG0S)SQhQCU6NL`}rwqs2>}CKEpC*Lm~b1=_?QwX1%Oszq!(PKjGC``Cc= zJ@`iYh>-<*iEc8!w6h5O*lO#i%k!RO1E0wjB%MkW>27JPn7rl{dMj){R}?GLjVto` zIl@)}84I90{Q|{@i;vDQsvZDBu)_RAEcR8$ycw~>`qJnC9mu170srX%(A)-)^-j4i zl>p7fvrnV_QjI7ATMQHUVp0`JasWYnVg68b%|h&3_cp7-)m~xXH?WtDl+%rIWs+vW zaQQcwd8C&N^mSj)tKG*T=TrF7^QEvC)GD929U$tpwIjd?APH|lM{tBlAAoz3QUUP! z-oJU@f3swm?)vYWe}B9uI5gPix?#WI{e?1H&IR=AG!qt3Wj5&4e~mlJIqH>|^P{`~%)Y=;B){HZ!3s6kkSqgMa^yobFZk=6v2 zITpcpiGT22IQRr+Z}X`CZYM$4KiD3POZ~l&uL$cKeGaIwcx_Fs%LDJ~-c5Q|#bHe8 zyy71{=;VWlC8&4=geXD^P2p)jB1AV$8c%HA04v@7roL8c8-*jhO4xM>E=2%Kd2i`& zDG*7vY5uSWwF7|*umvN0OCSnk6r=z&*mviiug+GEu#&Ud1KARP--qpUO4T0`&(|oq zleI*^jHA*uO#ba`q9bXNA&4xPp9_qUhxKi^L(t?+E*V>0!%y*jJf}!136=?bk-lTd z?OwLiThNsP+VaOf99EvH!w9dt#K9Nof1+v1*vJd}3srX~mjGcD1CdV16_H&sFt82} z0F}|)bLOw#A?NF-Vy;lX0va-CD~F(7iQ6ZU$B;(uULOLg8G3xrYZ%{_DVs_|x+CP~ zXVH6j%<})cF$cZ+aX@2wb7hksp@CdB{}WiqZH<^YpdF)Wij@HcT!3Z#y*3z!!xh4x z$@7vq?sUEWpsiX>_L+p0=!7X&aB3cR!-K0Ue;zY| zM(O^%9m0X8WQMUi5bl!m5B^pp-VtO065M;C-JH#DZj)Mg%4!Ytt-H5rUZN8~Y}5-b zgueuihXRC1w36Ami^!1i8^RIZ8IUnaQ4u(U-`$8aC;$)0s-B$2nCPrL_|G{$5|JGH zBIWTP+*L3sAyzWjeq2@^UX0}PK&%a*LfG{LE3D5tj9?oAa)I-t4p>4>vewKf*VAiiVqv;dQXwu&$@h z>97bTg00ftfdE4lkg(Jq5gebs$sHk#VTnR(&Ipzeynu6Mb&W68q>GIZ?izSx>#u=d z_WmjU=@R#S{%PtSoSYA%@A=7ydDY)<>>gYM{C*SQV2!&WzyKbSJ7$+aJX&|L`tH)b z5co42Dy*flP<<0px$}jhn~b)0UTR56(8(|m(Ks3e)vwIo__GcF9quPA?fXv=Wh1Q}7;FRR}yELlnz4gZ&u;6P?X2aq7(vx>?hk z56JuPrg*N=g!-RECzYQ7V3O(o2rnR}a1W0{%#0=k3omdeXFj}1WQ$cXyoHxztTax; zVAD^ryLehJe^Lgej%~x;X&hFxfvubfj$c-Q9ls~%_jkjq1lC=pvK+T#4q!#KycIj7 z3fM{2!rJvHRUBQjQPDO3Pa(i-13uY**W-N0Ks##uL!8~94DRQEe;01;5Qm`-9FVpy zjZhpAAzz`$kpw^YjL_S;M@&RrCQTH|biff&>DiIMZc(d~b+!}D_#;ir)ca%3>*-@7A4y)qXJtSMIC*%q?=p4l=!Ax|?h6N5QCe~UP?D$PK8Ba?y~0{R#- zTz|x@$ccNBsIT%zmifZ~u%~Y6Zp~8R3S@KbgLMJ%%BF>)^bVbT=V&ZEo_&DaJXv|x z5MqU4;gc`~k-IB`z??s)heZEh1!h5j1v`_&px$Ti#jU3xON^&nt*a!#ConEScAF zI{U8qxb(o`{`E8u>_0Qei&k(dRT?dJV)KYDaWmGT&7cE{NMf0ZNiXfj6$ zUQGzarad0Jk=FnIPbqGx*pw0q#GnW0(7d8=zGlJO?S$yv6fJ#BYT{%6tJmYS-#o!E zy`1}b`i&)#YRWM2w3h7!UaMy-)&G7HyA*lRSrp>RhM5=3f|#6?V!qYecWC}C6`U#u z^0fUu9LZ06=hpWB_GkED33s6dfJN0HaH_fsm*fIA+o7)|sz~_>Q*p|z8DAx>tA%s&pPJIZUPQC#y>z!}1l9q&@u>?ZOZwPenzu1b0 z3k?uA;37UAco%MA=)*Wg`W!F4S2x}W~9_X-k& zH)Z+*__m!xTTgJbz~+D7qW}?%1sh)G`6ozKf+vvHRa@$^yfCQi=+}FzN2DW|lO{OpqT!S<8{iM_ZTyV?naxJ(u7uKazMJ`d@7FVV?zzZ2yh%X$3F zl)_=g5S&?K^q~lCwy_QoyO;M+4vmBq`(6Jglyt&d?p{5yf6Wt_-#z3Kwz?=>IOUd` zbot5MbeBdd-*cJ^i}!Uu3dI!RX1fc&kYq9b3p*Jxj2|tm(cO-8ah^Z6;htU6P+ z5xHRmF3~kO6ItP>-y_bH!$W5*J?@E{B_2z@MW_6Tt>T+SNu!oh(({PFHi5Iv>E-j8 zvqQElVSH`EipsrW1f3F3K$`m1cniL zx(Hrl{znf+4(0l@yadP{BXx%w;^Fr+R53dLi-;(wPZbmdx4LhhAkLN3ZYcu#jm&~JMrDRm@W5L znM<1b++Qf$MU+%y^DYoUQgIcw&G396!brprF*}HmsU~AAYB)ozuD=>XjpR3WIo6TS zur*z{WtOFc5wV!(sOjKTyZs4Hb3|+mup68!Rk=ch%!?a{K7*JR&pFe2&6I!_>RNeyV-{8U-jh&tw1O+=1FR%O z695hwFL=61sM9|zSztLw(W{&ty@3LlNt~Y~*8qh8#U_^bFFWRpAQW?VDTOrf5Gh$c zZ$(+ID_QgC1Ruw?6lP#2Hw%jY!C7D+F5nLd`aE0^B`2X{JsE zg3{f{wv@cNA(vBDd#{oGvK|XO{${G&Ig)x?GS(!0NH(adT>loE>X1y#u7JQud(ZS9 zx;_D~{)^2wj`|tLHZk3EIr^;TTi~i97x64^5%_!gE<_5_>wL{Bp?Z1(PQj{ygcD(1 zwO&zUyrFraK)F=PpP$3;euVk8nemOV-Hsm6S}&4AqEae!T{Q?AC2pt1U(tBG+>Y2_ z4AF!Lg(uH#*$zkWYsf`SK#+ir-~$NpVuQ5>wLja6uH7N!My_x^w(A;pKRwIxk^aBC z+)#j4Eg)|9e7bmnh@`TukSc&Q0YoMWckoF(&CQSKXzHic2{nZXANs%Ke;0QvoI(01 zP01E$m>%y#s2*zK`s8J2am`<^#-wj_FLUgYM4Lzde#~3!fi2~}<67Sv1_Y|BY9R>z z{)UWo00riVYQ#j8 zMW7cv%kwWw6q>&ag37Har)(Rv9cyrda`j7BwX+s6da*tDOf`)#;9uH)h4dt4(H;l| z2pFKgQn(xFUJKQp+!_xAet@pU&_}Y^ zIvQNUGpRX{0Q%H59BKsf(2J&-sWU%Bpw7IrJ#d!WxZfW49v~Iy9U1l1h;e7}uTzAz z%chwda`)}?+mS#}S%(?b~_kdJkDU2%J$^fL{|O&rW)zGK@F_>&F!-&U#p z?71K(0cu+q14B>Siu9^|I>t7X_(2fNh`+pDX%0LJoQOv)I=hR6>ls@&c;wl4ekUs=vcK_6_v7s#jGZHZWd2_dHp>NWg{KiV>Kny|_x zT-47Mhzv+2=kd@G!6&RstZ$)xVSS|b8ih|`P*IJCXO*Arfw#7q_G#K{CLJ8nE~0U8 z5VnIx@rU?AqI^rZHgZ2UFRgwLqo9t9DJ>igM^AT=)59>ukfP8wQ#CQ;j>8@(7abXs zW)|sqpC}^X6#RhE*n^~Ksv!dMQQ@cZ6HszS))be2ef6{%s`#B+XZP;SD3P3q z#yvJ~i8y^2($P{^PPat|M_PP=N@Yv#jKOeH+5_|XCVj$|a}jKfa!z6+8nPp(2MDM> zvLMy9@OIgBn^0&6iopFuxa{_{KS0R=;J<&9RSp z3+)%CwxUCJl?RCzA(w%y?qkoLUJ$ zOjvlf1H$!c^PN+-r%;b&HcKF^DuN1fAccOdc{Vl#seGFi~SWkF&9U ze7?PXKeE-6_tL zXQ&u89*Ei$POM|*$22X`;`#IBy!S_*OvN>b;q-?N-Ib=A>w0ir(vi+9v|^3?j=DaR zX*%ty0PCCnWICtIlqaDnL+8Y;l{D+EvY1v)XI+F~hzPMDlltn1E8m(SBu|!k&6ZZV zKrQNB{&|Xh4U)lndR39hJR!`>WEdos`v-3cGlIRWO9B`i#aFvrltqcep`L$j|2IA2 z$PGuk;$jTEZ|vN5>aIc6cbVyCCTw3=`sJkU@%{$(imAw7{c9tA?sw6NJnu75=VN~F z%!G>3X}VR@)ChPNi8bi_f;%D;f(yPDjadjGbEKaG6G13CnqKWDhrwpE2T3m5t_r(ZUc`zzqH zYFsKOsI2jz=P>b}N22bxHt^Tq zj6^P)(UM@3(Ae7Cz5N!uAmv!?H7L+3+OI<@7ZND;S{L5vnVldKnxHLuPowoFL6O8X zLfml^ODv|AUW3|rziQb-5VD4%HOk(PC+e1Hdg+*KJjCG0&@7z;JC`t);f`dUsh52H zAXoYhv|#X_!p@igKeb8U~FSm0x7Y zbkqWM(EVbqvL947=TM4d78e$_x&Z!Z9^|l0pl~qm9h<`uI?ET}180Oj^<-b_do6Di zhp2%0Ef9i|m>`;8xr%xa(w}PD8?8aOqo(v|2U8wxPaJ)*!nEDpEFn;EOT_tF4L)|b z8Q-Q;tqCc9>g5TA#z$E22I9$kBH+c@s6%mmuHKh*EidU1(6R=iEMg22X~BfPIb?;; zVK}3!D{L3zQm-e<_XEyJ@7m&EHV}%X#1$)8XnFJXHdf# z8EES}knt6e=MEiSSdw_O#z6H0F0#96WKz5Y-174u_e8>vtAT+?2tQv(glj;J z)H8R4BAk1yx$?n@pKyEz{UM4v8}1p8D)wqZb}&Q(zcUv*fdnq5hWY|K{~lqFC>S2B z-;f4KnK|sBW!j)IF>mqBZ?ma4T6b!3Z17{eb@lUI!1cnos zRy?mL;n@*Lv7a)|Wz|?h!epD{u?uib)2~CYr$Q?+()DuU!2{iXW#nnwp)JN?jnltG5b^E z@&H4(z(0zPoYGb?XuY6d`~pTS1Elf`Gvlt9n}s& zyxkZ|BvU_waW71!g)FM=^bR;kau!)f}x-M1xu85H^n7k|a`40L)>^jZN9d2Me3)8x;sl>w> zfh#+-CiBjb4O6)bO5XsHvRIm-RlC9Tj zSSC#P^0EcHbeq*r;`0@#Z+U{`<$t(5a}(>KGp>_bRpMfkDj;#}o;+{G3NyRpg|mz* z)Hc%O@v+_38LHLq0%f@+F^mj8Y^-UT8E{1HYlPTHBLz<0!|&gE?MI)F&UmpJco3~p zxxhQbub!fQfYC9zCc8R1SHz^Qy~DuvFsA~0krnAkp#03-2#w|DfY(w$!8}QpWU3`Q zgL+n8yDEn1i@*nW%wfhq@~@{bm85>FJNnnGSp6q!2ePP6?f6d~hpEq$lkBVZx2P7^ zplEj2;tCQ9kn`wJmiOfQ%@?WvVS7|5cfIpiOeosdRi07&AcLu>j+I^fmq!Kmh}W_`mf>cspo3N#dN%sKMV z>GiJ=jge8)xK*XU9y8W*GhD?N=}|LXw+0?kwo+E zR|roajwQ?3w9ZiX^~>)vs^##K)rg$V?wNmBm{nMO*6#b4`%Gua3z1iZYE6GVt~aV$ z%O1cY=^{)wA$MQ7P-@V0^eePd&?(G`RFPy3@ z^3T7>RlS!G5ST&F<;9?1_BsuCGp_aSgo>kfOL48DO*GZ-XGZgnEV>q-Bid|woVS(E zk%s#dx=vyFc5|QEuN_AB79mEHPmu3=*1dmDZfwGY7Q;a-O0eoy)hgP(FPsYfZx;{H z8HoziPDMh$WxQ)`dt9a*5`b#>5lxnV5YNUs>PD+ma5HUlm`eQR4ZeVIG*-rfv6=L} zv|=w!abv7f5;0B5w>RGWLb|NXSDG2L8I(5ek`xvElCpAhi|@m;25Ezn=4{T|fHfcEvH*V76kQWx7l&Cn4g2K&BLC8QyX~nGOpq3U1 zQ)$nx4}O#|ByBC3Ru4i`(?)0|5L(Rm8xfF#P>^yEi&|yk=7%YPDLxtG=1!)qas%v$ zNK^mHgwun`_voi@{&A&7T8+|%YQNq<0hDh$8_VyMpRtRf#>uVa>c22a#PO+U0Rpxj za1;=5?b*5ncm$7`b91K_nePR@8vVv*Jx}3QpBlnh5+paxRf0ChWrayqg=NPd-ZEz} zZmKxfXaa-fpO&n~;?L?H1<|hh{)NMH1q>5SFk<&KeewJhk@^TyScmG$o&kzL?%!g< zgjU64dSob7&i|Gn@d)+5MJU}IFv15zbP%X(g-{4fl6v@L;p;^@?-TR*%DAQ5oL^5(OMrMnb+zlkn$6^oR4M6_k3lAQc0p+UOX5!@x$YJVtRhQziI#C8@Fg1RFVGX8I z4L#-q$DR6IIO|z*7V-KRMen6(4P83Z@@8clYnX`G4x?Yo$x;SHA!NxJ?w5fHZh z9D-C?&44(v#6~krmprp}0Rr4wh`Za7YqU3l#xp%Q*a3arH?HC4H1qXsN1p6Lkl$W- zXCm&H>ax#C?Ld?IbHZ(H8YX>nl8i_zt@-&_;8&VAew(M`P6xGPcdZoV$4Q*4il(cTi`AxlCMwW zpEDFdOy@fTO@ zvU4%b(7CfPqH^A?7ORd;Xrn%=%qNuGVU4Yf-rnAMw_WscR)<}`b4t4aky66jzZ^LZ zr8;CV0}1YW0|Q8#Dn;|yglfqA4EHrlx)^b@^$m+!@T=f-@;C)4=@cPl}v4w&_yt2J0vzcc=fNZ^O0Q8|PX zl@GDDexIKCV_5DP{yS~6r>^V(#>Un|-ZQdiFITpwcP9)fs`?V z!y2ZtygzF^XD;J68h&*ZFk)&HtV2^|#L4E|7Ao zkyH;uYY^x_ris{cKZyC>rk1)!(4o5RsL~rn3xVqg5ss6P27#=>gm(n9+^8%7=vid9 z(@pj>C2{7-RxkSt&T}a|F#w}2?JYQbeMvYv@(qF#oXl+Nnd?`_B{|jMIE`e z=q^!`3BLTx$A_ID`Vw|-AjS`Ey!AB!OYX<N(IX6Yv4rEM2I~708ntcwchM1DY5$j zuFu$jRJy;mw;4iy_kMC%-}$Z2bJwdaAca_c+5w*g=k`OKwso>KnKl_y($}652}>)d@ZFdKsV$Q_5Byu=s0Kp5PuUG<;#eZkpn+Ew6kG}fNE9`vLn9-EGM zfBB9%%fSrtU9Hf#`ZqVnS<}K?6cTQ1Q9_dk&MUfY@1(@l{6S0MfV|v?P6gGS0$T@3 zNR{UbjM63yQZLzUVcPIAAv!RiuU*xQj>ZRIL;d>}504RUfOZ_jWlr98ds>JcK8$A$ zzjcRbX|as+Asw6gz-h6TqFDbX2Ei<}!fb7U`wE>IVyhPY`H?M~0+)(RkqRCvO*8i`vGmnR|-NU#o*(%#eA!CaW%92QB?3A*m$PC7kr7}^G zh>R`k$dZsmvXtzhD2B$qgcz?=7;8$_8teHz?|I+%oPW>!KQo_sX6Ctn_kDe@>oO1N zYKb;whNc4}rTX+7b)&S12#&psEn4-Md=7sFEc7x+o>vWXsqVMq!pTk$s><7Pa!fB+ zee1&+_K<>5ljgKO!5oXpCQJ1SM4bTSPo8DvG`FFnAx|??!YP**wZ_EY%QZgQZgyjO zQ7kWR8kaVdLD(bTNthIR&h9Sg7}b#tuW`$=yT*}pCr)eibdDRC9QBek9IlXcV=ls4 zSbhKT*uz|<)VA5IxX~1U76%Xmn!{om$_MjrUUGZj5xi)z-WTOyqPT)kVl z{k;&*0zRB1OJi&>_fKNwefgJ{TR`-BU5yfV}y2F{TD2|BL>#pGGY}IgIxzsuvQJj zjp|6{Q8Et;OFwdMO4m!BH)QWP*l;_V&{9c1F%o`6@s_qy?yW5Xv9K&R)t50Nle+Z#^CigCYUUMu(gpwa%qP?eM ztdWEeicI+bH$%`rZ7;=+xl?|N!?+uMy0FFQjZkhQ4q~|I~nzdmF zAtprjTy7>Zrtl^QR-2z(3`j3xK_bSh>Q)XXor}`NE{e01B}kd9T3%Lz7PA6wRe9O| z!l3OfpD`_SJQ+O^8sKM;Jadr9cG~yuHf}PnwjJ#8!Z{Z3UC+u<{mEuk;(9d)V1 zSc#}rUsQ;V!2*x4provU^77T-bZ9~jd9qWD-=O#d)_ClE7ZA{x)65!3%PUWNcs!%k z@Fw-G;S~{O?ggvg%$Agx=cJ2c@3C^f1IBI(a_5O&`H8!1R4+wxE3r%IotJ4zHf(P@ z@U7=rczkbBjKNkAv`B@sxs<%d7j;T)QBiJM9UOGo!XnZXW2M*;uFBJI-(~^{E0yrf{ubA>Hub=JKm_~od`=c(yB@JT7s3Y$0 z+7`yqAHnO%gZE&iWb=3G7Bn3Wr z4~P;!%Ga_|Z$Aw2@_w@Ov=x((+xHhARqZ&Skt?a%ER|$$lw5?IdqU@6Yn$a$PQ))3 zhCgf5yypX{lSIV<-G*pNt$ODD3uNrcdu%yQWfDfqCMgAJnB1RlB!>$+2y)EnH8cls zDUL7AnncZgF2>qh1V>@)+06pm3Gi(^tj@Vzp{+yIIhgJ~?h1Oe^teUv8=W%Biw?z# zx}LF_ixbyXi646S-4Cmw{aXdKWrj+7@}lwmtq9rWFTjpB|^3c4Tz_iDA-KuC^PqpB@s zOObUDryklF(7NxlFkSpAb+ulEV#uRZkvVtsL*9V?Y;W!Z&8t7Zei$7Jxn|$yzMZPU z*iK;H#e%6j%&{aWKn!tGc15KxURFA+fh8P^yeD+3O6}{=RfUF!wjTeg4nped_UW9S zerkQ+Az^PiOu1X2hJWr%?$o`)r!&&-cIWzlnY4m)UK7z%&2eKaa}5^T@AgvY)L(v)F{nt*NTeRUU)8Ev0(Jr{rk%+ZZ^vMd5*J-Lo}2Qfxv zVT$3Oi_C#^i%VHw^o?uB9_SN9T*^knggPO&neLJ*<#u^vKf{G3HWfHR7IQbPw)lSxdv@V zEN|b@!8c#1QHm=zvsy2R*GhJ3NXoE?oJ$EKR7LqUWPZMkHFy|T-8S5TTm-&xDZEtP z-u(-OfYd}vXI}pl%O{~9E!e-d$#(9$iF^t9>`T!my8lz!fa&+H2LT-D{E3-rdW~Fh zh|1!3(Om|VzHZXmEmlz-G;jJr4&qt7Y?{od`;Wwil~0BY9;%xpv9A-O+SCpIyRR-3 zodv^g>vJTLgmlCnlU$zJCG5PfIuPdLI+&cX`}aUy%ORhb*Q+2~q$zd;#JDqCU_G>- z4gGkt;ny8dCR3Zla>3o*k0ekiAnIX|U&_bK{mFYx&Zpu)G~Wbci}e*!*&<2xMKP*A zfR@l-gO5?UG=klua;?$yiyhQ-{Q0(F!7b}Xn+_h3bt<>@ZayB^5UpU zjDg`rEhVJr*V*Z-KSu5#Jtgq>UPd4xdib@b9Xy5&n7&><+At2ScnoVs!%FT$1s?pE zl<(V0T{||2yAQtoV)F6d{!+_-@r~P>0Pe-}wxflay1Fxw35rkk3BzLQM_BE;VGw?H z@V)fQ+sm-~Rs{GZ2&xVq)c_qhg^iC%jDNQ_TL=if@+gRxNdC4xgzh5Vokf3;ENF1l zBEW|*dq^imJ6Cb`=%7=a-Z-rN&w>7P0#k`C#7raZiVg8*SYUuveulK=z|UtGqJRr#6!F2`K^+>*WqiN3^)Hp^-#o{IKh4cJWA_`_X+SKVDSEUpCDmi4+9-wn9ks2 z1`Z|;1nRpmk?L=Op~$fr_6U53_#eThinFlrZ(rD0BHO;V5D7!H6oE)z*l|$3Hl~Nl zTp?MZgc~n)>X9;IAf6o}Ck`qkiH-zA1cE?Dub{M;EjXB#t5}A=>|dSvDZcKw4PaI1m>zxP;pVp(6!{W4ow}Uq*v!7}lG~{g@uKa`0 zwzauF74sG9LzMupKLDA@h*u0)2pR9RCtpG#An_{91}g4I+X=wrO9sCV_)m*D!qx2t z`FrrCZ55zks2HK+1j!EAjvCM_FPdooWs4&tt~vyqo(MnDTK`N~+2xEMPip4rppzvX z^OGJ^5aSnb0qJ2R`TQQN?uH5)?hB|KW^v84a_^3GTy9@s#e zr*yM9_~|VLavt|RB#I8~!>B*fr~gKEa5%JD?JAH79$2}#DquPgiF0sqIn>CUx15s^ zHq-i-$tNn3kxxX76U8}xh@az}tgsAO?vDsO#lqf$_#$^i((0@l>%RVtjh_Cu(w`_E zWnV$GZmq4FoF`0V*!}&f?nf?Y{!_fb$N#^@3;(|-FzLVOYp$Ee`Zgoxdu*}~2igo!{-3A7`=wu{=?dpKH{nLC3@(f;rPt*C#sI+_~2o=WCy zVPgv7xIsezenEKsMb+-Jvzw8lDM-)$<@I!=zdE;YGO;!SPIUw|fNNubX86};O(REJ z3tKY~m~cB3XoLIvdKX6%Q_$5*(7``X6ScFkF|~CDUH?hy0NP+*PgApSwl)P79gkCk zKx80kF<~|L^ur||cP!IP=0`gd?@ncFmk{M-Ymr?X1?18a~a;6@Cx69o= z`a=p`O2E%q-Oa@f_!O#otUWZ9>zXwGJib@QR_$2qXl}9X{(^)X+}SCNjEX9P4h z3=9N*@G41!*xg9ZVE zL|?#xUbLTh`zOW0AZH!8lE7(Qq1o?olk#z9?B=mUkp(Z-+2@UI^PYrUiaqhS@-+X0 zZ{9Bt8FnkMBYS8m&f#IZsW__R*w7Gdg#zYwC*Uf#m0m_nJMf5KCW72Oll{`C#~6;! zSh$c`8E{Oq*biSC?ef6YD;PQE#i4Q;RnDn|HIs`(Vmof1kw<*%871rZm zm{voOz{Ca{HP5nAEl?>gXe?%Qu}-A1E+^0+$Z`oE+d~PLBna4`+jw=98>N`?eD=|# z76R=M1~s&%v8qy-{AVY!mlOATG(EMSXU*dCcKoau7*WKS{&?@08yzv;zk9|Qe6d7y zJZXb4@IAwCzu)J!Wl4vF9o|T};BVH09Dc;GzkzCd`mjRkGvZpIAAUMb@5WJ${F!^^ z_dAVQ81_2kt+?AeEfNfhU4X|#Kv z(d*hZeoeD$C5g9#d0udXzSM2S;99xlXusQ6^*$dfyM6ji80$R}b$g$Nkm9~^bvx+= zQ?NjB<-Am+Z!0cQS5D` zRQr2`72S5ih9%xGgpdk{y+J4Lwey^p+{j(N_x{f@aI4qpp=8MGX|gLcT>G|NnM_C# z=LxtE)5Q`=`UWn=e%cy!I*uiq6u~1)%A$84+-?YF)|JX zb}B_ARnGQ|bfJ+IIUmRPh4q`#*o>jax9XMcXt@#z@9ZUXg~;sihTu`uRp7;UoekvD zCJN-h&leAHj5^!oJ<*hvOfz99H>P|$?$P;rd;iTpGhV^_c}`omuVM9$8=FP97rGn7 zku&e?oExX{_C9_GTu9%xC; zJ+r9+C`K*@Tt936%+^e9F=sq@UWy7abs7-BN71UZSng=;ao46(=R1{ggh(Ap@;01r zpoAAFc#4f7%Ra$6WLeITjn^s9x($BTdY>9JqkjK2OiEl%`lc_ zm`zxnSy>Euz@TS;&-E*~Ohq?E6B?=6fo}dn;fB`PY@W>K^G_|f$dHZX>xNqJ+erCC z7XoCK&6(Ume8;!OioSa0>x#P$U;40$^>ZvxJoFS)(hkK|V3gFuI!g0uRLSjk>P0@r7)JskMi;xw7;#3z~~ z_l(>4>u!f4 zu%BZaW26_L@sSY2qASQdcs!+Rf4oF%+#2?>KM0B>f2$XRVBi-qh}#afnRtfm5Sj{_ zC{)~72aEslbB1_6?syS+eukr>q1BEKB}pw=w%5puG_-{JNvUV;YF5C|Bi>j@9w7~NO1{Rs_~RPH|iKAmw(W3 z*pa;B-vFkvB4uC@u$@>P|M(XA+jO$*0YB~qODBhgNm0u+1849WjZ;xjj3dM|VPM25 z1TKGaI9_auiwFt}GhdY5-`xdst$0HjE=%=`h>5Y6Qw-eo% zx&gya;Kxp-2debGv;l$nPFi!D94rWj?hk1)wWD3nW~wEar_K7OgB`t0%`dlernKOZ z>xNi|0_aTW9or7#h%Z+@UUlkQ!&sxxNTce#6`F~g|602Oe}t*LIKQxvTOrmwn(j=c zu+!g-0e64co1&c=Em47svTlajLhLg~6?XG{P{a&p8Qo34+*#AM9Nfb@PNXhTyB%FF zL?SZ6ff2=2V>UvvhYrvBcInYCRcgp<@ttG%yf%c$#2BWoqT^D zbuzgy^eVPmR;D(jkWL^<`U5lnjF?zlFMq7%6erU2(I>rG#ZH^=!a_l2KWn-6&BblB z%RQy5N1}~$F(l3k2i8{5)%)nUiPVh-fni`xL)Lwfz$+mNaCu6Dt!LGkGh${6X;WO( ztRnU~_j&NUsWWQ8?KV#+JBg8>Znu1_b_wy+?RC8rkCI-tg|=jc%_v0emG2&LL1q=R zG+=%AWdp?;374&@Vs<#x>tDAcP=U#_jg|Pt6>Ee)OuWDC)D!q43=p{+s>k_K*3@nqWm>efFB>~| z&}PnXA%J@wGHvv5NW z`Fb1EK^H}3PvC7q*wN2)ll+ZQ_sp(gmr0Wed*VrBM1kcW!!B$x1bIFrl2J}2jf#m@ z=zH@tM+?d^=a&)=dR46zm-rZQh(lXjCw?yvjaT(L_A?2;rJ8OOQrh_l&F&x0BySvA zZyr=xUgoR;B3hW`OJJwh6w!$Wr>w>v_GniiX2ZwBNPJXA@?meUtpCe(wb|&ZK>~{G zkcJlD{c4F|a<+2wgy~LBX(cutV{yZG8)5nAX^d%8cZuc+FI{uHie5Pr4?~A&e4k&a zhbvR0~}$_ zHVM}@tdxcI=)Kz;=CRjVIj8@aP#P@t>Ig|Qn%l?&4(tg=Y=Sef%5gL1ifj|HpP(7j zGo2MD$?!8t`^%~BpDZq1B$7KPxePY^j)$d_9Ii}b2?d)HM+;ZH%PU^Y87=J}$s1P# zURm9h6>E9+M0ne?xtVD+JDgv05&OzM6XDL-F+{dzg*|A_yE!5dwCc|qq9lAv6a?&P zHqV~mW7~<*!0OwS<%|&FZuOPWWH^5W$aZ}8+Zjw)W~0*q9%TJzqL(X$O9)Mn|K=Nh zRgFlIyBf92PJL5Jg9v<{Ivvw|X}JBt0P&0U6ZN+vI#}tO#8&~;pB)Lt7tnG<7Yz*h zg^M&YyNy*BlDl}j?R6a*N*swWMpPkN&mg|2Z)9tkCu&tWYjZIM-p{YLSW zVCd$TGcWixik5cPom=^+_~^3<Ym^yA3I zPCuBic-=!88e?pBba|O%%d7cmR_`2hm4}Zc3-X5_mrS+iX~K^7pDFrZ+3=A!EUqV+ zf&HYKq^i#DCW!M+{O+#h=O^7%d)Etg{b2BiNo=8~uE-PLn*}fDB24ylL4%!X8@sHD;k=>x5xvzb}oLO^WW6y zOn!mix}0cexg&uu7F_`$YhknuDD~=-*kJ}mNt0S(UNNzmyzbeQYK#`QWaxqVrxxXP z<}KSEqbhzz=KkvwCgI=5zAx9IP)MH^2I}`#qP~4w+6^5)>D)T0tUg&J(%MfBe?Y>( zDXGwGDJ3Z~ND55&wlqt8?&YWSXWegbU`F^MIk}GOxbOJeuY8*!1AI#>t1h3Lq23vT zmFVyWT}V*+!?gBlo56bd$#PIqIfQQWC9y669ymV$;_b>Af`9nOv>9#AX|Fadp>ZR0 zj3|jvHzSnuvAvV6>0JDbQ}=?~Z?lU2JNzVa5Z=;eCPMs*+Ogxlcq79ZNIyuUKa;&Q z(SknV7rnl@)VP(sfTadj&H`XL6%u3c6##t=UCyjkl}!2WtZOS$yC#1kH$^e@&||=) z@AJgVG!t+qK6gCdkV3f^U@w_5(SA5Mb%|xIB^gT^;YaM>28%W~<`*iDSi3 zD9-;plONg!bl}m_KO?bw_D3&zhctTe+ji#h3~qZLTw7b^+%xU&MX_q(`U~HBUoZkD z89XGDZlk}BT^qLFZ8ve_!!bUnecD?K;7BSYeHR(mr((rD=e+!gl+lh1gQLE;+CO|y z3U=Jz;La!X8{P0nKQB>9Nqg{(#;ddAj6GFAyG?>*t*un`(oz;JCR%h*n*D?*d%TV>FElzp9 z9<;v{itaB2Jw<{Wc9Go)?ZsF4-ST8W|9~g8iIK2}|uoHp+`Y>hXE zy>eU{Ca1H~eyDs_6H9hKMW7)pB;-GE-&fMA2es_6lM#m+00y`z`|;Lh&$X{1fgl4j z=Km```yV*=zfs`fLfO1rTzz+=JW;Y7jGjE%xT`s3{u-jA^$OD{{n8PVv9P|@C_=7i zXLvDo5iR|9>OR-TcxKI~UuTdiZsQlMBv+*13IcKm!sz;?B!$JWz6$86tbOqD;3a4~ zAU~P?oSg6#Se0TXOR=8KOG`_$l}1oWj5;BJjAuMoZTfoH+|q)HO&WzINpCsmnEg@u zxF&bjJXrY=;gXKHh)tt&t>{g%dS`&(Y-F!XWPWD#^p(hsI!x&LbpYN!nWr(Ik1G~# zOcV((MwFcc)e@lH&PKZvfP@um-eAtKJ^y>X*d z+8sF!IBNTwQI`ILQTknTCXjjHjbLIZGpx%rbEctiEjeS>+pR>uPWycGcjNQ@0jtOP zCkEX{^o0hy{+@75Wj(#J@xa+!1h3t9*ZS)Sbk?|*0#(`dnlNxgMKWS(XE2anRs5YO zF`Ko{wJrPuNCHf?$pS%d{5S_g@?p7W$zjw(Bphnh9Y6A}8gSuT?45_Om+m-Zx3v+y z&$rUnLgM!7)weSA`UKFzC79l@c-c|#rmR@*hdG*K@h+L z?EC)Sj3PPJ3TZ<@Hx70HxgSI(>BFPsM5KS>`H7P7pl!n&%kGsZm4)9ynHLQZJk5+9 zn4Tnt^_8c@A9n`9Rek#XM*e_FyBZn}l}JfDH7K=@fV<({y>{9?=tuT)(Zob~wvLY@ zLMCmAxY20MsNihL;jS#eD_u)U8;(Bs@Kl;Fv!rKL`t$~jIER}jgz@aPKODEX?`DUx zm+^UBTesdUd+pQbC9HnGbkv$UE~2AauMA*2w|T<}k}~yEM-5KwG+n?eISe?r+Z__z zbu%Dz^)6CJ zOd4wg2`sB$;JGH#ffqqQXH@!QfY0l7&2ZeffhvDM5G9c=HHW?J5~5#3xLaj3aPhYtMnr}4XwL*$ zW;z80QO^fqDdN5M=%8meyijF)7OW~C!24D;R%ph@$Cr|q?*$Nq3_ft3H;~M5Fo_Xp z5ton%sSk;lHPi|Ipc28RMLqrjUk?sMl?>L{5X-Ku(5NYWJfJs_eW+<3&;E$7LHLh8 zWswC01iHXrkmGWSKc=ah)%@;2BE9?FR`S}JdnK@d`EOT)SO}s37n0lalIC?f2?<#I zSCgtzGR@QaCx;&rtFW8M4YVmBy;UC^lE`zcGpvIHEbNt)o{BW;^})GapdLYtriz%im1FXLwid>0lCh=ykO0_=sY1m+wQ}M z!=xMbJDz&u{-C0N^LKoe{hEmNN;@$owSt(7OPvgoPbDs)5j(8!PoguDKqx?Lps^#d z_?`;bfk>m1NG=j!(x$A`OUK8y={!!biHV6Uc*y2fR^8+IvS+w{XSiC;&b0IM^M)*V zm7Z6Yujc^vhmLXU$95wC>nCPD*XS|9z+4g{dG<*7-O*)}7$88k4Gkto^L4vNN4;Bv z$zux(k#$xxIb~%ipx4zv#BEPjg#lRPC}rTzZYw^xXabk$pdaPs3Jw`Z3k^`9&m);p z04yxwq^lh)C2MV+sw3~>j9s9NCGnF3xoZi^0Z zpdS^Acb$coO=IRgcNaVAA1x*CuSTxdWG3JP++9Fsg-bQ&?*pDdP=k?EQ&R{iU+GY|%kh^VLC=RrwLEg|;9 zgJ;GEPXcdZ6}XR9Te4PFQwCP9KiY}3*qQTiU!{ek>B5Vy{NL>Te<-p4Gq@0EQ~I6VEZRg5u&B!0UHN^Cb-?p zxK^(b-8I0H09e57w2cg)mJtgc)(k5ivR0cX$8b7N5CABNNsdZRi%1nSH%_g6;Uc*S ztJPJ@2fg=)TDg>fC29k%heIRj`9>wnUe@wAE_|412Fx#p0gZGF``X zM9)fjHkF>qN=)0v=(c7}kT0UlU*3A+zYxLnB^WY20^aqbQWta_(_tB98Q+?GbsGWrjqh8m5bjz6lY8&Pz0N{T7-FBXinp&{W z!?lsUJdTtn8Ct|V&`Bihr9{S*S!N5i2QKy;ru3>DXeXied|GwJ~_eIO;M$3 z&5i>Zg#tgg@texrTn=sCuc{4AiYcHBSWgyye}e*z(f=j=c(Tj$Jne)tVkcO;@^rY| zRR+*7#x9RS<+KZl`Rl7Q76^D2Z}yf3fkj0!oFx<^9skZ~x>Q?vrOle1Ah-VL%F`s` z3t--A301h*DJdz-!%AS*lM;}{)mV$L=u<5VuubSqxP5VzYx z8t!AiQpVuCs<11g9$Bpy8y!AD0p22z{xATnSSDzKHvQXz7<;hoNq3kT!>vC4d@B7A zHwR}1pPTJpekI`34!kant(?vmVNMwt2^JEH90z}>VkvD`rh$Y4wZod+#@T4W-j%;R zK5{>UdOx-eslguCuK{jGa5#7MH4BkO>^Q(lVO<}8)Q`gF)~@`pDfxt{@#|(P+qYEt znlWasgW-}N9m4{+86B`)y@(=Fhmobl#wG#tshQ4Jg<)FvrP@Y4>D9r#Aj2WPxlhin z)Z#=^V?^zOt!RKiL1`~08YJ+UV14(uH66!_iuz!bD9RASr%YM*{Xiv?Ri?ZBiIpoU z+m#-Z5u-OoI+;RBLOLiRtoGe98~Z(J{pW6#cqlVFgH2Ns-1))GI02^Nzq~Vy*<<`V zv)@4D!XWE}5T-ig>Y=!SdD@Eqp#PC@P8eiXNXb)(DeW|m4ohZaDsK%xf4^sv04{v>n49VN!FY9+vdoMBMBE$IcOct?GSL?ccxhmSZv$EKJ z1Ty~mJ5rL^S<5!Fhq?jS!$ag;Gy--X_a9OXDk1sOK5_lf=St@ed@5_Jj!92>??VuK z{dW1XJ)C;N8Jaz z_R&P$1CGlehMptL=0i zQG~!!G~NkQe=HThe}O}tkNM}0^5=QyKXY?$4~QGGEp`x*sdhq)$Ei%`a8epzW%S;o zF?F3?&BYE>Y`yo%($U+4FP~2`!pM80Kt4+IqF*{tz4?Znz2IR1d4=h1?P4|f!_P{a zsP;~Sf2jM3C^|y}TU&TH0H6; zeG?^-;twnWT^y9Xj2qi-NUOB2voGl-cQ9HGpBOWh_NVDHC0Be)r(swKa1A>HV>uT} zS(s+GTWpmZV$=pu($_a%NSgfe%5v zaVz}e#FbhE<1M$hw3~fG5{d=1^oSD_l@2W$RWkdnkeybC;NjfoRBMl2Hw*P-(+V^? z47emylQuVjz|^?u#B0K8o1hfdEeFq;KBA&FqF0uzN!tZo% zFGXUf1j+Zep3YM|%`L$mKs{95rnvKa1q`jfEbJ^m<_}`?^`5)vpiCE>T#>fe_}2R5 zcP99X9YSBNzQv*BvJpho;9ffxm$IXn#3&WeChMz%l$@T1w$()|6~EUvK&~(pa)l*U zH2i)u`;MFRVhJ2LkYginKa6mx>#1`CHBm@QWMD3LVRS*#z5aw2ya=8ep|pn{-m3r~ z_+Z*;z$SlQNOd(9--?%-sBM$q;)k%A?q6M0D{toinV}$ud(+0Hw-tlfapo!?N`cZ8 zxdYzAd0D(lPU6rXDXOZgDwJjacq=p5bc%g89@~ParGvQvC2{7lI1ks;QBS&ne`~cY z6t-CfMzMcgm3JxYKi+UW6Pf_4xgafe+Y0tU$E({Dvvb=}_0GE(qtxGB^~9x{#|$%1 z+(JJ;HE*PY>Z9zp=uP zN!|_+{iA@0fp&wpFY-d@*;N9kqEHA|==rL%c>W81&bZTn(#A<@AG4C_{+9(FxQRmH zhpVqRIu&Ws$>z@HqC@kP+|}0*eir)yb&~!+c4R-6!6PG|N3>1-fDrAkl=jq5c|{-3 zGsMhM{hye2Uu|p){rsgr9viQIDrp~iew^~>Waq)9bn|7x*?8+2NC(SGWB_bs(+MK& z5%o3xknb_)@(R|=(~-+IX=|4+V|gxKP5Rb4r_iSnTr_JTNy3!Wo!n6~R&;hB4?Gf# z&EtM^oW9R`>czW=tBd8mYFprh^ITs)yB!fe z;k3R+vp!RYx)vg*YGL1Ga?L5;&MP%W-@2Wz|1D8@o#XO?;gC>1;GxD(92xM$Q8bqo zEkmo_SLs8RL{KVUflP`|#NJql!eN#Bw(|}qpdW6xw|Zino2Udw(Oc~1I z`@Vx>0-e-w;Ayj)Tg`{_kaJ=0-F>Ur;UI;fuSL#FMO&zn_b=_YuC0f-7_36DI`bcc z-@v4fJ0``qO1vt~&%>}WXm4bZTt-TX3B(4eWj%?rk=D1-S6;9h5Gfi~9hQ)^Z#YB@ zenmU%UpEOb%eH8W44@21GXq``w;L}Mmul}u{K5=Q(1R{x_*qzU#wVddftORfu2p&!I3{iTzo%tizs4*xm=(r%kDsc*%GKv->9sxu%j z{9-MnVUlIt`Q-};)>h?OzP5m;MgEiM!?h@kn*G=mSvu6m zHff9fBFwk1oVmQq>{6p9FE&<}>s`QVZawhl{2ILex2NX$bs8RvPEbU(eFnn$1R|Opb9FI=VT+akQOU9 z&76^l5t!c(C;<;Hnwb}mrUlPzeKlv}6jng))py#l_{(>C4o=U|c}FNk6|Wl@(&s$q zl(c%J_8X2BOGIOzoFYPX_UTvAIkEng7qK$?e~aXS!>e01to#0vc!e#&gNYG^+d4Bg zddd;|x{?1*IFkqi{EqQ^G?70z6O_nBcy&_$IfsASZvU3kCU^ULAtWw3APmSHXX&hSL^#Zh zLw(JudrUjM95>3b2HD?lgu;gWe355O0p0O?u!Ai$jc5StY?pN&4 zM(;^FDQ6krXCHr|6MW^09vF)~lx$eF;%G+Z;MDh{AW*>cJ-gqyeKzPj*S%qEt)+t^ zCg-Y?)F>AlKo9zz!a0c}#hiQhF=~4j$Xw^l{^0{vO$|Ta;9i2jT+XC)B3_h~(W|nd zlV~)!{FB{qIT9Rsfy|=T{-v@y&zewlEBb@>cny??M>UD-=t(=L>*24UPBNVpQXTg@ zRvJ`~7DU!i(h?b-_vNz!vvFpzHq>>c_Hx2Uq$*7`**ooT?0(fLgUw1FeG-e2x756Q4AFametDpvNUh}Os2>~5%(P`lXH_>{ zL*2|j?*2BRGS>u^LhWaJL$S?)eVgP`+7~(UU~3p-jWb$BptVH)0ltjZ%azPdpG!Y+ zo`E|+yp6+Mh)6Zi~#ut58xm5~GLC;4jER3S_ z?Vu6^>+`Eo{?JM^*;Dh{KbTjkC8g9c9P3R9#3z&ZTDR-`n-;`A*u{EN7le^wj}H_% zR?>%1#RbD)k-ffBC`CoLbpjpYT`GjY>1Dacqh8_%okSLXA*jM$S3b1@X!+eHh*jB? zC38=tQ=<9MuN8n0p zMFMYf8V1c(?bzRJADO{hSs&2{iMb3iN$iM8e0C{UHZcBChZ$zz8|_5w*?~_iuX?8F z!;g=8D3LZ{?6tUdhrsF}Gf8#t_C=DXyKt7Y7E+*%VG?$mKqZ<_4hWQFxBhXKD*2V8 z4;V^yujc+ua#vm7cJ9?<^zQ38lGpDCMk&)^()FvEm1N%YL-4n~p{1oC8;=W6FCO2y z@Q=pP-eX0jr9T@eSxTWkDzOMD4c@0Wm3i=57lTzRDKV1mBP03a_Gyf zc0|$W;8wJ5Ku|ge7yoNK#?m)*hdSrA^%aZeZQF6iQ|>l_u*O58KMpH+I1O6jhV4$T z6d!@{G}q&!67#;*ZFWYWkI8@KR?jf6QDY!PCdtCi0bs~zaG>%n@z`#k$RWw$>ryri z^JBn3sUdy2?RP&DuVec%vfCCjR%iJ~-hFlMj9*`u8;WkDP_m8{<3WenC@~2_O)M`5 zCcnC36dxHjp&mKEj6to%M2|E5(}Rm9C4D)b#D)V^AiwL@1|F33%#DoH9;w~_Ph{t> z-y!HsXkE`*N-kI;Ox_aE17!&?uv1f8QO^9`J!%08*_hY`aj0+OLb&#*Q50*!-?qPT z%Eh%i071j@mCht#{#JO7xNBTRycK3seym+#iD} z(T>nuTP&(43}{3Fl1G%g!nuwr#envjUqFcGwU`3Xu__ekB)Pg(I)pWr4+CAGDrM2h z8m;|Znnd<$VDh&GwCECR(||e(dY~l38Yo(6j2;X*ek}d*$`r{dK$Y+x;nNGU1f==R@s%#5uRi4U`TXk0Q)eqc{?@+bpDCBl5Mb*ox6F+^>f3 zjl#2>W@ZnYQAt9zG6utLAMM`fC5o%&bJ1@f-&wcN8A5_oVWzd4SDn8c4*MW3or`4| z#FURFE*6fWAVuUEcFhm;j6;42tvOcR9j+BdTu`e*#mN`_yW*j>pZBnTDp)`drxb|q zm9Dv~SBT@yHHFWYL(VzKnHRZZ!N9;^OuwVZG1@AZ&=4GDfJcYMwf_E-em!A-aEW34 zdOc=2w?Xcor3}Aa_=z;TZlg`Q>L=yREiDQ5%)`RU^?(urwh1HHp3F3FBiw8Da6OhP zO--y+H@O=Ms4K+$nNt_kUzu*UMVjWa7A;KloDEWGHcCv)vL%|%U8aL#H?$23{p$Yt z-w_XbyjsV4Cdv=F-#s=IWEoy{#)RO(U|_)f%G#5_d;9ixNid2=3JNS<5?>s~B;_Bm zkck;D_LQ<;=BPf~h(J|=(;TQo+h_D!qk>y|<6(* zKb6I0Uk%X0`>HJHGt<~GYD|TMJnN_{Z!cwU#}YhlZzj%aOX~IVO!x2gGeYOAKIZll zN%v2*+u*bXx6isVtHiW9$s;=esa+`?J(7E6_vzA!)Itk4NblmMky6>z`NRc=ybs}&d+}Zwlnfl57 z{DC~joko$1`kGxQp&%`?mZ4}X7Gbnb!L3j*KfR+YrLb6ap<{sEJuebEDcR`^v;Xs- z`x%4m_YP60+AG^F4 zYMkg&(qDyKa|*d52t{Z>3KDCXT_+S`1EF!E4#;gGUU`#0GB)+=O|;_fP@!iRhaVUQ zszQ@u6J-WEkM0^Wc%f<(8rK>0VoH$=e8Ra77f#crgNz1!Cp^*ZW*gSJG!3FZd=jHu zPqkI(R&#c=R2>#y?D(kTprBgFzLYtS<(-G*1FPa<-8*7Ngf82Rdlv7}9#fNvmf-QS zZSW$Ul#aTw!?|kqgnJfk^8Qpcf82^bbI=y-U99#v0*Rw~OFiRQFwZQ>S4uA|h*U)&1fHnreBamLzy% z=p_hfIW5z%CGLa||MZ4!NjJ|leBKX|M!uo&5`XVA-nViQeAj(s;HBi8l9aG>TgYH6 z!&_{S{_Hg?ELJqxS|RR(BMq+gn1^YY)JX>xpI;@^Nz?k%p!`>!Bu;gcm}CT1Qg2ey zOa&>EW+eGmxkh%&UV)|bkmB9V$%6FAM!&lH5Kei$QD?7+tS^F*1#91C^Sqj2Y-9um zCkxL8pCfPaHDCq?3k|wrd_ihA20eUFOShqLQv^qyq12N}WmpZkevd)a%1?<*w)62uy355J{IJ}tA2M>aCwOz zAeJ;h@VkV!lJw%V!^;zt4)#JD24_JUuS0D=%I(O98iFFsbUxu&4?{LT^T=t4CGQ?@zc*hpY&DIDL`~ajL@My zRDE1hgCl2O<^M9$HUDFcttYd*6pL>wi)9MKU7xVWAR;5ISEvn*UQ-@wTOi2q0~L=fl0Un`0{pAhyqx#?NW+?M&p8OFzE7W~AY;{?IJD$EXyS zgkg~kK0l{Pyl3~lp1G)WkK$=JYv2ZyA^+uJMHUy*Tc@(>I*fAk zRcc%gA>+9DeH9d>3ETe=LqPDIcs%;ixUr|Di7jrI?QX01rE}o0{y3JdZFQ_U`ty?eWoaG4hPX^ROZBT>cmD#F z%s_)^GwICCrc|M%k`y`Zg&eM}nihuMg1`5@THj+3;;79KsC1RJd4n<5$Pt`JPv1+x zNw$Rj_ul6KTMvPo5iw&m5eNxP8P|dTRM7GIe*sEa2$5MB+$boE8dAcM3oA6OmE>P{ ze`V?voJnVJU_SiY)1tq3K3BGJ2F%sndOaK{a@}K4G>+;MS>j-L`ByK@Q z=!7<)*Cq$%gU{bJ($g765Y%|42|uVu5r5GCRdxUJp8L9$7b0M4v1oY|WuZJQ4&WZ& z5Ynu$T1)&TGPvW9@r-_g%k#Bal9vfr-Ww3tCZzi0w%qwC08GkmvBPUlZH&hflZoug zQ_{{GsH`-$Xy85lCI4I&ZRF(^pwoUttIeG+>R!j#OJ9)5RA@p;G2X>x+l>gmDTBAL zmccC@c4_ZdV$5gRw3CqiVyC@YrHUkjLa3zoojR$o#c-(-i%HlYDAi@Sa8$z$PAZ2w z!QW+vFsBvQs3Y{iW^w=*`4982wCoOnta&pL5IK)uC9C`RjvYNgJa)`_nLQL?@yZX^ zD3NRKZUGNi&F^huT`hiU;o_}+*G&F#^IMhSmD)+nn|ruHptJzcpdocp+*rZ|?K$RMz()}>I?)!qzmLgMdiAvV!s#Fk zutuA6H%Rl8_g=HhdaC^9Eg{C4)do9a#a*4?XHDFYqCLJfyRi z(eL{AtWk6To)ORpu=yh*j%uc48rvY;-GmEEKH5QeZDen`_#zjpoXpuM~ba+%+hU!GQd3 zvC>vLFvZ6?zqQx~<8x6|7)$(szIaXsVR`ldDqU`@?}+osJ*w`Y|9Bm>QVgNdL)J}E zsXOI3bqPn;H#XoY>fQS&-jov>-d_?rLxJ_;l}?H8x(Jn7WErqmI1pe~?%u$ONQ%C! zz0qwv!T*T-`cwPW#Fa1b|Fii zH8|4(eUOB?-Xc|3n_qc|metjIt(xc(9@fXZ;*~ss$;oJ#vp^_8P++Bw>zFQTY2|+Q zU$W|W;yjk$UwE$XnWk9;gK&fw78K3ZMz=mymML)vxH*(h70RVhN?5wxvi1sfAF z%BZ4Cd@Qine~c7~k+gZ)-x*rb7-fZa;PF6p|~J|ZwtsK*#xrF|Ka=w zj^ekf+&=TE52wBKKob)#PW@st%bur-l(%RW&%eNT`x@ZX19(Gm#}smBg_XzSkSJ)M z{sR7($IKn~0uVCx3|25f0X1^O1XoozZ+>ZM^NUnJL)u#rTF!hcj3e(pY?F7dZoTpM zI1*ltEMPar1$c!zvBVccW(4}{X^~_TAtGBKf`jFR@hr4+uCqX?BWBjDs62c12?JKs z4t41Lv1d351d}%h<->vG=N)mXHDP_gI%>tfng zn*?RlCh!mFr+3NN_ztPWbW97+A*YCkr3jJqnXU)l;lQuZdK=Pli%e-1Mp8NCkShA~`JMYsH($+F4Kmlj7J zIe}X+|4f;|wZiHqyYuJO3m&_!a1{)FlUr0+DCz!xv~uRrY-W8N4{9mX(yFGNR@3Tq z3sXxosHIC{Uxtb`O=>GeO0`X>T3f^#bg?EHl!Q?0q|qQ4MNvu=lWGKwj##R-6U+NJ z?>Y0=`~Ek7-h0n;fA{yCd(XMc=lcclu-Ll6?Hd4Py+r|V(cSk}T^qshH@CCl)b5FG z{whrF;7!>vQfc@xXYZ=BGfb{ZlSe|Ozd@C4!C2(xjlZhBk}3gOGrz9xx^D0{a^OT~ z`jfp$ZD~MXlDwMd5%4)r7`lL85#qXZ7;ZB}q#8DH#1*Y1EguX~6)ApHY(}@^%`(NfqOKL1Hrl{W z%?~l15P#O_*wik@9M1$5G@G!%>tZ)sU^H437PTfMd`h}3n`9aeWyw|^=<53@J|leX z?u1b}!pw8&{oa%dDDR_JAF_Uxwx#$+TW(?0n5$LVT{ib)QAWQB9Tg)Lj|-Ut6W?L>nDFf9%{r zM*fl!j7l8$nwi5+wk0dl_(OZJ>lmVVfNnB7?0*%g9+?9nk`-?#fj<Dj4mL{H1L+psBI)jX0+QiB2ia5Q25e=)& z%pF^pDCZki#(o8^5Vq7);JqUw0k>e*9ysg9IaPp7t`~rP{d8jeRje@JtO$ANoK*Z> zdV@QKu3l@n{ln;C#Uu3lIb9h;8x*w%sSmEk7A#+iH=C_1u)a{NZRlEXa$jzm##-j;~U_HjL6#1S+i2DZtoJOk|kCOWyew-9x z6QsY(sJMEr3sSuc{O(*K3l(^fSC_gaMm%ptc3DR{m4dH zfgblfgW+$mq`N%)5D}+qq^UrosV1@tq-5tL0#(za*)oL{W6wIp|Fc)+d+c+kqh z0BP^^3}{wU<8;kkcCqk4W7}PIEw|Q38G3?*Q=j%M9V|nxpC;6PBTQKc zIzoS^imP?ouc8;0S5#iALP*!4wwd4u(vPee`G@|SyI)<|WQ?4Pb2<7(d}aAexWegG zzVukq)h}zvml}qAj;`lkK)?_Rq~t#SHerW6_h<6jVk|WQR2V41?d^=CM7g{tZDb6m<< zt$IZ*%f5#~Kt^phHs}vpljK@-x5y*L!F7nYN?BEkVV2ag>`I!fJg)1Vqtqcyq$2@p z`CVyLHQrW4BQNkytT@NVgfQiQT=91X)&xz!i9xxgGMD52t+m!nMX&S zfrCL2!tH%Bx|d&=NrIwI#+(O%QWSu8UHGIpXjCR&?q8`S+tc42%5E#wSDg}iP|Jn% zi?|I|Tu&gIXfp;tnU!#c~D3$32Q5fnEJ+RD5$ z(?Lz#C<>r2FI)WlA@QDp<1GfHamX&A268|N_+?}n+ys-bp(<&<{deMT#7-!KFWYvd zUzBfPK2KoDUGSeD%xSH8@%-F!mj#n@c32?#;YP3Ustj$>j~%$!@MeaE2H!FU(t4wm zit<(t_oLLGxj9lw35^DZl`AE^kRC?eh#v@7%W7?!L!AY12&Pu}o~7wDWlAGtH79``lg ztxz%?XPB3g2l~U5pu)NK06dbJIhOoCXJzeZkyw*^bn}&G9Ri+bZR(f}qUirlpKbA= X>sYQ>;_N11dIvH${@th??)LaU$q8x| literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-on.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-on.png new file mode 100644 index 0000000000000000000000000000000000000000..7441a54834d3046029430274272b8605be4f1ad8 GIT binary patch literal 23229 zcmb@u2UL^mwl0jI6zL!(bVBctgeC!$D!nO1I)u)migXY`YUmx2jwm2?A<}yYT|fnt z9;(uN=YF`>KKq>gpZ)*;z4v4c7z2`gneY7OobU5IbH0hv)>J0GOLrFw3yWCgk%BH3 z7LF|z)~#%OY~Z&l=RF7DiCdn!%5qp0!wl=dAGhruYCOcks*WeTu)G8OP2l#($P){T zr0eGAR4*z+UZz*FB?JLOpryQ!{e9MxuMMj?{#y;=Tie}z zk>%)?wu?idKu)`rDVeK_k?Vlll6QJ@dMC{MH+Ob+V#Q}q=0iz2zhc8o*8MIIC&*_5 z_J_1&FApw{=gglm?Y`L#;3}-jd`y$R9ejOG-dtH9dj5%Vx_7f`RAy^)Q$rWi5sH`m z=lt*+spMxol2g9TUcbJv3mhe0GCqfXX*F;0J4D6On-n&CZ<`&vCGND&l5Am~Pj<@4 z1YMkbsGrTE8`+=r-_{s=883U~lk^c!k6HYD05Kle9C&`jF5q*rv%t>SmUMo+T^qmO zV$JUt&Jy+>Q#;}^+Z+|h{1T++$(WO*X@yx=-%p(nY+)3e>78!A+{gowtlOaWe_J{) z9&uU23i#x2 z*SInN_HfRRUMeBcXUhfyE;Ef@+q2SPXNr)J*kLyR`nI-Q(>SEta(`-Z+n?T&yMMdX zo>}(l1oNZb_1JukF6f-EO)PDW`1ND0;5nj@Uqi3O$geeKiX zAQ^}B#4jPlX`kdYD>CBc;(sg=`*}(;pL3VF|7H5ews`Z4m3XdoNcE^p>*Z$rN^V!c zc2}C#$0T!g%ocaR5I43oK5q(y5ufHk?Dg`Bi7$gn#Bb5u5()&d6|rs zQe;d*GGXXC8B^LLd}yN;&S^G_*gh$(BR_V_ZS9sr^=1T+09}8^m%G+Gu8+Cbu0eq}>S5K7oI$RK9bx>v8pR>c#Ql&1z3=qet5IKLxQ0&Bg4+ zM&y207$#W0e?21uYxpH1zw&fQ@fy1Kf%@R6vR*>j`5I0le#Oyo?kA;wzIOh}uDj*O zjo1DTuD{ZEw#DE3WL-*V3yAZE$u`B0lE03tC*;r1&riJ`Jr|=ZE1nm0zR4WtKjTk1 zMAq8a)3#IBmJHg!b8W%Q=NBVK3*PN}0}h8x2o50*T$^vbD{Yk+cy063=a=x|+z&H| z@4a1JU0>&*%~WEN5)9QU_YJb=;VWAebL0ZyD_F-CZ+MQ}g9umkU-dJ67EQb*OC&^$ zeJnLGJ>T#Plr)=;tc3ov&?F*E zy(58Jp2^RMa)ZuzWaZ^rLl^5N%+7%dcXV{rda*22c>2?z?Wyad*6XWtbb?T2N3;J{R%V(>TVnH;^< zK}ZQguizNx;j~&d<%E0a7?R%IPl)z1S~0$wNRy`*I!b@Jh)H>h6&_b3&%oGw)h2ee zB71t-=t9Dz59ee{^g{OTK0D|#i2r%U7ku4?2A53@yN9(MYF*nfcKi8|Eh`vG^^+{P zr!aP6xTU&%7)VJ;_tk2yMs$2nk-Z|wrc-)iKY_a%}R9{K2D6y=y~D&AKkF9?#}SK}jpEno0~R$~DFHSc*W8?B0Z zpM3ieAYj0#@3$}R@bfXT-5r0Xg96#D$X?s4#kk8c%w&nwmRbje9XDo6)r`BQqXT?N_C(~Vwy!EBmK{LZTq;Q`5$!oqW``g1z^OTPx@ zfm=$h5Kx`=*9yPIVWL`>mX0=ml(l6zZEf0~hlUDm{RsZJSFB&|k`&h=6ebzB$a^-a9{NA_09>tj@DITp^ePfF~% zY9%syJkuB=U<%xlrtBC)4p7L z&iJ1Nn?+nx>*3;@^j#-K$%h|bqbaz0V^ck&r~b~lt9sfgDtJr{pAWT-fy9*2#aMdl z!OV8hF-_0{jSK*40>XSSDB`8#xnNmb*Va?c3GrDU%(#}U;&m7E)y|CfTn`0tr&DE1 zS_n);zUvU!f$Y94U>}f;_(X!_*W{vXHiDN8g6=#V7M;7kI_6sE!5CdkugZw449o|( zEhF4yz-~Db3=CQ37d__XT7&ilVX%d@$d+APWigz@!d@Jp)@9CSSnjK}9jL8&b`OxE zs^cjow~2b)mCXyK|42_@l#cNr*yZo9m^Vr>?WpB$dTFQg{LVCeoqxorqMs;4@~r$_m%>4EgmV80&PW$FHjr; zH11k^x;4x;d6U{)d0G!@%lPgseXny;i*McFR34cIE%3x^M{vr$5kOD;a)bPI>m~v# z6BLIaqlu6oD%aPCV=@%qm1Wa>+;L9abeaCt!PDS>ET|k7mLf0AkdCOiAJhC6dKc5- z>?SuXZ*li_mKQZB$DietioSUvyP7+hXEeQKL&jJl25kIaRt5Y=t<8Q#A=}=kRl3CR z?2S}OjNMg>7+-6aouWaacDmB1wDTBO>(_MYp_|!?6?GW6iZi%`wW`GTJDL5;{9d_r z+nH4CnyG|DL2J7MNf6fRq;~}Jz6<`sXsVE9|9)(+g~X5s3CKB!y7qQ9^v)1Je1TPn zD1F`tPCT{y{hPB@if`-wpQ*P@;e3+PqeO^%6Yy8~lcXbo(pp{PMjE%nm6_h{_lkP5 z$}g%c-PtGEjo|i_j{AO_TMe-S7K4S3kl5D6riY~)2$_9s3gBb#mNI>GF{SwY6^GsK zXrXfQGu#y+vu0t9Bs3&#wTF^X*^$mn^@YL0DWQ9*ydRrIRU;}%Z6K-kQ@w?w^MleL zO?nU6nDabNGmvr7F^YN$sVA=Cu{9wLGIkOF}N~YjV=1V5i;4|hc*`Xda}N%_26)2d4{Jp; zI%_ikZcD6Rf4v4^adZ7H{fcYwc_IGX`HmgALZ=V)zOuX4ZM#G#S;U;riAvzXUaITm zZ4FUhi_nM2Rm91cgn@4ApFIow9w!p&I$+ObAH{Y~KO(prWPU{OuW~RsY&6KX4LZG$ zDr>zi(n>7YFZ%NC9#M%WSSW5YyXULyJw48qbyBt9`+Xzg4802qZ)=M9NMT)-2DU#Z z6~;61P??;xOv|;n6n5D1<2al}vne#))WcS?(udQYR(s<_BhvkTf`uD)A`r2YeD5IY z1`mmymJmfS{VcHfXtuYL;BhSRpYE*bpi?BQd$2c$WM?3#6Q2($I z_)qKMH)C=pnE+bW>DEC1q_kat%_)BJ-M0;+>BscOZ_l;KipH&C;$?G+K;;$scd4#H z>pEW7=?MbaiaEAo?pORC)H-|jJibrvF4z~Wt`AaXud?8(de=4Fb7npjhgXL27882lf8M8h_8Bc_M-?DengZ1-4%0o>{)Hjt*rcADKS-btNFi)bzXij;Sio9IK z!8oay{U3P+oAddVglYGum%1_RznFnC2CyU5#)d>7!kNwZJ=Oz|k0hx4`OnJy9Ja%s?TVS;(h|XI@-uVa_23twIyWi49e7fEp_8_-P14t3OK4YZ_i&gv-u}}!0zyeoNfpVs zb;V@)a0b>0qRY{$lDv|1ycUsm)}e!b-(J7JH^zU&-Nxl|Wv~Ni$Q%3=T2(;l+8zdF=aIz8A>? z@B#CJ)ZD2i><#59P2$%jKIjPgm`1^D(@nz`uJ-gcg|Y{p19=jE()=fI@Y#BasS0Q8 z9`iLO_yR9@2M^s>$|`oCG}2iW?_p0e95IV6-SX@fHi{dHz^_Z$8ECs0h#A#`TQWTe ze{fL(vQAV}bP2H<%Sq59%?>T=kMFG>)f%@OjHe;+m}8GZt058}=ZZLJJ!1ZJU-C?* zFcKYkv%u~_ZZO2k_8vJ%1R5QQ%m67WC=DXPV74-db&#w5@Ryb+H!=Z$2HsbTyuKZ} z3cvxDa#1ECS_u{CN`=|ykCA9T%LoXDUD^gH#XIZ4s*(~C4=jEHMS#TwU>4|t8+Q;I1-F_jo3p-P&S}5W+jHk@N$~QYfengi|w^+-Y`H}LuO)uoD`s({!t3{|<|)$<15ea;Cgt?rfX zukBO0<)7=_yQCQ;X5PW`g*Mj{3_3|{l=gIVb>B?%^EBXjP+Q{`hb-8t2?h1b2dubk zdnB^zD9L15KXkbNHI+5<-PYHj0b+3qQ;}b&x&U1jqp^*cpG=?h$2yQsDTxD61stNv zcf7}=YCcg_2Va{$GxnH!z<&e2B2@qp}WDC(j-2efy2dK5e9RFvG@& zXr(0+o6Ce!{*OnvX%8de2Xgumkh4~$2H_2pA$%{h{9${9CbXA4e=b(?y$$uxW-x*U zl9PBIsEhDv^Y!SZptUAHBYps7v3q0{$)R(|@g-Kl09iZPae|)dWTmSxrBpQ^Zh9!W z@Lilz8$#`9@$F^KBn1_CL+|mz1$pB2OfT0-1%@vAt0Pebn!gC#sE{4W9J4US*h7=$$L>8C)-H zb7l-Nx1IOps)s5neC)3Hg5>Ity1`Sky}<`|ZM!G&s!-odcOd0j?&ujSAaH<%U7uZ_ zOe7zqG}szHjx#<#S(>|^g4sSy30~N~aB~#*lN+21j6*5#fXj^ZpjXqCSHtYmLauMR zs}`*3_NVN`uSenwe6R7YU35jcX}Q+d>#f;kzvWKSkQ?=r1Y++Ww|Zwh(me3VKYgko z$fca={vQSK-`0nl#U?(~{)vGm# zcS(KbMbI$zaSevsoZeVpBCM?)KwOw9bzWwR_7>(HBs4MRh^fEEYB8AFAY4OLrp znU~XFQ$c)s-B{9D+!4moro|h5_?c#n{lA9aT8Pt=*yNN8~v)Kq*}pS`Hn^hK+X zz!8DJ_VArV!WY~Bx))#o;pr@QN?r*ns-Pe!NN2(bl1-GoBy%;CGNsSr5*?wsBK za~JuKl=$an<8cMSaJD_)$_=7QtgYgOCWWR!yj)WOps6`_-%J||4DN|?LeZpTkdTnL z2s}zI*ajG8VgzWMpF^GrP{Nk_l4~LkzReAUUpz5HZqK&RYy9k|`ICWMass$1430_^ z9H(1A(*QkaNI*h?g{yB>?6e%u#T={5wk z@=Iel5K30zyO|3*;XV}=Kc(qTzZruvBtlpQk{Uj5)GQ*woYJ;vB*^< zME8o4hhJurUi&-*3A4$8M+yo;XxZ4EBU_2`4hD5`b(C;M4=VVf`NOYVK&pDUCbbm` zk7~Dt^AwUfJ)Bj;VapUX@}g{bFuZgpmyE{5Pl7IA*8^}&8$7WBVP1=c3z`)_2o{OM zf8Z>BoFlM78ud}BWRV%%!M)Ycc=l`^TzWhAm#$j-rxo5?^o#2vEXVeE`RFfwE(r}3 z?Ew-pgjsc86GB48^&dkN;xw|Cq9U)Ky5^OgBg36IV;Lf$`Dr$zLoB#~lm&eXqsLE< z6I5k$6$MGJU;>pHInNcJ-~L?>O9wx-wOy}`7QPp8ijFjS{A~hxdfjt*z1o6*MlXG7 z%2h$WvMn9h?DJ!Hp(_G^re^7CmQtp0&|m#4JqN@u?A4}c#S0$$Z|%ShkFYUDIMuaACC=kr#-EK$vLcL(xS4NupVM)TmWy=a^4>yWiW5(5%N|apqiG{L| zKt~2v#LsR$zc2|T=fvcf5%iQe_iOwFL96-ihY3~ZhA$P`B`4O{giwsc2xc-z{98)| z;7&t1ekdC*jM6T?K`hOQb2)37O@7cmO-YdH7u5P{A97IXJb7QTTyfZB29*HKlAm%- zD!e#2AimOGt>eSUPHc&xyjH&m7+8CHztV;9?klZ)cWv8hTWYknPSbHuQhbQ?R5T(v zmjh2cXYD5N$Q8djrxLCRAv^aNezvXw7xiC5T^gYqGYV`~gc%zbKY#}nK=cja^1hJ| z%?)5wmfLjLxPF+@Mu?iZElhgl0Og7Mjr!}J8XFDOoLx%#!?6UkZ^yrbdH)gnXc8M# zOXcPKrfV=vG)JrrsMcuTBEFOrzPYnLK>xI^2))|hhR5vy1w1?#ZL*ryfDN^p{v!`2 zp%Uh^^0X^c+FdEriNFMU4%B-#LZPnk%zwtE|1@~^ zpfWNN-t%8qRz8AkJAK`DTF88w3sYF4sOE$wQMUp5yjCpb-qrcG=OrN71Dzn#Fq75h zT@-!tpGjR^@+R(^yPpU7d)>45*KWE)MGa}iK|mi~zJbEo+m z0N-CqFq}la07!luP66v`=4Y?WPwwc_Ch&i1-5-{UiZ=^GkkzQCAnrS_VZ-y(w_+$3 zhQ#NPm%j)hyhBvO<3I~-kI!WE^U_@rc_UAoM{+$^5waHx-ficmjTNR%X^$wda4@_? zw^-b4j{9XvoOH=038(dvpLx(Wi3xN9AD#gUS$I&F@ls@+Q}Pv`3bel;QpA*Ee)-d& z0sE{J2EEPdmxiZ9GSsj?+vN8AHe{TGjgmcWRGC&T7Q&Om5S?97cuQ;CNn;Hy_{Kx(N=MM7U(UqH*B{KFS zfo|%^G2sl*fYSXVG+^R0z&OU?amMv7(mp#Dj{K8zbLMmewzOKYcRXVwvz_9GkSe;K zZ@2ykUF|yR#Syd28AwaY&`Jcw8<%J5EOqV|KxU%yo@STy0Nh%q?iThCBA3sgA}?xJ zCujBt+j24CrPZ_!g+lxYEU{31zb~1~kcokzD5?w=G5BdG@b=!=BWnFz5wc5Q|19V* zhEcJay6aZmhKbVH@C-$-0y`TFLrjm@7=M*yOP!S9m=funZVhD^IHMpxnEu;#SI{y98~Ga*Wj$9fKG?ezpVEMu8YIt@k$6L*=Ozq|Y) zvLpHtuXP%yi+onh)oOc^MH*d-eESA^K<{%xI-lfX$YYrzQ}QWlHJ2ITnM5dHpWONv zN-}MgT~B*N5)DsY4JkWO7B~5dDeJN&tPgoX_T35gPQ9OhS06DS{m8N6%%L&e>vJeU zag_EGx3#0e*UYncjT$3G;2K4g@$r)m4NWjxTS6f3HcR^s)Vc9fk_4?H?z-v4ZH*eX zC&aRT2DnILrDeN61~bTo4YNRO3_T(-VN>oe`A|xfuIy(^<$KzBeP7lWm2GctP^#a_ zwMFg@rrN^oEDAn|Mx&pDTusTz{~cogm*4_;=E=905v0tTo9UXi!P_mzGG@XKT0HyfV zzX}A3p`Xed^Rw3HDEaJU7lZ#}2-%Q`tLbgfmfckCG4*}$6M<9?NK54NppVMrhrtXd z#-{0PhZWUf)w`H9`3m~V+%F8rib3ZR5cxcpL+*$!#`;Nw1-wupZaIO+>ILKs7IDHV zK4x{rcAe?hI%(o>;r`l*n_ezjm^+hC#>qHNzeYG`WNdo}4SHgIo?zlstd{$ho6YVn zY?&BBxQm#d4$9!@C@G_VCYjfF1QBz|e;X(L*_ecKaK7|y9C9S1$8N6L#CnP?k+93< z62>UGS{LUt?Bpl;rdr`0CFweGL*ZE_Zq_ai$Z$xzUO(K9`ax*&9_3h1f(PW7nL^2d zx3oiogcUN;?S|M*fm!F;--1?z))biXFB{n+jf#mv>8~Q`E9%jGXj%z1}3P{%l)}n1@s9?X`NU!9Fy=UN}RcjTWthy4Imf$uI zUY2V+QHAchJ7o?KussBKYo(~wDy0NEha*t-9z#!gt6)b59@D*Lt2BSH zjE}7>>|u~LxT7m~tS^@6&UD?CIXtR7<(fmppPv^cos!(hmA@F#C@@adKyj-(12m45 z5yRgP(*<~SiV^l;Iw@LYfDBtcbLTV5go()Tm{r2gncIV8t~+PZWL8>m8zLet*Qp0^ zM8z5_VSe8R0ZUA*(ZzwN5{?5<_u23oX$do7bQMNA#K>zlWkQWjyR1>J9D5dx1|I-B zPYZgvEt|-@lpg#kDYQAY?Q1SbO9KU{K=z#*6!$wv06{F^U`^+eW6VIUqGKM^fVoU!JYtXRgGDA#o2oys2DT{eq!0Clsh;XJPvM)AP;c@ z2!yKgC9jHUlkFclQ~>>}&J+pW@pObQ_i*%HbkZ3>Otqf(Sv@cqL0-~uR^3uM95jp) zO53GeJ?JdZQ$P@uIie6K-=OLH(uGf6(gzi%-JXD27k|tUDZ<5WNxg491qJZ_DLHv& zEoCM-+N4OB#WV4XE{+m&g1>DMjm-vm63BXlDv;mdxio~O1Oz2d3=z!~NnyAo}Tx%|1k^C07~5OVHn zEuM04CBE${cJ4K9Or&!>um$wrOa$F@E*!w0O&lAjuFkK2ky7;WFeMX`Ckj;aLN#?U zcZ&06&qj z((ZG2lpO(fMz-k|fAN=*XikRLpth4Cj#rbq%TuSG;z3fD&U+as{*zJWt3DGDz`BH0 z2wkM_O#K!Z4haSgS`U*|o(jY2(dHLT@sudec!$B4=GPx`hf^&bY>_5)MUiM-eL(XX zzL|uAU=N{Un?WD`f8%pIJi%L4h(rfl&73fN~17YVW0&8(b`WV=W{uU)$_+aj^wfF6kr_qT+Eo zD6Tc=(r=08A;h{OwJnKzd@z;&2pHL6(KZDe!~)Vo(mI({yLAqzZRe2LeQ0Nr2-R@p z>lx@C>~5^^JX$o9{860HeF5zETvK>S8A%-ZtIA1F`N>y!NHzRG^cpGTEd2e7PFR@BYbNv-I9YpMYfShiEFs?EOLfqN;u?_WpjSV*bnpHUGZA{Xtq*4~R9)hQU>3s1IoaXa*ss zeSp^76#8G4=&AfcLuU6Sy+nhPfzZqSwd65b)t}kB(CoA2d>GzO&!TpPuB}6@&HUgK zL9pj@Zm7rp>Q(ToOp!jPUzxj~kYZI}uN-dZFh(32ogE2$L|>>1u{2a)Fb|aJbXBQ# zknlss`doC-Uxk5a^?Q>X=!;2lxq2*w9PC}+FlKz^(3!B<#9ZM?D(WvfV0>`;wSWnp z)lF$-VrtSP0-?{4UJ7~eNE&?_H~LyQt}*wlhz}$-q0Z|eGMPGur)bd)3`;}-BihU+irQ~l$WT_zgm zlBC840?j~_jmvPT(zqU}u<6jG>pJ>ts*XdNQP@%kI#Y0hy;AT&yxk7vs&sQ!i>_E# zA#$Yk$bRj^JzSBk)B6=3id}`-@}#6=3@_hTvC71FJVAk1-@HL1F9nxLHZn!B8U@(g z?2cXwS6z0nfBD@;|&6o*o=xXzPG^c{-`nGj!s17mUTb7~Qx zNE2E?1Aq%m{ZqA_SocX z+TBcSZ{J0sQ$Yi?V^2_DQ_ng~LRQz6mg-p80SQL4zq(*FL8 z{E(%rpwbq}8U$&!Gb1OTi~_2DjoyEC<$t$z{;t0p3bue2XBqZd+%@Q8x0k%YsQ>c( zn9IT15pC?+LY1#~tNcYf#gDuA{tnJS>n5j&Mr-9e;Ot{Z0pBfs=Lw*tBd+p#7eL)A z_i=h9C0z>jyM=(-^B$C}E%CPD4-fDBrDq;*8x%d&M_Grk(^ykNMhVkET(XtMRtRCKPoF8xGF7YaTL`zj}B7Y zH!`qQepjcAo{T1TRN}_85?HoQCa_Awfu8DyJh+GuM14uQ8wxSjsg)03r5iK;wMZ8s zTKcgdBJ9@0T?q|t*BOZ~!#I``xa&O#0KSB_9147WkBnn))U-w-FMIF) z`|5IfHgT*%EZ@%&Irk*aBrkg|#3BQeL4&>EgXC81WTY#a(daF;Zz?+ zOX|rA4STeh-v~aimrrN4Zi3*%)6e=l$>zUQr&X)J-|tK#*SH9u@W9?p#njIZ66+WMw0#`>`T0IBlSW&W#96R@>Ejg5>6pe>Ghy+(3GZu#4paHkrvXn zn->>^T7+gHV~xCD&rXYtdJeto#t8(!;|A)i7xR4yd_9FDwrf6M@{Wsj z!iBk3yG8veh_(N=FteH3N|(@*il~TH06G>>q!3)OlTLvrE2vVCh%#67J%9Uh>1KucXmfAp)>n~7}r)}PZOFdz$HzqIwCEY|U4(i2JY*+S0o$c8!a16;6MENJ2< zF|3gFH4A%*0*=o+{?McaX(-B=0uP&|>d(O#vd|*du%(w7`Q;T4pr)XnI==HpRU^4( zf&1~?fpZmmWUL)nd@rB5e< z=s}+XQz)D;aC{zJ5L-;Mdb=y(r-rj=f>Taw`6EI0Ur;tl_wAl*McZMJTV$f=eR7Xi zjqgh{t?%lfSo+cKR0SiV^>_y%iJsRftJ>Zy-a(K~G9nVFfrH~uI_zb%V@GlS6 zDm*p``@VcW=CbW-l*7haqNDHMB!jbmxl4rdt}vI2&645gQMj@2M0oPR zOL16~l2|hjMv#Y>9a23A%qTEe_H{AQR;dWd=~8{($RDn}{76Lg`OZMO`sMZ9-1+n;SttrIbEHiMC^~f>Og#9Kf?!5h5s}`ajFUVH@J%{jr4&ZC# zGj{>NeQw)QbzH}+K4zC22%Htz&7f=QzM1D$p-7Cm(Pa=VH%!YRiE{tJTfzlE{{8~B zKEy6mMd1#x8>P6@S|e%Z4PUMid}2#~yeX35ivAP_R~jy=7l`>?CkbjM+&L(T&-6 zma$kT@Fd;kn<_S1I2116=K^*`fQhp^Esc)r>#8_5A~Ik3sT+R{gYa>Y$)<+8N%*j6 z9R_>{!QAgqslye_YoXEWW96*U^l3kSQUPK+7sR?omqjl@BZ)X!^k-HPj!lBec(Oqf zxtx+$gB_{^=T-_?;Hxj9yPpf?^cqAB;OU$li2JZn(o7MtL`8)1Wd2QG?60=XzW}fQ zMmtOVeFR9OAQE_>A^gDbh=KxwI1Rw`U~mntni4tiFzTXKMa^9d&D{*r94`w6`#QGW z%h&==0mTRS_?)2VT?2qI8i#_C^cC|nwcz(De6-=Yj0`uE^Zr`C$1~m~aW-TEV!)v7 zN=a_e{r6%k_Y&>yv&e;OeXp%P)%P|OD$^7$F>VDc&`hMM!(<@M?y4VOZU+ZD!nAYl zCqYw@l|_a`_qff^#?p1|w3Ax^js8X|PaMsY)j8b*tD?5ZLRQAkHjsL`&m;~P2?d75 zkX$`hPcFEYk*_(y;JufII> z>CIeB6_!C^c5km2az;yZ6@wT%0kJ-(Nw zs0RXayEP6t$U1x?2o-7fMKhFVoAu~@tQu-+Po#H9C0)S|{x()^;sK$>}y!vJl1}`}#JG#VQYu@!|0==P#Xf-@nw?e zCgBo2V}Ta{z4LeVZ&AB|z?0sOYaLBr%207m$RzD|FEmBwlbkPbX2kz^ODDVl&@+@k zCT&5C#4Tu0hR&zrUpqU(X=G~6Jye?ZW(^+2&bsX)@S%J}x1{B~SQq9)KO}o;-)4F& zhB)mrpTr)&y^r{*a zwa;gQ@I#G+)o3&tcXB^;QK4F5ET}`{UY4jNtPgpnRDl!|)~(EJdo7g~J_soTwIsb7 z5r8YS-}2VzZskFS&I9$$k|Nbd0!e%C`ePEl7puO5m7!lCJ4e2lCA@rVkPuQ6D#yMz z&%3OKSbSJP$BihMELn)3w`gNByDNYm{#Fb#rpA7s&xj-m+8VW!#!hBg0y!N zj%Yc29Nx6KYVI8pf&5I@7@X~>bhN#GXc()E7k3)QUb3LoP_SP-pf7~YRguyBO= z(T4JEl<~>%fXH!miH7XLe4TLupVMaDVd~df%5qw7#HC046idN*5^X8$4N2&aZzQXK zU@E1qv)4X`k0Vbjp|}rE?kNzn`N6|Li4c+&QG3iF7L8Wn1FGi_Lx>Ds-JQzit{)zZ zX6O4;RzlbX<#$7~EX-maze%)pOurhQ9@Ej$wN&4{6S_Q~DQvG4-i-NLxLNdk-8Ex5 zbYsg+(>9x~AKP zzQdMcv=UO7 zN!Q!1TI(eN1RriPnAGw!`-?&XYLfHLh&S7{#}(!Er9YUU{< z%`%;=5a?W~Qq;RSA3E0>2u%OI-&LKui2Cu~Zs}9ur$f(ASxfcrcfsp;;UKMadPM|H z6(S&x^>y+(+8f{ZYmrJn9}WyAZx$>3`a5C4;J}l$$~x2B^82FH>Pm!3(?Dt-QQ>-o zKPbjT!w(ED2UF+$&xZN$WEp}1D4Hi!3umYwED&;wtZnog)Rsct+Pk)dI^8rqP* z_~N!i`yh?d@p+hxVmMn~wt6nAT@Y2@`El zKbBQ3c&|7`#QL0q_v&e506qx#*l?CAB5C#!=y{CXpOa0&DTFOZVLlGIAqed; zr`R%7-jQDFS*p?Vyv6Ngu>2ARZkIV@eBe&ck;1$-P8Av`OWM8@l;-$6BR3meg&*A4 z$A0zH`dgCE&bZxsPPqn~VziO#x11@qi5*r7+xG%59iNlFsDTr8Jd0Rss(&%!VoqrH z7-Uy1Y8p{3dK(8@&Do@|+%{~(u%Pn~XI17>6)a%<^U*G=hP_^v`ih#`s;R`^ZTGEc;Vzz?);z; zNlcFH%G;{-)5rymW_cyk z9tE0pyPjr_Q;+9b3Lhi?1=Cd3CG7&|Wq>orS#&qp$RlJ@uJ2K?kDFV29dP{J!}G}8 zfcZ-62GOI-7S%a00I)Kli92N0$ODFYQd-Kc(#=a7XP;cl7pEh;f{C)#?aW8W_xKh} zDWR|`VOi`|z2p5k<3!s7GS{zEf@76qF~F77=2JM>s1~lSuA&>=K6Gr!2d0gc{;XQd zFRkYV6-JyfWfyZ;8whfED#q=jwUZZ19f!0{<=-u{o-vi&ShA8`g8)vFPyhJwn$E{T zz4X-{pmgeCvLBeHekTmSUp`^{IB1=&^!|gk0))c&oC}d*+O^DtJBRg<**w&fIG;p= zg#xxudxPrq-OfngM*MUm%NtmInPSgV#a)`9msz}1Dt zFj#t9T_v5?iUAaN7iFvOLF!MdtARGr4q3=ApaS5SQ3waduXHEtd+ce`Z`MN-54}82 zS9|%}?Is@o(@66#M)mK2ssu0Sxb-O1Pu&qPjXbf$5K^&d+;%wryD3J$EwgU??5NlL z^qhI|DEBfZSX_e*h=7_O*{z5RRF~H8qqDi^U*}E%hP!t&<`vEdp*uK0ZNT?{0pXL? zxvR}q0imsq=a-?uR}tggH}NCY=b(xr9{8!fapvkbUzKpb6wt zBK)A--4AnT4x3%inXiXhf}umB4~q2`d;A1 zE@@3YNYK@r-nJ`a**A2(p~Pu=82Ap&^%ka;>W3e2w9K0D;m3EzSE+5+3ty_^Fr{5% zbB$gxFO&G_)_RI>!bU|>qwfT0k2&iST6wkx74DAA_^>jo1n+HMJ7-y-;;(kJ8kfya zq-3-2>&xi?IRIc5E*miRgo|fj$Cn%HC0R=@wuRzJuTNHk4!viuj+FJzeLs)K41JN| zx}dop*gpO+`3)m`o*M+$5XQ)!G6&Zi2c1p?L%hm?IaRJhm&FI``-0Xf!mt}^tl7<@ zhT8encBrS?RT=QhC_njHq@}O-n-n_tGGe6SB9!@XW^xfzd09Aj9t#YE?=oLbwVkc! zfITOS8nj?uDk2~9HF31sfa*%v*E7o zshc1$wUy$)^k8o8P1_l1?)jG!MflCNw!LLflO0rlzoh4H!sGTBqWS;M<^Nse{U0(c zxBjGE;JZSACI`>}@%Q(?X|Muc=W&1!(;0hp%XSo~9g*nMWf%ur-8{gs-lDKo<#`op z9Tf(JbN(t{GQchVR9{cC0GyHp&aRn^6Ul!yMBPNDhbHip56~(KILNlDzT1oMy*)dG z_bp$hR)!{E_qFT_`6(dcOaZO=8}~W5kQCBNiE4J1?9{OH9YD`D&07nUz2+gm_<)XQ=9vj%a2)AY8 zX%Obq;L%H74vFab%+{D=wAjp4tumFREM#`BphnoVC7^}{7P9eGqa~oy_t}yeU<##s zStC>`qz}Z(uxN=8s7qTSXU=k&e(F z?-?O8el+pL@LuH;(YLpet7s?bT7enkOir+wHsa|MQ{lRU`qvW5|dfOPo}fysWsDSZ-q1z6wCzDkZjG4 z-~LxC*BRB+)@`M?&`Ss+C3FH9I!F;|(nX3CX%PthN|#;)LKl!CM5GBK(nWegFG0G5 zDtM(sL@5RkQ13h3H}0SNp;cuQlgfbFWnQXp#xoBL{-%mSs1L%-LKz z=gI-9lRSjN{sL-yxZR8yzBk$%QzuH+h7rrpP~w%WmFMgNr^i zMSz%*+p@Hg?T=Gp`Pt7r#c}Am87)av&>(6!Vh9lggm8gN5?ddQc|f0miP_XqydHiW zW;B0*1~=hCeTJ0kOQxOwbW|aulxNPdV@)W9$Ozbb%vCG#h(FbE&8#~!4AOkTb!XQQ zg|K)C#UFH$>HGvS#3JvdB-*MIKPPs0x}(lgQrHjqh`3Tkm;&d|c@qvfR?F5J)9Ob~ z3nyp4+1M8doA{=i84Y=H)m^g`C*Nn-^E>u+N8}$i%3&(rL$Pr%=q*`^Tflnq18o1Z zrSI>)Jg{LrreV{vw!7_UX*rd~`wevuzy0i}=te~a*?a$d@F+%*v3||a5f9Vsxl#c0 z&oe(MQ1eGw2u7a7rjT>aS}i@NZuSIRGh>oHrQ(l@Gv8t@wIpha*c}k=95xS) z$$uDGz}6tp{c$OQsWk3$J7V5ne=KSZmbh@_Hzv0Sa~9lIK$K85Jy7=c*w{nR_r4M~ zcqcD*Qoy|0=B%;dRVn%F`0aPgxhp|C_XFrW}639Tn2fY*ORR~CPP zouR6A5tmW^SqAX+W<+jUy!N}}*NVkJK)7V7|EDsBGS5o`pkfDLdcj*$Vi$noHt0)MJWPG^N!R{JMsYa?`tt$o`X6W{_nVd8roQu&iGB5yImDzi0_bCA< z^UG|*tla$%mv1@g4YW)ozA7Qcc>q6TrS{JKz8F0~tpP4pAnRT}2^27s#{C4!~=bwGLiF+QZ1lH7|SWiae8Q(_QW2mAx>6RD~xH~UgCEiQXbLj*#A@8u*W z0La8DP5&{JIyWrUpgQ|0EC`Y7m~)TKnk~x%Xf)J1^q{|4oq@+duEV{|h1!X7v%pIk zq1%x!6vWRpwqx6-45bjNYbbZZ0%Fq;sGvhp6q4nq$q7;a0S2Bg27t`J-;IjC|F7!% zZ!CTY0n7(cfL9oRDQLxqp9;C?rkqd*fX+lex0)6n47=3z{fo>nW(3Tz}&8qOP`y?(T~<8mO4x zb)$6p1>js~fiHDlpmenQN`J)Kbr=$`X$Ul%X<|BA(rl>zl~(BYlC-zstli{IP$6+} z->&D5@bNOXP~aWS{m>M}?X*_@@Q@F@2POv5Xb1kvwp0L4x@ZCW{jyt7B>PClRLC%T zwMz9l`I66jGRi<5;S2#QFcQmB2K&SzYh=z>GD)X_ytTuO#Azsso{Jxt*ZYW$>W@>1 zj`FM<(T7Mi)ri(})6{p?)~RC{M+lxc?l9Tu2Zlx1Pp7d3t$o6nE|J+;9~Lce$%PRs zRLjSM_c16dRh`-YD?iT~Q>p3|O8IHO@Q+n`Tf{0aR?|FglII`bL7^XAPWFO{_9%5h zd%r<8+@kfCPMsQJ$ToaYD`6gCp{8=^80GunwEbtv9;~+g#*cwnygPDwodrOMxu=HtyM}4r9;*?u5=-*s8>Z_RSpq_muTznYi7J*)Sk@Lrp7fFF7;B2e7XP0-#rzv|Ze zls0I+X|M=f?yz7b4&!h#82tX}>cWOWHvgV(i!0(sS|C5DmvMYb0OBNNcihlu$K}T1 zpxr*QmwaugDhJt<4rur8L39=LCagXVYwFIt{_($LC6%hSFT+Nut;NzTdX>RC}_R*D@7H#KqZ zeU}J?X@jDTy5jnx3_aK>10gIYI)vl&7; zjF0v*cM_45q{@$q24*Pws~ONriRC|Jtfj@_z61w&w7q`(VEGGd`Ejy%zHQLXI3_b5 z!5XG_ycB2ZFY@JU7I~qIBrxMKYup4Viu2Ry&7rK$Y*T5sbjZTI(gL`#s@Yjr)_PMI0|T-BV}?G@Kb_GY`MzXyQo9f6fY1S%Fr1Fb{ZpG?9D#{x3%i~4`(oGk!=HOmA!E_bcDMer zKcZLuBk#A@(RS9VB2i^0<6@umdiqbdtn*^3%9xqvxNh0uM&;467V3{GKcfK#JLqSB z>)YwGhpE`xvFz5I)qR=Zi8kQI1xx~B z&R~-MRa({j`i{QxE;HB3S-H@<7{eK=uzqPRP-q>tN^uP{kz(#LBI=J==-Zb8M!XJC zQH#WwOhv9qF~b0_X#H;m%&xQ2%;(j+nWA1!m|RxkrfP!WM*bk#P+S*sm-x98glRdh z3#;m9*ESKf(JRJw%gu$UsHrB=Hxc=$CS5^>BAPqda|f~NbS7(5#*!SyXS^+S`&wgA zvH(|VCr9&V)e`N{rMrt6RaYlHK(=4jZ-}xT8@-0$6Q)hxPtOmrjqJ{51tv zg()?`r?$+Rp&Ch1t3hU@cZKpJNHz&yCDQ9ALgV1B;90XJ6*>!GH+8wuc7}2Ipd?I*6JqjtkbCFFt z%T4Nxf3URu`coB_uUFz)mt2wQ1$ToB4j2we|3cNi zn3^EyE&Gq%FQmaL&btH?Lh==qn-$gD5p(BTl6f{y`of9^OjV{TMK@J7HI&;!41mpb z!(jYsjbpl2BZG4yV`sHFaU92uvB|=z!DHfSQ*O6$Yzq>UYR(4|P?ZTA!=c~OfhEcQ zo`s5AXVRH!)7xC*eZKGZY{GG+8^dymu_N8b(0Rv^lwS6JuRN2}<;|ils;T)ew;6fz zD9x*P0!2!@%M-p~J`T$mzZ$JxS9L;vciKY2Ye+p|sMldlohj-v@D_)rX<#Ap&dL!} zR)VEyEhocy3eI_97rn<26!=hfeqNmlDmYO!jix?ibQdpQ=b(eB&X=+H=Hk3O0tg-im0&wgM3p}SPrjPr6C^cRoM&)x zzxbQbW%bj>n8+8R$oe4usWi|pK|C9ck^!@FhWBdRZYudm7WusXhkB!D+J)r>b(u8= z`v*&zpLSpZ!}>|t@B6UTK>BnNO|(gQiT^FvZspA$N18oM^>_QoqNmWN5RhWV;rU-@7J#*@Y(ji-G)PdPtU{$0$ut39EXqoVZ-s9S#g zM_K!itpxuDmH(*|Vf0eS>iRLxdnetwXA2Ov3b@jNt~jzCZ6-c8RQIvLt=kx&Vd|4` zS|ColbXvk3c}YG(TYEBp|oDj%tfdC7@%ln`ol$&?|!>>wA%B zXODQUOG2n*?WXtqmG@oP)GJT=q8SAS=bTVu0s+i|{%bbOWSW*ekjG3HA5I$w{S@q2 z?|@h|RG;~Am;plk)pHF1wX~l&bQn;!2;F(GftLR5Jog1(p>j#|5`@+R%4rL@YIjK9 zr_6vp;m&67(UHf#FUK&WMxCi>Ht=H-bIq%#5%j3efF zNXO46ERN@#W4c~TU?x9>Z~sy7E-#Y;<%yKyxl|Exw0}d}T=v&+vvH7)HSH5NAi@zP2 z1%YlSPo-0}VpA8rl;LvxL!siALaf-OSs?$jv^*D{RqQq)vMNUaJE3=Nrqiq*R1V8< zIHPBGaI0$dH?xmh{M=w=(Kz;Um}v@>MYNp!+P^G()$Bq`$J+VALFkP`;K{+7LaMk> z#ve9@-~JfA+5l8X1T+_|3W0@s%l6-)yd!SKzy7jn5XPi7ms0{Qr?2Sim}u8&Iz9d$ D&IetN literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-prot-folders.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-prot-folders.png new file mode 100644 index 0000000000000000000000000000000000000000..a61b54a6963612becaf0ecd0c8d73d12a8401566 GIT binary patch literal 48367 zcmZs@bx>9N+dfRAgmg)FN_TgIlpx(H(nv{3BMpj3NSA_$N_PuLDJ2a`m(u;-obNO9 z{_{IChZzR;X0NsGxawn!mZlOm#(fL~1O#jqWqBP01Y{lr1Vo}cNbr?Kdr%pEfas~C zB#TfvM6m(ipxDc3$RHqmO2oXhM1}9~x+xoaA|TxBy!{`s*R|9J0ih{eMP5eF*K9i* z{rRIu$5(u<8E0aAn(jZzdflC;6cn^MSn_qcK80etJ4fGn>^K&%*L*_Pd@?T~ji|7b=j{I~P_D=)?GZe~-Z zrWi;~#RQ$Gblj6hUmOq_zX@iMglem)s{Z==Bz^nKRIRId+dsKN-`{+_R2pVWW9Qy;b*O&ABBAN~~^kQ5#+{pvIxy8@RG zQ*Lp3eYF?7H(Rf3xU{sy)pAPL1J@CBbFsjVr=G#9Kv3bmHG#F2ZXQ&2xE+2F_mV)RdJiC?9`uz*AdWY!72rf74bOZ(9r3+ZlypKN5vSHdgDp5Q>cM zLBa2UOVk@rUK@DvENH zQyPqGU5aQK@Z_f(efGYkG7CNZ^^-(PRrTij3Lcc`lL?M&vp|zBN`KnPiMy+q+Cy=3 zSt6cD%!U|iWCAW`WPktujk_dSvmC4e)09%`Z2TCK2L`EeP)0tkp zwyk@IZ~s1-kktz9Z`RSIwCw4Ar~IwPM^BNy)a^ShEAu^P70u}_F%A35b`zR${X^$P z&Q%u0#>oCfRrmsyYRy)7GZcS9oR9PaI@YxM&HRSS)og+|O6_7sW93gN# zGB|GYo6u6MuxNjQBY8?w(BqHMPM`Le;<3)RY^h*LCA;Nb>fqTTHIhADg4cIEl1)Po zwj&M_f1Mv~k@0>P2*V{62p5husUewlkQHPqQwwqZ*`+k=f1UOLeRONQ%WqdJ+8KI@ zBiA08FO5DxC)c|Oo>|RbJUl$lwV|S_9GlYs z_peJh$D2!+1wHFc=bP^>EiD_8zqT`IDW);V^iCIu@iE1HHuL{8F!Y(r|{R(;Q>qxlL?XKG&UpccGNOZ#Hon;`9#fu@`v z@<)kg_C4xCX&&3-NT!E59~ij4r1xLm2@m+{MrFoVh)MocEj0dDQJdn94qWYwotZF_ z95FdLJF@SI7mIMnTc{z*lKCQxBDw;VR3?f?FEu24_4XX?hMe@(~7H z{_RzJ&2e`4<6$cK{;O9q50PI}!@Nne^m;a0Mce3b8X0$?&m4&v>e?5HLp`6bfSFA` zgt?IPsqGWF&pWmvq}kyYAu>Ez6>+@@l${gjZ=6yp&0BL;${)Sg!!)_-EjJ)sTjKQ} z(7HbQ82mkz`JscudS5aJpUWveX4n5P;%CHR z+TgYMv+PH)2DzX!X~5tE;~IzBpUnY2H5s(DwD9DM9zzSlu$U~?$UHk(!y)AkNs|df z(|F782+cCZXFo*2W7P$%F6cZZO*bA`d8IM@R^Z9`;YOTmYtYr9;5xj}?T@1B!^BL% zr?GOs@?+49`E`w&6bd36jQ zs}jxZa=o&#Tp8rrN%IH-f)NN{s8=$w|Ba^^+OvPHqekLKTHM-5;(TFU*e6{nI+ z`G-h(55spDu?>(y{fe8PCQyjX2VLx3o*l4{hR&|^CemLUe{pa>Tp#6Xy{uMFrhCQq zi0-}NXS+w`dSnv*ULVbxQ&LhSPZyDo^>+eS^6s|(|vC<>GCNxld+eE32YMfOpudt~IOA`rjx5q-x{{1;165Sc8 z*HBk4WU%deOYuqNE(XTf5ATFu+iqQv4o8#sQ{L6iJm^VFj|g(J;~w~$P{=I$>Y8G z^L7|Yha$ZdMF+`LT zSC6nW@X`f_u_7_Uzw>pDOIzfKB;PZtbqNf`S)iw*6VCqxV+WQO19Mi&Q0yw#a@gm& z>b|!unT&}h&e>M5XETpT3}D0+`UYzy7^S$7s=9wIJm@Q`TpY$B6kfl%Z-w<%cajjl zqR-96@DHFJd7knlA`+4kBZ`%k75A6lwf{D1>xipPvc5$$NXxt1UEHBsScudZw9o#I zX95cYxgFONt1yQEizVgxw-m;y28Q?g70bc^F0;ILetG}yOD^^0H-Rek#zx?Mxzgl! zAk2H7)@9L{E3`iO(LC`z8utCccT(@NS^vGn+}6v@lvWnKdL;HaG$S;Wn$6?NAw8zW z_pjC7Tt~P5+|{)dT9;Xs1)}?yt%mK6!5c;2+`$k;WK!HiMr>ADX$Fdb<82l1liI>_ zPV_)T+(*A^o({a>cb%sgwkgB<>#0h2T&R*NZ06dx=$(q$*2k;iO;CblNODojGN@UJ zo69-GgG5$BJ9H<@gn_d@f62<-@W6R*zIpci>8~$_4PF}nIFBNWUC#BSLJ9BRS4G4U zjD)clRyljpxs^aNJqX};C`)9pVklco4s8(mghIaFXtAv)p4^tS8s)`vF0psZsuzDc zVt%I)1c>|*Y;6;x+_W-U|0gD=Z2LswzOWmOUR1>fV;?c9D4m|Ss(+dG4;~^zw$Y>v zJiR&{oP|fC-XDew88!S94c}$ywDwNXw;1{a-hI?bq%guRb#k(Ckcysvwcy?M*5Gp| zR}W5PoWjV=qlVMct*)RNWA%?KBn5HP3l%2y9`Wc;CM#_R%HpXuH~&QlZWUwIZlpdm zX8%mg`GmS^;0D>cy}cbaALiY=GF6RI`}R0DXKU|jUFPl^FGPJnN2kb$fFf5M{A4{+ zxB*N=M@L6peGo{&H&#IKOl5VN2&Tje{lqQ8TOqt0YF58?$$=6~Q5A2g7=+$-vnbuUol-ML1e{xnuq!`7fc4-b#>Ug~oUEN;6& z(u99#c0*ZZ={?fp<&TcENM;w9fr6PbL$r-Q21wX-;2#`}M^U?(JUF*=pwQjy^i4r>v|j@Xt+{9Usjk5`Z1J zHvR4SJS-{Z@mqP-910W$N?}K5Bz7k!tT`O1OKzC^ljgx!-6ZB8V6g&dq6*mN!Du=h zQ_C946#57>usfFMyI)hOU^ucMe^83%j zMj;c!_0>uGlP?z6U!TrQe9!T6hv)GE6|-NfpKRa{CRbDLlPruu5$OYUn(w+S@prY~ z>p!sj9Y@Aj70+P_g962P00SRQ8=tj>Af`Ewmyc8W%p&UI|H<~5 zuZNWh=w%M@G|*^UkBeXXmk}laA#!VLp$0>4aF&htD zL4(G%)+c1uVQ|ZFO399A7Wl@^|6Qhm@!KOFrYN1mVu2@g2Vs5%n`tUO4PD*cMS;jO z4`yxZPin9yF-+u@H4V<3)8$A;zau6Yoswgb-OIFzWdHxaBzQ5AH8y#Qv+|H~5{Ihv zXtqB^ACrs`Amv04Re5%K`WHU**Zl(bm7ZPgh<3NLQ}6mLiGZ4*b(`5b_hYgITI9c5 z9`ykyy9`ptX8YzhRENQ+RTuksi@hha$A=|4zl$#xHF2!Ja_Z7NaOX5_;J5J0LD1Fl z*G@_HTATRl&=(Gc!MP;*{S8l;-|?6lSA9IvXC+-`5fQ_8!Alb|KmPuBD0M_6Au;}j zrII*z3U1{$6K2%KjBnv)U3QT%R%IQmXeGQXD^}b#f|sJ-I1zu8JY3tnUcw2!bN8;_ z`9_J#5-H*DgEM$k^H2s zx84{l;t{q@Sz3bM*#nA=j3bUqM5GYQG_r7WeZphi!>vog@i+-skPbdRK9&DEZCt=^ z{aUgTRXaDpmXb-I#m^vvORW_vLI^?ndIzbdfg5?kquq_R zO2w{jS=c%yjL}P%J(_n?)+H(3T|T0tFp*iiZ&lQ8iX9$JI+GyTy$MoIs-ROs zOJMI6=AAWhY~HHKn|!nBM`~-LVv5CCg5^O#K=3X9H75@1FC!gAP3}Yfa4TusENt%5 z-PQ0_3|nFR2QDS*886sTd+<2STe6I7fY%Qg^y0{REP)vFa#r{TN6=q}{r9p7PttN= z2I}x;M0HhISQyWtT*4#{QfeILSr@@W@qc~v_vueK4rfV)-4*niQmouUB1n4iN*t1y}+v}qR@bqUs81gx} zFV$a~JiyOT92C5YUmMKebHC+FOPx`kqLv*foJ2mdKyJ~nNZVdLnXb0IINpI;`U3Pq zyFl@1XC{3Uz^awzO1b~hCP-+dMqizPMFT}myrB-hOeO`QA>Afi=)ckvZ~WCs06-K> zSX~Kz{xnA(zkfDNBQRD;v5hRFCq9}#+=3mOM;xR~>nut{OsrT6?2hmUj+LT<0uK^! z-x01I;4|zD3^pUVGF>A8kl|XN{4!-eeU$1xv%#`jhwJvK9s&D4zs2*JFOHqbGI5EC z_JV!J9v-~9GHD2Pl_m;fmV}iUlQ@kqZGj(K7V9w5(YU9q^5QARDuL!371%ZT{en_;^Me6ru2WUCXa;XH!nKQ3iLw?$zsdON^uK;EFeiJ- z&+oHqqQOOxQj`z^vH&o&G~HFQl3DygJhU>8ER7b|C5n`lb`tw2FFtqz4AIWHI)bazc+pQGt^VU^nRXD`8#`J`a`u%AJ$iSL#6L{)K+E>?eMsJanENCtb`P0g|;NIv=wi7j7}f(d=0h5WL5Z6W8{zDQ%H+>{|B8~ zY;651!{}qnvi11(BoVydsj^Ce>TRz&=LfzX7TK)1W(b+sqU`*3^I8Z^WsSek=y2ij z+AUPrN}v`reA>s2a#p%^`gcxA=lMI9Y|(pR<4+e(CWrB`BL@_5KX2~eUBEXiIl$Hb zKBde0t%Vuu7~xxz^Njlw)j_( zgqSzqtIfA&Q+3{r+H$X@%cDN23tTnQI8Rks!W;sY2qHerbK`ms#)CM&D%XXUNwWYA zTUdUa3FmS+8uyf3v#7*ky zsNK4i1SXBQP5=7Yp-IWWHv#!E!)>qiMly9{?OpIKFJACniHFbm-sfI2k-=vVBTV4i;X#x7#|H1MTl0cTE4R%x z=z#q7Xe<#suW3qZD$K8i=75tj-4a=CsjI^uo8#{Z@bOE<9LE^!=5-%RfEVKGy*qnW zlx{Y*P_UBcwK1m0W%PxGBF26@5}SPU<1SVP1zD$!)(~vmblA5l#lwD&=N=C&FE4+| z+L)Hm#a@5d)(%5-$Q}2`wKN)A|51L#kdMc=PZ!~!2*ie`<^avZ!D|8#5J!LdQN-{r|ZcoAh zTs8~#(uW@_Bz=nOUMm%GvVv6K`1s)-1=cu?vpskoTIh+iI@1dBMyKtISHF>Z#o3pu z!=>atgYN!#eo?%%$B^FMfj_Y?UszWq>^->o80$`afD z7;5btQ4`~EYcer*;rW4vl@%RQ#2;jwk-|!unkbFx!=*Rs!SAsXD8-IDFu9;Q*1s{o z`(RwV3!4z{{(WHMW8f>*JB;SvKKiYoTZ#bUZmu{%Li=2kpJyl%DjE*eAcr%+cX)&_ zYx_}9L)qOZ+n5Z`M;OAAdg92CPq;f3<4FJZN?mJHTMxhCL4N&K+>f`OI`9xMdj%AJ zWfUmi8TL7rI=mk|ITYG*GDh5tWq5RU}Tw)@_$Rx zP-iL!{5F_`wr%%p=T}63cp(|f)1u}&PNs~lLg5YBTotsSvp?zGFGe=gbLB_Mx_T|#CLx&I{FUEX+&`Jvt|j~I**X~DJ;}T zff-uvZ-<-mva&BUxt`~c@nTG$?!4lAtroVV+6MI*+xh?avNEZ%Iww0rk0pmj$NepV zS}N$^yU&Lb>Qaw!IWQmkn-`#(T6KW6_32uBNRPx_Ypc0kJ# z-wL2MnYeG&c9>%jGMy>KL2$-0Oog&>uth+M1CqAhw?Qp4zQq9^0uBz&B$o`;(G7!R z`3b}HtW)sIRMl5(?l2RJTXquuQ9x7cCIA9jiGGN&NP){R59+Amxy#K*0c}ZE)|f7j zKm9WOs^V_vUmv_lB3dXN>fZlWHEJPQA!Otfs?;KdrV znQLNMDiTIZ9-=Zd*R_*7qr`XFv}m^2_dQ=q@P}y_`qlNX2LE)B>;qD--&4bAPE5*6%gQ?aEv_ zh0#+L0Aj>^cA>gO>S0<{YURmhi+V$$qx;DqGOE4SlLLsfs!W7`>o3798;cs2x}gv( zlq!_t+?xDIE$ICC`E&7k789uRhmvPD%Uv<-29-Z+C&y5fw7xiKZ)#==#!sawOj;-= zaOav$aR8f6VN}~EyMI4+1{ITdd+HN14xKqd>k1;j<5+lU>5xG26j0fvUEnz*lsaSg zzO*M1wa@ie%zd^W2IB3Ge2a=2>63gAb2(4acQqXG5@6Jx*qfoaRXhG*dQ<4O)L|bG zdSfy?z|h;o;C-)6@?KU)V0o!-h!E14Mh@G{zjT;kLH?gj5V>+chy00RD`yx$-C=Vs zLN0r-s2tCvXT}(MqKC(6QkS%~HbG4i)4yKsfLzHtPoI1DQ)|1ML>M`GZh3xweiBV` za`N^kFM}9_i55G)9{=Wo{`O->@GNe zq?Hear`w+{yGTm}jK*hi8Wf`X5Y*=EI_&Ch>Wp3?M0eJEWwcvx+YphalVL?}BdqX3 z*;87W*m09qBkOo(P#Kl@dsURUh~CFSlVj>4GkG?0lU+p$83f@CMAmcVjtiN*+t*WN zwcCRE>_+zcmHrErGSi>zw9r6q<8El_u-h^Je6=6W0UrbfXHmHM341)eJyr&`y&IXH z_ipVZ=l)y`rVNZom%63M+}vEL%Oy}w_QUXxt~2#$RdG9OyN?J;1L`$DmayTU7@+tY z=>KIOcy%I)_>+n()5IzHJsShkRT(j>d=a4lw!;^A+_xn%R`gPbr7Yc%(xvt4*~uoy z^<6W{GuXKwTdj~e@k&hvLLYn|;CW>XpOaQNY@iN#ZZ4B})|DPsg=*Kk$e+IfF=K`LdvFD?Bg z0c^y@A_;`__>29dAi3Y(Y=Kc2^{}c3I1Q_R13^Ytf{r88DEwGPLpgIrCJ)^cboo~) zuB%JFkOJ)wn0c5gF@(Ufj{zlE0^2hQ7QH7BO_*O$U`dB{t3`oOfQ;Nv3g!;1lB!1U zEvBc+jhG~ymk_>qsbQ+g%5>jjfl?SinSq&~0&gr5O2IoifG*6eD5*lO^LX@%rvt@l zT;|u{S>T|h5G+OJJ-7r|67l_7LMed)bW6PwF>px8V@N$*xJfxFCgTP+Co04sy5Jsv zh{+a1K7Y5A_<@l+n9az7c?fjtH`jYNX^cA3*jKlBNISpFAn0;0_~rtDmWmSkQk2OC zM?%sH$XbiW?-*;H~!eSqdZJhgtTSw2ySqW|#E()PEhL1OJ)TwD1>^tuP zkeqjUm^Ss1sfb2_sE}-TA3TpO0@$<2T1KmVcHtelq1MjTVa3qc-2n zNfQ##;PigfGnY{rcX1E~t~f}%#9=9wq*`*;J#nLDmZkl-YHoAOJd#x%yHlWS13~pxlpjiwUS%9$4biRm+Y4* zmsb9zMSDBqdQuiA&C>)VKAOJWjnGf~F>-hEKjEKBZH352+Y=S!C3@|ijn8(fu&0SO zwyH_Ye3t;))&m*@IsFEN)H%Pk?A_viX?_?MqN4Y!OSKEoKD48B-^0eHCpD=h@yG-Gu2^u$gp ztn;@!tP`0m=W)s_nl}6Z-w*iRMEN7g;~BQR4eFt#iUUxXZ1&aZ(L^NRr6gWR0XCP& z>iz3sZO5V#C!INZveXg5A2r(G{iI_>ncaj?2WV**-Y=_M#RQ7G0weA$VV2AmR+%E6 zOhb<-9a4URVN5@1kREm#g-xz#=^PnNuUY3*IT3!BK-6a!%XKWNN8?kw5(Q-b&cJ7} zT6s;@kv3w>h;?awYI54%?F2~#m}J6i5tv;H=^6^%7JaXkqXz1TGMv;|UF^7mZBNB> zXrwG5qn*fYPqK7GWXgl3VopI6(b#2i z4|#=4dK4^2(dKJcMg%RVnR&XtERR;j>Ww!L2&vp*f;G}aZ<7=?3(NiX(3MxTAur@$GC?P$jQoD zJgQKPLpB5w#HQkD!*lQcI0g}$g%;igu)L6eb&pMS7r9*eT!gni-@Ly&r}@I!y;O+O z_wx{AxONjK&h=9P!gJpO)Yo*GBAp`{u;T?i?@B zdkWXJv+G`!PNCy5UoUYzGI=Ud8skEike^c8z=f^v0`k=9inLm5$ zg}c^657yw)TleYXof*rbzP>*2r5;rny(0XH%`cPhQ0lWcPXQSMLIMKh)?6Cs&#Bhn z;JKTxPbOFIT(tSb-xt8Z#Jpu6Ht0{<0(Cs~lGjE?MnJ8uaTrA!_FNs*uJqMCL^l|V zl@tLEe*khZYgv>M?le&DXWLUU`Av8TKO;Spl9HrJ4wI2Q)Nxj6zJlp)6#{CGtlObG zz()R0ZcDNf21fNBwlFOBbFI+AmU!{J(lS%yXF}&#OA;*HHfK1pMT5>4cy6Sq>yy;< z(J*3~OIkCr>ZB;q*GWndEw-$MB^E~MgPr%R?PyFR(b+mAaZzkbegFOb2E2SURxt2C z`uIlHk~M;fMaAzp?$j%>?eGI-r^FM_kA|bMu_E_7@^lE%v`pz}O}lejVYaaag>sZ) zBQI^}*Z{axlOCC}U219mQMS^1ysa)$c5zUc*s4kOV(vLwNf5?>G%-P!7E-wqPF_e| z8|Gf1CXcIv0jXSfE*92Qzl4T?Xd!)}fB)_;Zx>da3j}8tm6#W1E*M$9G&vnaU-b}( zJuO!Z-DBls*lOE|1WB>dLvra}i83p{q?|+cqZE79fsNg`qpngm>SK2ivo*2zP=@zx z_n$5^h@(l0eDL|yBXW^m1?=p*KG02|l%~ji%=VRP86VnAu+z0}EsF|yK#UDS!RMMZIV^c=3moi7rsta;y9`NHJl`hda|D`>T_ zAzQLLY;l|P5c4udJXmXbl-U@cL6Vw+A0%FMR3(BbhfgE0AbEJW!WY(V(WiHZO{+{y zJYw;m1e(}V00r7t_kKIR-NJ`yGOkeyHf<+W9M*LlJUs5;f}QKW`D_Vk6L|7t3wmJ$ z*R9FVa4sJDwZxf^Y>XbZ$StdetRB8Gr@mj;_S3&S@s3I9aomDM9sV5*k)@Tgl_;E3 z7x{ObV)Zk_wj~Kvhk*%xm$`c)Z`Z!Y#ewsT#PAiwfyKo|0ef^4v@($t9aBw8dW-Fu z+C4}C`KJ@rsdBIeHUY`Z1`svfBFJq8ec5OMc1Kk}JgOJ6bau!AB z(J>OG=Q&s)u5VD^oc2Pt9`rhPo?l>e^8kvNrsLY#TdanJdMC+LUq0CPZ6>F!YdHbA zg)p_W6PsSHH3$`M}Ftn1ru6&E;QB$cOuoV~{C3LB!cwq%M<_vC3&GR#lnvBxV`V~ep z==&rwT5r+^Vsj z*ZLIS0n^{ZrP1hlza?6P(`(LP9Oku_5KK6??fDj`K#%M7OPiET9MS>p~*V=8&hJa9g&En9z_s7@T3kT8bn65MBon0S;+YfgH5HzHZqWIbNzw4^E{OxQ^tIlLrY6mghLw zr%+LS4?$}K#1%VQpoDXUt0FJo1sm${$8=iLPR$IwSuJGNp=cp#h3~Qn%+e*D!_cFb z(&un{`ZEwNXscW|2$ngbT0?FGR(4k@$e3nPW)7fb;nSLTa#wv17o^RSMn_ zcA2dMe>m{w>SStv5pp9hLu*0rL($wGe^1g&A>xr+e`v5gEP3G!wE?2K?70xA@erUG zU8YYImnA+169X2rigMOGm@XjNhoND25Pea$%HXwS1N#QhRe~0I5X)*!R?W#^5I5&Q zEEFIbq-6wMW`#Xh)rB!vjXv99+eU)?2Pj2*5S(i`G|!ELX_y4-N=puSNZrzR z^D%%+#A?Vvii6q0$-P{~weR)+eU8XHsZYPtyaLh5wx12&JaL^`r|)+wmpZenDI@L$ zm7(fsAss#z27QFd8%)Kp$-dZ^FIS?CCC+r%2}AfrinvQcyco#Q8nq`ex|Q=xHJ7Y$x5kU*BnXT4i zYlsIz;vjz2<SZK@wI8F+EayfbPtqM2SZ*?*ps%eCFMiV#A-B*&Vh2rYB$ zd#n5%h7)MS|0i4AiWqXwLfkn4Ki_77yZS62K1kSH8G`roVQ z1d?Tpd#|LT@BaHUz}&gP8yM`>phbK!0xQTGTqQ*1VR2&mXRns{& zVkdEw_A1H5AekjDZi1>~8xM*Mj1tkgTGw~@ws+2ll$Fkpr=w{D+B6*J@a8X;o7`Zv zR$Rd5*DKXpf+J<%7VxmnzUps~{_yw{(q__Jo*eqx^b!`GXIu#JZGwoK236K)R18go zoF-bQNOg4Z$;alN4Uj9>lyRB=CH@6dbl{aTI`RIieQEg#I58%A*^W+a@!sW6|Es|1 z4MeKYBW?%0x)y1nxdv}*!f4fnOPPXsVqI)i7*D!^GIz!yofna}_Y=)Uy7U5+O$8+- z>lJ;=PAjtnKGJH@I^&F)h9_ewebbA(?Jz%nWVc-Y8>k!0&R>bhg?$H`hV%x+#aAg9 z_P80B9h3ktz{DDUCv^jtchy7g>a{(U?6o_8AgG=JPldhj%;DG0ZvA?a7S*20`a``wLgA){QKu{Rzqil!%tUJ>(FS z;fJ|-1LtK9N&1;2n3z`KDUfWLo*oI3^77##{?bEy`i9fV#dC5ieJo_x3u{+Z$#V@A zKNP`&_Bh%h4W<(cuefsa*R-@Zl7XTh@(35hr$kWlW**B}auX`TreM8+Orr%XNMS)i zVzXPVW}fCN0LPReNp}E%ush!ISSx}Muue|FFs;A6^DWkA3DMrZ*VMyL1?@NVAdPUBFhRK9O@zrU)6*b7c3;J`x1z(4`nZ5AH?!>< zDnhKcG)A&)S2(7IG%@$+Z7~0Vab)b$P}H2PoZMc^g^Ob|9IT99dH=Bm!#rsQ%wJ8* zDDcyoKqAIM3HMzHJkbu>;jy{3+#vh52|v07BaP*3DT>-RacAIlWvGAQfCy6Mv)!;uye&E|aWP~C`9`}qWak?v=p{^mYZrX2A9Ore*|t4WKr zGh^zPUCs~_YmS&yWL2K?47Zu}yxnujSuHBy{Eh;f2Ufgm!(W)OKCMnHpw#oKXqtqhj!mu ze-hYc+3zXEJC5rcX^m2Uz)>CbE#rJpJQMi0TIiSF)1~j;-!1BL^2A1D(-> zAc^~tCWFn!k@!>o+1LTI{Jq^dJ$q7EJgYLI@;##$ubbSKmv4;bV0~5I8=|S!y_RC0 zg?U-tN<6mk$D*!vl?MRwU>IMtda!9}Yee`c#bLSzQ~&Kdbdkvye{6IBeGya$W8V>g zVz()^cXH(LikP3neM5+XZ%B>;N#XOldAp${@60!6u5`r^kZ_raPlmy+-3+My5p)Os zHmt}pqUmIMC5!hG0mlr!A-Is!Xbt%7dh6O@l*M3`{{o^15x*31>9P&ua^wi!d%xaq z22|ouOLC~(Is99Ck(9>qYP7dZKEK5KTwlTY6~o*`eL2#EHsc(-N7->7o17^|+X}=p z&Z&e0r#UQetH4{@ZkadQ7bKyg+Lh=g3XM7cqtvde*xqP?^2#d^uA3x*FM4~n7Pr1( zi4O&Atd*Oqg`2Ch;o#fj!JyBrwMeHhdA;+r_FVJa%zvR#<$Yt_b}trvQ#-%53X3bz zqS5uRguz6S%z%o;REoHl_0Km(G?7*~ObEx=^56L*a~EVGBSF_q4tF9rX)DxoHSHtS zC*V5%9I)a?_hJh}>IZs4l5j|U9N_Ajw8<~G-?(t4i53UPnY+;R8;y#DEs;>A856>U zD|AbS0BRSxAasZ8l`LcCK?6fj$n8Zmy$x-APg%N#@@$o5SWu!SRbM{ccJaGNI)o4z zm44*$`1tt1&9V}`oLD-JED}zW#}67f*!sg(WRis|k_NORtFh2JBNnmfel(K^t02!s zg{BUm{bmfCsRI=jfP1(8R*LMkI`x-K`iK-1t$g_yzzQ;cUC4=UGwj^Xuhs}Hgo}NT zr|p4m%($?TQwszI&ZFW6jaYqb zy%v2cak>}=$H}5w6)}2%7sNAoUC8_XhLzmKd|~pNN**nf1@jBg53myQMwxSbWxpK3 zaGeJ$0ocA2lnJ&wuJaMN3o&#`@%NA52q~PY6-U{JBvLZF)j6zmkPuoIynbkS>HqZW z#1;aFHN&b;LipYd7&!>GhhYXlVv*dxM{mPP(R2oU(Sc+mxKD7hlcf=|hhS7AqoLOA z1YgW7SXn>cZ$}4~a!tpog@c5Fd=4}e{X%ye^aRa9w8B*oMXFrpM6n$1+BS^5}350S@8n@Zl8# zwH~8OApD~Pc7t#7yd3!X`3Z;j_W(Flb}e_mT#-jqYk@g~+4WV=rjOVL?{`F2vaHOi z^Fj+{%c5orl)N&n>AymFTtLTreIe5W1n~u8yTtL7H7Sy4DI8B9AqZcl%IH+8^IwV} zS(G$^X<_U|e^24=5ClxYP5}Vw(B*2dQxtF~3c^0fhP^E!)A`8RA^tBW4I+ru+iaLjoe)-s30 zO-h>#oy@~3@(bZ(mu+J>rmzF24iDjAkl`mQ1xVk4;l1j)#@qs$uz!qt1qA0x;hZfg zt~o&7E0IuiGoYwq5kA{f?W<|K;;={y#Uy1v=6$B4r*}*jc02@Mnz{#;YbmN>fKM_| zKKsVlXP8+qV=+4g=y{(Kb))LYjgZ9-rmsD`84kXNY<5^hlokNpFb(dyVfd_NlnY@v zlIv7ca&#l;O`brE)i}$rq?4acRUw9TY%6wC?nmc*{fq-S1E0V@m+K(z-O^^EMFQBJ@usw15674 zszC)W2zk;EV-gv<5CVoldsuvJT25ux9;kMn!3sBmReaSR%rzLXuO1jrICAzKjw(@q2UY=WLAaamLdzBp**}#hkDi-8P_Log zq7K)Dj}G}4!e%^MO~5%l1N!dMkap7w-nI>rDMbI}JCxFlX)qc7p_0)UKL<^B-2o;59rklo?5YGF*XPduQjahv6qwz-}V45(Z9>hQsL8R^f zg*ZOrXPo5K-P-bYS?0<0I2gBXyyx-<`C=jDL!B4@`+?ej>;hQI?pM}Z?K?|3st!R}j0cpnz3z`eu4mgb`<@;w^YKV@jZnYxNryzbUPA(d z(*s%rSKrFlv4}-1vbkO)wBvuwDe?3kOU4*dv9z%g9bxdq+!q!3sa>fPk5(d_9BfM1 z?EHc49>|rhuP^I@5WnX0{$4gj-da`}H?(IlMP*TcAmZ}}dm76gmn_|otKDZ~%oY@8 zQkYGUsK~3X%jSJX#XStBJHI;*|IrUkVJ134Y0)1>3v4n(o8|dVc$tleCZ_#QdKxce zSSeUn#7hT4n3NG?+vgr!t1n2D8S7o^#-kbji>ZheEyvp6O}j%_bCH4-YDI|q6tA$O zfUb>+ghj1j>HP{i>Q7eZ?mZ9F2Z%R>G?PSH?DtW64DnK43QdQ<&C1%w?ASB+iql}n zAnMDE9?mYtbmc~ny8noB?leTt5}ji>2|va;{f>iC;7?YIq(7?Z;}txS+u=WB;|ym$ zSt|*?5*?5A2dd%d7AW8E(&tC)V^rJV&ZVPG zCiIAj(hbR*n5Jey)q1R1^@u90;Ifg^Gt|Ulld^`^co|So*8fM?TZTooe*eRC*N`(v z49(Cb0@B@$goA`giAYK)(%ndl(vl(~EhwETT?$Gnp@<5KqVlZqdwy@9|8<=g=WukG znZ5VD*80@CJY-TJ#U~a4*L3KHE>uZv*Wt@8HNN4F39 zgVkNC%iqkOvAS`eGcpax`mxpO)q<_;-hN;PZpAA8^{{S5YHoc24R(;X<+^W>E|B8w z$?!P;@Pveepu)lj%(oBO&m5a^^XZu!S?99(mfg%3YTwGno8_q_)T*;^&eceb_>pE0 zaTG8sN($DDNXqcn>#_9$YsqybHSV|RP#|Z<$hGHwTl!w-$bM~vv}~z%W?MtsE(s!n z$^fVLFA7q~??YMCXHebwI%XB5EAi5(CXt=*tT#eUfsmfq-?iK9aGd0l!ol%XZj}Fxx1U2zwdLuv}?E$UY z@(T&dA@J+?8c@k-hIjOLyqV&`0T6ke1Lbw(m>D)Ea$4)=X8`clZWKJgSb)EVB!;mz zgA#QFsTdI;6E!&k*@2Xt=D6o35#wD`R_B36__`;oO0)>j^qr%b??<>}Z~JzWkxQ^b zt>FCw;SQ=ZzCSh3v5j&o@^*-cIZ3nvmLqWjQW`Lc7i46hJ18jq3ld209AiA=PVTIWLB(4;zr24M@F}=^3uYiA=~2kn%?|o^wiF@0H+v{W#=|$UgTwHjA41mi#yo!;l zKnCTVs7q47aOJQg@E*R+VZ;S)q!0kKF$5K+gVqXsu`kbx#FZZ7hYdd&*#ltB%Kzh& zRmR<{7I4rTYiMY2N#UI|a$4HIuEfJmB*ezY_e+V;&ax^52+HWVwfN46KiAaJDgOvI zXbO!fHkV#L^gZFhn%mUri$1!-WPC@1C+rz6zA+b3oDFHR(WYFYevyqHVE{D=)qIwU z5_=3SvkfqsLs)uqeL6?!5#GM9A`L}-rF5JmcQk*E?_3>wa?p6Q=YgV5VM+80Nw2s< zqqrnr85ijaeyQWA#I0hj$i0_`eK#mn%JJ|eSB^fN91ypmzL|fs36g4K&-(=*Bl#%=LJ9t24wTg#d0Hi6w|=1F#&4Y^X4 zqB4|HnjP&?A~;8Yd%^{@oNQL-8)6&napi&Dm4*R$>V40zB_)AFrAJ=Tp!3GXh(%sq z)GeDtHOCh_tj$r&tM7Gu6Abw-@`fL3WqIYbtLzYOnQ60)=3t2%sj7~v@^8mc%#ErK zlJ#E^B1AH$9nf$fJ*%GWu&R05Oop}7bN2paYmt!4tr`!=_Y4c($-kzk7bY7JtskTI5y2XQ! zm^!xiTFuR9C3e2Rc-6G*_;5fsY3@i}z`Ing|vqP_sJkkiw6Bj$c}N2rbLOukwQ*px#a<4zJ=I^L}{<)o>rGI6=qcgi z;X=VZvvND_=KYI*x>8orLWn1gPul6$pWdRopKNM$^UWNGkbQMNhqZ%;pgK#w;G*LQ z$q1unZqn6&+Pm)z@SE;^*Q4Aw+}dTnQnkVH!-bLYE@gg3gbh{uqRV!$_o#+w$Wza; zk@H<78sAmd-e{i>RL)zgMjn&1EvN`34n{3^M2|V z?Z@Jss~HRNeS7=A-o}x>dJauE8#Lh%sACUEJ{YU$)CH$0R;3>lvxj_?2ak%LON>{;+0cGIhgG3fy+ zmY06DtHle3sCBK+GEV-p=jniFi-|iNBE%B1q=4cncdG6#IN2cTDgCyNA4rJk3W!)g zM$k;(y+XGH#9XO?SAK#;cSGsBd0=0J>t&!aE-o&DOx25itp$qm9RfYy+MvS2TA@wi za<%%!&;o(4L~$cBG-Ef3!IOsrvCMWl{sSl4u$mjD3cu|pfo*Gd)f{5>0#P*x z|K9ojdK3aO89P?4<-&5a2j;cOhQB=#1SOCvWU0e3&D!pAEsTFE_pe{t z9GVWhH4sigjV-O3oHT{FMc_9ccbsw|F!jn|ztC1C5+h`yB$-w<=EUZXK|`7LrL8e^ zbUWE@pGk}$-6;9%FKJd?qE37-+9^{np;Dn+O-y_&XEj4)(6gXlV7<{|%C(*xhZbqQ zdFGsVOrzlEOWN_~Kx%324QN00lGh^*J_ZmBNHFi%)kU+iL3cZG&uN`9^M*_HpFucF z&9yvv_ww(E@nr@XoX&;pD|zCbVNgpc+&+#-ctINca@hNJ)JFa~gItE)Dp!bh#8Vbg z{z0NAJ~#JfRF!T|Z}@j7y~HGj&LlZA4n<(iue}speHeS1BW&HLoTYxrGzGg&a&e+j z;?R;~^};pz(@8oVXSDk6y2XxV4AB;8XEx`cDoR|bgY!(@_sweOUr99b*_`lB$jS7l z?L)rmj$uwusGpstRTU{__}#J|!$r)TtjU?{PT0V}n?~N$ja}^tYq)6d^LyPWh8WFC zB}sg{MDcsHv(l=2pZr3r@kc#T7OIpD#iu_kYxb|vRCD#pTT^|lk8??W#IDP$KIeyj z;t$woB|72EpVh|}%B@jdx7No^Trvtj7jNdLuMh-z#t}5E3D%UAdk3$~NhAm32ix{b zW(xDaLD0#laa&azcYf0=qaf7G71aJjkycxR95(VC?2Y9e=}_Q~f0cMb78Nlkrjvtj z9&)LD5q{MmxBHtK#&`B)*M25|-DpFgBf3dx$?un>4_`DW=@3j zYzJW%g2vjCH&wpp@VGwGtogL;f1EP$7Dq_?_vp9?82{urIPv-F!!pQy#e=$q!|cIgh?Qc?&mW`7ytOBb6y^&Hst z-b}AzQzl4W+B1e%p6UIO^0D#eaiDYf`V`}hyiX@o1+DTSZu(;tM~OMFsbXe-KT;{3 zF~m_KhNSPRavK+WFIRo%RK&}Cd~f+v)x+EV8cBc|xW9eRdrFB?9({k)OtwD(r?mrB zO8jpXiN~iR=)9NpKR(^+-l(;pDrwt1ihB0r)4Xu%MpgKp16sB(;}cbhRA~47$y+%3 zM^uTl{O_va5C3UZ%@jn0Osro>p^I#Ip1@#WkZ^LpQwVz9y^NF)=aAfeZG$WrHKcm$(U+e}Z-%3-vXNGdp}U zQ%B*($M$P)WZO4@4e)?88}M6b$~3-#fJ>tBZGXJQTDY_@kxng`p94oPB>Ui$PrrbP z;9y{w0g406XP^Ky{R`y4r{xam0By^3z{EicjEke(8ofgr3Z~|d06pt#9e|Ci<@&oz zDzs_bH^C|d?ErNkDEujDeZ;mNkNyE-VXa*~mcnVF+Ke#z88i-6FslBl$*yZ;kwrF1 zN)cz`-zbFJOzlZKJ0GhkQ)aISShCbft*TA&pGC0hdI6OOxxjMHAcD|{ql!#iJsZaR z>*cw3KH2ZH&`~>!c*?-A_y7*4ba<0b-fwgD7%)%YTYrugxJqz#A(*e}I5BwN*T~HH zA%toQCv<{nn3*IQw5{b5T#k0%4G>9Jf1btpyFT@$L|mM%?_WKoA_zoBwz$Nt$d3Fp>w5Kw|-4Y~D)ZEySH z7!N7=B}Pa&Z>b(ZjGe?uIUtAtG7;BIp$mg@x;NCxWI5AZmPV%ra3 z%8xKwJX6*>X#|*JKdn0Lnl=;TIsi$g<`v-p2FqwZ#Z4Vf=$CXC2I5SDK}7!8U1rfA z^gRhW^mk=E2rwXqOcUJ%cN^ZlZV;^muodfeG&}TP`|r)88Ex>^`X9bxe}xgz))&$m z%B9n&&)l7o8`C|}$xDko&N33C0?iFmk&h7VqCzFI;=S+((q`SHZ#-=@WgKA=wY#;# zXM&%9zkrS%xwqQ)oXRnMh$@as?EzY9gz}Z$(;K2+DWVTS4P((`;DSdGg&rVFlZ)6^ zJ>*R=(v&18C+9v}aYsek)SA=1Hdl~d&J~flM%wS2aapV@an*-g1+QWG^QkSvPsTj6 zb90|bdTM`#FjBm^G3_`)2UAFNRtrT#nlE?YrTx{vVJb={duZ4D8|Rx5iJkD*YEYr;FH znnG1A(s=xXyQjG==umzsE0rVTlsw>G_2C*3nHa$fAklP+!twC!xc9-J=~gDui=*JN zWWcL~1Bm_GY3Vw2-w-o+w9I-pyBziBkMyykxN#_5HO`&t0Sx($$s>bo!CvO;V3Y#o zY0F<^HRv;cF@6@>$R>^Cg_@`v9nhK!yq9)3xPU&tZW))<1*+$fa$aIzjA|Bu>J_~x zO_FeSc|Vuw3cZ9T$d4$XUIEf!8E`j1*1_qMPq4o=F|HF){3=n^3|>-BVA{+DBrgqi zEkYvS;l`ttU3wmV3a-*a8qc^p$&YimAfE90jMO+Nu+FcZ?uto3++i4xqot)KaAO_K zZ`7c{NXNjT<|(c;L~?&d!eMtvTr<`6GEbE<&%|NO-s>3Zxen?n17s zyyviID;|wB5Wrag@v!}fA>OT8wNFw(r5{zZIJY&MT%;f3M{*hDIFAfDN(Dc68_lrF zz$8#9J$jS|eu+TUWK$auwwIkQM6u_O`JhN-hRy1ly)?eZA#9no;7Z%z!kQ;-Z{6w& zSFq>nF`BkL$TlZhOm&nfk*4wk%VuECT-jP-Pl8A??miG9xuVJprTW06s*Z?kZ}IWv z!uCjB6;BW5;z+c_)z%`BQD%TS)(X~u)s`tnN zn)(N@Rm%sU*CiyS89*xE3I;e<0!}{w@Xp`(Sp8@qU+JdocR=&Gxw%5pTbvSrcZ$k7|{OoXICQI5NWfc$?CiC$DhI zEL52kgA^gN1xhcdV)}ex{9;oK_G!R&9H>C0YI=71_vS}<2OR)fTgEV#Ho{;IFvLSB zxS4&wz=BNf*cU?{9KkRZ1SNG1Dki)PiRf)eX*1jh`B?fcQ7g#sz{b{-C>D&0`-soe zB$D*vYsyD}zd^LV4*e4_U@DN$)SP}h^8{ktF2b36V)S4EP64VZ^yK0sS4oMeTv}4& z-H|$YFufEZYv%Sx@UW}l;-C8Bo*!Q9GUbrf27&ZYI;Tqb-&WLt!P}aw2p-k)e5G#LK?fqpcenSY!eDvHJKaC+NsXEt)Mx- zQ&wex-ETT`59m}lM)d?@54Xni(oxc`fb;wCvC;v|y;Py`p#8|?rpArv|E?L) zE4Wnw3mL;ykla&aqeB(>y`Ys1<5kzNoW%&GWWy6hmaLg}3_^~t8Tt8SE2}8)vNDcE z&hMvFf_IqiN->r&TWvB6d_+C=xF^LpY2dPWTxy0)&B)(|SN-}jRHOCZuW}7pq;*i$ zDC$E@GFTEk&q(-PDnT@GxNfOat-oU#8LAr@*T^M~)cGB2VvIqdP)#*03{Unx96&C?{Cn zaaxW$8eM|CkxfTxq>2jV>Q`x@ic7|`NMK4B?eB6<#0k4CDY+6ANRl3q;_eWj?XFIk zU6cq;eVM&T?KnO{C*i@C+3W1}XCO;PhvH7+N^!U+D7f)=wg6R0M@p(+tspvv+i$r) zNprn#!dDa2sy!c3QZBj^_myxGts3p5>o_5JG*09{ zG$a)Xx*s=?j1(+`h954dWa?2n+Ehjf_m~3;uImD+>=~4;y!2yaXZMYzDGXV4TwZV# z+C07S@czY}YgRdsxkw=>#b4`c2_P0kn!u?PCpe>X?pHnke=h^n(`&P5py{c=F6mwlo-h7I0AJBdL1wP ze3RzwVmkmBq7!4L&uQg;%6!%T7oNoXsT_IIkedJ}u_K3Ny-g+*e3Y&m?u(Jg``!o^ z==l?Z9|9@gc zT3pwZvE}stQZQ~nyYZe>yH=&7^8g#Ul#6_ z+GViS{NJ9vJq0NS3~X*NMDgmUf`DJumY}M}T#Uk983j2Ndd9~4z|Mjq2*#(R2{;IG ziL7wBs$M{(wa|rnXdQ;(_5)=0I?Pe~EwX+P^vLt(&yqU8%gKxwdM2hyTm*g+P_88o zpl_WTXlxX|Re1#gR#dE}4j8_>fOI3krAk~`J}_TcQe9xh$y`Jr zMg$l0jf9>xEg=E6w{Ujsx81kOnwq!iK+VDV(%2}mgm>zFDI{Frb??z2Tp6kbinJtK zM9H3Iaej!2?bYUG7qWx;vjh;nm3OudIt-`)E=L&a1~#2}Y#OMo7>0`f9#+9`t8NV1 z@=LxM7jdNyiZCu>eqKspd|HozEC+;oQN)>=gSYk*gI8i8DASGYlMk9cQj8_wY%P9|Wk+qQJ^#~-^ zFmc%@(({2TO}qvtx&Ej87qa>V`ghnpgJz$vvleH30aL6(=%Kr@Ss>v5Jz&mOhgne0 zZ`8vZ#$=E}SF^deLn8%7BEgi4{Aw_RXDaWW{Ysq3%)ybS1k!r&N3Py6QC3rabzcb= zJog-Q*@$z;TzQ&N7+?;-4pRldH^gI}LZSZ+J=k_Bk96F#TYrCkaOnnxJ`m+RnKxkh zk7iGRCeD^h9wAgM>G~6Ll5qY9T#8OWEqHcZ^g7JxOJ$)2@!+@Q(TE8c z8oE1kiEU~>MY`J?mIPI~>xfx^uS!q_`U21d`Wk_#ec$bVNSp;;1lsPDl8ae2+74B)!}OdNpG!Zr(QCM$Z=ih&R@PnNr~SBrcJ& zoVS%3v1CmKDfA)m>1`)7#dMn?b;11>??`|m>8sPC7lA2rhah4fgSiJTZH8KX35;ks zDd}{KRW6f#6dqk<+q4`Krrgm_jfG7=Y>4%nT}IvFtV0LH%42Ju!XM zy%-y(_Du8uw9)#^enc5jYLaLXc=FsNo9S{;~Hy0+y z=vd-p!VBb6+QC{$j8oWB?!GH;H0ZvgxGy~)ZWuFi7jw+S7S4RF?>q#9mTDBscHxPzN56TT#EL8_KNs{Ob zC93$YOwp>Fg#);I^II?4XUfcLm&LIMBomLGwF`th!Xtu{FwT+3y`te%E>hFL>ihF( z7pO1eo>Z;p^mMWtKBN?JbC+5Y*^-)Fhcvw2-H%4{k0d&6+CRh+X;vGN4(|+5& zSwD&W2t#p`q6ut8qS^CT@|!X=B)f1`Y!n=YdTPTGDs;8(ImL!_ zWgV7$Nit%3+mpwc?vU9E=e14-*EzifIc_z&Yt0SA_IN815+C$qK(RN`8T2{r!bTs@ zAoz4DrNFA|u1OT{iZ=*Bu@M>`nlekEP!{%xZNCK(aTr{Nqce}4m{5b~e7&BSy94QX3aWxmkQpVw zW>osjb&pFsbNh*W=qt-fzx}s++>#<9RF$#n>fxsMj}b~h*bk9!Vfrii5U3a<{KKR> zZGt2pp*C!Pq0Ph63vhAaziflc0j%3X7(Zu&sY>$*FFJMx@OMW#p^ge+gJMhbyy{zL zEzEWEN*8s9ef()e+rcLjlNp6=@ywaV_m-z8Yyo+$nYwYJMeIB|hqZpG)~*z`aApM4 z8F6ua3Mu97y^RzLGfkKPCn^Tf8{;@g`*@0ua6M{3;H4ynT!X!0A(#hmC?k$6=R$z> zYQcO>6sdwiC&6myl#bW>=B}>yudbVyuroFP9uW=qIe$kp*PF$lJcjf_oZc1&L2*cB zk>>#Uw_?awB4XmlF&=9q^+!@&zdnBL_4^LWTW)IGzGh1L5PbdY@2{)jn0Mx4 z8(!`1Mne>ZkCpU@i~s7=+9l4(L?_djwng%iv5;$U&!#?84Gcm_blLaN-mghk6Wy_8 zx{$ocsI3rOiN|rEr$ADo&{~AoR1sXQu3!px>^*c&A8~o(xVd<>0hLh1r-|Q8`k4v= zU)r66{h#1x(72m%VKUwMqKl}v+sz}+D0FJ%3S}in$~yCyKQKfMa3)rp$CM1|Q-|D4 z`V^`YSdl}S;!&Fwurw-CyGpT|lvLE2k53%1TZrqo`j5!l=o-b^2PxZ+k_lYM>y7k@ z7;kJz`z8xH2ov%940BO$w5DvcqVw&HRMz-*0G_x-b%y=aY=BZ!1d?ip&Mr z^a@gu^a<;eS+zzRl-hKr|2SNwuq{a*qqCS!72m0F%vhgOpb@HZq~m1lp%v2iwhyrv zXxh}=@#gjD8`R6SW0dKhrBK%)G3MQ|G>}Th<_r+-91>JVgsv@{t6ttVuhw!}3ij^} z7C1M_--EA$MT}LSZ|*ZgP{eEwVZXApe~r+t(eh8BO>7Wb!;nDQ)V~XD(#YI+qy4M_ z8sQkcAeC0nD#FbxWR0oWb!9wwpq-2rMuK>U~P*^xoY?{v2Fc)7EOp^z|Q&AB0OSE z3U6GFQuAl*r=6zINFBTTt%g91B)pB_k2%T{LvL&~eTG)&dilS`Sb2?^{hsIAq^EA@ zML9OC9+jIL*`|>J$ARppzuPbQ?w?4`^LfH3fNS|kG)Ven06hJ7kz3+D{`+yi%f$KK56huPrYFZ?cHgd1Vt-+ey$iW%J)JFO#r`}xCc zP}4n@U$RrMKI7l(N3Y$20-<5qAzn$G_r0=h=WlT4fB%Pz>D5sYmF)x04;?l|ho^K_ zs{{Z0E4@C-MW3_1b`Pfr+>^supJb@i6VB; zmTtnY!NImMF+?|q-~IR2`+Vug+5a14J`8op zECF&N&mr$u0iYX>RRU_^2TXe(6e(fr&nP$uw*d#-htNXhVIp@qP;~$M65{+ZzcTn&;CVgOPf}f<0_uFA|EZk znC8g^V!9VBS7*<^|M!tyL|)a7+7z?dq!NjK+KH-HEtOVzN7X(q15vwLrlzJK!x8>D z1(OPJHC^zt)6b`Wp2IneYa8-ypIhY{%h%vzgQo3|@OJ_nTIX-FX9gvxTsX93^387$ zrk_!_we&T@Yeq<^!&-r08=L%rRCB?i1}eW2-YXGx+!YF1IK^f7Lx`}p?T3%Ti5!lJ|cPI?4#f=O+f`CUxAxpBm&)S!pGsHBzS75OQa$7p> z*pR74Hb_Zb&t0_zJ-zJ+CE_!$)wZsV!# zZh~yz&wy%##aJ?dS623WBq@jLz4}Ytb}eKPB1<*ugM+M>0;e|={t*a=`=B&LwQcv6*8W>Q72LSY^zUk|;bhZ&Utjvx4 z$E=>h5(o(NFiwwLz-kywN;Fe#tBW;M<6hxn!j_56qjOQZIKm zVBL@h1B>f~<>f;FcZVoouz&3I#ZumT=Je$)TvO;ZfE81J2&uC`QCmxqt)fa{S=a{v z5YRd9&2ZP_67h3@OW%GXD|!k9Gyq#(?@1xFi1azZJvGHXfL#-D3jtvEDu!sZCi>pl zr$N^h85F5^emVfU1#$TH5@)a7J*`gvd)7W;O|iZ@U>_?w_Fvzmp9PX;T*!9DvmvPB*llg=AroXw*ZMzFflIH z3RMSCgz0^;8H{3vF{xF`7w~2|z^pW2I;p0e^Tnan3w1e4xDf(YC}zJAMqAMTdG_y& z841P)6;geQQgm(^avgOGam}2+lLgJ(S8&-FfR5L;x)P4A_am7bu&Git`4*6qKv`;N zq;RU-k3|)jm#W8x|Jic@^*n0b5yJF9AV*C@^B1Nb80A%%MC};w#W3p`8XD^B*3bAuUs;vK_%rA8X0~iAl4$pvXkXgQXy<5wvxnxYYyA+A@B6Dkwp$8$Y z%EcB&I}dl5gmn91$mE9Txdkm!RmL+=;L+S!g-X@ zM$n0mlHGzGlmSWnFkURcM}lFOJM=aX27f_S$#{8y*Sp9uE7I=@5g?N{PCm8e30Wmg zY3#?u#%9JUsu$yS%w9%jwr+En%fWiVlh!xh5H!wGqk$b98Uo$@H;7eVpY^B*P2Vyc z(72U#z(<3UzBBa5(;RlKTr?*;hNnaa7%2+r)lKE2S&J0;zmLuQ4u9ZCVz`!Wojmb) z^58xE`vr3La0_=JhvDTQq?XHU^hbb2_BVX1uFbfieb6}=B^XCsz)|h>ujp!Tbk5+m zb7+*5NaL`LNr-)+apnWYju#iaZEgVQ<$A*HPMFV4kub4;wWdx;2hAe%oQz^vBqI9$ zn-2dfzsFa)!0!Y#23bqy6x2iO!fcm%#BuS;h$rYAsn0D-KoE+t8SiSz=^Jf{u{`nc zanZICyThOC2nBYG5)sy)Ox%TgSHR)ft?B|8sP06`Olh#kP(B3oNHct3)siL{sx3G= zIhq$>hA}OO`2%NQdsTp(Z}D613$IE?@h~YQm=QT{w+uaeqQq}NmzO#Ko?(@*>%-km z*3K;F(C8RxJf#Fs)G>f#br#@Ow&?u4nXOQ!lfs7bbV12p9^3)iLGZ=m?kAZa_<}D> zUyP`u{KsNdhkPjjl+m4Ynp|7{8y(d$XP2vx(TPN zj%Nz{dFJjilir96p*=}Jqkezm{qz$qHK9CrhJj0)F|9A>d zs_AWDVYj2}<`1#M5*XbTG?nCZGQ({9+!wffp`4L-T3XKrQ^v(&O02g5ALeP|LWC9RMAzW+0+4U>DrBgLlP>xGNk48{ux0MpyTP zu@3F8M+&k4see5ltn;e+e7qMXRYP$Yc}Gr=WQh%~vuzF_-h>!D%j~fqJ2RxTfK{k# z=<;oUNxTpc@yzKlr@SAp?5mnf)uvpVD*%aZ;^V7n;B0vcuno!yXmm>3h`xlx#3=`k zZCm!hOpza;wXt>x8^j1{u9;0M4U{P)BqXSImZ}5LrdFmo1kd^;H;ylKTD5gfOFGnQ zy*YC3*0B$)XB?sX;YhxEL0eaMWJ#uggjDxc+4&t0;AOLu+rTqz)&^-cMYY_CSq>ER zM!(a;f0qO5yD0ar_1azKkj?B!Ex76McE2Ef%<#va!}15*LPnnG)I}kS2UKMlYRPG7 z5AZZnM=Y4RO8a?7kVGUziQkVF9PS8PE2neN@opIY2Hl9ZIggt!)5yQZn5*1(#iI#Q z%ue5dfgSQF9(UJ0B~-wB*b~|X$NJ_Vgb|x?kM%QYYn5i;0Ptx{Ozi145vI2!3<#YN>@9>}F4mdH-#49`k^)V9N4+s+dG9VF0ShMjlj6RvG z)S~Lmx*A2e(-W5?GGnUsI#~*`T2;M({k5~o2=!zaVC+A`8hcq?y$|d{IH?R;ZDdf| zsO}+v!ZELK$1;Sw#fjJ*%70b;nk*C}32SLda6B|Cb1g&S-@hdQ-~L_4ua1TzGju&s z0Lt~?q@FvtCHI6AM(5m{y_T}Xa9h2fdH#*lwHC+4JI=$Yd0mK}#Q1?pv9Uhjwv0^p z?k~E1xKGYK|7iqUe{#sG8|+k#o?2MG2mkc~Gy}W1;4jdy3< zmxXY<8t1(%(@sXH*wHm=InX2FEWkJ;xXoXKpPAwg$};ny+Nl<>+Q+B&MtBB+PaJZl zzCz~>XM89m5qnbRe1|}n4-k$2F4aN!7AS&nNg}U-kQI#9wr3)w7gq4Zo3cUTs&tlqx3AFJUZ;48 zWcXFtzCWkXA|xhztbKP=p?DufTVi%yH^R9AFEwktW~}5g>>(pF@s^a+Z#L6rAHbU( ze6Q<>WW^svTPEwTFUQ6(Sbb67@`x2#QoZgl6=TdqXc}0xt81dK?_AH=ah1$8PJ}8} zjakhzSnmf-aBb#PhWEQ?_EqY&T=dHVrCII`f$N#24?3cxBKH0_Qd$#0dAOrFX`mIs zWG&R|L0p5s$`SCmS~!pIoq*f#t50%01vI;|)OC;c5m7x4_ZxBpNUDt68>HG`KFeZl6K5eyAX+QG z{v+K%l>>3#`2xe+FJ|dPyR}UAXFL4D0(SL{&flYU*NXiTN6NyR5pGVVeWkiu(|E20 z+}&wCVc5E?|NFAjC;o5JmOAtQp0pDSKenIl5yE5^I{g><^1nf~$#<&oV>T!3>?z*Z zNuT|9dc#wcmjVo%ab!qwMuEux&FyU1F}FOy#!`*=_v3k=;V>&cdzBgUo&3T7rt$`yM=+fy9z`&{*R(4THqRC-mc@WY|xEonN67 zhShUj?=ZWuCt?@Ely+bqUa?LIy;(YOZKbM>(cna>>}^$?=c`K7#gozNcBZPaR`iZ| zTTxG}OnyAB6bjwYW0{>>s2t19yg`J`y~M{$Z%w&vVB1|vP@ zhfx97^CY`83YjhO-%74k-`L^t{xhl^JYJn2acb#nK7QuzvlMHm;ONqnHl)+YWYG8N zPQRM08^0s{>~ksSR)V4^)61V}6XAOU4tHbQgUC!hBnQ2?rmk z2}MPV*^f5!(wL`C%l8O|oFR60x}KcYPWa(IHcuC2MbzAYH=X*)%V%yTcF(M~RPIc( z;)VsHbMEzdVO?ME8SZNbSj1-`WBl+c3j;xxQUjB-eIJN9*a-C8Nb!m44~Hb|1rA~M z_qWY4h!L|pGH6|WTI5EP{jFf^C(Jo660aI4u5``GSCX&pI*iqh)NAPp4++@ZL z@3(5-nfdckac54-Tras^+(h|+p` zZ$47fx`*;tofB__<*S)%<8LUKdgax>s++%{epF6YS#jnr=(}IY%a2p#!;r4swUYiJEk7M}{|pGj%GIv#ingc8EATIC7zIZYb< zOk`jnss{$mz0v01lg?gVUI0TJz~*Mcz?FG|^ViPl^~wWs)G<@=B4%?}!PG|j7Rb3^ z2mm58JRm@(>RGRnQdc&Y#0S$e$UuttMopki8Rezjz&rHUJn|r0%sRyle&f<|acx8N^3|nKF`1fs*Bq1?Wz1tUTC|aJMuj}yRS3%*};+k*?Jd@_&KH?(lkOz z9EH}v8A1vaVI-p?65@rFm$Dqd8^VEe+z(Jp&q%N*>Bizrt#_z2A|he4E1UMgWOssVv?%I2Vwz)e+4a@T!!S-$1k%lCiN>^U<3JC0tNnu|&J!pt2bVY!aeXh=b3Ns`J z{CA;{C3Z7@U%#*9Jk~;R7zqZw1PpHbG?4dr^$t~EY!mC( z6>F%jzD8ddE$5N_c<#>#`^zwWy%mR;mzdbInyQ9_nFKF<)GI9vMM)y1uw-IbTxtLc z)6ci6yuR-^?>mG4KIgEEu>aM^EwMQKc4n+jF2A9FFR^3QUqmR(f=1rfg|6I9c8p?P2aCs&>?gyXlTWdjZ1WmvQm+IQYWOQKD4ZX9Ol+s!)@eU zK04M)ty%hHr9Ecq$0Vz4G*`%{benW%xR;F-XU(8);nXSk$OM&onN8 zVRQ}aJ5z_g+QF>eSzZ?*!ejk*Tlo{cimW4%jWq9l8?>aO|Kzqe5d~79)NNobw_mkpUBj#$&!4{~YD!A7I@G+(^7XNUM|Kh^Vt$2vP zb@u*YRI5#(WnAXMFY0Zcjfns&ORTs;-`Dh)o^}vFkZ5eY!`NRJoAjkup2cqbx$2@j zkC9*P{t-{mScXujHQMq#lHL;EN<)qF)6eP*7x$ifP$mV8<7d;E_9z30v9lbd1A z>uBP0c7&M~kU=*&1B^w}8 zE~q<<)wC-W=XDmwi%UCbr=TLMA{xR2S?LA(7~=b9G&evgO@8)q2R9jOsQ!y%Gdwnr zFaW(POjY{{1hsi9E|*I!Q8}(MR7NeYar@N@laZ+sXki$6f_cekP}ky|wGRs*t4n$f<&iVT_p z^?97QD4Ba}G%DNanhenuI@K)V2(^gz(WHcg)$A)dIVL%11m}8P?(>(62r1PNx`!KEXHeyfA;QSR`Ucb=Ze8YT+NCHFT zx>@ov8B|yQnY&z9-s`%o<~~C=3XaN|QW8g4UYX)^)pzzM{?cQiGIf@QygbuizlgO(;vNDENU`dHj7>Hb#;=F%c*wq9P(;gn8zkdia-mdDRQW%3);r z1iYT15^l(FF*>XEnlGb=L-M|UTKU!~d%4jJtk3rpJ&~QM%!7#CQrQ zzR!3p$k^pbV&$d272G5m9avSERtR$nl{mvhI7p_t8{>=@?abCOfK^VsJronk7fUe9 z9jm9iAdw#*qsF8i{fvQ2DCwyQ{wmvK*b%dr0)nf{?ee`4oGK zoO()WM&gYhJ2}SuIl9G%(zfHhCrr6ENr@n4$$NPw{@Q{v>ipJumPL39$b&z}mL|GCQjbe0+CQln>Wih|VvXVsTp+B|!ZTG%1aI$b< zVwWJ%0_Q8Nm~^mR=>7g@9%ND^PXPJF35Z80W&KkM#s)%Z4{9hYM>%e|Z; z0!yc#HP{X*>lizi95MUCmL!pRq3lW-RIjwiKcAEI*V#T=`)_HDp#z1f>fCmHu9XYu z@=r*g8qPHAGLSl1u`h2`1Ezghi@D{ng1W7Ky_&5{@?(n7H9c}keBA-pdPYSjo|SEp z=+Q78txZaM$85og?x9UC*D`K)QG?_ZrW5?KD=q={L{0fan&TrIMHrcpQ?)KJ;q?+A zeRxC9H;BY_17enf5nc&@X%u?0V4AltO!DTPi6Y zqr?0IaX&EgB@KoV*2?kYdI=e(<|p*Az!TSU-6iQslS zYGn9;CEKTQWxWi0h|U+?Nu#PHPjZsZEJ3(3mTTJYi+Er1!r~j*K|9Rn(-8EVi^bbx zTe~WQwF=oeDt{z!`YX57eXx>HRH%Sr{YtLVCk(p<;i4@`hqEEZIP_sd?<+fjfLh-Y zyc4@Iw74AcD=u4+%VI036$Y84f>u@S#G6g3eeWyW@$smnO4lLwm6A*K5NAv?Si6AnxQ=>rS4S*Saf_*RQLJI5@| zE^2Bqh0Fvxc}^iBEq>F{`eqsE(Vtxk;Ei>3XTR$lJaa&gG{UoFpT>Sgn66MiQsv}( z-}q(YH(_W+>Eu+Pk!+-7YE6UMBvln}SnnAlhD4#-D(_dqh!3ong09NZ;RQyP`SnP* zxW88N&rGy6m3%}6QUsGgsdeNYSWJXzkH9cGmUIqZ$!p+e;Y zF9->4T&{$E5P#YVFM~MS7^PMfMIoHY6KfydUB%WCVb6HbV>gny3sfpdHD?$mz3^NU znu+UxmmY7$#=So89O|gel$Wq3iVmg>j%<6< z63Eq4rQWA9!am! zTz(JyRp1|n5wWog%JDU*pMVVbefD?f(&2zz34Y*i3RQ{Iv|cS+jp{YAw4D9_Dm(Ld zDBrjJGj<_smXCF;gDjIGWZ!p#EG;4;RQ96CzQ-^V*)kf+QbJ@Yk|j%vJ*`3%lC3E_ z&w2Oxet*B`-={zN$1B})&wXFlb)M&Oybq|8e{(X4@+}2nJL9g-N!vZA>urorNH8)o z!e((ElZ~nY5gvFafAmXWtX)q&qvhoHPdKG0o0-bRLVx7Qkx;0Ffix#jY0sl5xGN{Z zccGwhxmIO1^Rm(@kzt|IS4XcSH#WTEcUkYBtF64uqTy;Gio9~jAQ=YHFG$teNAa!T zY=!xwiLjV>T_l+g;F?||w^RzCVCTxQ_buL1W18rm!Aags=(v!`CPd*qv1;v>ed4ki z%jxgqRkjxQtor9>TpfzEuSY^J`BWSXUx#ZStbK_#qK}mtFjA<7)$;ekdpq&FcR4JE zEKtr>h7Z=j6SxRDNeQa<^u=H>284O(#qBxOwPedlYF4cfC@a404sgm?CA7c{WvI28 zof5AWA-U~tm3&25(k*DAh8As{@Zdph6}~oGKj)@kPD{LhGYmjXXsX8k&C4ZIShR9@Wc<^?`tL9<4i%bcRem zgU+agCjcIy8!ohmKrP_MJnwx$I zBq;5Sp8CzgZK4%UW6Dl%Ko(!N#QPaqc`yVod3Z&KEGkbawejYN=w&}>W?K)DSuKXA z;smDj`^z8#C@wfDB_+#4w_LO$DbXN;mqUQjF}%)*=c!v!NhASo!7IBea$fb(}}#R`X>)#RmEU?9?*Pz^pNRz*!|a1xE7q zt@oG*tHXYsV=ht)Kso60G184Nxy`otNf^SC46u2lE(AgoA!E_3l|ci&Jb)c?wwow( zX|_vBNYKtDte$8IuU8R#4#q{xol=EbmN{r=3KE$eyipCa`S4C4tq(p*4QU?qJOe7t zcAh51N0~{z_>%=g4}tJQ4qT=;vBd*#sFW&J{1T)SQ}*46KWHL^W8v?vwvhuMzon@u z4{6I=?K~DmU^}Pu1d>`L(zGLrd1Xvq6uE$T(z8vHOZl3@wulPZ^Y??t270EY;`jOe zmm2i`)z-b{2%h%n3)o8u*@B1XK#%F{w)Wwc;5pob6&ae5{i|IO zj3$%77J$LWY!kQEAQvq1hBW~xY$WF7cS#k9pa}RqgF1KW7*`GZiw4kCgHcb-&CJ>_ z{9Q*Noz=i!)Zpzy*Xy$bVzm4>7Jps$)f}ZWuz*(?&s$amW+SpA{+73*4qA_}>dk9* z2c;1_8^v4>u3Of*FkxpIt8jaWa7ebYm#Pxj)HPn7@RgE`Ke=i388#9{0OduUPkJ|t z8pY_8Q4q2eqh;RPe7E4l72QLbRr@6e8+$~1F*-kzr29mlaZ69JB*I(pRhIN?;J#V6 zbS;aa;hGl&=&f&qYLEpR(mVAbvulRL{5qhtF+IGstY7u_Issb(If`67JvZ+hM4dsA z^5;0{_!QEkg8!8hp0uPDvNAn7&FiGq8?tTE*Q?)C%as^W$(<~py#33(lA!g#Xt9?D zBmHM<*Nt{}qhdYK+V)RL$*p;_22a^W9!C+p7#q8?VEwj+XueFZUMnoR_RidQ73P`6 z%#{nXs@&i3(1#p#x5M@4dZ)HGj@n786j?b47jYAoafa!EYz1Pk@>Tce)^Aa)ZT3}E zlK1^18F#{knlJpdtLMox+}SECsA94jomrrnVNs0sj%vheZ@K!N>ger#DR|U;jO<-H z2m5{66!VNHe9C>kf+lOcl;|u4dNbVkKeFQ1hEw)DA(n6AA9aadF^9lvIAesccWyr2 z&(yBoiH%@sY{gmj7 znyZs($*Q`zOg|AX{F8nE>rx*6(~k3W{?@UKX*Qm*>+4s}AEv&Pr4~1Tkp7x}=v@<@ zWeeT{sg4)PXh%P*Lxav?qJ^vDgCxc2KzqXppG=uqd(y4jp3LJer~fG`=a&Bby}eW* zC}xHJuUx2O)WBxN?BJMGfqSvlyO&d!hor077FRI`GhVHBD8Agzc)nh=Tca7im)RZ@ z8h)6N_RE1u!h=oiXII6mOu7^1wVedNY=6J=bPZ<+Q`un>bUzvhQpB~Y9{{b)TveAf zKX{juLFbOK$i~rtpV*dl+A{9!y{O{qnzh=8h(IN_go-F$`t} zgXzVzGMv(43JET{O%T!wo|wfHv6-u7*Y4<;`A;tfnCn*t3phVo8+oD6dqk+U(P-)X z%_mmg%7MMhr61o)t@kaMuN+f?J-V~}Y@%KImiF)~kN-cR6^mg$zF5<{*Xi5fYPBIT zqP)kD)14ux9?GeE;JR$-wU?3gSFMHXBz%TG6kf$$Q!Il0%bqzDXJ$6LOAL4^PT%kB z+VFDV+%bp{v3h^G{rh}Rvc*~q;EP~Kg1&@-O>|$&fCtmA>dsCP_D(O`j|`bXkE?Jm ztV``@RYED>Vn5<=?HTKy*-I_EXSXv}6SsLV2_-*{hMs;jPOdT4t?T-!k&Zp&{9keQ z>2;O&$DhTmw$T3Mwdtmy-YI{%d{e9m@2mai)~LUpNwAsOH1%E)Zu83_jVlz|CVQgP zM?%(6ZGYKq@w>u!8;yCnu!Y75|NqLUBWYV)nwGMO+;JmJ&m_Kn;n=D95b(vZNBH-3 z^`nQ>OATVF?NlXZW6gKS%sBbUlBEvIzHRJ^ypYz+9*u?ecI)5sBYf)b zdN#mcxU^bXNsbf?5j2#v{I(UfN_FlP^_L>2sxL*jM`7>ZQL(xxRX3ooJ0;St5q6nPsuCNT>sp`+q9=U+CG#aYh49xll2^fa-O%I|il z!DfyB3S0?+HBJo|g@lpg7sK{!rQQC*4IlAwOw?5jC#|6K%`( zg&!9pk4jcw6Vm*4eZPga&)lF#WWk7t%i>yUb?j~mgLUb`v8gS5*6)Ewn>8`>uHW=< zxGV{79s3K2IKA1Y!!Smc$}-_b2NIh~6KP^z>Oj+)d5lX!_|Nuff=8TR^nIwyN`4%a zL%o-nwf}N^i8k9cYNz7PY&}bK@WXM>Pi1dxo~*7u0y(IC%Ilq1QGefr+ylCW_b#P- zou`;qh)buhXIHghWh}D;Iip1_znxgSmeJ~DNfZ8Kr1$G?(ZRL7&Gm-u=qdu%PQrzcHjkg_WrR@$>WUi9>oO95`4Xc-TuAuT zlI6QJI~06_``dV7@A60LGqeBPA3k+AzdR0e#)41hz04uUQ*Fs{IgWMICrizM%?Qo! zAhe8aktQU0O26+V-w$eat)o0hN>cu!ul&V0cWc|a%gPtKE3~qwF)hbcy>U;z7b_xD z#KaTlNGN_W;81|BwsGX8lSOw;r-(n6plg0!Sq5MbqclES09Zbg_$BtBDi7;v1`h_H zlS1Yrf8{g6(F_a4(ORR-&r6=?3{5W0N%z-4wX1RV1&h&(BK{sa@FQ*`X4vER)c`75 zsuV16jAtA)8(?{c=xC|u6(TeC(ZGuY!}B3D8ujsCBSho4U44>;q{Z7{1%*2-s2MB)Dv%x7kT*6=EqIpQGl_r#eWV2(dmSwLSYC@ArYX?_jZndYXgul) zUL_eY3T3VnMn6cWh^PX3lx);wr0-K;dLi0B`g+Qt?|h4cMBLQZujQrIOyx;I+d#9V zfWkBgouxE_4&mn~+3*OH-jXx4K2$i!(I;XRDu7$W=kBvLem{7~7LO zYg(QLd!{XFzxFmhbxQ812!p1b#r*3H39C{nl*#Ypdw-upN3OfQs5};q7o6#@rc~tR z<+0dWC{q#PFj#=+7!TLV=!g0B6<89OaKb8-KOZlF{@oYKNf6;JzJGMjK;PYc3Z$DE zx1AdO5x&S`^ADht1eTjYs)0!OY%!?*euJzG>eK7%9U|Z|OFrq3RY0TNL8T4sQz!6C zkCfZN=uA0u!Kqe|{Qw*qJG?+8!oVtEz*Xk}4@&Jo9n?cQ?=g#8Dq8 zMH5yH^q#PcK+E7Wml<`-?9SDF|Jn}NEC_Te{PSl0Z6;pP`}gl(8Yu37Z@C#@aM{<7 z2hX_MaN5Y9vb_6UIlP3@B63B;f1(Yv8;G5kn?4kjxQKT0-r=MNFz-h=Z~2`F3ap__ zvThLSjR8qWGn4)S@b2*SI4>0gn2nUJf*$f82YU!`m;ON6E{E45iLW_I#0o*hg6W@K zYVi0G0?3Cp<;&G6(j9=f2pa|AVfzR{jDm*l3DI1d>`C5rv zcr4>SiG2=?EU#67XB2Vw2&gUW9ib4LIUX*FM#mVqf8%xp=+@z?5i~}27*Hd;r>{_7 zdPhaQ2Be`objf1C9$J^?5E=%Q0R-P@fpgp48>HKyBeuT?_!F>Hmo$8XaYmXzP)54< zEUa$aM#H2y6I)}d7+~p`K_BYH(R*>WKo8uE>9b`<@3&3$(pw!fLF5dd=SIp2R+zg+ z91llk0?&wZmA8w61v-DYy1E+ZP8J1f9IxR`Dtheqo>MH|UqZMZ1?Gh0&`%(I134wT z8#D$TvbQv%pxbnaTS2L9W_Xr*&ivnpRmy^}vsqxVzr$%u@)3wl)?OXzCsD~@I35F` z3EGJa3=HHpHA_bVwZuyhE!nt$)PHKER9whpBuFt>*oFBucqW=4e+%(EcuTqKOOnpt zj`-u;=?vWwXl-bR%-gT+60|1t%em!_FTjIlOojAo+~TTrNM$Uupj!fM_%CoLOo;@% z1<{B-;~XOiXho=|*ar+&lm=J~;0eVZymNNI%S?I%F{yw~m8=jgc6|KWFUw<#6#yqI zEVXcVN23;jye%~X*`45UPwGTMEWi3g%0dBF3!)YO0B_K`3nol2!$3R~o^v1|Nuh*y z=rqcmxTy3LskqHCnFpZLvjPfu;A7Yk$5b;&1z<`_6-dp<_|ENcV_Po;p*O*xiktkb zg#5~zjV>EZ^QhFcGzpHd8`oL>-cu~o-v!{FH`dB|x1*zjg9}Dv285b80z_t;(efvA z8>K+jH2zkVRM1k|K2H4@;a^m1b9@!3o#?4anU*PG<4H@|*GGfv8LjF2Of$kpQm&r< zo57oVn=to&|E8&8^;b*gj9@|8HSqaiX|I9&j_XqR$&$#XwJ*wy7LQ%VI3}DOyx9`1 z(oiEMzjU&}>G?UZq`Bd^Ec?CiiuSZouoQ4N?PFq3pyw)?&tY+Vm;V=9(oqi$YuCfh zVB`CHS6=dF;~?PiQ8y?7{p0L1S43s$lJf#m63NZ6F9Kus zv)}r0*SC=S(;baMFDvT!qq2siC@p>3(+vt7jT}LzM3oX!%lO!H+A|HdeO1&d4jMTy z-RyjxRPjlCl@yKq-s!MO z;RvQp5-Z5yda1Iwar?6@bpnkq782~SFVFK{N?jbx)A~WYp_;7uP#C9x$&zQL>YeJF z_=4dJEUXnf_1Muys&F@pO|hiZ!;VjST(<4J+V8PK^+ux=a#SHZt$@0Y$uyevRM6=Y zJRuez_a(emm#!Z^}vE-Ml(L`2Y6@!1Qfban>OeR|=x$U+uqX!TVnes|Ppo zN^0e@54isrGcTgU4affXG|x{r>_Kgr5d8wx+AnWyu0qUB3wF! zxuehhr_NEJ2Pw~@MgbgOAV?V)1Ya7TF=)ch2i^rR1-L?MX=gNl*WwcRlmJ<_aZCB^ zc4_TKj`rY_V2&Qh6G!yIjeG^JgyJ@+6M#!*wg7$?BpwesVO`m~CRSF$%I?j3iWUV}yf=x2%WTM;Na zWKaR9BND7_FK^0$_k9UCsJqa%2G^o346FVYs^GSTTNA-wepT8J@QJXhDV}&N{|5|B z6o)zE?RCgK#d|*T>OXF(L%q~+>zuGC{~SjR#~%;{*MQ=&TjYI# zb_7z`_t3;^;!%cn+V{wTbD$c8QxpP9R6Ur7P!>RO2k`>rz^2^KW33|Ek)P(8UeP3- z1Aq^sS-Q-j5Y~J$a&=TJOj$c^QL=VB+X-;TI1&5tsb2qPGY#qYz>v80)H$gQT5L^aw@v7Fcnfsrcs&{y`XYNCF)k5U4@cC%r9~<&!17K zGMojoJiW173qxlbnH#GP^M~t|#NOD>5{QlHu{1NAO8QAIU0_s~ndyw0wUuH1Ex0q< zWAlPl;A^Zw2j1o^%Wr2Ty4saSewHyFL|g92^`}6d)N8|8fK~)%N)4u5@%Qo|E|j)~ zJl2CPmkYmPrjeM9-e*Fv<&fEdtwcaQPKZw8w-ON+vs#sZe+BaXrBPs5;U)<3WH4L8 z!2n(jy$kE!7>$^VX6Az{5CI2=mS#;i0A+>>fISaZXNdm*%W!dXnYm%XnM0Nblu=9oqK59JC#JM+u&wkWE2>z6N9Aq zHE*6}WYIheJ>%J92cJ$dmnn65=bW_SKvG#s2$5w9@0x<72m9azj&^2Fko8F=Lc1B< z5)rm<=BfkJ?%{eFM-`wzE%Me16;=K8e=u`q}0QW+j0>v`bVC>`jpC z>H|YNZvUnzZ=gfr08Zk^n%azEKZ3P7!o#l<@u^pohF*911A@njdUBJDe31FJap`^D zSQCbp_+1@Uc_0geEe%OWn?VxAX91~n5;32Ieai)DEA9*slNDPiI7mJR^bk$$vQ96Y zVrE|DK7wHv!s;Cb7@74HIEzHU{|-l@R`@Yue{tPi&4Kp@cz;6_h^~VJ{Rw!9t#=^y zM=}L=avv26Abhj*xIll|wE?Bv5|kit$hr2l8;*@10GCu^4K*9$QirmjkPlR;dO;;m zfnk&+fr7*T8mOid1mXQ#1u$~TN3ioE`SkE2BJ3+z#kK*(HE7(9#7^!(+9AMK!yMjvyq0DyfB|u;M3Q#+!Mk z1!*7M6>|MV6vZ~B`1}!?2tljnr6H3yXe{lAdmqPNg|ZXoUkD zqB@1+3L`6P1c3IMLw}}lws%0KW^)i0cL+7c&NF=eS}~xoYo4P}h{u!qbvQz2o1n@n z1k);b)cG{8D7g`|fd2`|zzivw1XPFi?KwRtVzoD>xwdT*E(U6b%oDZz=-@zynAbQ= z-vu88s^PVtfvazY9oY5CWIXgK`~i^w#GOdE(x90> zL*8+)FvA0An_9+vK;EPVxUhqsbt4FF`|T%)DDQ?Up%zD~`9DbA_hhsS|E35H!h zV^uz9+ljORCiN>w$!ZysLYp^&E;^KqhaFtn>KtT!8H<_4n^GIU! znT-QYFZcISg{QAG-6B^eO@IuaJ3`lYXkQ>EL05qdlfcjiYhIS#6W~Gx8(6nfO$L-4 z4U;k%?K%|6coRP&I6f=h1Q%ZUp9}9t8aZ82dT3SHu>dFQ%|=U0XCtx9;atY76UKSe z&`VUU%#gX+1G;H}@dqYHX3%z2GXXIL?FYNOVhgZ-N*|h&XjSmfy zMeXTOh9d5FN_7kj;?|Q;L}NFb1Q%}oP^#&DW^~ficdTThJamU_1(hug0$HcnmeZm_)@i3LhG*qI!U)FQeGAwY=3u~Xo7?AGe zQY_AW&f+9qO3WUz(Jx?_BZ3fjaase`r*prb*bCQhSzXIW2)DeWL`ji zCtNQ|u$T=HG93gJfmPMTO8>)K>IY7y4|M;%5_l$aG z`jT?`9z%~Ufsb3<7gX0=(pCUBS%dPnC+4Qw{0ist;7vF}o;20b@DqBkj56VgVP<1n zgm@4*|4yR4!(by5G)*id)q^C3P#^HsC~#8!n4kD2>mn%26!O)4W$(1uU`h;S4#iZz+>uW$_o;K?lGChX5JCY4PYB>j?*+ zIRd02oM{}2%2d@;j35iFc#98C#%! z-G<;P&i~wrjRlil^e z-x;VMIu29IvihKGxbD*x>oz&YX*^xf6#Qio}d_mA0aki)eE40;83o(H8UD$3L?Mmc>sK#V z=b5k@Qd7)3MOHE>v7Z|QIA|Ro$k^t-`P6HttaPk73B&NlnfpSBB;~GfLq+Mee{L9! zQDfL2z4ucu{H9)evGQ_`Vx!v;V(;oJo}QuH$8X;EPq@T>JHDCoawfb*OOUPKDFdY` z!y{jciLX4eZdZ;Al+%t-%w>rjIwSQ`)8eCRI{M}I!;VXR*R+Z(qz;>N9mmSM&20Xx z=?hwkdEyz?^Q@1IVs{QZXIN-<8(oy~eV$44ec|Pt%-mc<+$rhY($@y3Gwl1Hks;UL)4;_x)w?{XcobeWlOvXat~p;sMY5D^HS$jRdwGytOrbJ9YOMr!iMf~oqf)*AQZW0z24$Bif zEG+ELEO%;{3)nC%B{{4z6kr>3@)#nkDvO0x8AEt$fr~kR3Vmw;!@^?v^Y4xQ7*U;u zh4qm4PC-`Zv+14*{%4&Jv#7ENx2e{~pKWDsJWcxiR8(#~Ux}Nt*=aRp^PYTl-40^a z%DW)Rn$nOX*J5IN$`lnF8}$A4BdaG;u|5x;ZQjFapdTRHR~CZehbPVAn?42eAmCE7 zIP8GKG&ggZNdr}~EWrK;4nZN_?M{~Fto6lcL!tcER#qAg4%}&yo?3jeuGgowwb-yt z)W);gu252#Bp27WHOviJRgmFdsH?|)6iqjK0)vBsMmmED#fiIndNkG4Ncz4-M2HFD5Zb}5Ea#{W7iRGEE#_jze6yvkAzD82Lh$a$;(Gs)UK~vxub>cC!w^S5SD@khzxHXMj6-AL@OKs#7Pm{d`jsDp$(AZD@k7bT$Q*8NPlj!e zR(o#$K56%7&t0H#n}iprXO#7od|~^n%P&J*LO?-9wNn{^txi9PsW0_uGM?B;D5Kxo z80l;Fjm^#RA<-qI`z`AW30L;Mo6~K1k0oDG(CKb@o0@8hkOc_QWKabLc<8ZP^Wr0A z)&ok7>c;NxZqDL`wY0Qs4i{UhA;S!6)D#qA)y(_gz1f;?9R9DeBde+~mr`%G(PWhK zF(16$hzH=5cJ%yTgB~PMx7MoBc?-{Ngza=cL8SffCAk)hv(8+7=q#QGX2@^&rmN-khAJuznjE4&C(AaB z$iZn4A?YAqX|lZ@gGS@ji7=qDfVySIwzr}tjjkLmr(?>eBl4uqhL47+qXFU{r^)c& zM81%fmX_8rHb!n2W8LGtTc%MgLUB7OWSzg3IJu5hc(1yo6yyFhFUo?$_3yH*gj;Qe zPP&+h_hwSkHqwpw=;+8R(q^&QGl7AsIX(c0f57y9`iJ}`!LatOL5!w@9POMPP(9qA z7J?#-h*_^jy-TeUcY43fw1ND99Vy%NJQo;v6kasZdhvppr$JECG^j}JT<6-LnZi}z zS;~pu^Su|JznsK=0(px1URh%CkS=U%984bA028E-#%E=XC*y8&kBAHtUUk2ePG#*S zS2cNY5bIRVJWCMHzt^X3mf2M+NBdp>En!Ufr?F9(&?gwll_N+&w7E6g4skUvUYfz8 z#K}+Ke7dC>ZK=a7DLHSU783O5I|p}Nr-NiQOOqIS##1mo{?#J!m+ERE5^NQp?`spv ziQFp{#hRm)JIVsK1AEByZuu(+2k=738X&E@EndLRb3;)&<1x_B_XnOOmZy4hszXF0 z7^H>}>*$iY?7*qE`xDVb4@EaOOES0zsXlUso^FjcD&DMiz;Dj?e;S4D4tV`4aTqqf z_=p8zsI-$w3rkk;M=rc>Q#I<6tZ@{~V~}(nRgv*Y)cQ3%wi>&D7l*g$_|CP04U&$~czEwiEXugP zgpy@%D5r)=pqfcCjv%Qnzdt?)X^FdOV`5IR57IH89vG6srKsRC6WgXiuMM~M*+Rju zvn~7&{bQqye4LwGk2DY*DmFJt>vJwTHF!y10di862jxt35_ycHdRP zY7axp_Zg=z(^5}`6!RD?{f@N#uZ;_;XM!@z!jQRhW(LJ`AEPAk^D{CtAJYZz@$!cW ziJ6F1RY`F@AOd;B47k44q9~~}@55p1qPu!W87rTE+kXfcfTu10;ei{ZVoI9N&Udx2 zSLTdxP^JEAG}gd!sHt)-kYr5O{LMCDvmN<}KowQDJ~0%|;&2n4!DWHNGuQfr6XM<( z5%kE*XTmhvvWiy4+;*;(r=X>|IXOH${B#DAK_ha@AKwLIZ}K{`^V+NI+rlhw%iFoa z#5t*Clj*#BGzylr(V3Jjp;{JJN-0%?Zy4_@5?6mYRNI|-845$5`i@COj&pThjNA@6 z1Nag+ylrPmM%AWjPJ@OWb{hY@i7RTD_&XRZe52Sy2AzsZUQbGwbC~ch4WG4UWK%@YS?j zubt7!ECO!;hzfzYE?avKn%WlJ;5YLsGp2vb0HNnxgWt5k$i%MCzjD8Nzm|Z>YSD4_ zzfi;t718Kuwbh9|2C{4-8f^{+q~BF$|FlrV^c>Fz%z?Pt?&f15qJgMi+SPGKSs6mI z=m`5w`LnZdA!e8Tvp0a}n@Wz%_wJawBW1-!&DrXgg$ka)=P?voohz`!TTA(mPmPYl z30WM>p%GD3Ws8b!kzsl6TqK$rE}V1c=!|lTp9}CI^{tZF^mLT^9U2Mm;!;Hdi+Rs* zQU@ESq?PcNkvVz?S!cyiMO# zqpneO8Tm6OCi!!`?jdwY7!)lIHHj3yv!rhj;LQ-}o@)?T1VgLBjk;sh0-w6$u~O;_ zzP(M-XD$o9NpBLK`VLb;G@Y>z5jr1@SdG>CNEK_)VM9!55|n<{GLEtXXkDRy=`(9! zskUOCNV1iY%!SISK6;i1F*0gbsNKrC3Sr+OH$tDBgdSnD=ABB9Fk(UxNH{>Fq2M_t z>KvK`XD~A1Oepz7g9tXN`J;Dw`mxVrwshB0q?bO^TZqU7ta3ruF}?6H+hPK25(4n@L@LhlCu!Jwz80oYj;4coP-k;UG}IMbV%WPGNXG0#lHT2ZY3#Mu<=*VX zgl_K&;b?|BXTA96~Z)`#iCo-|n!-h{F!We*HHO6`v{{^JbsPt|nT{Axvi1 zkZhl($Ch|^nxxaUHLUQ#^1{xb1`D4AP>29p%0++0OC5T1wmUVYJ)3IyBLK)pG&HGA zTj7LEs#B0K(@arZ{GX_GIfo5uPfUk1jmE6Hu~Xs@nU3X-enve2@Nei%(|guK z(EDe+GudkoOF%^C`0V^8N!@=1m`yufwJ3{EP zdre9o?&xX6F3cRzdV@-eIe2XlPe>F=?JN^PEz+$`YVTzi9rATtKorOAq|gxx%lZvHB_h`C?3MI zQ=+e^E(CaZs1pB2wn9qtyu7pFVFYny?%^IV<0t{E_dN%lj_;Pkj5%SZvyZQ@0!g=b z6PGmG{O)Xqgv_qNV|b-8h*mW&zU#hPBnw5L#&5Mx;q;vPhZ;&Jj@=Rf6mw-yJ0d2j(K(;oe_)`+i z)w!=udxr>Ct< zfQIl(ytZP5!6O)O8CeFPiW;Cl#STjT`Ngp)ml%KTEhJGScmNwEX;oQEoe{Kx zc%ag-5p&nlj=GWfg=7AfB+Drh`b35?bfuDI$yk;yd%Uo(kb{E9!Lq4U(f@)*RiJh8 zjrhdT$>&*|(9D;mE@IZab1KUm#c_ z8ktC;W@GEY_GXyN;wKEX7ajn-NFggN5E28yj`Hb>Z0?41s?Vu7qaQ*dE{M5Sh|GVt z7WcML)hfS}r1GdO`V{h%m{th-L}0>w$@jwfRtsAue(({ZVNU1fOL~ASde!l)NNfY< zzDoG>6N^M;Jc_R&jlh2j4bF7pylI}-+qimWC}|cHexs;oH7jU$vi*F*LYCmFHSYqh zC>?fW#ixl6ll*(CUYpnB8|k9A&2)U=cW%;Eb~b*-N7h>uOnmXmKiSUL<}S48GR9eB zI=?hLs|WjDh&7i0F{52a19b;up}3bmmpDIuhQGWQW^`BZ-Ob8?=8+3S^-0pktbKVN zB*Qn+?|PeUvFj5uSs(;Bc#XQi%w&H!MNxs!3smz4-b(w=LK|-w880j6v$L4tEJ9#S z-^}9WN-#b{*luxTxYCo1lc?<2?z@Q|589y1$r0AG^u4qG^W&V z-^w!roFk)cqS;$1u0&G)j)Ejp1i;#O4_MV32OBITm5l!* zr<A}oA%e4Oud5Lo{Fh`LCAH_3K%@;}~;jJD)9EWiFu!IYOd^tzUJ(n4%g#~mbm zQXjjAF#a4~E_owncFRP;B!&8+=)d;CCn!opk$9zJ_VVX0xUgLg^&WzCGeD4;=xy!X zYq3J{{nrZ|HRs&NKjRWyz$zE0{<%RWosQ_aC%3=>OeA0R=NIonZ=G zL4uV?sJc0SZ2g@6T?)t+sX~EZ)@Vk{7~Al})*H2$h7geno$I;C+qy-sZ~iKxpXT-J z5=o(GDx5u;e(WZ}C3eIW>k9H~hbW;E6$-$DFc7Oxke>kS&cX$fV??FJ4N_yPV4G^` ztKlD5UyQcryC=Vl;ECrSs**fOwSQDpROE$>X7s;}qvA7FQJ1+Ba_VNIuf}L4y%tgd z;-BzDjIk>kdyT<66Gec5AuB|aDatIUZpkmz)c?*+>Vsc9JoUl^Gl5^A0C#**nxyuT zEnnD=4YU8Ia?@j4GaK(Ylp^el%qyLCx!zmMZ!T-^B$`r|af1QOlyGi@8If z|N7~F6VuDRse21inY%py9zBZdt)SC7+t+&wNjBEdo8*sJL z(*5`S)X|R>XY)i|;Vg=cHdQWQ{N%bP?d7f`o`YCIBy{ZlxBD0sXS}~Fxf+(15>mi^ zq9WQf1l&Y5KTDML_8|q;}&S}6>88c9;k_Vir zg-#}1cI)%c3Q9_J^GzP*pWK|<;YRo9&wk-6$T;H18QH5(oJjae+Kj|bmbzow+r-5l zl@lDD3n#LF*r37^R;+UYOOlkcAH6Ku%NwOcMiZ_29R8cN1p;*R)Aw~BPCG{O+?Bu( zKSLP0rtT=_H3U+)Um}c(Z1_*tz4-}*F4_WG3pb!e&^L-;ES%%2E`Dd03~g<5H@+#S zCCYGC#!kn|)J^ddn>+>b)1~GFm*i40K4|6=TeYMQUX6ozAgzc)Kci%4$jb%)9}Lup(c26wW%Am@ z?8qm1Es8%vgqrU_6X>;&_(p4r8bqAcx~=8dJFnC`+mOPhcN0C5q@~8n7Q5#O(TRgwqT?Q8au#9fw-Dwgqc zB(GRmUAE4}^qLsjlBiv5P&2Z2&r1Op`>ZX>)BHgZ$M4}6q~o24-wKuExF5RMf5A{A1bRhkvz9Jr<=*s(MogZr@L5Vg*eOE)1HjmDbgu*Wv?Zw+RXg# zGux8mq;scnZ=F%^fTJI;RvB8Ha@MZ?b zLF-EA?0s{h{a^GGO%&15dh|jddjo|lj4Opwzm*J5|BF+Rt%LDZo@}hZhNU33<(zUX zrF$EBY+^tP>cc>tB{pw-I%i0BvkRC|i9PDJT)(0*jb?AWfV7;bFW3L)?bud0is(A{ z(DkiywoiiCNq4_b3Y~qr^oTtL&v3lkXxSj*5Rwvh!iI`Dc@%h{&H=}{t z%P+KpB<|izrlft`s%+immT^_j3j|tLZVx0x&q+4m#0%;HrautOM?)wp8;6` zZv%4+Z_}?=e09G}tSdUShY3=p9RHSk%&uMI#F01O?hu?@+kav%=Tf+huqTrKW6!It zY^F?{ZmU52aDf+<))qx8ITyD5;n1*S*Z7&|MyAc&7|F}w@8>rYVcs4-s_rR^GJ(1q z1Loo9L;E&IKg*iF+`l^5T#Avh{*~l1)O6q-`}!%o*5wrt-{0D?{8I}3dFr7dD3@CO zDv=$+{Ua@D|K;r+y= z3l9Dk&!JS&0Yq;@XD@ltY#D8r&| zW#}1d?+(j~Xk5EJtaF=y zZqYI?EW;nhL<3*4TO5+jzMv`+2O@?BY=>Mok~i|UO-qZ~O!eX)RwADrZYH>1{qV1A ztNSW7wZzohhjj~aP{1>HIA-4> za`@s^-_5V8D$fdr(4N7-l_9Q1N(xTGZFO+6sY9VO zj3@N=cvZ&Cgvqpgk1Sb}3F5A6SjZUd)4u+)1h4nI6BaX#7OwRZ;W{mIEO%}iy}}oN zzpS>A=(4Z1X_&0UF)LkqL;>Rkr#`;U`r9Fqvpiw&D^1LV)gH(X9H$w8+Y9{Vqb?>2 zT67iOpKXabx3Yb>Q%e``1Ks_HsQ51#TppQ=5w>84#}hMhyt@RLO+4@Ze8Z15QmNBt z53k?Qnq{^<+#LcQFxajLGMqlq*5$3_jI8y>**{AN>37_$D!14-w?BG;hyk08gJ+)f{tAm0wDiPtwvBa8 zDMgXyZ-Z_vu&pLa=s{o|Eg}4C)<^lo&0FQg?@HoQA=Sg^*2A|o~5X;QdSf@?K*!VUB;xAuJ zB_0)j{WC2V@I(D*Irn9M8l z$WkdnMKZ-G6JJ4d^8aJ(H)nj-P4*u022ea#ZYHB;8>=6{!PvQAn*fDzHt_lZ%-p+=_~yMNh(sGSF^+2wSNr@Qitw=c}dmR zT-E%TSRfe!d&+X!9G(x(_;g{etF2!-Sq@a)fRaRG@T!>E(3z28`S?wj`>x)XYPBF9TJ<%d*{HWt9cnXKhwQ&*!p2B5tc}2n z;)dk4p^0U4@88XI`fYLdgiDY$sY89x5h^5c(W=7`5);2@FFrB(G|04L0@H!2cvYyZ z#7V1h=`Qs%a(R1PkNu$>3_DVp3zwUvpj8&{6bM`;d2xRHY#(oL00KcFrQ~B|ZWux< z@;1|0+D4=h(eq@(7AkL~H=So5-1r9u&UNwf#-^{bT&pujRwNR#FeW$96@BMf!0x>V zi8(-nMQ&xxOv9N5)_g~ zO><=y?8OiSKeADTn0bmq z8MpcQ&i=9{>^qVt(~;(6N3OU^XOZ?;&)EE#Hh3ACr{2hy%cmeC#>+a7viq#f!4SQYkjrtd_&s?WgJD(g!5=rNEP z@4BGPPrckI(|aosUqPt^=_^0?aQhGOc@igIaPUv{7i38vjKTk!kGKW8T0AItdCmf^ zt!5nz#l3{~XU*DW)+Hj1yN=B2sAC@ntO5Acyk>(Iso}q?KmPXGVa%HuQfM08?&E3D zJN35q@tyGF@oP_i_+8EwRo^g#;Yi}ST!UI^Go0f@DtoayP*M!2^10=v%)OPvz1h@| zMcHw_rF;8Zynr{wMpUG#{d-X-Jk4<~2nd>c{j-)Yk^0ZjUss5q!>MV`9QI_0C*c@8 zXPl7zbKMYb%-HVpaod1P(FdjPQEL_Iq=R{;u;)d?-KA<9`;uNek}Lpe$nW*%)bFP| zNh#thzIdMuYd0}YX+k4xrWB^R2JM`|&2Th6uZyq<1Brge)o(Lf^&2~Kuu`IJ_{fNc z6xx)(kp@?xZvsg|6g!qf8Cez!Xr|ody{Vd1=|ZJVEs%tPm?R_G)=P3@^_;j(c`qvEuL8o zLLNVbH)Ha=e6iDv47h4s`)oUOdN<2$4vvoA(Ta1FIH4)U{=Iy6j z=~@xh{lR++DN|;z6HLMtt9%teV?R1Nidd|7W}dU-I$sOo(7wnPxx*?^{(ChMs`tyd z8pu^ojWPW`G*WSCy|`oL)fR%dUP&0>-Pa2_4j4~J0?@KYgi2z9#T@6QSoI3BtT$MS zW*SV`1pip37{eenU2ER)Xg~A4Y>AKO*&n^_Q6C`)iNw*ze26Fibj0bS0m6!6>82#ZxfVSEDdKd6dMx}Hj2b*w565hsC%{fs*5BHFW&Oa%# z?Mq8$F%7*v#%)57-cTbweQT8QlzGj;p;i_*B>!?y_@G&?Kgrx!iYKzD?`omxX6)8% ziS6)H)%NsC;QIc)vb3pm$d9+Z|3w~c_>8FMw)k3B-{u-n@O5q~B%vGqrDctLA0QL* z;(UxU+8{r#*-!Ft5z#xvYGB~`%*$!2|E8~aFoPRwz#W~H!n}Dp zg}54dF$B*kcftHN3giEBewkjzbzQv0^=$GuoYX!DotV&(%FhxRimj4^qY!^IE2Ks{ z7!=;c*q{)=0QUFV=<^o*F@FYMxSuJ#x>@yY_y-S@;Z57~q~RaxC+Q)AZFhBe#}-9XEA`r;@X@vRvY6%017% zqYtY!*PXmjn!AGn&No)LPIA0piAe|)#O7j$c{`V{C`wzFz_Eou7KXP5SuZU`YyeoySn;3dO=uK zsMM8VJ3Qbg1a+g`c=dQ}F>2Ot*rhObZtQT_^HReNi1_bj_ZT_4TR??elvoBt(DK+83xSR+Xt^)I}u_ zoUbU6$U%yMIq2V4ne(ao3|KT26x~@(oqw=pYbdQTfa~?fLuudCcUf5 z`SYJ%^et-4GL{l;QgG-;+kz$y!z%2R%w8} z(brFAH~~Dy$KS1tzzOwz-wzLQd2#qLK!iWtED=cU^pg+ZDK+~0PiMH^NU(KXI5h4u zvzjr$rTFJ4WHK#~1JOH0Co-x>>3nKXbDV9)BX^*52zdA9sl5$)l6W36xr3%Xvo_Mw z)TDNwxad7o0PHtQzKV3Wnzrdi%52e;hq6O;`34r7;s#-Q`06Z2T`@NYhD$V#{pSgS zNspQ}Pd0})J=w?L7V@<2-9snvxY|b;`JYdOOUZ~?DLOYs=05pkL{;8IBid}RHWtr1 zojY`Qpm|vOroZKCo^!zJ`#J8Q%7Q@i8msb zE8)MzYet`}WOB_pU!R3GZ+&uh;_**^Ye3kxc@u<_4M1qzf3|E|jCR$UHf>#@wY$Hu ztDXB*`)j`@4pej8iN}WK3t}I(wleZE7RNkzjrNF1NA-&s z+-CoY_e94yjZa*)x%haRk_?*%0=qN;p=}@a^MsoY%wH1GT&GmDyx|Eg%l0@t&sL=Y zMM`LO%wQWt^-u@MZwIBU<}5JrExo4coZNoy%&}JRQyxzBQb~8dh)0e$e zf(axsw;|bK`@#&EC&o^%R@5F zHFY|<;ib1!7hEd%JzN?4o^lcoa}fhn$hzmjxq)2#DVl_zHBk=2-?970Qz`85HeA5l z{r|CUc2S+`;bRoye_Wn@9G>?)(CDF96%`8Og6Kj;;|Jk&JJA5{u<)x+_&1yc;FPBo z7`!8(bhOG!>qcgLCm{Et#G!Du8wbt^LvZ;?M9NBnA1d|=0vk6EZYC5hk7DUnK}jI)fa3$mz&1{XrSCU z_y%0jTmDb+{oekyNPDqRA0ENX_`l`f?gKhSTBN=#TLlt*Rkvk$8)^VB$*@V?atT^c z>6zOFiOD-c@(?smfZC_AKXwE-7`N#`?k`e1{@a(N)-R(BqIVL}(AV$JYI1l9^g6X6 zIa2J7vpE)yqydJ=KScyOhDb6Rr3WumLDZRz>!D12Lv!xGuRk~6t;NVlI8dD2T`Y}v z1mZ_|a}ZifRB5bzgx)agH1BI3l~d->X`qz=h^$)eGq@C%wK&Xq`AkwKkOrC~!p-JK zMCH`j(LrMe`k!fY1^-~Cb|Obbjz;~rvP|c+e#^ArYrA?Z70`1VA360ScjIRC*BLcwU z)6#~bmzxu?CKs8abN=J^#}SIrHsk!lZT$51G_1}I^i$*uUj4PR*#@DJ!zG=6TdJGPVnz8x2sd<08w#;(7 zl0x4gwo1ck=uP+Vgxm0Ee8cSW9(2RndZ$s&#pPF^{1j$SdLZKbv!iS+aI1jK{=LsK zwQ8H3eG}b?Wg1QDc=GrQ384b1r(^IRRl_tY)BY(h$*YuomeW=KV8T`2LP*|9D9X3q z83vI}xXWYnkS>|6;#^q$3uQ6aqDFn2iSz6=*SUT-OU~to6!%?DM@noWYwp5Cxt2Rf zz>KR3x(;kaoeh;??Uxllz&1uh5tos#cp{OnMXf+*sjb0@Aw8oE7K7pG3aO{ZPavmG zZ+VRD<_5m<7@?k7kk=h4$j7lw7xfSd-Gv^U4z(McF5D2?Zb9g`lr8$sDx6imo7QDj zSj0bO3acF@nSDJ|Y9QY0_B!$oVr`x9jopj`V%p%6#{hdAt=FDv;}@XC1#SNLV}-t= zyquv3i@-R8M*jmp>ChitLvbLLNb~6O0=av<-U1OYI<>ZBXh+`FCWY$Yf<;2|+m>rF z`*Ssl2brPtf_<-nqrjYMjr=rcUL!H*>cXnXt*~b})%aE)RtGgmFo6+M7G3%*q2bSL zyZv|1Nvt8kBO^uM3=+CLxHB!}t1GSJGp>JE39TlvR_`Q18YFdUY?Zz560?a07RD<` zYi@U_X{URVT5YES9U9=LZ4b8lnTR2(-_8?GBBD{I8MN<8Q-p+jE1l_s0`W+5f{lLI z97PkU>BVDcc_fi}o3O*}qt{WRPFLsa#+ecmi6sKl5_4Q}8FV##cMt5Q)79 z|1tfolR7%Uk8S#t@dC{o0Q-!vY z>JH25#aJD%OTmv^m?qA~SleZ-H;RQ~no`r0qbf9eY=MYLMM>3`W_bC&X2JA%JgS-5 znKWu9j=eq*FUU%>qC)D*%4q}Xh6{#-5DY#&UzCpDwmHf8%>?CcE&=Ri-NC4{K+aDXIFC#V3>-E+t z*LWazuGcUe~7;CO9lI#r)N9Xl$jMl(ZowmCG?a+c~*4Yn>ygC0{nCJ5$h z-)r%ze+L--SL2J#%Dt4=rZS50m+ew;76grv+{$l++&*4<|Hn#!+Ar;IBGc6XQ=y6z zpR-Far_-eQ7-Vfo+_&P5LSH ziEUA6SCoGKf;*+#!9-wLiwB*e!v3T~QlQ@GdViOp?-jb;)2Tknl%!`u=ZJ3*3XYrd z!trdGG~)Z&;(XYALUOpZzIWQncTs?xCRz{>5&<-ZP`%mTcxLMk?jTg`5pv#E>uM10 z`w?wKqLfHt8=dt2MoJ)xFa7SGp2MvCo&lbmoNU$2QhoYog1g&FqVCF5-k&;aEMWj`YzeFhZ3om1OMYl|tze4Ck%sn_i}=peuCZjCqkVK?r&S~aZaxw@1*spP5C;6vHP zytmAF#lk~-;JQi`a|4|)BynO1`F`{$>gamhn#C67k(t0;pBb$E4w9(mAO=KCB%HWl zcJ2DuiS>Lxr*za(mSjRNvF6GR*ZbEkKN;5I9Wma}3BqrBo(lQT6-up#C zZ}E9oXw8zAK5f{EH5NB%H%T4F<3)=I5QSAat*h1Qldv<2Wh+On9j=eb#p4{!J-3Fo zl9mOBN@CItWdYXPSoy0Q>=U}K1_i2`AO5P;pJ{|t@pG}W+h}y| z&1hI63I5;##_~0!{+(7(po!^3wghn16{pHf#BVWLrg;1dkUMuM#@7ZqJ$@u)I~G(o z^EiZrejqD|n^}}ZVAEr7I&L?GX^vxGJP^ZSF~5R&kS}mdTfA!0i^V>E{D{dB67P-N znADeu+W%1ZX<|% zj&+_?4(rNBc~Q@Rt#`HEEgl42#xj$i#I;J*_adQ7EKB{8w?keSdZQpd&$eTp%J;gJ zwV6~uJ^F%#X|JAlZ(4^gb`4!${tY*=7xc~P1NQzR1`m0?U-_6BG*h*rD^KH69;uA` zBzJzWi}JrP>#PzHPC|}*0)qF+Qglf=$y_hZpLO^5zm?jcMKctA{R)y#w+%3pxa2jj z;=48EA_egdR#bB}vK`q|XYjpw#?MTY;cE;1$pBNulBXdcIKT=MY%MGXYI+2ut&jZf z=1tD)&`PG}*3bOc`Nf1=;#t%z8Dv;Lz`R-71;b+ka~$ZS=LI(C<0l6eUoiPZmb@ti zQcW`y)x#C^$ePjH8qIaa^pDes2B=9j*%F!dHR556ABI-3TWW1d=VU}=kOhZ^j*sRj zDKGGlU)4Cz?tRZwR&F*mUubl5;M?`oNZS?QVy`De1bYsA*C6<&S`ZLx^L|i5#bR!? z|E5kqVzDO4Jr8_RE+si1QW#AGOKiQ)Vv`#GT*g$LC-Bg1ODoD3%gRF};(%ZEN6bxC z{%O_Muc=+!$f5>?j!|z8R$E3&#?!nzd=f2pcM@Ww6MA1@0~60o{f|y}YnXV?tTGFd zAn)V(-i)MFB_@ai;rDQNA>M7^iUm+Y$zqb2fGrn`-lxCWGN6Xi_3hijSOZsASI)+d z9Q`jAJS6K3)Ubtc)*Lc?&uL6xL&AvG&2;a}%->0-Ug6_z*kB8id3j`D=rQ|Yzkr16 z)-y^9L?(vjjju3^q%?^SvBR8^brobo(*|Rh=pLFYmhHBausjn>X}1hody8_hzU_U7 zx1(db7YK@4l~BPvU`DT^SU&y9J_dd%u%W0%N1s!(OLK=D6Y!3xb#(Q0oVY%zPAdR( zIH$tuQH}MM)iAzMs|O%OvZ2p*P(ula(+2z#n&6n7Q{2DdSG%!eW{IzGF@dlfeef(U zmxa5BntolzE%#o=`CmQ@7{1>WEI6-4kZ9UO;fifo`@FKs_3xH}1azHypL#yYBjlIM zumvT#FMlo5YBbtrX^YuXE zR#teNcd=a%jf@8$o^Z>5k3!qtC@Jk04d8Gw4n0T~6Mp^`#Wqgh_B^_?IfG;~BP+Y! z6Or^|^E3N#ZGB5;{s!AV7j*geIQ7=$Z#m9qNIo$orI?I7c??04%P&BTpr-Z7);U53W98zPVC!4iqM%pQ!wVM}d_t4W3{S1&ON&DYCK zxAf?6e?zpOuxc}8XC>p`8ex!p@iYrmSC6}C4dBcKvMI2=gS=JYoFho`c{kUcG_R7n z#lgrWrkpBgX^Y84+W<%@X4LE|cYsLa*^Lsq?>^0Gzs7DlhCc&GHW+FqVgq9kIdJS0 zexn3jO@Kh2qj=_ zU%faY_^Lfl+tvO0n@;_uTVut!)F|jaEJDP;b0ygAaQw>JX{^B@ibG;wKkv6ZO@jj0 zS4;|?)ZU9InwIpgl{r`tPh#t5%S2OYUDDF&jFMtg)9&?seFa#pIT%J&;Q>j)tHd zPqU_p=!U3d7TRniqgrn)N-=4JsyWYeEs|=Dyn9`Iz5V`>UC`0Bee2YAn8+Q%#A4po zr+58Lo2j-s71|+pujSP!lsqCrr^ zAYLCm`L+tG%U+-^_&SU)vS0XM_gnh7%}9yc#0l5F+nUtp5?D|nC`vab)h@n?qNJL? zAaABEmmr;xqhAa0^AQY<9JQp5sdb#&5f~1x;@<>-RD+wYN3Tv-Tvys3b4my$M7TgS zMpw39O2zS7MP_#fVc%+${Cdm}WC3a`KhWCd@Iej*j^hsMhAN}ER{cBY9VkD( z=@3tO6*R*+j7-KcH25jWWw?;jR5{ieX{$bcs3$9%<%O9KrGDd#MI zdPMYao^$x%wEN0m2Z=VPmn;lo9k*JiSfNCw?VgNJJKcB72a7!76Ej{=BCV~iidhdt z@7v!+%y>7;senx1J{M&*M8j!n%((0mAc{Y|UAZu6q1z#X6)p5443*hmzka1hbv84v zy}~V^n4m?cvFCQn7X*uC6hFIoQc2&&G%7fZ+?Pw%{5Mp*k5Pt;1zg!as^j~?GtGhY zfamo(&+jPrw%WvpUo1lNgTzV94eDm&DpsLXXvfvf&l>OdE$-njBV^pae2>ooE)zY~*nfg)9=X(2>yx|xo zJm!0`pp=!B)u@;y$xnE)L$Abz#Nf;Zu*!@v7e?-j1iiUWtQHXMZbJ8J)z846(&CU4 zBpVHwn~(JX*)`WDt)kEub{|d!44=6Np+61PfZwJQGURzOUEvM#Ab-?;*#Af_9G{h` zA)OrT`Qeldy+dA2wQ)S6Rl%Z~txYx5xyNWk!1LH!-lw%A%K59D>tMD)X5Aj=yC(f_ zuHx*$qC$BAlWW4^Q>1Ze%#Uk|#Xy%8ESsPHxR$>U_H>Utr_jqfXfF;e(U8K_eqi5I zXi(aWLMgJZULnIay-hy4w9T1?0i&^eRx*tJYzr)3f6DkT;gY zM;tl?W$NO8rY4~&leo*iB}B-tdr~6uPhrBH+{nSY8Fc~8zW_|Ko|UX=(}ZbVpYnYeundaI_Bq%7pW-Psghr$ zzVY1Tkve+xR}RZzpPjlrQ+0+aHa_0Uf$OOf{?HW-4Gp3kZNpVh2ncRCrFnOGZw}IS zfJYoYj)r&2mPH&4jV$0!Se&x%2)P5#5C9b}y|Q%^eu3}iyrIL-GfDvh8d6})pAkH+ z;^!mw;6YwyuPT32Baz_vKa9O)SXAHl2Z|tqv`Tk~Gz{IHf|MvNFvI{N9n#&c)X-hh z-CY7hBi%7{ci+SJ_rEXhyUUw-9vIHq=bU}^UTb|~ZU4wH@>L4Wadd>0^J zo$Uuf?J?CttHfrx^NFD_1V!nfql{{w|67S95j4Q3lwX1`Atj)~=|DSjkgGM;`^Jp6 zd$k-5?Z3ekdxMyqKYafL#akemDMy>P8u0Q~&(~7;dxmAAmC_Kzc?oMrS^$WXw(fwA zT_`QE>cK#A4r7+QS8-^%hd+w%N}2VfH#+Ieqn~S_-^o_r86o`cx0o{dw0_NZynG-X z?VS!7?dP$vhGQX|!Yuz*p^hbrH4t$^Y=~Q2ZnTFkXmc>Hc)cFoBL%xup=3eWFdKY` zNDs~9>F))XfL_g1+Y7D%hfl(#McZk`?BHHaZdVwb4Ig5(qVn~O)I?|o;kdezOG-v& zm;FFU{ATl2bi66X8nH7U;$O9f)tP#$uPLt!GF0$@7x=!U)D%6A0k(-_43A{Od=vbJ zbbK-42Yc(e6%)&X+2DKYWx~_bM&ITZkNy!9Np+E|=JXHvdU`SsfIf5cT(PlaNFzO_ zF1YOGz}{-m2^2RUeIZ8CQk=*!qNBS-wGq~sY42vUWQonYA=GW#hU#%&El|l4i9YWi zbx6BR=$356V`7sUr&fIjTO{e*jAk43u1|YtU90B#4Y65D!LzSd%F%n|X5Ery;y;jV zU8>akr*Z+s!(BkY>LlH`-T0{h77^+U>5_^vrXS1f$Z8TP^ruvie`BCJzOH_LdSV2w z9YAt>++smlt(i4^`LNxDg&xjvDb&})$JSP0YvIxr3J;SJ(< z4i+El@gY>bFe)kjR$nCKyLYo6(0-A#Nx6pm(W{+*#gee;4<@gPYl#HniXcfWOon=1 zQh)w(-_Df#w3Q~QkBW}1iq%g9RImpwRgwFk4>0~Vi!2tY#H@W`2*ud^#cdn!f%(Zq z^K3#}mDwYH(d@l@%Y|M=I(}%gQRiVmqu!B?_0*D1t+^!8guApB#jOd8>)_g!2zHS3 z$%rQgOFMi4{jq#nD%3|ajJzrx^$7o_Uhheff5ESHb#pmlFT2^v!`e!a!V>jvNw@l2 zliM^mBg}>oVWMztZH>=LMotb@c}Oyt;XO3Mr^5J5gc$8BcEiGLuV)ik{I{cp!Xe9p zX=V2gWY7&+dl#!vbd0{t@vz|0h7f|eknY`T5Jk8ktWrok1O$z6a14(fU^5mjE-vV znIvEl?45O|3Ord1aC|YE`@_Yw>;75=kO>LH8-RmRSbTQ0_^64->DqVa^w~#v1h}WDDSpy0PEW8~94Hk+(Yx548`huFmqIWYKEvKro(pe@b zWs7-L$OFwA(?3Qb!=oA{BPei*aPDQ!x8V&Hl>&2MpIG>VhIV!ck$UDFyuZ$rAz!i~ zU&E=!fncx{lX1u^(3SG;!Z;bpwD_n@k-A3w*`H@F@I?&RTdF-ZAk z)z!%%D9P%V<7S=@cTOWVe<#dFWM=_AX===A&9CjuFpsTRcMvO>0cM{5?%)QNR5(P&5WwG@16qG!v3ASO+^MHmN6h0!Bx(eH z#dc^mn!X-Y`z>QAvi|B_&}nnKRFs0C#K**5p-q5`5L}PFIrIDamh+MDuOzd5{(bKz z#Q$I=Z4Z+TdzC9J`*8%(Rzu+Dg}GM?RdRfmn)kk zqr)*Tmty5o|EMnBvWYs+CUGkX)A+7Uf4irP(v9H$uX%Np>q6j;9^)V}9)vHB-{Dnl zQ!>E9?pt+7P~vAlO3ut!2?1tJ8Gy)5{VvCa@LOS|Ey+7Difze=dqvPqqm_OTsPHW? zXz&9~-#Im)a{jF?p*TQKSDt=2U?m>kRKq8R!NmDsePL?>D}M!6ln3n_hQIw>fEiBO zZs?w#6)K-)Sx#CfN5J3D6x`ek2|$SzFNm?$1(sUZw6m0!?%~>kE_d5_>9*(V&BD#W zCUe0QJ6&3H^|k3yya9o)zHdg7W!^s2j&1j z2rwI9hlkk1?XNw`0-BSKI%FTa))#*+Iub0Smy)oZo?X(~dsMsq+Yp*`qu9-9sKg`Ha3opkmT!MU!OF&G5y^3}Odj2C zwG0rBhDYuUIGr1}1O(r-UXa)A$d#mm+Q1v46A3>AWq(^L6CTK+XM@w1KJFRSsb&-` zJ6?ZheL8H)I*4`2dJqCDuL{|_!SC+Ga5_y}HOf7#MO&I77Brn;Qf2l5n~^$mg z{CXM6gTFZDu;ki1F-6O$GbK9O05;%l)ZYS%?lpfe=LcO5=d!}6dSC8S zO$5#K8M1`UYZ<~{LDcz1&fC@Fp^HB5uyHv>#Z8sV8E{_>Zt*H}w|eISKow{N(1PnT zWKeJTffy~!_P)96l^6~l0?E^YO&2CEA>rS%_*ANSW^B;JE6YVd(bF3!;q8KTAI8>d zri*e%^z&dY&duNM?sLerzE^6OMOjO{$lX4t>uzEGc3!eoR$1$9=pfj6+Xsc5QeR)+ z3aRZJ7Hye{<;}nBJX9}wK90bjit`wGg}02!0Q*K~y)MM0`P$xg8|jlkYp`37^ht?U zcvx+#S@1~!S-P64tG+6PH8ovD8THID5EUbxOnUD@GMwvrvsx;sdgIoCluQCzsACi4k!&$e@qW0VP zPEy;bl|>2fgbEx2)2OU0vh?u)#fWD;v)U?RN5hlB_=)+K=3C+{l_rqj*@UuaO?5(Y zVI=jk=cQASgC+QiwlMxODdR09Kz1JiIPbif8=oLHa^87uk0?AfxJ)0#H(>D5sjScSm*th= zuS043dul$fg<_mj0>`=V6j`+-QJFWKo@=K=`R{{Iqbd&m*}m4rH%}f)&&sQrT6+^y zW8uD(y!Ucwckl*$=Va@#L5r&NarBU6`rkES4f#7c3Z6d6MuU=wK5e_1!U?+jx!U}B zeUi?5_w(Nm(r#-tA@0>dK<4+98KG;HPI+jNx6G)-rVk3)^SrKcO6Qq><0*RYW?qJU z<$L>A((Scc(nNk(a6$H)6jNHhK8K|0$MRL_DzLv`~ZPk)jcArd~cRd(P z6Jkv+|NQPlH~ZnhbU686uwQEml#iqn|eLp40YTA=u$ zq341;&)T#mPh~90ue-LVn2w<{GW~S#cU5h%>uB-LLKn*3TW>Z-Exd{9-eD_WOGNmt zc1}YQC6GymB3~qd@nE zTKbUqcOmi}lJJ}rW5gm2xmhCc>7j~|&qd!^A<)z9G0^LNhX&jWV*T_`- zRo&x1+iZ6RnE2(6UFe}KaCQ|NB;Z?n9g+E}$-tIAY{-mEgfSIBl)NqprCO4QE~d%< zU*z#5U6-@bPy`zx(54Xpd@?0IE-xTSc!w5%%$b;17eE zmpUvj3rRQP^KxIHQB&8SI*%JGIUPHi-%}>Pt8>?d*O`Yhr9IAaR4xApggj4pelk_CR4~M>yz@oY@ zoQ=5ES#v0eO{kTNl60BK?n7^$VsbqUD7t8tvs)moZuH0SQ;0Pdvt+UAdmx>P_s9DiJLsqFtI{+N(f+5;Uk6s zny*S{gugMHIELc=yZ?$J&YNA%uG3j}f6SEoSe|B9rMw82rh-A%DTVg<^A#x4X8@5gXI)NXuir1f$CP*%>)ax9VOJ7N7+cy>Se% zVtK6quEjBe$CE&Ng-lh@&OXq>4q?Q2aLFJnB2Gq7F?eZO;xg$Z;KfD+_yh9FLQ%XV zNok<$Xe}fm#!7uZi5oD!0!rX=qd)BLmz8(9o;^oYQNrZsWSiKMq7Rv~3XH>&5Wj>4{h6q%k1|4#zxK_33j=Xk zrGJl38*$vm)E}?~Y;W#VWpj>PkFZN3Ju7PrXTNk7XRN#e!jH4ZOR9IKK=LrUtUzno zBAzS|w2BqEEGGTp$p!~e`YP)!TmYen=pEW2GB7|9o9zE?6juGOP~HYWN>AFGZqjV# zSNpm-%dJu-fCyVP?^9yu`d?_OPa=Wb;K?^qH8#M*=GR5OQtF!d7rQ5TqfM-bVwd}u zFV1-$j&P>3W{I|^$EGyKkj18-_GW2m5aj)Dy5uX>#IbQADhWW6h~J8*^V^cP7lLm& zMUHstC&mEVv$p$hY`g4CDlKXK)yqyxIHn=C>%C(DX|Omy_!TB`w=d-jaZiA7&+iV* z_L)GG<^oRBVNxX{>*YQQuN1&m(j~?f$KIFSn%McM<*I)1*{>nZ<5KGu5N^8YNNeFI zPx4wXr3|`oz&h_Yqs9JvFPck4@MJ|GrrqmU%xLwJ!JIE|Ayfl(ps=nIipPue`u1@w z&&PRP`HFHTbzzGyP}^}yclYM5ER^%eV>Ob!l7tPYsMJpaQMHC7Q|*E2$t4}Pm4$)n`)k}P`V}R{IR|t+OPnlH zccv;n(s^g?FyFP@eBe&d*S`QpdT|T_MylSai+h@}(pF%`bRFHh62u*P9pISNx6kJ9 zl8OUwPkw2gmz5C&ym)q9#9rDwj*PRB@X;2&J=Q0B{>*iY#o6Q}@vT_L22z$}OLNS+?8KGk`YIEwlnJ`1pNYjWC%d z!RK^!)A~|X)-As2J7M{Svf0B-V0%X#&Qee9PS$@n{l!Kf8o>W!L@NQ~Bfs>ElRmR= zlj7e6Y5uMb7H{+a?@gs=WHbc#&YVPsPp}fjIr&P&M2^NoktRJM1|e+KS*9w_h&2hq z`l<6wD2f{)TGt0%P4CT5DX!#i-T?dy@$-pEZraw-P;SYytl~d8KbBeiwS?*ac&?zA ztUP*)WnWQ|w*zC(s)6yOHJqP!-ye@8TYJ;_B-CO$#{Uq)#NYtQScwaKg zO)nqXAbhCv!!GP*mH*de_K2XvsvViY_3xpPAfBugxjWr64J_55z9{h7DK#5KwV=Oc z5VCCvQd59p_twqPCQg{D!PU*3M@p|_^{9-eYw(=}iH}_U_`HNx(zcPua?c)Tj^T9(`E) zr*AK8*@O;R2L3wLK~_c1Ep%|GL+w8*Y< zK{0kbeEZ&Z=)>!FEIFM^3T^1WAhYQ(sai3XmOa`MQp&x*I5X24Ol&^RhH52NFfWH} zgmJoq`EHK!d2^>(@9u7%p>NNK!qu$v3n%-j$OzxTZBmbeGCF^U1qnFb^zoLcZ6_?duznFAN^$R95 zY9c`Al&YIgDBGJZQEnB{7PkJCUam)=`i6IzU{1=-Y_BGP`|jtGM7Q*9V!UL-aFM<; z#BF@4P`7SqoK(r;DyJsMiT`1e(rRLGZ+YP`jLfurF}@V)P^=sCb^=38vAH&rr{ zW*R5qwc0o@sayJ9t)CyDbvbD(5b7&o=?%bn+5eRZTmo`4_?9 zre;A?KM*cZ-tUBive_#Ow+mix!#%AiLmJ0{*b^Zm{|tx&<)0;JQGCE@Y2r+mxaKL{R@$$VxlW|x0YjT zR=UAR(!y_7jq_GUB!L{HyJ13BYHU%J6pMGfz$}j&Lz%h67WZ!&D=n};l6`l6C40W+ zVI-ACPQWvna1bYRZf6ozFOgDs@%x)%6DXci?onVLR$ zsk}T5+@WBL!DTud{(12O3d!&1;cx8|ECfsZ`DYlu5e-~Eqrj8Y1)1TEKoJU!HeSaK zQTW1<0qlgW?nr84|>zNKZ1yt>^xgeH-YvTXKKLyjhnnKj2%Q#cw@30LVT*En-X4 zplr@_&{HKYW8nqpp>pe0CMPbZ05greKNe(WcyF}NvlBH zwC{Z)pNHo?QM@#|eibvFd28ucPh|R|F}#x9$@e9P>q=Dh>h~V!ngS`wdj_27Sfc^AZmnktnF{Y+978F~oTzBe#Hx-TZ#V?(Gog_wELrClHZd@HjxK6p~QtgJ~M;1U)y)F)a6*}%MbGy;&=6&+}GdB@d@0g^TQ-XI)`JV zb=hdtu0hn+jFG>fa!SHvB8Da$t3sX)2i%D6uD!=<~u@F+8k zdAPi5%(!4;vbBXptu+J(?)=1u5BEo~+|!T*L7k|4aFEcmFYPpwKu`J;4Y4V<;UYWD zk&WSKncd-jPGI~SW`jUJ0d!k_bJQ#)l;nq2reXQ&E@73kJ9RV`5fs@Zku$Wn3g_Fb$eW0{MJkN0q62D zybRQKIw3;kT_dSG9YIenI0pK=(~@h-6(dl^PH`72UEqP?qKE2+R)Ye>WX)pWZxdek8x$&s09(L7}P$i`u76HXpV= zhIuJYzPvukPs^oCw~{Msdq@Ktft~PYD^Y(rDCvxQivE*)@L+H8!ppy@Dxw_ngx?np zrNHZ}qO_xXbjsF0kO~My()h9_O00&e5m;|a!|?#TH2G}65SQWI5SNeZUR_t-@h|%fzKRb zdm6o9w_>DXp7QdcwxQeuSt4_NmC`>BecWekqW=hO;1xkOgqd~gqvs{HfrxVTGbI;S ztQNUJPdc7FDyLI9Bf4D;Nqk@y7-z4As-2QYg2USTCCN+N;E<42_u%66bc(Rz8+bWH z*DA*!hguMzcUnn?vX?Tk|2)*y`xDAz^XKJmy=w&;@Kf`m#)=;BOxKNiW(7Ncm?ZrF zUfchBjsJf?GY0~Q+_?PkdRjg1&NVL(ics(XqUv{~g+G1G05UDC?iqWboWb$*9{4RT zEA1a$C;^)utebrg;j%G$Em$$^eLS1~@G1bRhmUGOO%lx~@@(nnW8EALs@~7?T*43} zBqZqB*rL{FBqia4IHtIWGuB=FBNL;R4`AUuV9!ccDG`Q``;R<}ug%NfLPGju==RvN z>g)N0WpMHEOsX-Pa&BDVZlGyl=i>~?G&%|3DM}nj#i5@8hW^mc#ueY_{H?DJ7qQlx zab$i_gmx*sK&`6&*xlD>-O0*6KxLEo_rEjxzlC7;=Hf#f4SakhHUT!V z->N*+_C29D5i_9|3Ml5)Osyq}iK(eQY5wSnRAO*2s;9a)2VvL9$jFwv*i;Po>G5Hw zqK|ytiG9lJa$n1{6=B5%aUVz=d(F9kCrb+y%fj$k#*NTwh;m<_`68pAaXVr-OC|Wj89&sk2(}iw6v8%0`0LO0{bS#GyWKXk^MkSHKG8HUx}%s(hba zIaS~y3-Woz^axNLxD056!I^-4s^>l5Q+1pev6u^I4%vk`LcW2YnMPWU2Vnb;by7v> za!RSCwT!`R^3F;M(biMT+8F|xI*yWpf4Csl56Y0u_hcdDt$j|tV?|hv#uU-rh zAGfX^!4b+K`ZPD&B)dLI^Z}KW7U!sXa*w&|pL;?f=W@xY`aj-j4$G|`7qPy+66OWB z))@%?op><&-?`ob2?^Be%rG3oSm`oMG40wHKEI=ROnqdCOxfc)e;lR`TFA5aac_!Z zpNYOP{e_~UcX;>0R_dFJwHd*cajQlMU;!tb_YFxRd^-GJg!fI2+zZ+H`ZV{pWkeC{}T59$r&FTrU#MXidXm+;OdyVFCE(|OJ5 zdD~@0PTcNETE3o1yqlYoL+IqPTy8XlFrc+4Y3T#Rl&|jbvck7moejc+x@S0L#?FGt z*iO7D5HSy$-goXRfu3Rz{xs$v4g+NWC2zK@gl2HptHrF99dEhpE#0XyH}2m3j_1F% zk7$3oa9Bc|MiY|U>fT`lAO3QmOIB~8d&Qth!^s)rHiU-{DQF<2Rw-Eg?^qxsLZgS< zi^c$Y{s){*3Q_64AH*Xmg4Umwr5a*PhuLYDo*V+e^OY=dy(8Ehlw$k_ck%ENszx6=m~iouehYK^D@+&J=$8YmJ`Yv^gv+Ot(G8 zS!&vb;&fuHxL~VCWwGeKD^gulg}%@*VWfr4*ytf9!sci@O+ar_MO5Pwl z*ZV{f{UnKz^T>>Hs6&#FB~JpsV{NqbMT@fFXqq3-t$tT);HYnvx)fgyttl%uLCcQ8 z02`ml%)l*wiONMmEC`9ur29q`DsccTaaVv;q-^1>a)|zPc6O^*o`+=fc8KWb?aiHe zv&AW?qzXRo!4!t(_BHp4@FnuW1BOXvMiv-a8WKwq=3W^gr{mifW zHDq=j|BB0KJ{k9IDqs!4y2%k*lMF1bx@c$f)@?&g%{~x=Y^o3d2-{|#j@EHu{DSo# zslVD|T13FT+8fJIbbsAzG==PFJP3&*`xwea%*_@&NUtXlsoN4YoJI#HDpy%Ir%QVq z>xeIvnsJoZO=A9BlM9%gpHCKfI9HQ|4!JQHy%nMixLJOB{Vley zngW$`xB2d{>4zk7rq=N$xT!oF)BowZPqYBAcRfF!P_|!kJ8J2(G?3Q>>a;WJ1S`z2 zqO7Q~RT^YKj@uQcSdO}D=J|p}t7Z1uFqz-#JK6-}2p)mX4C2*>&dmP42=~;u-dqju zVQsA+{L=N){7$q65$hu55luQ|pE*&VI8{G6o#7C+tZ|f|O~*F+>m9M=xIIJN3L=?^ zXBw6dk09@d)OCTUy-(-b=~dMLG?WiyvXj>;y%D@i1%3NAhjBXKxoUIQVk>|-+`-Zm zW(Eu2bO6yM@L0WOs>#3qxK0F1@4-&}+D}B9-nK_MQd!Q3{aBl?>0fw$me3{bA}%_k zMmE3~Gk>O|*gCHi;=tHaR2K!{H+z2LuS!3%&PL`qd71LvQF4{IXGsFdP^y26`YQmF>!xj4|^>+{p%24Jam+q_JI z?z7f)`?nN7umI$w=k7YLq2Vpj6XWCI4^by-<7n`PCAb>jhDFScW`PlaA~uM6S5~?^ zvce0Mz~q8X#XyrM0Fc?O*!4NP%!iLuHrrUOf6m}Rv;PMFJ&8D%fbwRln^!Uz1ohm; z&D~1L;sWWc&&?nX@+@Ta{a7kMGVN=43u%z({hk}n#D~s_g^6r{V$*VpsE>hQjnBi0 zxZ&??&>K$V3R8t{is!v0ROTLea-xNKr~IauJnLuu8gPorIsCJ`WwnO#@IDEl`NIvl zn4Hu8Oo!}8s+Sx0KXZo4Zno0B;1%EbtuS8%n60O$=>~>-4G`9m^V_}8Pep#`a;nKh z$-`6Iz2U(C({vau(f}xt=@h576!kw5`tnu8PIJS8)nv&$8UJiI)KjUk3wzgDWR{W8w!|3 zQ6J{Mu+~!)d!#AEij{@x)O-2C5DA^k=k`f6S2D zpp<{jkf;VeviH=Sgh|ikf@oOhIp-jH}7AXJT|k0IMC}CsgdVxrBqjI(DjuHYVv~v>64X} zTM56!iNzCK)7h-FzYzZFVxUHJPB~qym96s!`x?dUpJWMR0Xwk1YC&VV34Zox5q+t) zC*R!QcSP%c8u)SY?zYOwqYzY&mk_5*M5x@SjL*RKTCYo*Q1&BJf_>w^dCrTj4|zs)2J z4>v~jlL*t=_PdiXlv?~juFKH!u{sH;4(jS+;;(L(uDj9@n)Ba?M}E}wJ?7l>wqa&=c`rWx=njlCYO$nP`5}e*=20K zuFfBvazDAkhPR_orzGxnN&k5jcM%H1X&2ky~8*MJqAud~&YY+qX*td!m& zhMbRP{?(=#cx-AGZ6Ej{9<)ImxI*XvXifqFN8%cC>!Y6Cd|g)SToS_H1X?=5?%zo@ z`9}osZvz80?H)6;^BH7ufKh9F!OLJ-EWwf)zY0hW)d z?}A#@pzElLMpK`@b)h|>t29-`NN3K90nb_h>D|Dg-_%5F@V((owu>YaaZQC)K(7 zr_Z;j)&d0M;e+y#Nv+|n*M*`Uhu!dlJN{TC)6(GVd(NKfE6rcvFgbq1?xr7nQj2v0 zQw(9^uX+5an$VevQhu-@4Y;bCh->M^>yWojSCZ1tr?C3Fcr7ukw<@IyD%Xmy z+1iFJsdD`}12_-tfBN# zGoiMS#UZE2)U z$dDKUs0Dztp;;ylyz?u?*o~t8Xuzm-A$=wHnZ!(;gUDzQnueFeR(6v8>;UM;w7B+v zEwuEB0zYhNKsQS?eqH9HfqRQF&RXJRU<2iq8gx&`BkDl8SOmOeEvPR6J!(1<5zbRd z1upqVU_?A?qC$X9Yi|3mw$DwyNZU1O4+S3UROe$e>=h5PFiq%?>uH zky=y#2obYd--$ZUBjq|zJh?j0hA$hK`N(02+ihOP#G6G)*=j#<)7~nKL=5LB_gu*Q zBw_6|uXb=FpYKw0vcF~cMZh}XDa0SQN5$$=^mlrIx-u8qU=!zk;#8S{L(41c_{=Y{U8TD(;^DQo^n z^&gShH+!A4P8Ij%dmN#kB63H%xtDJ2GK1%#B=}{9ZpOP-!xrPc%H8&b>#;9Og8(!z zO>8LdAQM|>D6i&m&m4U^BDYkh#=S(h)PN@+xO6q2M?`OVe^Zr-`c^7cK5xEIFOproXhNL z^0P(BaSYXXV2V@$bE5fr&1$ATX*eGv4?Qt^N8-|$Q9vj)+8f^fP zLggkzAi>U_AmEP=6Zmj7UB?%V8@md0G^Z~n-tl6x^aNF)-tuiOS)yXHX=J{S*C#5S zTU;>3$0KY)$sXGgd##U8af4>IpI@{*+0%1B*kYC_FG{iyM`cH%PZW0j9l|p4sj=Xl zxbLw5Ho=3acd)g8?sc_c8Dv@~jYE3*%rf~DbsKbTrPbAb>KDZWI&sOhP6QdDRHw)YleJX9@pXFAbFxu4$0t?Khvhs~(wQrY z0a7-?|7}A{F+byd)zH4<*^U5R<-Y!JvFNjw%ONA8V>y}#y^BoUytMcovmgy+hgd2x z0SO`vtWQbb#+iN_#ztU{@)|HOgmpIaJ_#Wo)qV{=@YIz>a%IcI534k{A5dLPW7zlP zV(0Vg#nAucB}JCCq6nVMl#Py0|2=Y{ePc4A&=pfKd(ON&>J&Bxkq&lK;&U(UWVUVz zt$qr^fp0qmmqrL&EcTY!Y8lr$W8eE*@+y+nCF$)DNi)4WYk>KzZ#6t58JFO|GcqW# zHYIz*7RRuXD-)1O8NMc{5P@so8XXr_5XrPYS>5eWzWr)jF7XWzHeIFC=TTA-)`Zk= z<xakO18%JfP0D?CjU}>>v5(5lN|1rXGanKE=|C?c!am)S)*v}%c2fH(83^y>zcesROl$_7B^H?ghn%i~9~R?<*` zYvly-O?~ki8OCA)0`063#TKvwGQ6YNdp(vAAqo3BxHjke5!$VQ4M7#*d$oe|t~NG& zvT9somCW50O4yhzGrbgHH4gkgm0#|Rdh}xjYeCp~;I+GgRrotxL(`tOoj=y%zbWAw z9)zkJ>fm#~8LmUOkzzpH_qCS?=LWcp^E?nHGy29+Dlh_*h6#qojRX`U-b!Go$ANT0 zD-s)V;)3wrKuqIhp{ZI)ph5ELsj#V+4a^eWbssD?Ph8_I2di+$2JD=U!3q9^NCdR7 zuPoze3Hbk;w?KowKHZvcs9Xi;H8lo;wm~^HavHIbh@Sop!#=bBfn?(f&l^R zQTc0ioKXg7o&Jts7c?49;qR^H4FOu z>{Hau)2kz}Y8rvtLS|q1;wydURpg~ajPzOIs|86G?dlaRLL9SzP#|y^tYZLQN{NNj ztp7HH9mOzx06Gt{v^(&d`ox|21Jo}VRW~6|!-`aA4E&uw;}<9T^_vhanKG>`fX7T~ z*vjkL5A?Ssm4NT3`?Mja8$|C&bnY+GS<;$Tt4h_ufq&Piaa4m3PuBai zQijCp$oT*VlduARTnNGif))W*C=XTl=fA07d`Jqr20~>A#Tv z-xMc4)Q0BLr}NqR^6qr9^`4(Qc-oY1FYSvs(LT#LA3$bQ58Hz26fZx#e_x(QMUg7w z0IDb?meR(u2Xa&F!2fL*3H3OT^Y{~KX=N?4D|iDGHw7ka9?TiY3xHYhH(gp^*lI3; zVABoI1(wtm1%R^a!tDsLn6atHFKS+!%CmXNU^9rOI+>(r9?VlSP*eL3e_NQ^cEndz zRdt1N9~Ystn|^=gPt@jrJVNl~&*BCHl*mAjC!Vf2P#X|#$sD2E|JvMbA+c`$RoZkY z5QOJ(vHNfRIQ{9KE~sw74m}7Epd_fmTkj6DAwx;Fx^oCb&;RGrdIr>0ooxrWr**q7 z0Vgn9)G_ulgdUH-=W!Z({h4%~;?OR60?2vJM%P{-rmSr+9bHMc+rnrO71`#|jlg}T zDz(w6O01TwD6d;s7t+ak1L>$dt|XC`o*QCSkc7CESoa34$>1by+MlGEc>0irc zPLs0u%oT5dIjI{J7s*uGEFU%d0^B?LDlHYv*Y(IU?t|xomgY0=PvpHVe-cXtd>SBl zdU}#-zX-w*TTz|)r%&PJ_7Qv1`AF@4BAk>kLhIgQZXr}= zD%d~ddjgdLA_HP7m9$I@hQHjHs7ELi?iu;IlCAj4{#sB1brmR{5IQ$2OjA3eg(C-) zoS;p^nmc0WH&j9_!Oa#1I%X zv+oa(uX5B^HrLk=fXXQ$J+eNdXnXj~Jqa3jg+Veqc0V$F z!hs|Pse~4!ya8EEF=sRTqYN9DS_j_T_X3ro2>=pw?uhy^(aeWx+5a`gyFqxN@BZeD zpW;k-sNL^-HH%N>@S25Z$=|Lr-kA;YR)o@^+7nlVSk5{lE6F7~J#;6DSaW~p2n3#^ zKT2T0^jX1f3y;{yvG-q9pHXSXL=hYBE>j}`8&FH^8O-&*&*I0fokspLts4a1Q(yl6W`*60K*RF1N#0Nh1998{&gJDyB#%8t0A2$w2B$*P1 zCI<8DuXp#d`={p>avs8Y45b$Ol>J+mNDupK>-N?+CH>s6;iu!5vl}m4u}fHgWVO-< zaizJfh=ezH7m~K6ABaqrS&Fh+4^GwEtq6$Bwb-~+7q!WVQk0O5Dj!=cYsqLgT}g=_ zwAw7%EX&A{$PHG~pB==p@QZLe6V#cEG&xVzgN$6LCALWCS_>%APZ_8wXUJivoFd{qS+S#}kx6Ufr-)WuSD!iV_d zd|(hk1@f{}j&lnb`g~vJ(JmL(lirh8ASj#k<%|LW=JZ3Ggb5`tXs;cmED<=l=K}I5(uKf zGJVOx$*Co@3SfmlsMac*aUqGXKrcwJQN>YN;1B)6+<*+37oD>-;uOx|_~Ln81w_7I zK7v{E=_ewY{;33#s70_(Q~d|TpjBOjqbGE_JNt)py$pIwM*JyuU7`A}=WW(LB`k{| zSTE~`!X=kD#h6YFt?5evM;onOo+nEp#LlLJnN8)Xn<8S_!LK0b$F-j zwf&)UR&3x@r+dh2aBbzZ2_v{v^11e51F)w<(W8?eQ;UzpZG-!g^FyH&Bb z;)?7rkz0*I=nY_3N2JPUM~nm4zY^+rlvw)WYdGd+j+=fibzAzwtVeEs3f;Vq;%6f& z8-lM`pjw@IL=LVtwuWupMfrtuyGV3R|3cG*&Q~|TM$MNF37-HO zPSP{~I1gxVAZF`OyCNmFtW2WD6ZiuP0v$ltDOn+gw)hgUmio`$w10Kn-p%#Vg3=XF z)RNf+Du9P~3#wX%Yo%seq_J<1P{6Fi7ZV>96UN!mV(NL8p#17Loi<505zy7wNYQU{<#B zW#pGcOzk+n(8fSK4Jdh#Fc&54t-6~rC8m!?0p9=(?9Osa0hQC079o$8I&$Q7(Ox+X zDdpJ^)d1oQ$N6&$^b)b58;-~r-s2k@VW3}=)fLcybW_OQ1;Nr8VEzkvmRzVO0XQ3B zD^80sPL_Llf`RfFO`|yK`POqk+Wq&g+@k1CDw0H2Fk*@Un?nYsNmBWDaKOo(FpD`r zi?ylOvmc0KHuw<0@ok#Eet!H?WeY?z*$qOPt?mr~o|5i`Po1^?@#Jhe1_+TX7-x)> zJV$KlX--&DtiQjTP^E9>~MjX+_9@b0S=I91C8!Y>v7=^S-i~ByhW+0 zcXK!^x1J#1Hc=dY()pN5wbT!))*|bmCNSuWePV-?*YL*tp(7@I;w|BKMlS}S~wU`@$ya^0Dqh23*D#7hWF zRItqcAm)P?RnF(}SN|ZQs zNhu{9IwchjdFbv#cjsGp?;Y=rxBqhBslE1Id(AcHH-F!&<-`tfAL}x)utY8ah+3zr zWSQ~F!w2|$55*y|u1{&C1dQ)zW0LD5(a5}$JSkH}F-dz!vf=>4+v)lW3WR_2mxrG_ zMj0z>2uv%O$XmCbben?So}a-SJu~yTa%V%I?V}Y8XDhOC5=n)N*i}3#Fe(z*H;w8j zRRV%uZb*KdS%JY91+iOp9C z!^K>8TGp|+FYPaG1xu>fQHd>}5xf+)4n@2jHayNpAF#XDTc?dI=@P|K=}WQ_fBAG* z;r0uCe^g;mdf|O-yX*75K{jrE@SQ@lkT*uy!3AiA(pCNM;S33xa5D_FbpefXs|%kr zW!RSp)7bGln%{h>W72t4L3r)WR)V@=%c6j*hi9a%UH82(xE4E$tM$t3H(n3842dq9 zIOspnO%17_E&G}o;A1+2nuGM9>-NG7eWD*0#P#BegOmJ9BB-98u*d>yGX4356`7{B z?GTkkN5`rD(TcAEiplU~ub{QuWUo*NxRr7wNAShX zoNCIQHlhY~f@qTRqScKhT&MzC#rq_=B=_q>ZacB__iOjZ!jz!&#Ql(6oPAy&Q^DbC z2HSc2nQ$VCRcT8RFX;1Xs)r7CSg3YmLyx|`_@$zkoy!fyN*-k=?KMQa(594+TRENl z;59Plpw7qub3u#8Gkwm9(j{l!|KR3WN6@Dpx=ip=CBsRV63iffk5N>4FoDWFyM=yr z=Av_}qd7fF$-ciI)6uOTf44Zij&E%c+GRnwo%ZMY#X!XhzF;UUFXEFvivt>f(~Nrc zYQffAjufKkcSBEp=b~3&7zLe+QvT%8K8loynb^;7IC~pHMI)_84UhNe6Vc{YwOxE^ zQ%PG9=ZCJb&GHGil-h;se&x2jp`4&uX<_QIl+d3&9@a>w@3g4?S97jE>jrp8hn$c|G$-|QsTJ+_tUN75QjEIT4@k%M9(wCT?HaTYjg^`hRT@tI9kPyL6A_~+53@d-)qCm4vEi6T7;XN*^zbd5-OZ0>Nn3yfk7Q1uu z%PO1ewGyG*Rhky^PVe48_>Tz_0-XByfKVXY)Jvpte2nVub~C3peN#6cM1f7o7tkZ@ zfzadOos~6&HzTUbBB@=69o)^CJm=P+3>cHq6d%ZgJwEk6cji#RZz8vAj!5qB&$-%i z?vu0AKwrcWo%8{;^yK7ER?w6TNr3>7!rlTC?_IYU4{}5p>ll^&to@Xp^UT~%w&9$p z(($E@@zk8O$ob9u3-1c1#4GO&xEcLb<)yNoBwy87-a?eF$QP--+nt6sHdx*%PF04c zm4n&n+3V2B=SxE%yK$GxXf&1H)R2o~hT$%?yA_x(^}ZpnXT)$EoYX1cFUBC;wN~!9 z^uup$fF6jLGLi)vXM2!j2|K4}y{1hLF5wF1(3$x0b;ZMPn8b-v(j>SR2;#Bd6aaQs zZ5NbjW+S{j#Dku2*HR)*DE8Cn3`|ltRVd!;5AO1!v6D;<F`=h;=}lv~Y;p zYGtmW4MKHiaHiEZ$Fz;lk(7la0C%UH@`Dgj!ng1;`LAyLGvEGjpcB~42e2=qnOydG z@gZEhZjP`k2~VPyWONp_h2U*bKq+`*cvtrc0YXEJI_rn;z&?$5ZG1hT9_*&^xuoz97%9#Bxl_@$mF1rVJ;R9M&7X5M*49@xv`}Zb z65oE17Sb+bs^a2)7qywHG!ufyZG9+23Mm7N0=o)G%*$*5%$36Eb`{WE9j?~%GgfhJ z?&P31H>b@``T%(BZmAD=VIJf|fKK&OJX?h2G_ghG{jJ?Fp8>TvnF}2qU1YWgZ~QR) z)pbI25*ct%e|h-B?(gBWq*etA7*x>)2%}Z71o=?_!$&^>Hk;K8F54Z>TQ24=HhuQY zFdf_X2SJUQh(dn2Ch_6uZ88&ehCKA};BjkYyw}x$(j5N1=eGm&*lEMD zULSozRaO>I=Jw$NyO^)xH)VqJ8;t31v zF`^rfj`u@zYOQ1rbf3|c)y0w1-*?c&g2LbI?cu-?PinnDlNPLwsDQ8^L1>5m>af>EnvnS9|u#R)M&xNfwbPridWEPD4jL z>bnlZU0Ijr-N!IN5SD;U;u6zHH)!vU%5D7gH=q*)9prCOD>!b2XC2IyTjM#@UrFi3 z5&y(Z(IU8x$6Y23gaRV6NcFsd_$XJWioT)%ax z%OMk!L>v$C?3v6e@YD%3HmcfdBGg+AvA3)6u(Np@nmE>&>gTQ!ht}9p8o@r%7a?Jf zlbE=50RTeP-XI+baCT{bvYu@>RXly+> za*-0aGC17#oY3JH_I{6C9mc2Vp!83O z$GpgpjCs-aXOfq!*0A(95U%RgQ&qgM=E<#f#hOlRra5prh*o7+)tF*o3eYF0(htP< z^6p$8g$IHjhwx3Su=I*ryxJmukwkOsJDR%B`Mg-C z@VXl3eFnRY&Lq9W^gU#!!^$qt*cPo=b&G7;kBY;We5nt81K>5T1CEzv@)rLFvRB*H zbB<@AwcQB~0RQnMAuI1nB+o$*nbB$C70ut4%MoUv<4B>kOKU|@>cm2LqhA`#VVs)S zrPP7QKW34+_-G*Dd+OqvLJ{+#(@cq{yC!>$Q+u*Us?pZNE44BWK*c$oB(p98*tz$5 z$SP~PKJ$HH-Egkf5hzXGO*UM)mCN8Pmvi~GoaB6npzOZ)Y@3AZ z%>DyG*HnzYq^~HJ`9S8r^={RZcof+Ps-5uu8t=BOpR$cP)2o~ZR5TmthS8Ka_o}B{ zl!KoR7d~HuFmYSeyEfk**%}So)V`^pO?N{}*|j>=)Ookmii!9NhnL+xJb`__H2jUP zgv6gQNuRUfU-;27@~sjd>l>SsW-a1`qMjd_DN7CqydlU{7WL zO9j9o97cl{yYKlthMiZ&sIIgN%gU# z7Q>69!OHRz$12iexZMwb8|jw*!MQ2zWT0X87zIPS$7SW+Zv%a$xVn!HZK`MTx}HTd zW_YW`2rQmV*@3LS{pY;tt65UV9B=N_Q+_rKd;MCHbwGGu8X$GFGs^`1B%Uy`8b%7- zE5PVe0|@Z(6VOImZXQh~k_>+fHjmXLnKpI1m}4TVDO=Oux!)7p0zf#{<92p+0UZ&< zPT^xw!bm1S(dKxN{vD`K|59T%&=OlI{-wqc*&IRaa9gj4^FVUf1VnD0O7?Ysp_}Rm zYzqDs_{bfDrInJ3sxOX%8vhA0;=yOL^bJ?gFLW~`CnKW@jFfEOB5}A3yp1^r53W_* zY{q@yoB2~}9*q%c0hG*s$q7kh(!hYTGvAB{BCUaV8~D_kprt>-u4q^D3KvY6m4e_k zoh?S_jy$jmTDLfVo5*PU7f7543E^X(wGrjo@v)vMkVW5Eaf<>)Ps7y;Sq zSv6{QSfpozT}e&#W@&SJ#})7#>`IygAsZzskVA@t5dVxHCb+!|ST#+98905am? zm*3z1&}DmB*aQ43?ivgHCe7miN#=xkjU~Q!$dsiAuC>N(^x#JCAtPRWVO8Xp{g&YE zh_c>Y-W<$|ly13dZxxOE`e&@JI3c2Prd5Razn5xApt*rqA%Mj zk(UiKY@Gyxxo$6an-NF;$oI#eh85Xc@@<_RKd3J)WuG#~}7GnL|G!iBvJS30lCDM`C3mtPDJ4gHq$21Rn&sY*)F zMONB;V~Ix4O6_+QyJRZ#r)5~;-k?t`ltvQb;M`2`V%hk& z{HGkPEe?v1y73sWTi`Hd1;xyAPtYLK^G=}XVZeRhL$NLV^hBV;8dAYYib@eJpg25&sUokNdY3fPdGJN8KtqujUsaPVCW)8+l8ijPYsxQBA@ zR+fJ&8vwNPUadUQdY4t`2*PP%yNRV(!O?|g^emGP`vYNn){l(d-vqoAE4L`r6LUXv zN&!RReTy!ut&n3&!S2e65~xCWr&C*d|9;+0avmk4b5ik;u=p-O{r4H4ar|Tai}eqE zE~l@umu(W)w3*>T7~GO*rKQ!l%CxXCKC+go_H|K~GD@*Cd3+ngL;PTlDQnI;jwzK= zSsl?P&g|$6!>=xCtJRvI4EJBD1q9ImVnj-33X*x5&55se7*H_+I?JtnRzu0U?G66- zWrv9S&#JcbNA?~%37vi8jSKLALDKM?fnqWREPR|Z+K`_5>QKpvmZG>5g>7yFf@vJ= zR^c)u@|Bb@R*D+c@Ul#b?$1uC%;Nt(q6Gv58e$$M==XTEL(I^TI~VW2hdwA~~TV1;UG03~E* z*kj1D7^wFOIxIfO|4E7!OiCBsfw8tPBQ3qx+saA!EcyWLPz+_;0oQbEHqnI}pf)B>4SZTctPxfTGIX?kM}mc^3b^Zpr1uO2nX%01kzzNebQ$Y*AcRFOcg zqm$P4QQT)Q=A6`N);`SIA?y}{??W_hi4~SzaG-Mvs=kXEm|;ZOx=^4Hmk|JbnM*ZL zu9LJ7S-q}0bUrR+#%{%YZ>7lJdAGa!2G|gUU&j0Jv+4K>5@|I)7;P#cdFkHu98vJy zPw6+#z|ul()4MYa??Tok_W-L`)5^gMFLyGcJ=JUARn%qr=GBC@U%E;ev4&N!#VO=_HShrJmGypwe0rZXva*d~5GLn@ul#V?CUwB4Jw zc&)nSU6EOlUOU^J#xV7KlmTd=y2V5})2luh-g+U=j96e8SKUQP-sz=`s$_IyiP6a4 z3vL2hr`3$pYY7RzgQhjx^OWmp1#VrjD|i^I`&#Q%-|ze+=&{}8>&}GcN2*Oxpe;>% zI);x{(D}`HgSWZ1InosV=X?zA&TKQrsm*5^tbey}vXJ8TcaIS~bk3n3e%2uepqp1t z8r*U4rVlEfN?oThGhk5|?F-+p}2kz6yY(!+HwNElE- zqOi!6FW|Jg$Nc176m!73Es};=YkERLr^VmxpRzHp_5os$yr6B@s&Kn(W%&E8_fmvz zd4A+<#Tu)ea9f;+Da;`BZ$SLaknN$yqK014$IZ979L9A(!{WgIg_~oH^mPxS2TU}# zl$v;LXNsPzBt6ClaQ3Bp1xvq=hfVj?mLjZ26h=G0yyy<|lOcC8)GrL4NCS^Of_EQN z2sMk|8Mgn7q@c~a|4PT>-RLpLNPo9Jo`x(0*-VueZi${PxdOWFcB|L4Yz<4;x_y#+ z6e2~0rpjvI6M63h<2e%VJ$I;}3nmSW6qrEU$8Qo0CbeOF^2FYAr8_>gGf##8^RObK z?n^wOX-G1t*8;kg=^uS{slu*rG#gyD^w&pIjy>!yCTj?(<$pj{f4cHNKRnMRmeEDC zIW_AqZ&Z%LVv+dm>)VxK?4W6KfELX~(;C zl$S7i!AL4(rbwn_!cpzNsKx2&f%?>4R{75af+fj$kEO#bEwf<8gP_K^bR|*y=Lrb? znadtmZx|`*s{HdxL$5w#jkea*JiOh|OK)UU)C#@{z|Cp36gLe6{??Ce#~*>_I{!)^P!e|CE#6?S}avo?;<;!l40VPLn}PjObvE-w^IXDIRpYrR*KT&*X8TUt9f@bXl~ zeq!aT_aiT(E4;W4;M~B)s&kT0%1W;0C!sThX?fU&=_xr*&U+O%1vNo&oXBWCk8HE? zz0V{chw;1b8>zgukaDK&6g%=&$Ww7m?5`j1oK|Fc7bj8^9ZP$D=yI#oEj_8=?=6+n%_xnk3W?gC zOK4xQFZI>Qw->ONJ@gwYTA7k*5Oc8``TWHc`i<~WeXYJld!ZnNPAA@)N4dV_jxm^; zfd=Fze&VTvPAIfPeeL$BCv0M_TO|GQZbTT?qQL^cYXcjY2X{i2$&GU&8_5L>&=2c( z1#R791Uk!d*tk0rZ-&a)`&n0A@r-i3#i(DwZNx<3$vwFb&%O|sFf1~Kxq3G?3iP@f zMo^!!*@Y8)vBdY#|1hg#l7jf zP()eRfQ$FcR@%a30f%JjK=WLb@o=+tE^0vO9+c z1&0?EZuUenZ0kxYo+1`WyD$Yh*cp4wdDWTxQ^ZoY(#AeqvDMP=p|xuaxojHf#dXlm zG6H*3xdf|)rY7w*+wdmMm^FLlG1{8R_Lo0b&p`yP^XW$tWwUpN_6@&UyIcJ4itG)} zF$oa+P~uns$?PYmz9*~=nHf){vfEt29Jt!IkE3Ud?87F+ib zq4W1Vpu!calEsMVpPEv%kcAou6~#LuEEi^#rPsH^mGdnvhMhu-aA@=)KNzQ}M_Vb{ z8ikLpKA#*MtV-F&&N_&Hi)Gwm3ZmjZAgc6>JB*RFvcPRr8-I12U=%N-KcxyYI3PS?|NvpG0`M)`aPv8t;2;1*TdXtoBjCwLe!UYI@A?MJ3aE$ z+BYb?YhXY##bF{}8}t2TSgG%C!^NzbD=TCNExAsHT!`rDw39P{K@Ne9!mst&MlUBa zv$u3nQc`TS z_5VS|Ep4{J*srEB`HXB|0skUTj$JuSrZ3kn`MR~0_xP*na9&TT?#(4mvT7ugP=gb` zrGPcbRB{zT7A`aNh2pq3Do##eDPPt^9Y?j*{(X~=SFV&O_U8dJ^=j~vHYVrGdlxDC zs5T3AYN<9=FE=Kkk5)b&g!6e{n;lq8#xKH+YL(EO#_W;@V`@+x#J~{4RvemFy(Ak} z#94Lgd@-Bz(nVR%-utXe<#25(VEo5ZNz)P|cBx0VsZd z;dntYv5c;yeF8G^YEdAWrFKU8jru`^dwI6mog`37f4`kTQX77Lii_><`p*Vl__`(L-z{@;iZnE2ck8N zkHFI@$SXww#i!FoZ1>u(@2d%L;{7m<>RDn=?RvyN#djN;e1x|xItA%5=|mmi`*AYl zU%g9cvy)4lZea=S*cQ2<%g=f0BSkw=d$ic>sX7@;Ilbc>dmB_EYq|W&*M>aLWuV`8Rdx6NFA5!OtW+k?`islplUctL24AfHX*c%9vjW$~=BpL`ixUOiAH-OC znkV0131F&@NKb*h5Uw&B+sQ$Q6EdXq(fen(Teup*xJGD9pu{9Yf%DStoOUQkJ~7w$iNVCl^4cU4jZB=gr3nVq7t_KFTqxrE(Hu*(RG^S*paw z!W%2ylbIOCFV%LK7~F`6@|TDF-_uV#CCN`d8~^Aeu^QE|tsetu&1{zbZjN|~^ah;e zo=amx-+e>lEu!;ZDeXRJmrZ)VQco`6E2)U3+}^ysll{SxbwpbQm;Kh;AUEF^!AYel zq`ymT+90KoT2CfPYItpgjlQmM zXbQ_LYJ{6_d^TXRa>c0I>|KZ>oK8t^xFSQB^@w#lN1f#Tr6E1_&+|zeY-52{sm=mEz>c9miv|P6P)rWWv**FQyVT&e$x?GEfixh#%W~kbpaKEa{(S6HhY<2(5ol z0?5IokoMInFgR#}l~OFLI%8&kXHWWVJ!SJM#eJ&bY9^p9LE^eKM{`ZB?wx5%wJ%t68pGr&1XS8%#cvgcgGh{({;m;T{Ot>sXj4#&rOyWOMTKJ_0()pb zsqaZPA@R;Zy86Hw#zzrHqU{~vcSSH zUC`xwuAbxCKvu%Z_xCPMY)79pN_6F$nwp?CQ@m9VQBWM;HT(M9*@J@6L7e&99_j!~ z3AQ5KHDO5rwn8&m;%ay@SIk-|YVbyJsWpZZA3H4~V0Rya(8r+P4Xn3c-ExEpX2by7L`Vsge z63tx>fzXP({%PzO`~LC>=ck5AbHoI*CshxDY3i0CHlSLuQGSTgqRKHnzKe{5IhG3Q z8ybWKT{hzW5`uvMJ|rY$I-)g^$V|(~*Xi9m5_Swtz%H!)26oKOd-D>ahexm^ZqR^e zY4gv=(ZKkp9vf(+e*KtHM`EQ6e6hl0K)?%e$56zAJwgkR|=>SSsW!Pb73o;3$s_olUcYj=2r+2F5 zWp$Y*O-o+uFRz{KALEAAC}^K0Drk?C8r6BSqUgQ43a6`Mk^va*1 z*97L${p<0fdG_1d@(uq!7mBqr-}snCr!oQ#?%Z7n+|=vgS-zOnGSpfH(QE*%B0mP8 z$cCYA|Gt%O(~4Dtflj3qm$}AI7bnzA!NBA^rRfxT#(PSPqFX_*?OY$zuxYaiRep$c zRrob}Uuy_PlzWbBQ~@xymi1hpFO77UZ?Z6~I8?$&u}YX7&3zw+O-V6COb?6W9u1KD z8j4khezix};F;3cbhm0k&{Q!|E!7 zBbo+EiF&SDg{|KD;f(2T!uqCO33vhfsQL_t$2d{AhGw88oVFr+tv5qMZAwA{YOO%l zxYu#d^QzD+%3Eq4(kHo4JyF?-h1d^;z` zy1mEvsJHt4Sm|m11%d0g&!V_#L2j)vo3845XHzLnlCWSql4EE?XK9n|0FzyJ^U8_P zI`G@c$yK6E>P6P!Z#bCT1o2z2${JX2xFg33z#Us3GXF}jEfw|Eul3==uR%yrq}-k1 zQjlh{hT)fP=W8B2N=^Ish9nhl$0FhL^QF-ArvR|OTKWK$Jq>2zbd!?C2uGAQwVZSY zPLEQG+RH$)BEs%wpC7fJceEeFJ)Z~;zx!j=`@x<*p)UK z+h0mcn zyj>r2i&D(W%bMhq?I{%z&!bGQoyH9KmvYpdBX!xq_U*L2C42R4#QVcDJ{vUBZ+X_r?v8s+m(ObM z3it18l8Lsh_cw=98kFCXny|lc@GI7?bSx9O3SX1a*HFQiOUvnsG)}hBh-+nO1Fd5e z+^#I_yQy^+_ez`DRZ*y`;IBJJ`n{DCXW0Gd&;>CLUyQ*?2X#)gZF6XK(lY_*GZSR8 zCl5_TkFKyj25lnG`;|tm{i0{$U5x%M-DmOhGEb6Tpq5 z)qD3oj+%!BQJSdF#a`^TX-YQzcB?g!nOs)MGdBG#xtp6C0&;SN7_oJ|^2nQC+`IUF z*HW1|N<;EINw+>RD5%1HtygU^V&mHy$AeC;Wq;T|UvUXk9C00QT*s%^Tr<~QqNw+0 z6BxSY)kYGSMn$bX+6_I*U~E|5J{4Pq0;g3v9XxGxF7xKZjjZ)X&c-mp{HratK!)IP zf$ilCjpbRW{%kLVMlgSsr!zH?&ES`DZ^U&%0y7Lp`0O(+%#P2e>+Up~ai_qHiU2|7@B6lZ8LZ`R8X;I+1e(8oyJJ?foFl94rL??eSLDxQ-`S~Apq!49;N z@z6s!zff&rOvv84(i+Ca6010nGSgv(T29?Ro7}V;vQnD0FC%TeY6-$YKW3vYZkHQ; zp@(spn|C(PprovN4SoEm!u_|qhX>a6+*kJ4{-aDa=8hgjTw^WMBOyV886&#X!D1Gjd8S)243)8Y5lPnc&k;jbz0Rf&H zi~ihi>;s?pzr}qg8s1m5MbU$s_L6k2)`>Aut`UozcK}T1sD>nNGe;^KoAEcatgKOo zdnog>#zsc`DoulH1^3r#dN#A#Sb7wbxIzGmuHEE`y{qt!L{-FP>kH&y{$Q-_KbN2L zpV48Hhr@}GExvxX>Fnqr^*{r7r#95UKbN7D2=qH1>)la9{~<%h5ojbmqrH%?Wu^^0 zRCn-JmzO^*u{;a;l=I!!`JdM@F%2_7gy!EOBV4=TCCP0?ng1QH(cgptK=!{!7C`~_ zU&iY{qrm){(i9lA|8s<>WeNg^l>d(0|91fjDNVQHw>~|3^vIL>zqdSm*e?VAe%R#J z=R6iw@W0pV`{P_!hy!}YbCd@U)^h*5iUb70#I|B#9{uSezznhMFA`SJp5P3OCVw=2 zm6M|*zkXVa!yIwY=g+tzd9=*T@_)&+f6q~u#nL3q<6!wuC+Ccej1146o2c>k-{*%2 z3y`Ac@wsrGth6GYLUsxxbpaQ{9PrI_cWx(yaL)KY9bRu{D9hi=x_+th5{)?y>1iCU z%{4v4L_Ju>~YeHYfLZBOIxw+YrgmI(~CFB3kv{IRV11Qyl-c4p>}pCTeG)`xOE#eT~P*p-);J5$0CvNs@1 zaWQ}Z2(7xaGfxz?n7*Cn+qZ+sFRYv=fH-vk`1m*rRt?$(-`&|3pr<^i(rRo2Iz0R) zt#fO#GQzY!z4(x$yV?8PF<4Uj2blBbrqP~KJ#}Iv@>pA%YSr}HE(?IR>hn$+>j`EG=#)d z!n_fx-6jmk!juPVT=v}FsitJ671;hCBg4Z79Q-i3^Xwpy%PutTAV(5C-idlQ_Lb%3 zwHhs)PC-7tvDt$MU6HYtb`3Ep)j#LP$KO$!b$53cl$Wb@`HbLeqZ&aTX1UOYYT;_L zv(9o{N;#2d8J)>WWeg8%qKgLV0EOy8>*TQwb??zzF7 z&klBR!&#@jb%6uA|NazA?$VdYuo@b){Ah8kijNi$L$=f1IXgQ%J;y%`Jl<#aF~_wt zm`*^K;S&DVTwM(a4ioip!VRFZ|DHCuO2&w2>4 zep$6Ps)6shNrX362ps>P?@Tld-HWRMz;S`8-bdtg!7L=A(J7r{y&St!)%`haOEwTg z@594Gm(-~RE)Li#F}rNXIFlE-=`5eGX(toOt`nFcf)8FAw^>tRbf;`5g_8RG`g%h$ zd^mzS%joO7TBSPM%c1$^4gU)Ajr>9wsETlBEC{ppAj0}-gX+dn=Y@-WqGA+q6d6+yU;Ob2h+STP#bkH0 z-0w5*6wF&@P;}gTy==UC@;Ulc*(Nh``iK#&7~`K)9E*!oe*_D&5XVKRnn5_MQ=ER_ zg-P)Ca==Kb_@c_Kr;+j{3feM#NEE(RI4sD$a`I@2sqSo(hPfJgzt85+=(%4ZN|oE| zAWDSdKym+~Z+(sZq{GAi^cSu8t!ijLek4QnF9a%N+mYfuwKuNd$-}FF1YqOb#}qFX(=zoDR&QlWk%l3cfEgZ%?LhNAWhBPq$4A~ zg3rWV@I%L6=skJ-qKS;06L#EgGYsYR7MT@%?fxu;h67AXTKh8v!sg6{F^U_8$Lbw4 zS9S35i}$KcR&_6*SW@gGh%-#Q^Y$k?%^Elrox!KCudlnpk~jZ|#Tu6|t%i7#%cm2g zyWf~=YbPH%@kypir>l3bc$7S=a&QEX_#@tGLuC(fvGR%vm+5Kh`Rl#3YhiZ6tn;rT zEuS9hQf<#alx^n6x}INJaoxig>-UfmXpm@#`SpaJUMj4htqTwei6|XKcF8gJ`;ifb zWcOyh-E$nMjf{<5=4vp*BoFDpnci#T>Gq!KIAYO7c)X%6X^bj%lX9)gi;&Ll#1pMQ z!(6I}?B@}FEV`8EfE`C<2kEUX<$omX7uQRxjHdjc%@h}~!#8m)tUnuGyiUim2hexy zS`prOkRB3Tc8=qlI%!IZSh)GQ5SkRcuzaF8fWwtf@R6UR>R>b@8}loi4UupOA`5IX*sql5w#jx?foIGJsBfnUO`; zaS5tgITSzCNM}UiQ7vw>=u6ITHZnKV&u6dW5_R66zQIjK!CXsfU9**HF@vQlt7e>l zy72LlmSPwve&?G$cvT!qy2-jEueFNy)Hl>_#|83GqTnOA&(R_;NLI^^9iW<|ql+S5 z7MczZSBMkUePd}W^)iPr6rL9v%}JnZC1v{Em~eb~TYKvtW=JWNB}i?;*xU0hj5>W; z6(zZmE?|`jEA6qYNj$3gK`VsJWI7H~7a`jhIj}GPz3(?E9^l;8%GNfbVh`dGCR@)o zX#FT`5io$7$41Y&PT2@v{lf7TS4d3zWmjB!X$CsCK&h%cEiBep-X5$ELZBsxz}Xy`+?Q&oabh-;LU&(&frR-fpWjdY3i&j^?))Eo31ZL zu#dtyem1&nYB1uYdaNe#0HZcN6boWKXS^A|+iO9bUFKnOPNU$RE&x5rf%{!8QEx7Z zlbwXcstm6z*;u)gYdd+`NS)bE*LYTsY=urlg(@Z!J;-vvZDTKsx8${9j$s-c#+9|iN~xqWtuENm=4nqUB<1J zyvqLQL~j*0Rr*Ft-)2@qQZi6OJ-{itYt`7skAxILB8-F?N?3ZI$}q+w4;by_-<(s( zl7^C&6$V>0uIHtsW{kx~Ba4s>H{TqW3KololCCtJHtw$5@WQ51p;&F0zL!&T8{0ti zw2pgjE(9uRC5 zhF#6XX}*)4QmQSlL~2cA?LyyqRiEae^Wjf=8cf$?++Fd;OPzKCoYK# z>8i}aA0A^1;o_M7%;G|UZi;->i#`^UV1>e(Z*k}mpImD4i&E9p;vJOx^Ir^F@K_j9 z^lB4iMRB!!$s3IQNl?ML6Zf3W5|pema7*q2z!`-8`5U*5~5>L zJZT-CKcz!dGv9DLs&k@o-BKPDwa*ZB$(&io530r65Sp5$9*(fxC<kqXXqG%uxCt z!6$DhXkP8UoDisWo}Z`9K6X=Ine`cV`jz9nH(;VNmdyes^xtW$|k@sO0j10Sp0+IryPC z!h1+qBpl)f!s8r%`yIrdzErDAzajysDG}uJzrn#@Z!hPnbqaW4^78V|e;5)6Kv$f_ z-u$mha>BBj@!?PdruJX+KoX!ka+Zp6z1q0!C+75fS zl==Nbap&+G2k=V_C%*8v^RiI|i13{wFX<`f_-D_uX zCAdmPFO>AvWUNAp`oXc1&*jr}nJ%L1bfy*gY>}CfM0;!(lBsAaa(9NA*+WON+5^2; zuX=NKt~-ay+Z(C2!=>|6M)NYhNhlnw&kufm23r`L9fByn5+8Yf3L*s}y;@7_NfnU_p@>IJ1JVHy){Z0>?*6ZcO^| zN-Isu)^Bt+TjM_k=XhXZR|`1XM3!WxB&tmUBvbQ%cRoT3_&oj@KWIsucysQ$&nOQu zmV|-ew+reh5+{?|L$*L=R3BDlP5aC4C8Nv$Gs95?DRrYF}7-d4G8 z*5*B?=eEupi(>!vi`%8-W^rx5pZXOZrxSpTEKICR|By>>6Y(}UPMxn${vISpk;Sl-Sx0|9+uJTC2N z`5~{*Y0~f2HqK>P^|huT)?B17Th^&Tku75V7W+*Xp3?4*nC&k$tj-b$C1py{os9#N zVK^1Ugm~{tsj0o^c?g^!1NGfO*k_MC5IzBn#BKppT4T^@8g#dg*IieXDFt#Isng@4kqJ^KyY*Wp#}PFQ?` zGQ65-!&e7EleXhtQ73%iFva-Xg~A18(&i%HnT#T)Dq+nA>d}_T;^{dlfsUgk$^GU= zE>?QCNmPP*vqh!YY1m-^J8gGDqq22K*}Sb`w~VXpG8%5Hlk4U7`nUe`>AGtF3kK@^ z#cs;F+n+yp)l@q;J-1IDy(wtzVnhs-92iHV$ICLcH5g6Nnu*00#ygLYOE=ru&9rz9 z8jnK1?;YU_-a>g`?)<3f%BY6&Nf&`B_*Py8a_WH$#)@b1el_r~8K1{eTZUVf=L>y7 z1A2wJ4j({yxxzd@@CPj|%LP`OOm0w^^8RvBYIa`;A%+gxp`D@Ly9^8<`)bc#13zMXC^YHe#d=5vW3&u-+VL@7~7CONr&t0|cr1<5w9P2Rn9%Z#+ z4p$+4wN*~{%A_C3dhBj9OIu_OZ)~^X!!D{E^3b>q{z;$Bcsr4eJqIU`xb^c9mbA{! zt&>uE;)EQK>-8QJH z*O&%xr3Jd5i%mcO=zHt@pjhEqUVm4pzkeHyTtql^N0hVh!ZSfZZ9A0|UZq`} zYsu6keuwNG_Jj8y&fdKSb~Y1n$;scRWc2m*)4QfM&M`9-3iP-r}@(e@Ys{OX=(B8mdJVNCVk zw6$LU%vIER8Dyy6R5{5pmJ9cMg`&uuB158wBnA87_MQQUHxVhPN4PceV0O_Ng?{|$ z>=Y9HG)J}fP~+6{b;>o8sZJ{DeakPYMK>~U-FFjvjD7xy6DRP2oqf`d>EnHz2cx|_ znlFEm_w&G>*4EZum^nEKNLECWo*r8vZyc!XBDpC3tPS~T3iJD}*cQny@jpy`cQl-B z_q9Apl&Fb>=%nanbOs{`5?%CeB3c;2=rvJBqNeCIdM6mYMNjlzW|Sa|(R&-icYB`i zUF-J;Ygub%xv%TK$~k-Qvk!IR+nvCl?*i(jFTIxn{fxmM9@_MiI}rofb}rLFPD^X@ zuI$^(AddX%Tkpu<5?`EJ@1$^jFiDm@H3^(3((~9n>_~u8%z1=ly_%4nd!YOrW++8U z`4RQw_1MYiQjS7?1{C2PqN1XL%oJ(;Vd)0~lOFFZl;_K^zFGc+rF^K4sPFjHo&fI6 zCTDg(o&r54?|z`eK#*ei5Dup&h-{W*x`pe0!Bx-)dfXY&4|DbA^@t82s_e|L*H!O# zLrMbu51XA2Z-~FY(bRVB+ot|>6v{bACajeFB?ca%I70`F-BY;#g{r3J6mChtjZt99 zYc8JGC~J&B>63R6shW(^Z|yw(4l;Jl^pY5Aj5sfEKUa)BvmNOfA5$Q?aCF?liK8j> z`I$eu%2re6YfPZwXTn8z*wEbs+m6U4^JX8c#7`VYia{lpC2$`JjDp`4O;qGmg{;Xk|r%HB4tZum)GoVAlDcx`EN_|dI8(_nOzMs9GI zN|%@ycZv8;<3yZ0iO5H1Nh~(R6errx6cej(oYt`-&EecJSiHJLF=Xlmk5l5S{gct? z3xD0plRAe0g%C*AR#v3~*wN9t@ZeAUe0*$Sv`eS!#tq530I>+DnDW^)r%+2CuL#G7 zX#Hw-OX7ip`FroZ+Y($%+7`al$IF|fe1+1Fb%&_0WBYd(JGKnfPYZ4GsjKN$$AkP) z!vkr;Uo;$3)H%Ll*1%o9(Wkk!fHah&W+=~U!+Z)hnYTNTgk?@=(;Fy6E&D+DFut4npWAWICD#K-i?{7}jBDyc496W2)SH@&REw8r_{qA5B+TFS zlS4D=?nqY@@m6TJ-ByWFl^dh1p4I)Ea2LTl)1zvs ztf@}F7_aj|6xl&dYO`)me{ZT$FQ~^~nM2Iz1oD@5XY8NGa1WjI1Px}6aFuCntnX@? zdBbJJM~Vh@i*{!LB1(gi$#GK^wZY6SsRR3naL)@j0`fE_Ino*$?bpw5mCnR!gys_2 zEzM3KxvHnD`E(TW5TliPBuGo|f5^k>6e5HkV?RKuiu-aL^Y5A*zgp1vwsw%Yci5>K z;eJl){~9}C?tq;jYRPTUd5z6*?wNM?7{&T12x&wX19hC$WzqxQAddO5jyXA~rpp2o%+zi7MJZIok z;yd3{%~l#NX~(kdj8FOLTUx$C(oCM+&c#(jDKxp?!TQu0JU256yF&THYk`Ou*V-JHN@yU6_&6)TxGf)#wc@v5XEl< z#&~8?wr(oKb=8ri7vLGpqb_Uj4LLg*3o18 zDx7>hI$_7ud}gf!Ttpqdj#yte$E_-0Q-K4Po@~jyQ(ex&d!-}=S`9G${w_CJzOM|k8WAp zCaQ=OHuwr*blvNj95KV|aOX;kNjtCpltBA!+ua!H>p2^Mzgh46{Vmq4E{q48TUcg!dtCrxZ#S3rRpb81D&9k#jXfb`k)n(43{ zw@I`bD=IC{Y zY5mnhy-g{V6kd zN9Wi2{p1!$(x{Z$PYCsx9Jz0g?M{(LBKC4*19zhG{llVl{8Y+>dLD?PrkzfjON(bP zAkv^=*Z+Wz6zF`cxyD%|E#E-B&a7q0CKEeYCbG-Y_;hOn!JKzPuLYbhF^(^QT@37JY>G1K4y!A8@38 z(>Lt1W!AYQ(D{d(^4?Qx{f2m$6L8{1_DyRpqIn#M5#9QQWwP}iJex*?rqrV$MMsgqC#A@vs-`ci1sqdB_1rglVWOwUJ#)~Jf-82KBT61y~h zte-6I%)Vtf@}*KAncts#qPiMHGw z(#J|*@R>eXY|8@-!SELu9}?*C1$-`wmwwJ69~UoMa!93D=rwUKuI2Ow7_wsy7Taib zb6khHxm^sniL4vVY!<-9?;qn}lE=;$`6F_Faa~V{M(M9^!c1L!OZ74v zyj?f(MTS$S$0PEOJXxBP_oeKI7Nn9O>k|42&3}#or6`q-Wx|PtL@PMGIc73fcYGKH z^R-ia{iV3gZLEO_)P^mC$(^k~w+y77e6j%xL|bGuOl9Ls&mJ_$Ap7jeVc$X_KB-RgDwBI5&Iy;A>ZjS^pN>{BNFP+3hq zD7XKSu$$l6H#fh%$8L`ES8HpLjab9kgNA`sn)o=hjz^G?N{o)rrAzpbl*Tvxzh1FM zLLOkVK1sL36}Hj8bTHIwQY(zUC55Z)6xh%-39sMX!Wj zLnS|Ur$9vRbBj8f1Jk(*&bw4eK#zdZXS-#zc2WafESI}PQtU|Ux5E7-Mh}q1o2&y# z!b#EmeqWw{ya2^>RyKWDxXj_FzJCID>L zK!8iq*X{&6^MWUPaIDI0{fG>j-K(>=fUs2n2(23OYDN7U zujyK1u_$OFkuzuZ!qLFH8ufl6+7FF8Ehe(aRUnWQ0a)a;Zo-FXEubUbp+dA44J(Ug z-CvF=D1$@YGD)gk28%moKYr2v>#tz``oH(^zubS~HWpf2DZCk=FJ64)Cmp6l^!@q$ z-p2c=r(MOzoQ@-;+}+rwhZdU#-`JXL7K-X8qd z=bM;8k4pf5p#P1PZK=EyaS!)O6=f#Qo-zxKG>*KD{fVtNK1fL+{vmz`F6|@@WSB>V z$in)>T@j~0Pr}oMEil>hv~#o)E=WNS9d}09Kq{@Ac6Y_VN3IrJ)fNd*kSDFzAC5~y6dvO$v&~3 zFY`znxG9oN3Rz0-Hu&9Oir7)IGO^0`;n` zRyR({bcHgvXj87p(E{AkEY75Q8d-F2XACA*OE8~(0qOEvO%i=|e}|S5cfFaX_*&Vn7R-Odg!532b+3{4a#9)~ys7jaMCb1yqP4ocq@$+AB9z=7 zsyGLTeuC85a;6oeYNk1}sKm`s7ZljlaLYcY+o%wc4v=OVV#*~uIJzF!Jj6V-eq1VO zS^s=tJ|c^MNZnxX$$ABe{Y&I)j0O|NHLW$;Wy!|O8Ty=#P*NHkmRH)F`LgP3!Box@ zSmIo-c>cS9yH0b}8Dh3uN2(^S$Mtzrd1}^<6|LIEU(F8GVCpUXspw8O_td%OoQ>7niM2hS zkOtc(-vCwGL4kHyBZb!M<9T+2?iMSbKu|WAFCU81{gLqM&dG+y+&;sj!@IDAO+Czu z(5TXq(VJyhn2J~FR4M|VNXaZ+;7q@75HvjbztBlTK=L_>5zgNKZEnFQr0;^Ze|jw~ zQ&y=rQL-ua`b9tf??qSig0f|h8}SQNnK9~T%>8^)jz`T=4#n`jS8jEd9?F;PEtf6=&<*;>h#4KABY}&0 zm|sQURRA|HFS3?5nniY78`JrT`uras@Q0Q5kV!@O!&L=k&EYF}z2vY3etRR$BLdiF zg##eWW@%PkfAjq>#xprSm;tQ^@uT0Ys(=R`8sg5m9U(Tl&U70bEhN(rrqzjn9V&_> zXlDQZblb-SgRKca65FTpz|uhT6&@V=Elk|s-V|7{_dP$=^0DzNyJIknQ7u7gHkAL^ z5H0Pc)WaS$m2M^q4XBrw;!5#tkqs-jV)ENKxBqRN=7r$%YSqD90ieiZ&w7JPEmw9< zeA0_0XXNL!3caM?r}>sD96J-m!e210f`S(tzrH*k6fz(XmwA+yP$F*^PqetW*uePA*w8T1+&BKzF3F2p6eP93tm%AZQO-FH~=my@kTgO2&gj10d#R24W>j6OZ(*M1by#sn5#H+ zg+Bn_H>MeYCJLMi%}o$Y8JzEqf&)9>!v=mtXmUk^GQ?;wWwm|U%TW4Qpp-?9zh*b1APOf7iX5;Zp|H#&V7 zY)o~bNSF2*iJj>Rg(;%DckiBe-N=Iyg7P_Q0l8rFfRg)MgFE=p-2E1%CBb!v^F^RD zvm5abm6w2-QFL~Bu|fHyixc&(OIGVc8BJByG4wYM%}GQOxgd+Ou5PSVqIZVn#pxcn zq@Z9pbGXuuqGQ%x4oa?InvkBn?H#;3BlF7rJkfBYYKffrO{MpNjc>$SRs{bjB55(~ zJF&dgVjoB#oG*{gVbt!`n!dKlq!92^QY~fgV)_Z#Q$>P{Ur-J2Z-lyt4ivMBJQxrS z^BzXXh^ke{o?qrm9m>898h*8FotWUr@8HTeXUbf6k6yViRzAh}<%F@efZpVAZ|S9j z-g{%6gqkVc>0|%sNwJ`I9gXJ6ooVGSh58>4u*a81j20SjtK;GRC|^6&`KZ#!IDrVv zpH6*2ORjd|Dm?5np=bk?nc757OEvfDwS4E(FZDox?`c6wj=tdHq+oY;M~Y8tGQ*WbcR_mky+`#L=Q zL!9g0d+~@&$6CJ-jx6SXK(T)zHvU-)Nw4D%h@m18pzvRd_QWkUT~D!AbaZ@yX3>8F>iISjdF8NPr%CtS+uTz`@n4P^>Sm zM%x_em3I9Yb1z@K_+d5S*Hm)eJ)YMN)2OVym07(w2I}GJC^=j&E)Rd6MN`H$Cg!Eq zwmWGr9yUWemapll|Lqy^VuJ}Rm=GKM67jwyfDQR1xet^d z$D9i!1H*efh&Ln6)ccIfKp=VD1F|_lC}c>#+`QQh960!|_~J9UumD33I%s(ORH&cy zwWk9~(D1$>IsDaI3iXGwW|U2b>!@OTvMQ!KLBqXvfHpeBEKH`xC}BLzoz^*UaDkpzTIW_YZam)!)mq{ zJ~ZQx0gD${89wq^Jb1X_U!}_;8bs?LdP_Q|XB;qpV}!N>Vk(#W-&{Tu_J`-6gq7z~ z#zM};QXx#u(GV8emvcQKW23pMN8@u}zurT&2DYZR_yUUEsT$UUs&%|1Vd*5O1KEDK z^oDg1{r$&};SQ1Im;UqC0NJAqg+u?}<}Ta<<+ zx&{Uok)uaFXL!G{BsfKUgT>0!G*vi;K>++`A1F2SF|qUgcd`F;ADsXx^K_KlC(e^p z!u7Fr~TN4tMk6vE{j4=i76)apUv9 z=(uaiwaUwvBcyVcv2^B?8J;^Hr|?fhoRH$v{-vsjp&#}+)+$Pmt>)iz6085Gr|K5# zcZ^rhj@OQ5?vR~*NeRU11`_am`^%vgnmf;9Jp zNFdLs$_A@90vi5!Ly0W!wKh>%Oq*)-a@D7a{9U6iI}tLG6kD-DAbiP;`%k5p08MAm zD_Nnu_*QBkyJsEo^d62kvO*Pj{XmC9r!cW8=|?b)m4Y#lRn%)WUrQ?GWI$j`^KZZh zoQsUs@oa&AMy!!N*}aM3Vcy@GF)-x6Uw#h-YBBSJg8uP0`zhOUsCy#ot8JIJ^y=>Q5`vAfk% z=5S{2zod~=ZaedH^F<7a>1Ae(>qlAFRu=wc??!H23$pNQ%Ce&_!Yn7mO^2hZU^6?J zQ-G%&-6!&6$&!hDw&;7$hHgw?cOHB9RdaXXYHjW4_cjZxSI>6_cSEU6kvI8FdV3U1 zn_#Jg;fSN6os{hiHG{x`ds*?N@W|fQZrGnJ+p4U>bgn8?KQ7@TZ7&bR_7)7t^Lb7gf&TWR^KTzQq0rdG#De81Q?y2)xx-C__r_%DIkT|z)XgbEzr2xr zAODEO2%h4tQWi`d#k9)JR=+?l%X7X!gw7-jx_tGa0w_lW!AD{t%62Oh|9eDjw zi{p%t|A0IWRCg_-PH#kPX{3R%`J`DptFlxI2(l6OJ1Zla#PIod>4v|A4_u(IHCZ_SJnv(K^h zRlb7rTR`!8<-z>3P^=e<{KT*u ze(wbTc{}RT5J*Wbxg06HMj3b-d|7^$(0Y+8M#cno8@5=wb^*h$inor?ep*|zYXFuJ zHrb(UgqHN74Ljf)eQmLgHpyXO3j~_!t&0(moji__UaIg1(s&6p<2A2-vhsn5c^GYA z>T+A=>f+!$+6H+AILEHJbq|2T!ooJhegejgW$J?KaJn(j<2Qh6UW&iv^ffFMcf3{H z_fO=bpH0~p*YE(kTmA7vbsPT1O`&`lLX4iBnMf;u0A`8~vy)dzmiqvo2X`hg@tZzO zTgqMhY=iJ>5>2s3eh_#WQa3GlT1d-51bZhFSq7h-tz{MA0F_XEmb@0Q0UMY1dgET7 z%CImosrG)Q1ajVZ;#XmkhhSuebZCnGwwp zRpOdR6C|V%M&Ujx5$!4+Hscu9=HcYTubw2N=$tJ*+VA@D;PRa`(9Fzpf1q-w1y|N0 z_&G-M$&=3C9edr~-RlxN!Bbn$8EJJxBv@7@(UsN_(QwGKUoJm;LWSNh+c8+S+Ia7r z!!d*IHFsYRzsC{3GZQ{IGflKVorqjsqYSR};`2G#-g1G9ulnDN4eMX-*n1q^b|+O6 zLNN;)wEm0`V6LKgC^eZJ9N~7ru72P}<;r+Kbr%D9JV^PWNT7xM07zXPjo9-72j(y# zNhfG|+h5v(#fHS@LmLwwB$b$T%hlEO&=vfGLDDrx<7S+q98%gAXh_J~3Ri;Ezq1l$(LdnhlBdn1_P$Ju?KA_MNgs z1U&CRvxH=iQe1z!gJ>DP3pD#2jk-XT2s+4`3~nqQM36$FAIQrjg2h@d8g6WltxpuY z6Q3Fi9uXa^;tsLPsX9OL&pyJ5!JgYC3Kw5(>1`mg1opv%}bmTyz2PFy!?DA2AWqYTVQ7LoyCWHMD?ZY zeynFekcti%`Im?pSEfds*T;OJ+vD82B6z;v*Oh*DG#o7Fx$(oS(UR$SNA}r*<}S*C zWdsrXC@sDb@V_n`O%L32;pQoSw=V6nI40uroDbK38vjandb{1j2iHd0IL>PoaY6}n z;B;_130@eUe9GizvFbFCeSFfSq-lQjeNY)ClW<#d1t)v(@xk%VGZJoIGkhlZ0Tt|5 zsZ(pmSh;rCQ#FjoJczT#3YYl~MGnsK;M>{M)sV@yC7 zFZ1)13DF!O8!GkLw-Y2AS6}#jPm~werA;-p4!H_yd z7KW3@RU*ci<~;98d&rgo3`GwuFA{01*ck?cRcu$)eo!4T&bUu_N3ok zqc!JbyxE&2V0iDgyWn~|4&%Q^On(&_1)lYUyJ^^&{42m9vp{$wg!(?qiu?kJFMV{a zHoC0PC-2}L?VV`}s`Q9!SWUZw$1RjMvA$4m0}gXy)qp&`S?Z!L1`Ju zKrQwoXqfT8%+o&caV%7SpQx1#K5x=%if61o&KTP zPBX1q=*+U4lymWxvUBT~{VBIG^zy!{{jUgv;i1ckv6m_OpEa*eva8lEu3F5R%lC=t z6W^Q&6tYC^jHM6iSzq~X8-bgu`pDj1RUNqFFGMX0c3=1Ma!sv_I434&!E~?@(MA13 z0rJ*yFWn|*Fw@pU`RR8<4|ka~hvnTj%V(Y9J{j*m#UD?VuVZiCoh!>f5UBeoWYsOT zl6H_gUNxsai43}kx^F=DTHQ>HGwu-YqA0oWV@JlFI@?w>SOLc|DA{O=Q1m^7HXqDG9lrZ1(2N{nGlj zRLYM2qY)Z1VR_^jL?TgW)6KENa6Y%)q2;6dC{3|QKlFIsK>nRnaTJxFtW-ZLY|fw` z>Xg6#d1#AQWw83(I$!o`Pm0-{xuvPW@$)(kZHCcz<~eAzhk~}`{Ntv~bMdV#7azHG z*rirRJi5O^JiKRlA7-_;uDQi3GsMLyx+(0CgVo1to&dEkDAs=gQjJomSfo(On;yxU}>jx&g)0oUKPMHe7dr*6qh4r8IG3QzVe{?FRUhf)|IjDE9R2=}{3u~)sUi4uxE z$;*fGGn>N_GqdF4U239S%>X|BDLzUWwWF6Tx)d=o&T5=H3dUdX`ifM4b>)yzO>k#) zj_a{2Z7#a0^d{}Door{ZNMt&TK^pU@`3`!9;(3wtj1fNy z9KBj`iCMU0@oZk1qtvd#0-Du2uf4I0e{M%yI?p%F%s)c?fCe*Bhv?jN(gJ)w*#$KB zozFVImr1S1vZhi1nRd3kF!G`eNc4*vb1%vekfOr&A-*cp>0nM={o5+XX#NgP2XfuY ze5V{!btJaO*a<{$} zj)v5m8M-KztOrI5&Kc^Lxi(h+Wk`UNRoPQXmbI66`_|x4U9}^3)P8GuH;tQGuam)$ zM{alG^2n=3l*+%P!@M>S47d@4EAM`kz*L{%(zr58M!wA>Fyz z0-4H!zivDvLyf>#pjRQ|%Zf2v3Fin_82wnGm;7NrZ z^p{DtM+$fghsY61`$V3<==l9dgrD?r|2tpDyn3=fBGLm98N1f>j&gR~K>oFWb0fn4 ztZjk)-o2K(*3`h&B-^*y6gqyBMz)fOnMO0G7=R(ysQ1c-d3yL>*?WhF0U>CwdMz8N|4(b@Zi4Da;eqkZqi&O#=vn zMPK~8oktCIgwz0q!h0aFdy@}*Q~YU1qQ{LDE_ezqeN<|@{ieF>?(V%cchwmtSo7PL zWK}Q5?cRPv(8Yu!-myy50bR4xqJy8KzC2b&Udw35v}vqAccTgHxwyE%gHN73kys(< zUBZ}`1yj))&l6tbGPIVa5`DeBo4UokHE=lmNbEdV#13eJq`^S!a+5&m5Gb6W2(e3$ z%czqcs#j{9W&b&}^08{z`Mt!tx|2I!7M>3j^#{YARz|kN8z?ZZ7uo z#t*0x6O!a92gim8e}^NwMm@~&J>5f-^n5J-qa!lHKLsvQLD@vbXgh2x+!>nMRza|R zbBAb4*so-k{hWk);Ez|o*bSEA|6y+M5O1soJxE}JUr+Wzs6R?jww`~bIiKucrVNq9 zLh}!nDAZCE@yA0qscH6QkH>gy+2MhKt)cge1+(X0q{7p{hW|KW+S4_p>`pc=o28kR z?unhjlX1P2M;?vGY$9$E6ObvnBqxQIDwK}BA>ZraL$4Trva7!VOm7Q?Xlq$iq)1DT z>&WNw(qfP&Ef=U|iAE0=HMT9ZedcW4paF1uwB6L@?(@)zIgY`KG?%sq+$^zL_Sk=v zkNteqwXOoj#U<%Oj?IjpwQXJH9Q^p3?#*21>>M!N^*fB6sI{b4@=AQC|9cM8Z4H+1 z5NaC9vjX9_halSwJ1M@`Uk5wRexC76e|hfRSd1$i$^|T}$A10T@Af?Sb_h8<(?VDE z9Knx2d6Z!*z7AqRMpKJId2S}HzQ1O=A>ink5&Y6JKZ;qSv9H9hguu01l6EwFsN^7e z`I*JQIpY+jFS_b;j0X$-kN6tv1ml&h&5?kDi;$ZK>KadtM-Xo``UVjsU75|0q* zxR@x}GQRwi03Gz3Nlr1f5}9Gv_E;5Xc--y&Tco!nF{6RrruMG1MMJ4`ECqDfsm0nd z%1=DWrmWBZY83iTN|wyJo$#;kG^#!_q{9$=>q7)8&) zdxx&(Ys_g|=dIkYacHDmat8<#%K{f|cPCLg!{>G#7XL}}!G+DeZOx?W10SzXsH##W z(_0|whazFXJS@aUqVmi*vo~x$`u`r_tnz!fI<<59v~;j6$K|dh%FbSaZZy52Wg>vrR^ zJIZm#;k1#-eV$YxGUr&+BbU+wP!KZLjnaKd!^=zc8Z6?>8rEGK1dNLH{NlgS2q8&f z>7l3JVynHMsGA@^w*aOmN@cy3G4{f9d&6+uq$r;vXQR0B#a#ZwvR-8i^Va2-b=TI5 zrvoU{mkVzGF*Go)oW&yiaSUZ{VqwgfNsKf!K?kvu;HfoburS`^(z9W9B$*;5f3#AJ zbIW))?_mqe!sO){t^`jF(`}{aC4OWZtT1p&S8RhX@f{RI8)W1|)}q1@IIG2_`JDco-7XBG_$YAZGK@HcOAsxB+)x9eF&2mzFgcC7a8 zS+E6S#tPh}5dVt#Q1kcIK`gL8MT=0+&o~mrYu)Tdq-ZCT7wm%WRu2?tPQ)z`K-oSN zkexIk?!dF=Mj6zxU$(L8|KUIO6dlssc})nmGSvi%{+uOz5B7)9;N2vmw8PUN1&?A; zI-7L+B2)fv2GnZqlE9-fh-lV;vvf#UogE!fAmlD46bK*T~fI4swzQ3N%*uB=l;>2uHa-{c#_=D z@ngi-sj(~FjB{njyjlewE>|CehT;Xn{7WlMvizZRzfbJQz>nOdVjE)Y0cd5+o+P)n zi=#q=>`V$*t5*y}-0s_fVZ!V=qBe&c#H@D>vswv)YZ+XzGCkKG-#)qvEJ#Nbv3N0)UhZ8veoM_WQS z>mF-~UV5ceVuq$f!mbsQ$WWWKzzvf>gGi&Lqp9gXMX0yMG{8a%yO z(|l5EEM}|PaxZ+jt2dSfPbw-*^qR)+2nyN9Xz;%@)XXqF=e&)6+}J2otK<0ggHFDm z=9fDmUC)&@9VDv@F0Ure#xl-6nU#HQNve;pjLZL36T>Cks1?Q;0}|EV z8VWcLs$NjnH8-+5x_NdxE;hF*d_uE0sx4wtr+_I8@~}xGl*Fequ(&AUbE2FS>G9gs zeGDxOwoqvlI$3kn0CQO48+U7D$vtlZdi1Kd63L*8%wVISjym}|EuhJk zS&z5b>xY((!kL+w%xF-*Da#-Eu#BJ^`Ox_%J(8w1j!6_1&2}S?m}oJm(NKkN{ zk6bs;T_RaGt!NV=7hX?0*yvlsFPK|aXGYU5240=R@4cuOzc^jixi<_wX2B!$m zI^!vHt55$aGR{Hn$`={?$EjrGyFb#Xo_ek$1W8-6(kQgbdQKHtWIsARd-ga6Jm3{D zcOGuNB4+EGS8*Yl9k6k~srI@$gCR$f4Dd-bwd$EIR#;4%_`zB*fK6*!+SNj5p1<8h5jN4N$0> z=Tb%}fu3z8(`V~_)q`s=%J8)-~)doDDuO_gwHVH|S_X(sw zP(XL_lw();@v7ELYF`uUO)=#trd(y2v$`@L-6Q4dp2y3aCiT`os^WzwNtvgyw|VB~ zcX%|L%M>o7-cciKSoWRl+X^!I;@8h^mmTUHR{ld4p@%DBXRG(``{oTHZMd zk*zkhDD3u2{7Zl^?Art-&d}p2|B1wLn3CbxTlt`1cgT{kt-j{mpA=0th;nxDg4=PM zw|k*Fy-h%f=qg-EQBg7`qT7x1Kzr;XEiJ9onCQEEfOX&BSPa#7-WtKcq*}?&->=`@ za~X>x0r2gXvWO;cKNh!Yl+V6 zs=GbQHFx*3k;}`=?pFlI!P2I~^(^w}%v}1_Ywr4ULNKoN3MYHM%yLz*oM7tuDZt`2 z{ez!f4E6xaKDJ}+m>qx_Oaol8p3UAOB(nE&zA=wBC3L6iF%{!g50gN3yA!xnshbkh zIRc%NJ3c886uZ4+e8)V>;&%Y6y0l0&g?fCPOjiv{j+j9(B4}v#%nR*;t zaa*-I*Y0CrbKxA0r%$n;aSNp;;`#i~WagD*-!ZjU-%VUOb(fbiWD6Z)N(3}V0Bo~Y z7g)u=1PBShgZQNr)`O!d3n_Q1_CJulPHIsy_|(o4@`8=EgRF{di}|lwm1VGBoY**-^wybc&8X@*OY6bTw&G?QPZL{<_n4(DLgp#9a$s zN2f28@BTO@ww0Mpj`c{eh?CRYzrQB&%okLA`Whp|e(KsC6*&K={S*G31;LVI*31)v zmbTAm@skdhSu%pz-d)IP-?v)mox0RoxmEu=u;6&TR)l)X}*aOvfVe?z>q3 zdvxpN`G)&1z%u2;jA>sIy4;KIK#-5Iojm5?2y406@1w`Bz=M5OzXnYszF428wu>xR zuiyy|WOn<7ho%Kd$;=7n1@`ym7Ga69%naEplmT?BNOYW2MXV1{?*7J?zcNhD2JRU1 zXsBgcfy0yh2}(-O{+^!tx!_1V3ulL4d@T$d!0O>!Ze z2YQv(N}BDlrPY(Hz>on_4r?%bVD5P(t^tW*g}7zp@1;;B+jSk;Jy~5dFO|m`qHd4q z8OW4u9PByKU&h|asO&3tz1ktt%|YL(P?DMmh(DC0+n9Z~kh;&^0`?X5-|=054=Qe# zh_8h@%a{6dT7{prItMh4VjIQY2L=wO)0)m{DBfN-IS7}b#?YfRth!I(#pCr^x)!bE2EMhsG__DFTh%O<+wnZ$eA57?`;~I5O$c#8xpk?CYMi zHSA2{fNny1?CVti?^h}Od&->CuAm*vx!;u$hOj?g;||n&>a>mO4!2|+x>#*fLh}h~ zYOjob2E&E!9FKEa6{&0f{`24_;5!@6BSH)C7Isl;iJ-RVG%$bbh3ga-9ZS@w$$g?L zvMOji8~RB`|AwaCfq<)<-}aTBgP2=IdXUSbV>)osWd-ar-#63JPj0TilX^i{pE*bU zLuLj*Ro=lQ(2o73(>HiK$5=t~DyNRidIm%iI<$?PSuzuBk;Dm03>KeJ8sipU#i|}b zvYLyVlOv@;_a8MRJ7R0s`Prm z^XfXXS-pxo(<^$CJs^XHU0b@z_B4F`+8KRd7M`A_^Gh6hkPqVi(Mg8sswcF${kL&((L(+6)m`Y{Sy z;?l~n6olmKTpeb-?3L!!ux6km>@l9h)?I{5co6n<%k&NYAV;}$q9r&8L~lAL@No4z zZJrcnxvb4(Ey-Db8iynkUYaI4f$7wUhKAwxQXF>N*B|>GjNH<6~I>0ClUD72W-5~ux zgU|iMr}yK#mafGTe|2K-v-iICbp;<{jZ`!Fu(sr|*kCW31+^l~XSG_%jm1g}sllaM zc;-8NrmRfnvu`6bqkklvicA0^ym)=vvTS91nZC29I4U{OQdTM-D2SsOv`#NwpJ=mV z&XFW{4y#_GNZZjsAIN)#K|KdFWh8W`rnMXF0Ig-tnn~TRzj2-_T=!h!jd&%jO@LRy!>deJ^<<}<)j})#x z>z?=`kBy}GbQ7Cl%UCQKYuBj0L6c4<0g1GG|J#X+dU#QSr*kRY$2V69;p15@mbFYz zARi7{R};2BY*}`Raam;bq%|Ku5f(7bjUdW*5ot)ffkRJyjI~B}OYA7t0<`-s!42aS zIz@s|K<7H6Bs}q()|{IN?Jrt1>4@qUnInz&C2+@8z0%hMXhUq_0 z=4tXD-EZpHlov(@2lsD@`t}MRt9`LUW81rbW|VWTNYeqZtnR-I)=M(SXQ6@*$b?~A zoiN+?k-;L|k_*KAeZOv(!4`xlXU+M?1!Dy-7*H>?wp&vruhF+h4h#<>iKAZOBAT#4_+EZ+=TG_O;{DHAsreq1Dogl59 z)tVse?hk)frPcIJDUkMEIP(!P!6PwjUV5Onv(JJ{GR6@W(qu95JEW2230;H^(jk8> zh`B1gG{3QDX~?HhCBTT^E{Wtzt6t&0&eZ-gEIe#%k<{uP{#p8p@$UmG&Be26!7eg4 zl=ap^;!tBvxY79$Q*zNkz}(@WR5E;b?_|p9%iwdJ{hEphsfs=^pGO=vRV>!J$(6zJ zsXeclOBj-Gmz(nO@vYLT>FUyXmk;PVl(4(cg$sjvE}-OuEVu?2^>2sxk(RNe^zELe zC_P~5`VyVrodLq4jJy#kHNs;CYQra(?6Y@yL*vp9X2<$}CNn=QlhA%q{L#O*f_9<$ z>4#l)>ne<#sy=HU-=52Q5h-Ayv=g6uwX)XUepkHVtrmC1c4-5fSKXj_uS=cs_4%9g zD-z`&P6G?alt0jz_}VLr6SNMIy{aY4e8j=jcg7>e#jia0PGP{Ae{DPRxwsS4C?_aU zh<~}IHV|<)St}lr-5%J#z^EhEh55>IMV2&+g5!dw#mv*bw?%Be|;a!+`zzizh7{ z`AT)k$w8KAF$BZP`wIFb__~d~b-BT$*x4?YQLMZxx57xRKM%wQ{iGIVW}?VKp}2dq zeDuP)j(yk)l>bPu6{<9rcUy#c&uvXr8N-%vJ4r!zn*%~iolD}#&MR%H3?`quC6fe#=Ij9R+qT zOrqH=&L9hoBe?mPZ9I-6f^3m6pMGSab5TDy?EE%!v0a5aOL(5j7|OW^Z~;u8TC~E# zML-L}5g={e9HEnr`MXDy^;SL#M=U8jX^vh!g_3}xGWa6lMxFe5ig0sOgVI;4mczt#!reG7m?8AJf8J0kTdr)RyIIqr47P0JUt1gZX$H zqhfJ@9#15zC%viNH#RgBjr+^sNx#tf8uj$c<3Uz3{%-j;mX~{G2W_ZBg!2m1~JH!?>=lf;bhZXmIk3oWI?hY>L&eBClw}qLK^)f4Sf+cCODIn zkN$7~yRwqfp#3`05jHEflQ)Eo0v+xEgyRQzXuEqC8ZQa0k5e!_2$S3%IoUa!ZY-&} zHA)C9=p87Skypos02B_;Ot)DfEbS|wo(Ds}+R`m_YD3UMSZF(LGzp(yOz;yN$Q9Jn z#?v+wF3Q1mkk`Vc(n193*kFjb5gn<@~1K|GmlURMm?&l{YeG|H^G(X%+C^ zt~y5-`eS7+a(=H}!tO2XESJM3oO1@>oubyw|&+shL?9iD@Z7l_pTZv5fo5=??!P)$HZiyud~SgkthP)$$$s6 zAU~`;zqnD?ZtmN?Urd75F_Uda9ltE95EFl*UT~)Y-uh*yn3|m~ac5$G9D5^91ZGJj zyJ_<~i3h#0dmW(HR>AagAGzSD9^q}a6sPszS9@gDY)EgZlTEZ31%(e>H1hksa@ zA0mhs95JVWTHJM4sQAGn(Bjw7Nnw51%HuP$r5ZauZOnL=86)ZN`&mP{qn}6h)f)=LsBH6aX~Ap0LY|+iR z0lqTB7e00<%&)#JGgRtI!;^pYg`KE7SotEPag17uY#4`~h~8C}4hvn_ZoHGjT6Zhh zS$H{0Na&ml6Fq(YoEI-9jwsPAG%nf1ZA6gC>>Ewt&%moxyRs0)dNRO=)(pD0oI-g- z^+jqZe*XL^c154iIHSDznES{S|cin29T#el``SRe~SJ6k8XkFrmrK)H+@&H$;p9bSDXv}emL1AoV8f} z+zBRrqhCNng3g{AA(5yoccyi*n@!1a1#SRFva8<;<~OS3{qw6doiU$L-_n>v`;5=& zk7_nk*mK8HhfLpZ_-%g6f__V&4fYtog{s7(d8s%oD0tr-!P3n_WD%<^Qg-N-I`K|hcf@n zol+UpiEsR=O}D)%WIk2r&hnGwr{$9=QT~FcwN2AsqBvW5>0WTn^=XV=D*5z_mJD9s zT5389z$r&cvoMyh5YD_vULOuw;NjO_1XiK%4k=x`J)`;2E+8$xJZ6is$Ga@CNF#?j zfYCk7z(;i0Qk_nF`v7eyF@f-V%MR{739R^KeVNEY&MkVQQpqxK+=iIL zlV;P`XS~ziGrcE2FrxUN^_2+$Ed;TY<1j;zO@uc0bUKI%NvpHwlPhQfh3z=B_{( z8!KC_7Qb5k5NGPaf}}IYLfYaOwJ4f{uB9_e_|k6Dbj5P%?Xr=rFGRe1*K36e!R`dv z(}=WRYRu)3lr&6*`cV-Y)4{k)cvh)sbPa1RJ&0}cqs7A7p58oeJ=+Wl_Wr_SiEa_# z@>_hK&fRV@l?7YecDruhf4%welH02A0ps+COEgX~1a6AL5oMs~ZHc52`d1q&oT!AC ziUgP`1B%VKsyEA4KVnGhjW#9uUQIO%P5piE<)eb<(>?R3a|x){eLvKm!CSJVx#QbK zDbF;`=O6MqCB6hT_`q5Ix+<7~A^x5O(z%P7{;I&KTv z2}rBZ@J*p6RyW3K<|NGCp_|&R#iTLlL686g$)dgQmRbJ|oIzMF)xIzYdkoL_@1N4H zhNk9j+U9cwuEbci{oq5Kp_PI-d>ksmaK08d0kp4$T4}%GRX<}PGjbErMk#vf#HS11 z78f5o{31uUZQm-W19B(dv{ih)x7S~;rKA< z^kH<6!jsu0Ih_+g;2#Th3OKry+h0&N25!~7lPxr&xWnn z{4-zRZHsb!t(OFoc)y4BnubB=((YGZ?P1axO5^K%U{ZV&XZUZ&N8KTYQ~tMMXov;S z0;%9b(_Q9I+_|}IMn}#_2h(y+3mFX&>Jl6i`w?5BJe<|>}Yyx$t9lO(GPa} z-uI+;JGu5r9o}n6*KdfSRCGryE!~MhV5rctIp48k>W@EYDLHQA_nuPt+O&qBhCT^r zzsMV0P$1xTcE9*PpT*tJDRI*Up;TBDo8sZ0OUsnT*B-h<*NxgPUDiLiZf@p8rSa>a z-?(9-$e?5>T-tY^ExO>lvebE1m+WX~6=_EM@2fXo56j0NOzzkQtSozFmRNlom<&N%k15~L;aHw}2>-oY zKhzfnz`uN0XXOTC9d&5^Q#BeLb>2;FTk@?IDaHO~KF84fO;fCkr-eLx5BJB3bY2U}UmvEuGBXun?&IbMNQVx<&Naeh~jVW}ck9%D;ez>32t(%IC)%3jXFz2%}6N zWT-+@*>t5*b@=}CH*k+YNJq`gccOGsei)tkB`Q+rT_SY}&@A*mENtL)2?GO9GU1!A zepaaTFJD$s1nrx2S@m+IpbzYfZsETn%R*S23&8TK`Fo|pw-QQULt>=O(^qkU3C``3 zMJxWK3>121Lc8GTnXTqCZ*MV1?~_B(%(wy=7%Hotozq3f$LIFr`IIgV7pMBP)6cpB zxNNk=#2Vu2$@Ls9*p zq-7jHSmWL`#f#j?jZm0SC-1D(TI7PQEGsl_G8lqQ6jn)uHTQqHgt3o=sXma97>_Rs z#9=Ps+~d>UUfVw(C^NiCLQ9<=c8i%BzrmxowB!E(mssjw<jPG6V>-^``*&_s2vz8y!xGotM7~ENUF9mE zNC=Der3IQXN+z0cs%bdG;e+ARJm7BRI-^H|D_ z{`9iQEp9u>x1$o3;JCRYvi#=JZv32nY}H{ld=)viyI$8L7MXZ<)m z7bog}QzfqOhdns8Lf6koz@t=x^W6dkFNbULm&3@t3k<q2Lk!IE|1mohp}3u&ZTc65P?POllgR8VV299f zq2}?i~fcN6Xc0Kz#oMYcm zK}x|^Di^tz^Yxm_Ea78M(-8UIh`9&=x)Ckhdy)Jt zJ7DAM@Dzxrc1#Y*i#_k60}QQvawy(}`XMGALzhS@p&{b3XHK;sUYr)Drly9!{Oe#k zzO5Hs%lV@MnX&Zj#S2Hl<_eq`mjIv|mUru8?Q?YWJ`ffc*9&p`(*saL&icSu0jS3( zY2JVN<^j!=(Z4D*cQ%%-;ekcHdDl+E1y5f?m?Ggpw6L~XtmX%vH{XwN&iYFNFw%d? z8Xu2-*=)1GJ$5qLs9{+_-T#4^2mNfVfaks~1)xW7y_TGklw@1A{9H{flCi8AUk)qa zW1W3l;1<|)57O_R3}IN%OLKO^eIe*q{l~JeRO6&Oa(0?qcg^1rKN|A&$HbMc2$0wX zr5LGqaB6bZ`dM;i86*{Fn_4=CIVa;xTKHWs^HXk#WtDg9w;)v~Lm3NDEbXHmp%(v~ z%3d?S;rl#1-8vDG%;FR!NndUYu!4;3aPLY*t(PE@$vv&E%pg$`QV}5ufk-ol6Q@%I z7k)V)Pf%CqLehb>Q%d8Lv4^?ouCJsB5Ng%&PlSkXxkV! z8sSxISZqu2OfC@b8rvvEil*wUmD~CDr0dsxHW8~opOIx++Up&U z^xx~$^JhxWalTkFlM4mBrgRISpC9A)wKotJ{4=mx--N`@tBtEkl8=nP(X`ht?5zVG z=s%L=#?G|f#K-ox3dxK=BVq}EfVtCoocitvmmImsqyUK9)H1KAzhvr7l~kqBbd{zL zSw$v7J(%{#O~R%Gj}F5t9G<-BjrGAS`THE_Y-G#-@&6DZzO)mEK@N!zl~b8F{gu~VZEcAj10iJfh{goAC~qc`yT-jCp^ z2%c~2D<~v#`70*|$|ALRNonHCtUFP1V{98!+Fk0`%+axHnFQYC{d&b7m3a2dNjtG_ zzxa*-=gL=w1e%87^zhEsl)a~gvcN?(Z3$VxpSsQQBMu9n|0fxhQ9tMNkoQ%5#VSiV z`_ApB*_tm+9UxC_*|R>Cj_j`gc4jha1L=RW7r4C(W}=YzV%!D6%v=m;y}%O4!4+qV zawP3)+SQ(fyCn#4DP~j9RtHZq(`L?o5-`@i*{Lk?_>{2VOOmjw(&)Xxo)#^4Mrf?Y+&2%*vkB$?rcKd5|ci z40%q{|6*xk-jkh=>qF7e-GE!+v@(vuYiXKS^>X{aUlyAidAhs*1h?94qW-7TO~igS zPzW1B!8~LXXl7t=iajfI5?9SCXg?$x6iBf+qo{;EQTE39DxR*iKNOnl}T;vatZb5jZgn`T#lbNw<=Lr_8 zi1aG=r_RFix!ow#$tn`sJQNsfwm6t#>619(4jySf&V3CSJet2c|9va$?%t;*&Px2Y zsac@R-h3xazDyR{yGMN|96j}Ne(3tqxIO(Jnut#w8s>#P@XE5| zlhotM(*19z#^{2|UgZ$xCI#j&-QTO~aX&$8+c(|~4f|bu%zH5$mXD3rCFYgFODi4; z7<1fvmet9Tb!5Y-L7bS$!IQjCo82RyxyDvtAHc%2oH@N8}*_aE3l~zb5@dK9JCB}H=xk9z)%f^ zXN>te@)H=q;}_a`tV~d_k1&1vNL@e-p}b>;LZi{nq1(_OKsI=2tdW$zxtoBL9)>{5 z`U&AF3N4ggm2sS@f=znGGnW2bd0NgB%yxzxa#>b?BJU7N&Pqj{d*HSp{)A{?ai-<^ zLyF%{nr7RB^k=th=$AZi>DrfLZZ~-4QmgomyiYgaE}NHo_}hDNzgz|(yu|w0?S?^b&9)$p!NsKGs~khWt`ls~U|MeaTFBr0wegMd$$hEfU-wmAS#u4CK>fs*~F3*bOe5mWf9c!6TiY zE1%$yog!qLW6(tN8zt{{grcElwhIxrZfG(V2nAp|B!F~=6>X>Yr=Zd6K_+5NUu7`2 zo8Uq9WIH6)%#*);vW_Z>Yr8LH^^CjlW6hcQCrenaO%@-BUQTLrR>CJkdu_YzRbCx^ zGO>yTLPdm_D&al_;q$Z~%*H{_0=`O?RMw=L4c+z+a4)!Y_#k3%HM-{yP(2zk-BMZd z@bG7xvZggxJ~nQLQV%icEVvk>l7%!;B6Vd&81*~tvjMq1pwVGv@vuxnPBmF5=KA}D z-CzVde%Tll(Ovx~q*Ag<|E#FwjXl<`4mWT0nO}Xt$%#@}mEZTS%BuXo2Cg|0b!TM4SNeB1*OVpuj=XFSx+hbH z)=VB0^*5026jl*FL`w|LInS~~x?-Y|-XMKeRqZnz>8&~>x7{W_o_(Wtk+LOQfx}JO zNrwAhI;$Qa&q=a0bKRAV#_}DQy=_#EOZr)xPP5c$)|}QQr{1$DeTo<6LA9?+Bx^M$ znis0%a;JYsOmXgwH^mvF^rEqiA1)5|Wy(MO)B+Ai5A%|H9$#y!V8Of1s%j|>a4TaO zwk!(?u5=wq=v7wQaZzgLsib(yRnL1>+?`g;8Vy{<>J1?I8n4~t(~y#&W&|zFr~xX- zB_=X9@}Pe8JvVzYSO*e|O{!2r=rVb{7MO5-RiRV2Ze-;7TR2NX4&pd0o}O+F5k90# zW*EUd^nUfWd*7OVX7~QUNI4X>ZwnbO8UDruD~gPmtNPSEHfctuPO!DUMt|(RVs@~T z(VfZ>l6W@0t?~*q2ZxEaL9U9zW?ny-I*y%x2fV1d{M)$G(_pjOsuSAi3juK=$=ZMvuh&hr6Tr8X@ zCij+{?C;2_a+!5{(z33yDkD#&pz*A0uQ-pAUOJL2S!)K5HOG(!dMpQcOPI+e_kOcm z5-6IZHUCtl#%ytCjhj7-+#)G00=-)JKkixd=0)s?D+GqPQ*xCi zunkA;ljLzZK1yvWbwn1MI`FjUHF{jznt3*5^4DwND~3nsK`N2nse)QkJXem%$=O@0 z8LHJ~Y{0l%fT?WaJLdk+foo=F01h5Dl0E%{lP@4%BEcC5{-C^KT&QT4j%E2q;@M9c+eR~hHqxJGQ@V^&6_Mh0-GrY@a~UUejC znh@5--F7G7h0~)?T>zE0uY!RBrC7;M&S5 zb#G<|z}kGzO)wFe(gB1^Yj`!b8{p$9M91N+=Q!+#A^`bhDo*m?bbd|x@i_!WbqK2a+ zj&prz;p%Z1Vy@v+;!>$6^XL0D_Pb@Nr|%4pxw{bghd4DXT;Z(4Zne!iC>z5*@oUwSk&-&f1@ zY6a+zA=M~sxX1P;AymsP4{|+H$@DW;R6K-2i`GjcQhah!yX2X^*VL{h@EuPslR0jV zJ`!+~jc=Hj!sHJSthGG%%y-#mu1N90z-0Fy5-a^&61k60(>7YEQ`qSg|Gy^;XeB@E z9;~ZqE`PH3I%8wlUKxL6UY?zE&W}+_&WtGE(n&F>%%FUuIs#vr2!BW~nAXfVs#kLQ z<{vij4f*pyB$!%bg0*At^aKzBhJP+10zkcO|;AS|@7!@5A#m2%C zaP8W)obqxFU!bmB)DPtWY;GaYpHH7YJ&Me_q%wFTFc`;i6F5Xl%3ovx#fFeGe(^ru zS9|(2=&W&7P`GdJ1t>67D1L+DczC6HuB5_FbOXBuB*&aVv2flvn4B^1A%2(;iHt1n zV`OZC$#%BpFiU{Fm?^8Kx?20ZAQ7a~eP@-Fm4~L1^(t+zzk9;<n_Rs>W0hmzH{d~p=ynSAOH(?f%j_&R?OqSnO z>S#*=X>y8`kA%7uWy(kOUSwAJEPs)1K9l2JTMs{gMoILs)sgBg{! zBq_1l7wV#Hbh_h(2hxAB551HR9XsUWrG~+5s=o)um~xaO>)ow)PYPd5f@l4^3{+w) zm#&;{Q^dVg{{u+(uD?sr@I4)yV*hh2g}8T`p(_QQZ4Bgd{xru|s3R?{l+K)Fzq}`_ zZsD;^6#UT+;n`7#XmHk=Tb3W(vN_wcdoe5=i_lt2olppLoUs{`R3VERsg!ca*VC&r zH{}26B{j%Vbx_9R?mI+UYJWMZC_kc3 zx>%Fs<3WvIeY^htL4ID9?;hqwF8gouH$c={V~);TPYU`wcB62#y~eQMlWugH3x8es zow>I+Q9V*syO-u&W=v~7g(UHvWG-dZZqw_KpK&e56YdiJzwXl&8&O=;KpT&Az%_L=+I zo^pNeJPhSqh=r^F=$zK~T&obU9$?e0bz*OAYkP^ag-nkU5Y;n;!`pY&;MOmJ<6kWP z3pQX*S+dWF5l=RA>Z7185ve5ZMhBuj=IG}yv=C`OP*-%p$|a*aAv@h2-?14g)?CK- z88o@MJ1TL_!;_4_*-%A#!&cRvx;EA|GI2z3&{dG2b1eP4=FQ!oPDhhAr|f?oEPq+m z8oFuZ2U_i_)K!NW2R&?(UqN=e$6cZ|7yLt*vXQm>IqFT-o39M_Y=$X(yo4rB67_Oc zDwtKPT$uY8&zBV@ijG5lT)R>=B^#d{c3g#>I-4|Q?rC)%#V*;06~o@zH5{;ys@tP( z$(g?V9cys2l08*sC`0_(1j>Z=cS4@kxMII$UZsSQL%zxS%FPb6s>jblFK@F-SmjTv z$@v7u$qg1B(G82qw&U8A?W6I(JUe9wqqqb`#4&Hb$U1UakEdrpEqFjM$faIW&(Pbn z(#}db^ho*Z95kZ`jg)+zI4dl^#AxU(8v==s7dzh*p32(cKDrNAQO=5rdiiOwlE=<{ zU6|6Hc4122f&DP*XMcB-C5BT$;f29UNqwgh=x*BEW&|#+NusZ~Ze8pV(z!3=In$E4 zWCvFhcSYUMqf?Fi%>DfPxd6mfv{V2@*^u2Q@is>fiyMk|yyk~9MW-4RGz99kK4tEf zb>veNuxwOf>r;EER3v4aPFI|+)mlObP7x#%yDf%h*2*t6_|)|2)SO;kHQ4lR?-{g| zf2Y(KYmIbntGT&rPfFlTD=YPvEx~8gFvA3OE-p6GE2=`VUtqD{*|{o1a}xY=Uo-dN zx952hE^pu7(hzHxP<^^|od3s@s&8UNrj6j|jeU3s^aoFnYLC%IMPJv;b2hK2*O{)m zHZhB0liP|LBP%bCra;SjanqUD1b}-v;RrZ=CwV{vM(yvY7k|bb2i;$K*RF27@)*c} z;rqAMD5pF8(NagEhidmqomw}2ofTSQxfLdmxpPHVlvBg#;YR%tlNkePnOev%(nRcN zj2VV=83;=WSU8I{^a?Ak{Mn+~ZAEF=LMW#KrDy!5KMtZnv^G9%VO@SjXh*oNr~P44&>NAKcui+n4k@$5`l0eMkykX^OO4 zo~jyOZ)rM6=U-Y}H2594@uEMgd!VC2I>}|ph-a8i81_Z}=mSqvo=kqzkEY{BB6ibt zuZHBr#KoBW7o;0;1SNOnI(O#SK{KhI86r_;a)FSgy%^MI!<}x?@|%a*Ox710ef?g_ zoVUq(bd+iHC$o65_ZP)Ry571+3ZiDo$Z0CXWJyvp%iy?pNlJO**mAPI)X6ubNDSFg z-#2HIEbPMh-R94HcW_??N0M;&=#a;(tbx|XtL&+TU3}|vduB!-x75LPMh+&v;XGtH z{rS$73CFSU-I-tR9`sA8lIN5Lj?59?mWLm8H?6G7YN(U(VjHiZ!zkTAiscMqZkJ0@ z!qUB4HFfs>Y`4m8DQqW1t%oP8=YU6FvDho-DPtXVAN?bj{v$H_hUMxXAuvgo*?R=u zluA-3x8F0JDMM61)o&&7@g2Q(HZP0&k9gS!%Tn0Ap8t*F!~Av7e(4n0*i;gA)_{;A zYZs9T$$P`H_ ze&^4k)VZj^n{NcV&qxNKsj8SdeldflY-3ba5Ihrqp6Jh}&&n5u99R+3dZXRdt*U3=^4?zRfcNwCe&f8Km*6q2N@Fk0KXx2ArcR2w_| zb?m$I+F9ex0sElEiuJe!!FLCGToPXR_>mM+`+<^@RNY^>kIMxecD23NUMN3LYdXVU z=;`7oD}x9-bsfg4onbx=_XJQ#X|XiTI7lIUf0Go{Fx75SmEs;+1e!V9xz{aOS&HJ5)>q^!f6f3rtHMX>; zhxk(3?&ol5J(1nHCs-w!sg!R45m#vq@fjO?R@DlUB>F=2CQ7n}nTl0>YfNi-+dR1? z6XEA+i)Y6mY!*G8q|aYj@;+Zw%Z5j0;-I6a{JbhQVK;5Nr~B27cW=EcCN?N|$!GSttcp@&@@0ZxlId#kmBZH^yVmA|+Bka6O8`o0Q!buyM+2ut*k;$<;??TT5bF{;TM zL9FDpBd#m?i|&5o{Cn{Nu`Ik^2Y&X!;KQlYxTT|J23XM;G}VgUKxJ;s`3b4P!S?IC zU#>Ae4VSOwLr(UJy(x;$Rkc5D=BLM1#i zLcFav#Qy~LjF(aC{4pA;qT&`Usp~+lG`d^h)8df4_}kV@QmKsek?2r^E#qax(qw{w zJBRae0nzE-f>d>+p;2|LegALv{-nQlXPXZmwVxb3EZS%5fB9P}Rnj{raXXTInfZ!@ zDxiHniPmy;W*T4Cnj5z=xDwJ^1!GViV$Dc3^1xURE9p51z% z6O;Iq6y=V%;?FAC&e>#Jkuk~1g;VE!g5 z|D}XjbBOQ9eEVhakG<^8;EqnHo`W!YFVaM2La~^~eRu|LWYwrK z<)FL1n6dY~LHCU}1qH0kdPA9YME!%*i1|Blu; z6y8+uh@K%$O~2MM{s!yZY)_>|DvuZUoWYQI1AB&|nhhYics;kmTD6VX&MxTKN_n|u z^QU{|rx{~SgOqjjArrzRZ|%r5YpHt7d0pe@`l}aF#gbd@ri0mG>{Z)bT4cxdZnWm` z2?A*lM&U4R{wTBm`f>CB^GE3h>^1FcLXTgRM@w%TrCY3 z!SW3)$}%9`IN8{G;L|@v*wF5lL?tzVKp=#Ct2}mKK;!+pcWGa~+|8Z<{NF1Wxx3_U z=g&Va#>=~L(sgWh`($I9nwrXbzj)4S{JwQ{bo85T+Byv2LEBl!U#-)m#D+pe zMMu(AM102|TntrUB{|j}kU(jf#G8>$W@TntAw%5^2CQNqC?{EB=#*`33w(5SUcdfw zi}ao%2fe{>!1VtT6G`Yu9PrL5CO}QU3X#km05AXch8~*zV~*-t|9c@;P>u#!-Up%b z)xEcnoQ@FGE89fHc)nIE8l;(FqgPF`$y(yrw9hobv7z8J@zmoOEyHJdqo_#kU@f5r-b9_g|mS$Zju0ndez!>;hczjt!7FgD-2 zMMJZ~m(&DUTH3MLUFgpoifU3U&*&nbZEVd1KrDKo%reTpE$~6-$GO>fc(TnpV%^J0 z`a5wP25}+P%vm~eVrML`-;koX-!5^PCnC(_kFT_FlHexujactZa|o;ZRHL_;ZHyJI zqKwR2Myktr>e3hMjxz8FO;}SJ#s?*HNKY`k1BJ%90|}-5*ndl*CxNnz^WtM}6HEU8 z_G8W<=L1&OqnLm1bi3Ty)Kur+wxRS=&DUW9r(2b){}!)|p1fS_e{HI7L=_41J%FJ4 z#(#ZkrSb>*X4+ej4XHEF!X%!@1B;#T%(*wW~s>t!K9;v z>5Pnf;&M1u5b>dMP}A*?IP7lpKDO*k5Zu3|_Wb!fMyh{zr+bf@*R?ECTL@kyTByFm zvi@JY$xb&}rwdH0_9Do3Nh6CcqvU?8B#A^WbS1yQK`WM;1u_7{tK4bnr2*n+)P1Mb zU%cYkwG7*o^3_)TtjXqluZXC%nLdW;e-UM>7E{(ku&7>LCso+upFUz4%PZ0*)b;kSrjArz+l zzWLU9WoU^qj9xe*g6UD-9N2C>tRG=iUMGL;-+%bfZ*RW8I^u%u*GROt>)Ag$JznGL zWBqh|g{9W#)C2S(RTB^p?BBAYk}_!{_3Qw0UR@xy#~4y7xC1r7$Fw#}cp^Cy%^}AV zWfsT=vo%+oq*sKbGHw&{h>0bDgrT#(C1a@0t-zrGU^Oip%15nep^=l0-VKYiCV@g+ zTuPV`r`Pl>-&q%alv*iwRtslcCxR~7>bjf8+uLB`boRMPOuB_vVK*ldN3mbWe0X1z z^9t^ z>d8o9uMI3A{ z)V&!R2K~eqLO)(pnh(yL#a#gI+h@9@2C#GbP6Oi+yi6SsQWK=Wj_GY+IK!Rd$N=X_!onaTcyLz#Z_Sfgqf~f z7VMzaTpub-^f{UbgeacLgg$@K%%i*=iUGKOu@Jxh^~PhwBJ8mn8$}q`^hxU3ZnoH! zq~OyTX%W^W3^H{QE+Jxp>lEvn$3UyeddRH>$bKB5aD)V=4g9f9#Y>`VsS$l#VSWxeI#VENqpe`oB+gSoB z?&Lhq!>_L*NUOP6EOEL`qB!}DdKoHPmIl%0?m8lJhR^5_iZOPeYr(s687}MmsW30k z!N*$YYKD>jTOT0;kn;a(a)uW$py6%J&LHJ89#O%7b)5WV4q<6AsC7yMhOeJWMIx=g zWcf;abJE$0(RrU$mJUd-H!%g_nwl6{bdAcqFpRD};Jma{yHeCY_R7dxuwko>zP16J zU6S{G&kuZYX;?<7gK@`XH@Nv>uRJp@;tWRsO6dp8{Yr#nbWfU&CpLB~Zwm-ttm~Kg zIt$lX{CKq56zvoM>O2E|L~9h>WGY$^zPB zRml8}64k>G8*OcMXC=JHpM=oQ-1hBskj07PtZJ`F%S8pnzWrwr|JdE2ecI24p4QaT zTK-!JA9F%QMSYPC?z~SALy3i5D$C^~`)Czg^C+;jwN=@@9Ah5ek&UA??kuWWns-R* z8nabx*m0l2wdDPVhuJ1z0vx}c%IHBA>s;2hMI@V#rNyd#9`6cuOnSF)5YErf*K!9s zctvzNV)i0~>C3S@A@t?62%3ktE=e-24old9_M%#))#wqR>O!s-auBlrSNnPbCK(h; zs(J}W+w7mn$t_E)Go$y6C2NqA8;srT56$MOa{j+=n*?qV#!fe;f0NuOu5<2ELS zNgDeZ-?&XH5FyKIDe#mqM*!10a1u%Y!?Sy`7w9*Yiat;bmzLds`4V!kwv zU{+Uck#M07R^U~YJw+@~*AIKyQl9BXlo5%G+suaSlf(Jjo-X`{ExiE}{v%(5ORFiE# z$n5a()3L7So+g!e(cf8r3Uollz|m1D?DF^OQV5?C^EA9{ifse_y*g=xLRg(hmGIQK zWUYgfKj*{sXVFI}Gsp5tfs(AHIVbYNlXx@QRs5B`?NUF`qK1SEmti*#c{>6CrIuU$ z1FQ&hT%yjxFkW@M*~W0l%-Plt=)r@B4_}0Mk-xF^>(~*UIo;%;8aLv$U`jottMr*! zeGo3NV-7_z6_L1U#2-^cla#2eKj;&Ua4PDa?}SI7{dP|5cO+0|)kQVTe%{Rm_K((0 zbadj$)yNM~qkePq9${AFk(f19@TVD~XP06G$7WAI`nU_6>3EK0>U`O%Ot6; z_QIb1^WYcG{3dRU+@^=oSsI3|YQs(d0xMvxi1TU>ab8UTw6IXCk1E1yHBC6Ov9-@Z z*-|jPUJAXiSeF*6Q$$pKh-IcT8TG#^MXpVGahe;iR0{o9V$N|5o`gSNF3_>iXBmFATivG?p-gF#GZPbr)V}#59?*~ zO8Y9^_LvA!-l|kxT_l**=b~Ai1*(K?*Cng|p3FL8+aRfSOwNch082`kxnz%K;8_eB zgj}Lm*hpL|Nx<*>Wx4&6FPt;ctmV!s(P#4gxzjh4oN8^K8I#^HtqI26<3I5CD(d#; zjgy=6VC%5=sRpN?1(V-qJtC=NbMSJLeT-+*!VR-uJk5u#*0)KE@vvrxNpBd8HLp2J zxkX>=M1oyTObT{x%*gFI-B24ACZ8ZpYdZBYM}YbTpFBsLs^{giC2Bs0WhzlhH0#&D zjFQ=Kb{uKObF8?myhs&PSxug3R_6WNo>79D;*GmdM}6l4J>S94tWV)=A^Nd9c>j;8 zuMUf{`=TWzBvraqRBGsM5CQ2Jx)BE$O1evskQ9NTW2m9KQ$Ro%I;25`p+maizW6=A z=id82&&!;1_Sv!aK5N|`nUm~fj66FFLsorW_pj+cDYps|B$)f%j+U@u|Dh%d$0qsC zE;~!_E1_HK8FF1_@UZAU)q8+l?n7zcrB>J2`_4 zmjwQHkgviD#K!;xuFinJ8C`Nzl2d=0Be%Wm?Cj!MpYzP|8{b=_`~H$~Hy4gbGf42f z4t;RU{=*Ci-<}vS>|c_0Fz%<{g0Ze+JD%d&R|puA$dDh`AmzhB1Z-%cJ$*-*rpjipxfbKR{7`-cZJ~{@MXu; z`>gO9#}t_Uxo?L$}RbzE(b7&=VGg=RUIa$oGu^ta5h2LNI|ycY<##?oX=i^ zl--EDV5t5AD{8E?dZ5kq*Ix}{G8lb9*Prf$j%_Z~DqVIuFchDuub-Pd^c?+i3_bbgA~a*5dohx$g@0r_tGXoE7)~Zyp}?O z`GCse*1cD_1)J7HX{OCNA`QuG;;WGU)nIba}+Lf!o2)4$><$|k3KmmLgURs!aa|~T+yD9-^rAF zl&dL_gNd1l2AtoM8Jyi*tY^)$yaAeg%>wShIK)5afeDK#I89@JW>S>B(k}|~_+BBo zYjDI7R)KPcK}8~ay~E<1n5EZXGWReZE}G~)L9HsqgWr??juO#s>GkvQMX^?IO=ay@ zya+btj=}{QtR7TtNnTLI*-kFz0ACo$05V-09uaZKRR~7x# z(L=JSkbj`&GXm5iFQdNlx{p<|*jl4{>G%hl9%2jgm@~2C&MSh+dq#gLlo%sJIE>4$ zI)PW|`79>(#VnKpcF9ECYQFamtAL~q53d@8JN~F|JfBO)?s<#bcELo)#TpG_2cQw= zZ9e}K>6U`X^j2IqPdnOgTBoPG%mD^fnmJCX=;_OKJGeAm#qbugfb-*U=*DyN|me7W0jk&qVfgL~kyg0Sm)u9EnG6v>+G*kn%?pO0*i z_6KhvS-ZK-)uhCvi9;0fB>WYkYOQQ3=dvxScVzypXmy13=o^okR{tBhmL&4nR>??? zM!!HEusKj9Ba%%0^*?k6c1dBhlK%+qd?Vz2Y|S+MOqnT7I|?tCV;vp1XLa{_j1@;I z744UbG;^oB^V_Zh$OW7z9t$cxKus)CS|-`~8*0$sV{=?K3~dvD3K76;n~2B`g8l^)ih&&iBGP? z6L_CR4;_y(@(=OYGU)tN|J~TcFQ2s-#lt60wexVj8di+Q+tX@EJ@ru7 zh3?;GIhZ+2Mn>j@@8P6H&7j}6ZS0yTv17=+7C50-Vest=748qKmH8$YD>@9?ZeaMl z{3zh0#B{SZ;Ch8&t}(@pt60qO*Ea!M*a4NrK@B@~P}3pBAdf_Y+nAlD7XU4}50Z!x z$UOQ4j=Xn#S3v|L#x&MnQ%*IQxX1CDon6 z0eCg}9&O>4ex&;HU&z_wL1N0QB2?xNt#1l4NPq72CH&QTWUn-opB}WBkfE#m&`=X< z<^JrYgHo>5Iz;o07RJjL>l&+T$`Oi#1z7mx8}5}^i}^mZ!Oa4#;q?CR@x-tHzGyzl zeCE1c*0%9;Tk?>rN`<{NRHO9r)63ci@Un?g7uZ3Kw5I0Qm`DxsPq2H8>EC93af)Pd z_2XgJs|nF@^Z7`0d==not@Q}ve|%TCTJ?0GkvDw!_GxH4kqTl&U@wP%TTsK(sJXo6 zxigMRrr4~*=fbA}NdkrJ(l`kbN~fcHf3_}Kf<|FbotnWn^78Y*nhh}ix8@bAPvbLR zm<`CQG6a~`$6>3kinCSm)zvPAInJD@HPmKhVPWzi9v+J@J1{bdoD!U7f4Hnl@=CeV z@Ogw0g)BGCiovJ)7j}d*%)sQ@Y67r^M+W5ozV4fXI@TOd<+36h!c)nvN&trNy6dmV)nKs?%nZ`6$;>UDC24y$$#dRa2OWjk&?~9rX)_QiF7S-&Z z03kGJ*>aY>G`g1u*?4f6lV}#*PdD&m*Ibdi6utW&cDWO)yw(~9{y>3t~d;WA1`Rm z32v^tzF!;JT6IM@GlA%Yq#>cFJCf2Z##(s0H3?-~oZ;*zGb5|oO{DPl zO!_^g$pC*cLWAmVM$>yhW>tjO<@%0tBL@Qf$kcdY7ur zY6y5A0`lo90N>LT~c zgx~yzKaji}i#-!5S%|c0R84;iBI)1 zz^2R{lhi)vNf|h!&sjuW6;>ANEsyFN8RabV0{?sh%yq9|Dw|K{o%oqP7_rSlYbn~U zEltw!RLm?)CHL`)v(dyN-#epXTW>!;SEJ{CA{?{)BgSNWwk?Lz6;>O_)@u@HWM7Q+3`e=^$XBqNKamxT+vo#9GjHVOS=?l5vZJtk$ z|D->!0NWWvIIq7poRFPuc%E3i_KC2WIx%d1C*lb^dRet9Jlq*K1Mb>DW~IM5*J| zT@p9nUkJ>N+p(5(u`_p@>G%dt_!#)P+s$@Z;$|(r1A|k?Y?uL)O!jMm`W>*6{! zj+Kf`f3r|L7wE5Hp4^P*bbSZegD0#e#!MNPz0XQHmM>1YN!x|eEem}Y1&u2%uUk9d z&(=G)Fo)&Ohc#R1O4{hnr`9o`9sykOUGA1bSKeFY3cdbK#67BWQRXC@nVb!?7q^As znb(tBx}HCtc;{P*wcX{M{BX)^JGV?;{IK12xDy<2dz?ElW7Kwsf9#ZEKdq*A>rst& zG_@USUo!N&J882O-z2L3%ye^yqGIBBRHc?x1+{&oU87>1e+jbFu=E;fU#Xo}@0+Ip zv{JjX{2$3yEOSez{f;T#MRq74`s8-Ab0SDDMJ_1G%8lNHp!%$n;G~>2Vm9_K7v~Z; z&OT_3cl)tHkFVcd4#nedrdnZ(LhkFYUrG87_6dN5Jqw9jCw4QOPe=4M5=hKb$eJON zgc(&au(FuE(gow%lEMT{OON_QJVF-Oo-ZRCDA$si1o(8jI z5a!AIa1R={$f0U7`4))l;x{8Q%PoOt$*3>8Q+~K_h_~z4HX5h)-dwh}K$_1z#bQ4W zIlEn4z{e(cZysgzVS8N)On^w*F7x*_M(4h-KRT!gS{L=Jy0lD@W|Pcl4}a$UyYrc9 z3Suv#VEjnT1Ysh+E_A`wxYoW^@w`N3s`q5TvkTPCmus9i&4r8|(LMlleZPTl+5>X> zoEAPfOgc%(%jmu@3D6rzzloyk7!dxsJ$1ENB2i=g=TtLee~}*F(yN3AneP(|O{~;m z*TlY{Bn%gqqf68e6_%Ut@Utcrzgy5uowCJP9DnvTNK`pHs5;l+qF$3o+bbC*?BoMA zSALmsfh}zK!j#gFS2Wt>&awc!R?CB&o!yeWvY%&`l+1G9nK4KFBo06dzM`yq zcaCs)L`DYbOQndSfA_!vXgKm`4$K&Ek8sEG1#w&S&Q#T_7y|8%i=hu2z@%kE8;XX~ z$VE%|5!Y7&{#rWt$*&6iP_BVikP~Of8}iZ8aN5*1jwJG)-7!I)ro;-vOiQZVA8!L3 z>@vfogY+H3sfwYn&*Y^ed1OVXVPt7g5MDe#{UxRh1*ylks zDBY3(#oHT|_NAYGU@y4n88kjrXjuN2<*bN6a@%9ZB%gc+r(vu#l$r^{S_1bFPY1b7 zD9HT~es1=!RS)ug(%3-&^`2D=yYu)$?JHCzy*`IVFTmQ`_@_`OZrpwVmjcExW$C5s z^>~q|{cXx0Mp8j5`bD1daDf;wK<4^Vl1`fQ zcwVuMsr2-RWZB^1+ECgqFbiVZ0d#;Rf#(G7JCmou+(S}^-0=Wd?!I%({o|Fr7tn%E zjgT6w{t-~7TAUXLzc@aNZD?8ZvF#mqrKa+j;a6KNO04R+T=1{5sj$5*BA0`aBQQHq);8wYBZ;J!{w&`STu#%yjOJ(oOk3Sn9?hpzsCfpI~0^y?`6_=ra?NG`n3ace*)Roo*^nmWqf z$S8ejq(CL@xF2|*P_LvF+{_$HBi5)!ncw5jjWH~UVV?C?-ue{NEP?iy5SKyBtqjly z7omF^Q=5=LN}L-VK&z;vgh|bP27!(F`}(%VtegX1lk@WO;)4v3wh>mUMJY4-0i9lN zdN!%FqN1W^Q%}O)ScZyN;t%TS#2mq6u6D6Bf~pN4{oa`rLfunjBgr=f?pu({3uu0? zsV@TsZ{RXvuA(!`KM zpYJP|Dx21;zyL}!2P)p>=^s3O0HEF6sE_ZtAKbt#o6kR{Id~ZUm~lsM*NjReP@Cx* zt3;1$LDglV#p8qMnrdGR-L9U>px68TyuHwA_kO!B#S# z$D{)z=?~8UdCrE9P|e4JJ;}YZEvb0doc!!;A+TB=suXC)`NA zgO5c>P%xlkRW5y(01#LuLnvQdubADklHjhbM;=Ura4`I-gr@kugLuzTIdIEa!hj*( zay4K`;q>Qb2xm={S3k-0?wI5axi;&(#qy5eaCiB#RzDyyJ686Z&xN-{XeU7c*_U(i<&8*pd7T&c5K0E-8S# zPIbM9SP+<=SuH6je$g24>0Wn&wr^lg!+Ln?+u5z_wFKI{-6j;D&rOV_hR%V1+en?^ zq0!NewoRwRTwKRAf5kI{_+%w0)|J~8P5t|c(6VT@+Q`%SW@jYP_Q(+w0^=USFg19j zOu)eGpD8GBtxm-BU;^VW7Uo}whQ5AL12+zp*Lii{!}r(R$n&7?aHh*3cl0%(T*ADg z1yg|EP;3a}$|bF4#}alB623_*L{3QokOxQKp{Xe@(80k(kv^4wk{$GpzJzq8a^m$=l01k>9cf4??{ZU6EM zcZnFmxXb-vnbL4DLL0?27s$P`$u915I{9pA`|r09Qt{Iu>AHc_Xm?zHctZkS4Q{?$vZPuEO2!WNM+_8!K-+{D za9wK0%jxBlKMw#@%1-nR@Y>MY_+5d(;Ioxr=u$W_b>3|E65?}idrnji=5s@#4qV;u z>*{j-W0qsbbz4`ayEX6kod%e7poEi`yCFJh9A1PP8Ypf^*V)+I5Y@nO=NG~9oO)Dq zK?6UeXyoAQC%+*pm=k(W65a@}Z1^tB(Y!~x0b6E5eL?xE2wU)X-OB}KAKP!HHG`F( zgA}Big^M3n4s8OzoA{-4<}6^x$pWhKUf<0J%>dfA)*&8ck=LpggS9|cGFjS1GW^Kz z0p;%=0jVEOzbs*Kr$BSvD;W~?Y9-4dokBu~@`HpjYC8(7$WgosSi0NWD&KB*Z)j?1Z!T}2cXeB7hUv;0 z8&5CEe#eba)cB5pH~vYT?8}nqgVzsVCVX;z`{B{khtFQXv0mdpW&ZN_dSpMvYi+nK zg@)(Zr&VYFtPxH`mN4(xQq!`Jvt@4;1NS%bd64e<;PvA2Sm>_2@d-mlP5k_4l0yQ$ z`t_z=7q?TQic_xM2I$pegLsYa<}yCJmzsUoQoIs__O@V?{B=hJL zsk!j0SG`gE0pT2zO`i+Sp`#rd4ycTD=I68zWhQiF7&n54~!wRfyQNOqv{cAr!m$ z>19{UJWh;5hAHrLRs5V977yDH3kFroBDfYkBkN*rdxKJcm5GI6%)TNPlE%Y#eWNbz zZ2a_w$ynIE+o7-hmp-0d)sS(Rs^g{IRqS$Qq-C+h%f&~2U1IIk-K2?CA>ElYzkd9-tCZ#z6+uC97upl)(;mX0sCSEI zLH@J77A}l;g(meaD&xAPLzs2cOkb&ldzAv_(vkoA2d zt1pvr2bToakhIU+iX`yZ$<4=u<1$FSJEz{ z@L;?V9d5_<5&P^FCWeX=q}C2UmZiXJpCpz#X7@nhT{_Q}Xi0+i5Hoxa z+%VQh5?OS#@qB}Bn|ik0CwZ+LVCAi##hRFUk}b}5 z37(q!{m*_&z>yOn%Qr1GH5(i7Xg+Hbp6vPTMK5jLG#zglW?Ri}(hYG8G5{@z<_|vmT?8XhB zWm;OImZfEqGV?l>RL8%`G6AA|XOkYcXOp%|9>+cDE5{c*7L#th8kg_qG@5TR>`pMP zJ)$LYc+tm}ywI(%kZG*#xjoT@$S-I$*bw%z0!Bilfx#Y%0#*~NzLsfG%d8=--ia>q zWGc1z&uc1J!>)+b%K`jcQV>4#ionzpL36M9;Tx?Sf<$>&MDfh+zaxoLxTxiG_aoH9 zX118^$xEg?Mx`olwU{yaanA>$^pWv&SBL9}EBkyL(ih7=%f6N~Q2x<&SJ~Dhx?8f3 zj!Sx^G+j&i`Z1R5u}woitHf;aRq=qlzM`~%@zL?yOCfL0{6WLFS+BBNgB-LVaz-a5 zf6hAiCL)voDVF8@&3WrO3`M5(eK7~&cZuuNMf-NyMg~$QCuo_few_sMHfe?f9V@Q4 z98ZXXf@| zi@!Kxud^~e({$LRu?v7(RdgPG3TTc%M`{wYnw~$?F55F<192)XC@Z~lw*7X9P6ESG zHBs0A{^GmoU*o*d~h;WE}m9vJ7C2^)MYiEr4s z9X{lv0r4^?Q8&1M_ru=#Z;vKa^f=~@=n%WRW`hPvsgE-C)fH~qsSR_9&ME@Qu|c_N z3f-s8pM^z-sQxNa(`zVz|Ae=v%aihyf4#lg#O{;$ozsR5TA{qa_?3>@p7f#EH+{Z9 zccyg$6>%y~ZI{$nSEbXnT(KDXrUw%J#+X* zC3g1v{6euADbz<)$mK|tT9PFyRD}r9$@ofRZ$KcS>5yb#Uej_)`p#C%&{G>01erqQ znfnB|cg%kvyZcsr4Let5X%G__Wvw~u_d|o(_x;$LRhk};X_JS}mn+US-#pFG%1+m< zO{zZfn5fz>W)^OU`okMB63vAc8=6@FDZ!Qe( zJe0uVa>6d8)jy)ni1G{rnw-*J^QU8Ss9CnJUgW|&Ec5eKvjoUO9GMoY(9!;o57T(a zNDINyRx+rT*YSf9+;?(b-D_n816M?T@-+Aj;ERtdJBv6mSPwve8GSW*&FvLNYiw|k zVY=)-%?sPTKvP4s|AM{(QS4u3PMo@{I-DIYl5$@Q4E*S?KHRyf(5j4*cxh~y)gV5R z#?it49jUn{Y8f@+AGMR&#`pP2wa4gTURf=3eV}T3aSlr)FH~8Nhfdr-qCJybKA5TE z_nAf*XM4eFbPLN6A{NC$feR`bIq2fM_gMyt{|hH8TNkA_%M)T)tk4jg4QpjKtdFys-g3D2c_|b(^=7r(VDM?g1iWF023amb+#LAE|0T{C=6+ z!uQnT{aNWt1=2K)fo$4(*4TDQ4HXMAX5zHCZFIb;>#aEXdM3g5j8VS2I`PDRf);_Djt>?J6b5reY~il zX=XTq&j>Ecqdg%ya(7qrNmLDO(*fK<#H^Hg9JII%12V|LaGPn~^t#hIguli&>eZ*7 z(PkAg*4srabfoCy_OG9AA0Z1OL{P-3)nSU+Y|&84&i{^sD(-Dbd?Zx@f^(=~zrDgz zot_UGjj_ra5xXHRe_D~t*g_80-=mDk7!49gpgr7Lc^!npD!M;{+JyflWW89@vj87* z<+<3vjPncTsPO=C*4qY!W%X}$(@mZAp<|xg~iT`l`!Lx9G$nX><16J zxA0s`4dnss_L&dgCuNTn?znv`)`Jt1jc;St%HKNeAg7h8#UpF2-2{>ubcnd685ozij7=Y;f@V4br0 z*T_GDM1E@QL{DkoM$%fd7E*YyK{7D0H1dCWvo8o6~ZiDT##?g_vwgxt)I8 zXAwII1P+Rw{oejg;!O2abt{d$g4TMevYlU?LPWT4RYgP&=;uVPIp##x=vnClB+1k~ z10$Hk-_E~k;JSHArlut~J9C#?w!EMsYkC)a8r>Y<&T!ITVD2UDO5{ezm1*ENI(=ws zRY{{K;dx#AJ9tXVJA9+Q?{(?nOGd<~Al4Ps-sG8z;>_-pyZUlIZM_}0eh3cpqK`k$1wu?e#pY+1pSUHixT}5Uavq4> z`XvUff?bbi6iggG-pTDq9*P4c0Vx>;#n^!#{)V0b&Ro-_wqn|1gaAz2`=p8wh4B$3 zg9iiOA2^idf8M&4%h<1Npso3E1g*LlS zM6r&T%GBQhE1}W|EtAU!+OpSSszU(@s>A-_s>%U@?F=3i|L*4{IaUdcN7G?*bPJF= z)D1Ep?fx8`&q0UfU+t#^#SB+QKN(hRtjX)4vJ)X`X4KljzcO_IDahK5dt# z8M$WqCoG$n$5d_YIlamM?bELrS>Ggl(}t~uB#Ax22)W~cB%<|`0(+&*g1rw*%5dX7 z3%&ZYDi9=6S42IdEN108;pX41xZk5GdB82J0GlJM;9^0bE}S~4h+ct#x`-X?4~d;% zkvbe$FSI#1(jvRT&<1Wxv4u&_)&@lp>lT*wX=%`!)yCvkrp@=~7OwC17>{rAd~8Ed zE>KhT(-6qVmBE~whlk0V;>(EmCIsHyasQ zrRMrdN=p5Np#4%YFF9MNG43G_5`UbC3pApW9n^wLYYbFdR{x%E~7E4{3ZtVM|UBy9xiCkQXiP2Oi`e$ zRp3rN*Yhiep&bd=me$_SK*;f?mb*aj`A%OUoKVkwfLN%6q0RiCy<~?5p_U032H^3x z=Y5iz>gqSDB%W_>fsunDt%-p5{;H}(z{N~sDU(VB9M7Vf{&HrHeifcpJzdTRuxUOC z(lkGQ>=|Cd{ODahXc(ZvDTi zD^!S!CjBJS`q|IetWuym$^Ci(*TwpicKgSxnrSONo%sd-)dz@fd1Zmvqem6qZYNs{ z84K&-4suuA7P>SLn}DtyrJ?us8Fm`3*e9>l6cIK5#)amR?!KQa>6)Brg`t-5?t|Zt? zGOD&J;CEBv@yO%+^jocumVLjgjBW?SFuw{9!!_DL0-wt-9O?V=i6>Ji?d@Ey;^NcE zY5ewodCR3KUN%H@bU0T;tdFwc4eZnCyqR|8s%MKCSnTn8#q@m)BXRGihe%jfy+AL| zi~Mwn3vYPc%|@+ObHRjBh0_r7V5xyv{`+6R>Tr8~Rx-!(6XHA4O#Gdj2iQ=j>AIRf zoV;RR!0c9P4{nRK4ytG)C|*){i})b*P(PGtu9)@cQ=7$R z{ysoyN-i^`ryr0p<@h636fmJ8=!A>@n!#)Jag5Rh@FHdq-WKrLf+pZdTFl7=YuRIDY-E0KSy!Xs?WN#=U`yfk0973LWeQwZG!a zZ{$De9K{1xKigL+2L7m6e%W;+uq!JAAgWJFWFSVOr#u5u z*S1UHD~`(b9)5wNF5rfe%idD!64}H_h+=!0>O=$WvMdn$@YpuB>lpC0XSQaWSli+{ z547FH)PFh+%3<3KzPPJ#qxBO3rD(2k^2}4YMUA2jPn#0y9uQhG^m3=BX(*78&b&*5 z;K_|)W6wNK=i^V6*|d^!e%W@h$`_NH1&dWd#4Zu7h`js8bNPn$+tudrJ8!r4$MT|~ zsANo9d4>vce#0I?uU*5iIGWb8-I6*nAeaXoEKx4|;mVdNWXDtt{t?@uxV;*^%Ehu2 zUpZkAc5Rw^r7L}c1lK2{LII+yz0=s2KeSMv;wZxtU23|H6x8SN&P+?gU$R8vC$8h>Fw%M9fK z3g?2|`35kM7$lwS%*F!(simi*fWlhi4bZLyc_toQ4hQ9$l<1Td+D@1MbhoguunmC} z78ZubFh~xg5z`4d2C6k%-))stIA;RKEvc88)EZkIqdRs?iNy*@bQN0xl(6SQR8jtN zh{N{m&Kdv{`iZVpXa6W#k?OUJHz9nh8qO+_P^^RvetnAO{nt;sy(re^NH}9~N0I4? z=-BE9iS=7bn0B(Ej&y*R$K$r+spkd;*=E91pJ)=u62_IX*mDB>8^3OgpAGwxu|Cpt z`_kUAE0$Vs&dHw96u8ZMPO&h2F<}qHBkn)fGaQ-Gf9FsWPDPdC}17mLc zB;soPX2gRq7Yf~?6a$LR2D`lS&xxc>Hu(dlZ%E?VfakQ7;{4sXIDPclh~9mz6M~K7 zPr?fhJ3kz~{lC4A2~#uv=J&l&gaB!imLI0(m^QntT!7;>AIU6H@}--iz+t5tF~#lg z{~A7Jg$!WRbD-#j{3!$=Jw^%m^m~JXu1tog?6({vaCi~wxQM#snA<*`TDOp!W46Hw zZ*AvFz--8$KI?|Ev)3m#D3jXI?3=Udla5p3qU()M?_-eL9UMO52-D0a6_h=kNg}%P z@*{W6zhWiV!~N^O>^J{%5M=S{qTLB%!aMMeiQTk4T?T!utLrrz(YFV#!)b!C69B&P zh(JL!hy_PIHkK2o5lj+HI(>X!uR>Q%N%`~9XL@%*Z~cAO2qxY^J$FAQ3(D73i})M~SM zp}kM5GS$+nd9vpuS2(VnzsyVwmJ~Izjeu#r;Kfgb~)+FR$0w35xH-8ell%( zwjftN+2ns;Lv%$wQRFPPBaPKHi?oN)3;)*J`#Fa9U)DsqQp1oNDquFtA~~8~Cec?D zf67M>ti4~?u)%@f;vUolpBRT$wO{*G)Hbpd=~kFnmToe$u_2?N{8ksis7g1ogo_Lu zSO?NKUDf{bt11~Wy!dMc8FOq-@ghlKv+r~5{ggLTWZ)w2WxnDi(U1x4mR|7Ga23H2 zqMk_mn^>S~`M!cV82jfrkK}YF`QwqRIiNw$xlZo6)w=YKCoHS&ATiOZAwg+I{WJ(w zhWCV~69f4&5EACxP;WL1|6d|>_4*^^dLtuoCcM%}M@J5L18Es?&m3R^hrxbcfMtw+ zS$TjTTXu8h&TGBkb!C)`;&Q1?t-0<#G#R)oPnCZ8q2)IXG>DKy-DEK)u3R$MNEs#6 zK_)?LKm#RHhMm3ah)J;W`l2|3*Fb6e^%uaow77FZ{7qHB=&YhKqn}I3U2WzasZ%6k zirrQ6;&S^&*)sYjA~H=`-V)^&eRe5CU9A+Fp2gMPNl~8c@MadXYPF>+xCTVRNt@iG zf_CAxAYat)>=ZHXoDj z3ZlrpYrrXU2GxjqcRTD&6b(*q)MziGVj%7JdFY1n-nkp!*}m4=Di&ZiK(hSPLz|Bm z{@7fYhv#ei)t+b!CJgd0)CAyaa=S%g-xvG@fMp9S_%L^WLPd)LN!J}i2J2O*oTW-Z zaRwMF-RtVz(c_3UPy?OZQgAJFCW@Y`O)h4$Ds)6Y*%6H^K2PiRF2FLV@h+_}@ySEpd+Ns{1R=X(nttZ?4NR=Q7BBr;H5*+#Y#VAy|u> zYbH8U6=G#^4?t1R1^z1yV3)KbQOk>-m8}7H{=Amocs{XB0ZSb2_WKl+2RPMm}GtE^j(}Kv}4LM`srF!E4*c|mPvDX=Il|7I9MsAe9O`c6JQ?|sL z2wslQG+s15mQd*}akhSdjnyRAIvv5&oOGo(crjg@`91;i;;%avEMMiFH+6m@J^!3< z)yx(`SpR+t!Dah*d<@E=O|FyY(v?+|<{rj>|6`WMT zbh4HH`+>nI{fB|52|oRgivAbe#e;X@F{>SF@^}((Mnj2Q#-8Afx0{qA)qXs5vs7~O z1B{zLGMQ0{uJ5N`CrS=6bJ8ozM|h9LbvZ21`$2s`eI62KO~-F@DFH9;fDRH(XmK0t z6@LX1O`4vj1i~GEZ8sT66or#|z>u?9wf+z`l9Vph$nkR=&-H&e27o&As6JBpJcRfj zq`2$yo_3ktCl-Jeku>!I^UUq;rY7kqdbPv~M#!^O_6S7Aq&tH=w$Fp` z0C#X7BFxj5_B+{+19qdQoqv4EzivMObe1u&kQ$^t-WzcWf~t z7S*gp;43oP0KX*%@0)nC<6*=@R=>cxko|&@W_itxFH=T$zfTX0KCF3>7| zIZM=^4Sl)bv(Tmw3G36SWepJLi}-0br{=;F34MEtUb5K47qee4gJ4$fJnU^_qV7R6 zwBx3VsQ)iU$P!cYu( zeZ6EZZK}IdR|UVGcBnnc`8l>Qlz2Q_X=f;zNSbLdaD&r~js*X-)+>*{fdW%KmV>#g ztM7R&nE}brC}SZ!e0*LDgCW^ybmTrehsOi6h9#HdgxOpmv;wty%%be(mc59u1AY%% zrBDM$UOS$*TvTj6b0U2?8r22E5KBSkVzj4kClPf58m@`?)cyi{OtT+(52UQi-KFhT z=8y0Lt=y$3qY-yYH4|x5kgRxa8)9E((&iU+gob&NlP!xXs%O<9_ZFI2zdj(;o*!0X z9TS97A!DMs-w&7IAPt0bgX&Cm*42NmgA#G(GwQk9d>RekxGtl;>!`qIHbFlKB5Wx; z`*?84z&BoOcUqtru~<93&2O9?BYa8hdK3_z;{j|y~cbHlx)%qoC9}_ zn6UR%2qDsQvOeB#TNn_({#;yA0-Y{5PL~t42Ik~w6%AgG4W{r4r;B=UgdO5K7KQmg zTRwe)ho%&M4RFh-D=Ol3gabqo>BO_z=0h|YpQ)?IMHC@ z=TDrV#HI|ndidh&apVr+s0l`(*Uwmn-XnBO_Wb7m zWoqW>>s#WD_12PS3>&?%CT*5YG45Z{%w1ji!Z6@GH6Zm3(Hc-7%kE42upezcXQ@@G zjs)ncSY~5;tNroU7_U#gpEO`r)4j(Ud}gXQ+}{t6h`<|;x6el)TyWuKQO1{@dVeur z*MAfwrFV*PG8?S)x3QSe0)Il89?!q4KYlxKy_w;$#BCA!N;z5TU(J3C2(vpC=1-{? z+gl1BSd-aTh^hF*W)^fWYujdFG6=b+4#XDjSBNijI|_tWiF?ZKIrKR#k-F?GdE1fWh+}Yrs#O+A4e}wwuRGqt%$-V5Nhj=x7Qc6!^zyiGGkpK z_`;-UWWN$F?+N&ei&^oz@+Hwt0m))R5jXfgifPJfJ zX>!V5f4So6pPS-Xoc&^N@iosTcJlC26F0^cu8e%#$KeKL=1oKnZ>Pv$kl7%ZjzuB2 z8P%mzEQUNpT$?dT5qj(VKTlRbdf*7VFKx zp}4GO-hY(=Z=lcASHmZ5I9D^|wAFJrXD^e|wdmxjeY%gkc&J^)NN{zO6=t6st|C7~ zUt60Rdfmy>ZMWu6A?G(CA?3?qjG4VS^B|Mj%!jCz6_F``F2Z{DsLZ6IwKGK9uQpQC ziHZ5tN?xiw7(KzNHpr&IJ!r<|_ZzI9WbR&}gH$i+s>3HI5?NWTBaaN_LUur@0=dT%m|>VmIc^wpOWYAW^C<;PlSK~^tz%97B(XS5KmkDSPq zHD^ld0gU!Q10}=sf0+k?kjdAo5u_5?`^m~;-L#C~mjuIyb-c`3YNB0&>21qMHric+ zNq2lu#h~~v2-914XF|vF9)ii+DCc@!p>EY*JJWd9i*pYnGSVxXzIIaDI}#j-uq)2X zn{V3;cL~^wcK=Nwcv`*yRyZhXqK%-TyU*fN%l}JpLs6Hrj}y$Xx~XBdRT%n$?m_Rk zzfo>Sjd7Zg1RkWQKbT%Ya?32_+t5^1D~x z?TmFoW7Y>+cgPBf^5|?f<`Xn$QZcT{cqNaO$yCNslC)ddiYN{0q9_}?2ZT{&y+G#P zVl;Cz`kkky0H$;Fl5sQT-;Cjb9?94ADSRFRSrQR$X01tmlQrACe#h%`tuLQ+W;Mz=^ejBXq; zx?%Jf-7y+|7d}6)_wD!nXMc^cUDxA!JkI^x&pG$DHcP;5?Nufx`TThh5(nwD(ua}! zbQ1;uqy|Uu>Q;mt@GA$iZZVVf#|s7{(*c9JlcA0dEifF>!Q&jerD0(3o>RMMsffr*N z@=sG0mPtSj9vkaKPxv-~*JQ-sb!!T91p0j5Be4I$0tj7BiU<$S>P-|G2BM$}uw}sS zMo=|>9HA+>h&4vlzdX$bKjdS(o)=`T3f;OvVeC1!D^JsvPf3 zqSb6ltf_|p(?$8&$k1nw&m^G6GF9fb(&jR$?ORB|NeN-2l5+te3d(>QYV0)XrYYYX z_0j=|%+DQPfwHsPNX=5Ut54wRjeY^Zz;+GdaO{rObov1k#O0rdw^KSZi$jk$0ztkCE zM@vY&XxTR*=nnk|oL81Y)OQ~q(^0?ix!l+~jBJ`yzI^`r=E4r`0|yJR;|~13*?0M# z{@d$-?c-m6Qw|VUFqV%^5~Bvk#-v>tE8V1^{FV&R7aYK-TLuM#4utygH>=#0-<1_l zS7_!4NL^*xwv-*9sIFhEr)PrMjY-zpFIxm`l^{)(S~eUU90I1>6{a0z(yPuf(-c*u z0jOz91DgL7E+-GZe8q%}lm|oRc=f#aLmhm4fTu6$pz}@5Vc=IZ4~yv<`a|i6^E-Oy z)Tq}|tj|BZ#(rr0fFDPy?*?S+S-DK+@=jd2A6;^ZD1#7Ekq$T|!@#VRbYMDdA7R{+ zM!Pxb#y2taPkl>AlmK2EpO8!q=(#aT-cePMGnmE_o#IWq*~=;^-L>oBk>D~-{KQ%H zr_E)Me1E_P0Dm&=?b0gKtdGd0{7R*MRQ&RwVO3e0kVcry-9Brl!-bqs<6~)U_8wE- zan52YY>vKRQjc4ynfeli%whcxU>N05vW^Kd^YVELR+U}h%F0SQ1WT)6?)k~Bb;&0Q zwO$nOQ^R!SQo}>D8PRAj91dTt+KYV5eg+Hx7x=~1(8FsVHCW0 zhH2l4`XAN2PZW;lU-Xg`yJsIMJjD2O3m?uLhI{lFAb#hvqz%9P?+4^j!qnFZkuGX5 zULA?Y=%n!M785)I)CjN`JjoMdW{8NBWs*1Psu*;%53F=Au%Ek|JfH}! z=H`3;s^x85^x+m^sA|1vl8d#JZIXK{rBBb%RN^W8JGlYP zsj1efwb7)ju+C#099r(uAbic=H+OT*}6DK!quf0D>5}KEW2CJ0kEVWyAdf>|Zzg1o!dhPat?d2kI4V zxyA_|B32OY$NTx+tkK8UH~&TIlRO?&(uAOrsUkp}%usfR+~BQ2kirlv%M(kj3o`Fk z!RLznx!?Om&Es%;hYS}_^t;Qnn+5xbu{!2nMM7L6QJboyz@A0&Kg3Y4*0SHabkQ!3^uYL6IeZa>zZop<_;V)QY$eK2B@QEomLB_omP{1SJci2PDd=8 zy%I{SS!4of%aPTM#L5~D4AfdUik{!lPT%@jrL)~+1!2}kaM~3@96{;vn=6=*`wuH< z+mzJLa{-r8o;FQCYySpBM2^|fVK3Q}!;N&v(@Bq#X^X_{?o#R78;!Xc2kKBk^NhRPiwaM(^K+jd5#1`Fb z#>-htJ@kz;^yaap5x{pp(FgQv<>tMMoOhXPYOG^LL7+s6@Mqp?zG^v^0i z(#p8D3~mHN#zk($1D{CHdCbR6Xq~2A&74mmvBC-c0+g-4PLyup^r6e-4rp0bDK~!1 zV6eGCRA&C>*P*EeRJZ{5%`VZ8;;bxZZ-74a|N1q@qCe$kTDoAi_c~zjqCMcXW?^UV zdUv1Opmv0FOACmSTq(W2-0@j?fhDL#M@WbsW+&R#c7=_;2Z|Jv-5;h$quSv3X9!`; z5;ta-8tm2L4jjv*caf{gJlk?UC${YmNW8ihWlCH?-d<{Wlv{1wZ?p$?1$`{k>(c6a z(yec|u0vt;_1jlI%H5c}4snN8+-tz37(#850-@O`^+37RmRj=xexOtifF&SUl4 zw+g`vgWB^3O%Ba>{=yCx-WpYxJ-JQ0EZ97&B8(^_jz!aGiOgTt z?7cwWlm2_=u@18xE43Lm-~Q+=h<%>}3f5Dzwe zLLT1q8Xuuv%>oG&otA?#S9|1SAI!&Z`qsukh_2`%cP#q%s3cGkmKwUZ)Sk5oG_vev zeZR7QBQ-lt#YIh;ZS&=OP>1!0ZRtuh zjji>yF*wQ$_37zP%Lz64`SY}o7WCb(F3Ff(KG~RdBiiA~u0az3qMfgns9?sp5-&G< zMdo@O{F;Cp5Tg13N9WGtZffB;%m9$4V26;@t#N$T#^+174&;z(djQ-D6_*cS9lZGc z*3a?~0H{_G`126Gxcm3+-cydZV?*urR<#K{6&(Bt^L`^h7TpG532@Pei%&4F2RLQ6@E-2EhA8_``U7nQ=|Ld%Q9h*{AHtH z(6G|?gJ@2g87qy_byud6pK`x`t^J`Y=2R5Mp=t&|BC+@^1c5WMMQ^Ng=4*J`#BAO( z&{D8)xYqjqHvODU1ufsG+jnk6%O!n}h9}NiJfv{y*~(bZy~nh-`NrQ^Js96}eP~4c zOV}6URkZQqNz$!NpeLqxYfKdUd+_N<6&Fi8lsA?a+{YXS-WoS>Wf=G8V>~ZtjW?oA zKYV5h!2atkJ0JAD@%UJHmwFd#=)t}sRnV%;Ddo-HNlcmjyvG-;z_mb_5 zUAKD@t2}$1hfUV<9HNkrGCm5nxmekveXXb9M8DNtmJNueuayS}9(F_C9n^WXrXQZZ zq3e+>UUq!Zm3;g|lR8h_CF;q3cqmI&|0`}LHRmww5c!m(q{oX$Ib~#Ot@DOCqECfR z*g6de7!`bT_-dsOC~x|RV2PPa#9-z88e;89G;*3}I;ESN>$?B?f}E}-#D}8FZZ5@d zA@%x#bp{9>I|O{Jjx&JAda$r+wj0U%Sb_^_U9k$-6SIxmg81*4-u=t#y+^!0QOY96 zKQylI6prVwVptNUgT7f?_2GbVdw=Rh*xjZpezGNe;n!D2r`koW;QVj0t-(;$0yUTzx5s8_hiJ5EphFrtm!_ZnP&+y98hLB&2oUZnm^DiOMfzVO z#eMaw9|oAIO~#MP%A#azrRHypVh%XLsq@23E!EL84+KJHUNLuMgjW|fBuaYZ=+QU0LzbQ?-2tL?7l5p z^JCO7fcLce`>egN;PEs$g)T6?GWeeF#4OWQZ$d&sxAU`WYrCebEKTqN(%=TaBO7kc zam!Qnmn~(}phtqOckkY%?`Ys=#s$CR#-XNO>I{^_YsN!Xci#C)Ybv>TZ{szp^G;Pz--iP!u*^Ofz;*qAM2<2=u<6H5<0P)mr^_+ebO zrb_qB_`%6*uULRld-rXh%#CQGXn@1d1|caEvcYk>6HV6@d5HKqY_**~+u)hVf85c` zqi;P)Bc8~A7K||=L|WCI=th!R
  • $whgr;ydH;(WF+i6z)E5=O-(;l%FO;exwf4Dgd=yruUui zBp#;-A+zizi#ExhIs=K@1*Y5sL?C&(+)$^ehM6)5QZ(9o@0Q#-e)?`IufB-il^MxB z*-7eli02(lE%Bzv`h3b%R9G7|>_;#!*%~>@Zy>gQj0S%jNy>b=5X_`o680iMB3;qv z-nt^V%m*vICHu(PzJ3!Df;_*q(81)>vse4Jtqcx_%iL)HiTFkdVa&MC?;yi(8J=Oc zkj%|*UfzDt49BN?dWzLS`QZ}^aLG;lvD5RTSA^q=2Jn%w6LKl*{g4W$pqXMJFA4k= zAFUj6&Vy|1qJbpdq2|%=bP%J8Vi0EbgX9zx^wg$-0^%WS>hlj#vDkx^{%l4m4|{#H zR2})58@We>i=(6&m#8s{0EDJiL{9w6c4#!yfO02a37mr+d>Nl_0?T=vD z=~~rWkE`0s>dEd64au7^rPA~MkV=k;`OA!0JeO`2-kqu&JpGD6b9(2HePpP=Qkd;? zu-^vqF<_8Lx0>Bbivh4X_U?l=9h6ELO&Eo#<8L1ONT z8;bKG-uWmHl4OtLnyC=EEP0pNPvEXX_@g(#UcOQdg{vWglasobAVpypi4QB-1&?<3x?)%(R^hfvYntIDfH7b^rBfuz~@IaJx zT9*1;E>)&-0zCsEt+TTbwRCRV(lfF z&`>W@=WNywkZIQG?HFN-nw0v87>Lpf4uS4r`Iv?oxKKwnYfLdrV)H4J z2<+X+FuowI;h{W)vkgZ4bw&l)GcHOTsE0uXJNC3zbPoIaZ84(Q{?D0b9UEoFI&`0p zc49@z&##6IREMzP_fu?sd%x#|yG;oRfz?XFevJh_mFRi+@L?Q3K#n`rHmmv`=qnm= zMmb9#e@K&38!L3iPah>GBTAXlV0Y87+y@a8JFk zD$%~o8R+&&+iOlLXqDRc32Dp3^t=rq+r-ifW4rIr21q@m5*p4zf- zhBe}FfpYp1E(fuo^kbj)^orbqcNpocx!L<~49~IaiRzSG*X`v7rIXo%{o>v`G#z|N zw~y%Boz3XT$-fIty?6z_SCSML*SSy=0P)RD(kvv6Z^XA)ku z%RoN9%wClkChM=v>xT@qTWh}zjBNXH%99}JBZC1D%Y%={Kgg0+yass3Mw^uup=kstf-!btOlKQrMXe^NhK613Hf z@Ww@I(P82q=rK@=x9xx25c*00lR~QsF;k;O))nKS^jJsuX)WJ9YVMB?6fn)JrxdU( zCQ@Yh)AKV)ue->moy`(1aNmUG1@Qymyt5WnnmT{Upm^5WMfQ_cPbqX0+&4r{#ugxy z<^qc4?`k49URnUx0}QX>wMTo?Q|6JDrm8(&#WiBo4+q86{T)4P^|P+d&UrP2->+&d zqdc+R8)lGl^fuC|kB}=>h^>ud4i7Rx&c(u05++H|E_1R#P6`qpensT+yx}rV$SI`W zr!sk!AXldD$|X;KqAwut?PupMjQm_T&c}-IsRCf<4@C5oS+j&_MSki{KdiCy#N`Gx zg>Q6k9#H1dqoPV(p$l3>WOqxaNZc^Dw^>AABraTuT!&_nB1Or!$QXKl=N#456fM|) z=RFF$k9u{-wC>X{x*2d5c;O7^sJq+$uuj>Zgipg+&GoPRj&wB-;uH411U!5&`@5-r z>@|H_{r3YP+7mTk6raw$Q2!VwcU{3q2kx||*|bn`B+jAwO@GZYbI4}<`dM~XeVM=< zp6(LZ{Sv&oo_ZOA7BzP@7}1LPYoE}O1rKFOnzQ5P}@Qw{LEd>vWtdupidk#5}LlU%E zWq_xM4|ABaP{dOF+`H3*AC|>fq|!kgT3gcKQ`r1ZuXzkKqT@7ezksj?nMwJZ#BE17 z5LVEb@Wm`ESbRB^x_C`tcsH{(x4=(wtI(6-pg$G}Amr}2__OHy6{2sChki}a97C*T z@A#8ev;D^oF;cYj*|TSRT_kwbi$-ZYQyC z^K>>(`r1+6`}tl5nF49c)2=6o^YLi1#no~(Ji3Q zFg0~_K;Y~LHh3!7NSf<3m<@x;{MT|ixQ)!`VVRn3X>zUC9?sgyA@>NuXG1-Xe>I8U z1;B&K4Z9m`iu?Q@Le-Su+TpVreZOsV`Zl8he7a{8$$2~1{_$W6?rTi?ZN4449VQsm zJQ~oQ7El^ue)Z2v&gc?u+Vles8Q#;XDw3?|eW+HgZC~ZsiEf&)A& zhi$LMfOZn4(f^1pcQ_vA03Ru=Mx{ul#5mhDDUmJ+&sTl(AI}m>QsHTt>6EgP?7mn+;C65k5?EqcXX=~`AyV_oz?FQ2L?^Hj#?D}WIu$!I)LEJyu5y*N-p=`R8Y%U{> z=Fi+D=)NSeb8p8-dMa=zUair-qJ`t*&|h?5A5v2*P*S3Dkky!nBKcBt-Q0v2Y&;}J zJLt?;?qyayIfzGZGUYi;6L9=2vU~0>6z4h)KV>PL3ebiPYHt~)j}93It}V~-Z9*Hp zx>yjxF{z*Vqf>mkaXfB&YVIVv_DIO&oNx(YtE*pdazi^KaRMaE>#yj_ZRumogNAJN z7@TAqokN3Ss^^W>zhBnKW;lT?Aw z-rh%1gDN*mwgM4oZ{aO)c{HqOr5}%nG=Fry9sdJ9ETwLc_2$2!7eGu~7NCYY`F+imV4o{XwVp9}lnG)A|9=0fd_>y+Jk z%L@()>%vikg(=$&FYr)zJP@FBeXz{sqNv9OcpIiKN$o`#49Z)m({JOnnH$dt@z`{o zDU1zI`d5&B{?i&fs`T$}Zq&Eze^>stpNe%m_(gUVX^e}Rk!mn@@6Smn(U(@#@q?2_ zCmV|;;gYL8GAKjU`jjp7axmB$j2s`K8bp}}s2Cqu=UXgQCd1>Wup2fl`)HGJj*n!#>*EC;Qc##809kD$&?N7TW0oYEA>|@;M#^MX zR`A>c6od|(@F5UH#8IT&i(s&5JIM7*`RT6&Dzze9VD1x>7^$Y5 zmKS6&@l2DyK2On3zl-G9gtQ9S#v-cTaq3yYXiLV=OCL`qicR=JF#6GxwhX}~=f8FY zX`CctI*vcfgUxH8<~ol@85L%}DGL;y(Tr~}xphk(k@&u0h}VI4UvUPQzb>pgS}=_P zYt(do1z7@Kp^!u9F?o7-uewzED#x^KAD7;_#j>&(zTLovmiykit$B*YG%r+o`h?kJ z^g7gH+B|3GgiQ3G2n!fkGXNyai;>Cs0*&Z!3PzQnj!33#gE|+7M@Jua0O^+2C7|YV z3^@cE?xz73+F!nWAqC0Ln07=A0tt{};aiHSL&Y#HIiek2FMH+yx9k6R5E3F|DQvEz za(cFpq0>q={)Ex4M|?p1jm7eVupiH#l8e05IXx`8$}_a1Xs>$!$=wp|+x=I(lu* z(y*kbq|fvP{R1ziV4uc5U(lq81edD!vdqXzCN=N`Sx{AeyhL7MHU;(}*I>=_K@0sb z%|=OAQs`NHHyx9Ojj2T|-+D<#+y>h1h*mt%T=Iw}@|-$PWl1~LNoot>3~*o2Wf5lP zmazK(km2WIlJ<&Yprus;Is#e1FvGpD(mOawiHXR)8mE+?!KFNV zBT#D>9#8Tifqy zz)V9NJ_dNbqCw-t5gP&M9rg$hCbD&!;w@s&*#X56cb<3|jp6?k2mt1_uAGF6%qqs} zJKml7GW=dkYzioD?RBLkMDH_mr;6M`zKaq8ynbghJKi1ck65DX%Jt{2C0Ro1n;dO;s6@qb?j6hGx%%m@- zBGnDo7Y=usp;rT{owAdCN)Qzd73lUnQG53gkuSH3Ef5Bp1moSwQjT@JgWC*kp%z4* zv_?;U1_Zi^!+d8gj^y!$aQ_FXvsN_x{~ z7nrC#d(*SKCp*_Dh%D=QbJpgL_wpIKr@MQxzYf6R%h^*#r_+60#9ZUIyTK#3Fa|T$ z+qx2Lz>zm5%}KaP;0>S@?m}WETjSH*HPl*+Se37@Qfb6S>Ui4pL|zIBmXpaEFObdxd+p} zh-L#r&Fi;A_M*2`Xu1=xOb^h)*Qi~2f>zk|8;!FFJhLNHjejRFR!7X}hMbnwgu;xC zx(J>s^KQBf0o=Z}X_sH~(||HM+iE{F;0TKf^T4YE=C~zcw>lb=n=UZC^d?l)r)3&% z*CkKp{k7_aL9k~Jug{yVk(TX19b*tBDtj(KqG&{mmKOuE3twZUD-u%sIJuC83+*nC zXHVjKg@MXT4h|37$myTU}@(ee%2&wsh zANVp5xJ^#%KtPQSh9CL8N7wn6CrFri5)VR9C4@7%JoO(W@jw6S3z=4^krsDYyp_88 zT5()q6`!@QHZL!)J1kj3Q$r(;A3fKt>&GH;qiBNw9Ro%vk8ymgai=(BI5DM!7Aat6 z8C3AW1(fh3_!;dV<=GpIG~-Lg20|$D2nzm^1H=sucS^X9)nSs+XdcR+h+4U3zNtm_ zPf-lfKkS0vPEx6S7yWdP(eUe0cp2h;>sIOG8kXAujukPUd@S6T3xHlI%RyQtPe9rl z-yw|j)I|v_V7p1EGSnH&FJD7Jc-B(dOrVq#={U)|rm(mwmw&4CpKBu+^W;(GAw5qU z4i_VQ};++*QnUuK2BwlZ0>lD+*nc<-@`!`j3 zIjHXmm?LM69SORMrYZf{%lfp247y-C7`aXK_*1}%DJ3-%cHahNK21$g<&MXNULx$` zIw&>m;G%ggv4qZG@@1LAd0s02krC_bxJL1y`L#?)CgWKf#pq^KI6m>@D-@%G=b;VL zIWX%LKpA0jMQ{bSbDS=c(&)?`U?9+5D0}NSI$n;aNA`;_hsV+0_e?HMS_eL-{8x>6 z8@ub=2QRJ27a6%@`X6>SzSG#v=P5TCuKO#k!-Ch%))p`X8gKrZ8f58#uRX+CvjfjJ+jN#Uhw2?*QA)|bs_})`y*aR90WH^hy z3b=;tKL}~yGSA+>r1&Y0hji)cDVuK7d1^`TRcF5oHKzSpiaI9U4}=^NpSKF6(f_<` z{f6=m`^|J8`z9h%>)`(wgkM^e!y+q==I*1E8V8KssqCoj%uP>nh*fww`MvSwiw=5Y zF^Lxw-+9;ENP}CL7rykT(er}H?iT-Eqi7QDejkO;6&y_SxXq?9>hHW?y#6_HvuGm0yDgqOX0}cte=pan{aSV~kOIfiVxw5T(gimv!-%w9pCT z_yd<^b+c5eBtoVhqO4#U+TJvh%-O}G6jQ&w@Uz-rf+0l()m43b7?@NDL3H5qvqKM> z*6-)G~>R&r}v`({oa)MHhgFobWlUDgMGj8R%n; zNjDh(QQi=-GqJ~*RuSpHGfzSPHa!wd^iR{Ki zCtM`VYbYNI1x`0>LS3A+b^@Yj+{VC2Wy+2&QdYs2**MR-Z^<&p0}~Iz9AD;Cw1n|6 zdOv~6f*$x)9NuN-7VO$Ly0xSv;qLqWrT9xjgx>%e5@;YX!dZ~~zx$_*Xfb$KAHmq( zUU94c%X=e-5%$gXxUguK)bD?Elmc!glR5ajj|-jgN~T0#$5Pe;WB3`h-l27cA`Xv- z_|d$4Z&N~21ym!m3EJDZlt5%B6jWjj*Lh)#7d#Z%T()2h$V7OkxY{P*EL`~lYnePH zNiz9T9ajF32+p|IQ+HwKR|iyrDesvl`e==6M7d#P^a5uJ?gmCRWl!ZRkF3>!@3}fm z4I30`E7M^rw);j@$~2)(n;JLl8OjFVk{_kU&n`S5A%l~dS41&MQv+(VF)gmaP%aVTH+p!_5? zEcn?(MDl(CPya7m7!f0~j~&}iPnc7W444db)8$pm`q!SlXmR{BArGgk@yDck z@XY@r40n^VZpSwNASEB`t#0lo>&8Ro#=7A)Po7wtuT}IH5-)qe8k3w71*;<?g4KZ?p5Eplq_# z%e=@vJ~OilFRS^TQ3Utjr!|^9b3Knw67RZ$D>Ip1FIkH< z6wjb_UaJ(St^e7-@zRsc(y4~E5NkQ(GAjIZ8n&_(V!TCvV0FT^FhmXOXpeTwqH7(N zxs1JE)#liD&(QGxgQbR%HV&{wK@%M1Hq#1-%DMAHp~hlXYes_GR~g8u{}_Q0P{{?F zksyLkU%Sd+zUGdm@`e{6!|v}jt^2_VGIWkV8*mY?O4BCCQG-2AfB^7dy=X2ar-iq?;Ue_c82hcy&}xtGY&iL0)H3)%V@eUB+1id+QJ7T zYj_`+Y;8zkJ)U!E%hPNmEx5Kym2jO4d5t~5A9yE9KaDCUqcH~=4#3b8bH}l6-R*i* zUk;kH1bB9dN$)Or^N*1?e*Yb1bnsPFsAwnylmIX76lWAw0VK>;%q3iCl75vHHE)tH zU`%dk$rj#`zgz=$EYOj|ZtZsFyJ=6aveNfqnuvTO+79wdqh80AyMywcE`J2ReRu=8o1IXwBv<`I|@ftK2ll}l-UC!awPY88m`{o z3alRquWc}EbsT)KKE@q(W|8Yc#4)?`r@J+SeTjgeGcU49YS_;(Dc+<~2k3w0O^g0O z(V&nSDm$(p)?7brPg845gg+08H$uLw2$#M6T5W9FMSqN&E3}r)$YWzP;-M|Fjler3 z*z4XK198_(Z-cs_&PK-0wd?L*5C0%UA2=J*yyBE^dbe|V&OTaP+S~U5Rc#pes6%dt zO_clFAFLgFoR)EwE$@dB_*;)H%<&q2IU}~x|MT%s$1r>THF~;3f*AWTn+#ojDM5bu zeIqbP(rQHeG1bhe@H!Ur$)i4SMde|!q>Bgx$#Jt|qITT}1UztzgzaqmaHwHjXssA- zOkck5yzoLbeC5ck*S1N3migWCn7tsv2I)Srq<`KZPJRgg-W`;XLR!%BN8Cl zM_smKY;7BQZar48jXOy1uz0}QJ$3WywM9Ja)3o-eQ7Bn`^7KVNm&DTe|HJZs?f_j8 zY)tg&@UW_k4T9u-9G_oN?K(#Udd@{xmlOc`)7m%NBhWecNKod;8mi0q;$x!7!u?5M z^q7OiUF7>20n{o&KzY5tjDB99P7q#J(VW_^;VqmZSe9>kHR&-ZA(KD8v4~*uVY$xw zr2ikmDf9*~9oVH$4zaKwu(E=@muU$ezWqP%88ytJ(Bj|E5+KoW`B0oiEe+`Hy^SY9 zRf)FJaT(ry!jE&kD6*n=%6XC!XR(e`FLGln8cOf_x}<$i-1R%M^H{pJvZoIQfjPE} ze2W+!Z{S0yxR}Hh7rLaYq?Hp9#!%);9<+PCU&^^|oAVmyXIc67!qC5-PR(2=ZC8Vs3W9+=rh@IW%J?Pf zEQd4cT`1N2G&>^KA+ySBWzD$;3CZ`W5uIkf9q_CDb&`Bu8kFtaHJ!BZ0<(Ooi)m8k z?Zb@A^~w(6Ta4hljj`U;W+MuQ7gU+NVtu|4dMoQ+=O0Th2Gm{muJ%CBBhxLV4AG9X zs9jaVrCLWX0dwaCulk}J?TL-gIlZ&Zc&j+oc%xYC1K}MZM2;bTUw;aufw6N(YKUGH zqp~gd`D{hV7zn)Q-)P&Zw38bqtor@>!1=^Yg=__VLT2lpiHlsY(?y>Q*9o#!8pUb@ z)h`foQuH*^rivIm1ekk&5GYtR+d~Tgw+SFi^W;sc}GkWLe+n?t|@SNbyv6&kuORBOedhzwV_LRw>1>i{R9vpZ9^6I!lP*EzkB-890QXw61RNB7+%l6n z5%t;QkYTuY=>T5t5r{CT7K7QzdK<&&){3QlMsxD5tu5$Q(9VBnSZ%A1-&CfiFg=OW z5ne=8w~=e8>6W^46Sp%=3!G2z)Xa zKtZc2DJexqMKwFn-0&0~m^=?91$lW#;GI*7-tO*V!S__s*ig03oOFa%fY?_b25_Q~ zMnNc$dZRlzIcaEY+5&*g$6dT!s@f$5H$am1SO;qmOv0pkh+QBEI?mmx`0lWd%uO|B z<%8Gtd|_!7Fvl~_7Vs%jO zI6G4zoYfx}_GWKy59sY#{0RXxg>UZPzfZ3KO=`zM-b7CM6G|OJ|N6y=I%LE@*~Z6M zjRD$Uz$caS`*#4YJ79&=zx@ethgkzA=tTaT)qHewmBgeHx8zrD!6N^jfS}|Ip&tzk z>)*O(E!b(ZDRA&=gYA_kvz29z$&nJ{15T#<8uedcFq?G1^kk?E44u7AKuD)i-`b7* zVBAt|p;7Dm)iBux&O5*V^ZQ$l9;Hl%bx*Zs5oblhgo+nQh}UsQ_UI4ev*zmX!K#YM zkG04tLq8%x0fIDFM{j~)ca0BauL21WKErQ`0onI+@~f8(E-8oG{^uw3-=qh}nXP?H zaqXDaNa@~I8-A;?dqy|JR-6`gF8>IEF-I9jUik^c2qC9RH#~~ zJ{#rf_Kj%YlNUk5kz)`rDD1J=kym__cTJi!+mszZmN!rid(<)IIVViLHIMdvu}`kG z2}gVrrdx4If5kg7_BfGz^bV;OREy?Z)6lTnoj@WSoeI|PX2$x+DG}Ioy;nbXZ2nZ7 zR^GZv>^wBYrxm6wi>_?p&rx%J7JjyKvB^z#JhcSm;q5PBwQm(NWnm%ozb zRIy1N?vB$XQge-cO8^Zn?XpP&xRiQ{Vf^T2VkC}%qKb(?x!3-ZQsX)!-~i76*lj0z zye}w9O3J^2{i5t9mpL#k_5Zv&fFc6?4rx;N!N1j!R51v*3&*U~SKzUGyzy z(R4xGloh(OZs%8gXm!lwbD&o&tbN_RsyEdsWq*I?mzL6=f9m`fw~)R0@D|s6`(bNh zKE1w41@4{3Fz@qx&QB#egjTRp(xUt!Ro5ihK-960=@jKTZ6$q0*z+LCcQJJGA02A& z>Nh0OwTDx4Lqa~)saI31y;Ca1Y^E3WDG59J4pG8(unt8!t6b#weap#?&xz-7PLRGT z^a&9=I8Zg>#eAFvY`F0^X`a_o&|8n9VY5tCCpxc!;yM^rqNTOZ5+F&V=NLY-ZvZ%` zG0}yZ)LD7n>9hO2lNP^mkrUVsA5CZuw9QJydvjbrsB+*qA1(FFBz&;ReVX_D)NYN{ z)gz@M1j{YW2%+b#oN19PN~KFbH3Wgu))UZC=(E25qUC)r=YqL}rr5@$st6R)O2jFe zzdXWWSGo|~V;OdrJoOd5>MlyUG>a6*nd`ZG`Nc=MCT##6%F_V5I(bcKO1}(pG3Ump z&B_eQrDppaMGDWZm?tOhF}^s@$;T%GqKXKX>PXNhduaMt45g?abNDm5dq%W&_m+&m z5mb0op8d5Y5=4j^4G|8BrWfhws;IqPC4~4o1FjVIo9$s6Fj0EG>outx)M?xA>z7Q^ z2l69h4~1Z0zNe^HfV}THTVi<^UiX(T{K*Mt*}AdDyKn4Yz0xT2ydPZMOiF!n6c^zG zPNddm_iYRuA6{JK)F1e>Uvx@{A2PaZ9&tKMsV{tlEv&s#(F~d7o=+U+VKkD)4;bQcmhlFL)JkvIyq56z_mwX%WI|syq|F zY)sCp>4FBEEPTw8a@3=bNC_^pLdCV7>rYw0Frq7F_93Or^t6qLPLZm?y~w=lScH=V zEplQ)k}Q0ylK`4>+$y6PXVaQZuN|)wgyPle*xV7J-Reb`ejXMl<0sox&wpiFt-n7& zR?-8_yJYW5Y*F2m^F$NAeHI>P!jr4!E?P9ma{lO^b;MsXq}#Q=%SfYf@>q)h4Aae~4R;+snjO$;akkTR1@tw6o9YMGE`Vq@F>0~f*&09R6hpznfPB<` zMC*yK^Z2q}bS_Ru`WM01#QeRh)6|s?aafIWb88uFERf@WYoboI%k1Bp@cVX~i!(K% z_NU5>1VH&N2N)a9O z@iUZN?DcX5P5(Zv-CRCrD>4#Z$<}}kt8>uPXJh?3WCG;FlG`EvEKa#qQ&eXH+kyH@ zZF(|_{Kz)9^GFx^9w@iI)DL;d>x$A#(Xdm8DV_SC=TTeU4UfO0TsJ@IUsSvF-7Atg zkJ$)wiSb;`)7wrLB}n@etKsfz=-&OQ|2zZxEtbKa3DJmnzt!(dt2^qF+2PY#Ode58 zA4-~;%0HEOu9qN{Dt8zP{WRypu_IwPqowigyN%Ty6Vu73Ly8O}_!F zSKMg$D$V4xC6zg?Pv&=0Vv+Lu+_o{SLu?^%Zm2+qCbg6y4D**7e7I?)Z>QT-DErs- z!w((Sa%=qHa$=%r&1C#Kc9YiZ`uFZKUN6i8D|bYTpsY0IOANOIJ}79;`V8r3`e2-m z+bpdOpGi$y&~7DQ>njf-#_Phf+bc@Tpmn30Rf_uu;fo<4ri$aY00aV`ZGl5BmHmJC zoPBWYnr3!CWFa$@Cc1EP>9KNehyv47?a`hKm^{H2*l7VMY0HPGQut*ii~U zn(_-%ymGebsBoG0@*SiAMM!*q8cG`NoKglCT3v>Z>3-~4=0+JUa|Q?9k^mGDB?arT zeb7j6pUMwl-}Nq3@nXeDyr?-}B<^GX3skDx90%Gt?;JiHsVR+U5&SMNYzgQ-Olu#Z zKbC|7TDr)MJn_yQ(PzOfn<8T(P7P_-8KWEFge68Zwx4oJpUMJlz`KbrCUjXt8$X(V z`7_YIg>c~yy5SFdLEHG3tzBqO6e8>FvZ5)wG2Zpq_Y3Fc%ehg6ThCTTQFGbm#>odT zUGe=XHU;m|JVa@U(d6{pZ+rA0CdVI2Bjim|wcy<&?ueW0{LXgE{Lpxc40$J8h2FeD zdmvk=yx{EDxQkIYk5vJxZFYh6WN*q+lZyU%@$(t*U8py=Tv# z?<>KJK6l!TzX@-UDm=&p_z6=)7{6)XWA0;_stt6cjIb$V1JK1ZFW7rw(tby9%)XVu z9Y?*fHCD?YV3K=zk%z!?iBo1X6hFj>*2_s_L7<>0nh%e55NiLj;8i_$e-r8=W@Jg zCUm|9!z`A1N|01cp`Vn1rAIm*{UT6WRkoR1r4U4>u#TjsNVbqupE5V0ewx&FZnn`} z`wSLfUG*;SY%T=jtpgJbkzU3OIQoGs=3g?g+WL9j?-lX6`cINJGQnah*vd|2!p5~+ zyXDG;)!^m7!7+!cyVhrzXNc;WX~{o|$i|2@-%z~KJvlmzs_uv+l`n*`>Mct}n*eqV ztKGzh{ks_~=cEVNW_Quj{A3uQR|36SFm_5c>lvSwJ-$9Pv7)Pc`$z5iD#uhmI>dCH z0NH(g6)yI?TxE02ET5;lc%!}taBs|DKUt& zfFKAA-Hp`HNOug~-8^gbx~}Jb-uH_i{2}hWXU|&aI?v_>NCbV7b>Tq99!LqG-)g|3Z}$)F%$nXkE@{cJw@&QpdRh_9;u?Yn}!!_ zN)im@ALn+1%i;@J;lQWs$R3bed*RMy+fB`4BgG_j8jHg&z+-w1yY+LJ7?C1_X#10Gic$FJ^5 zb6#yYs9x`v3I`?cOk3ETWVuVx^K$VnJ5uw=)Qbc;8E4nx&i|qPPbdv zZc*vhc$RC4b>yOi!STw{A7+g^huezraC(xi?Ih?lmtdP7IfS|t7)-^&f=^4vZ0E{~ zetqe|Z(%;g?u-|Slv7}uzH*gG{7bjhFx8dTUr!*RrP4fI0>YQZPh2H7D>o&(0_~s7 zJ5x$G3(qqhKm|WnsT@UE_I~q^wc48_LFH8+&;_!~#dRf!?Uw6%sm*8)n;c)B*Iu@; z*d7zjoWGk}6Du5dmZcjD(XZdx30m44jjOVrz~9)C%?dp?B6BOpGp429Wc-rb*Gi(5 zs5&rq`dq_IIcs!FQiIy-;lQuz7jZgk{lAQQmZRv;8XdQl$lg-H)PG?oK`R-j(*q8p zd-q=bl*>sYm!y%6)AEwTmGn-cYW|r9tc$x(3{Mc%lI!gn6Xe5_$NO&w+d1Tu1fcqz zObv3HbmU!`*;d(8rVZCy&PK(JcX00H8d5U|OgS3m8R=YBN_6mreNGGfvK?(i5A>Ox z9>mWq=V4vPQDLXSq??|PPpgt#AqKT+awX#VaH2;xOfPE!HL2p#Eq8(30_tQfB3gA`W z57w1LPFh=AlgI38CzKi`-1nx7;AbDkrUb$n-bfeSfS_C!I%4I36eI^5m87BotNgqg zi*7i*N*H|54)x}Cry=g*K&UuU{`d~B0@O$G5K^W9%oZ6dKy*UhscE`RH zk4MyeaoIF#XrZ{ok2!^ST%KMqFF*q*x-PZGKHg*qKHd2`{k-O*S>Sjl{AH)b^0x`B%P8k_EMhr360r- zNv_o-75af39e=&RjUbzv%Zyueky|QbJ zpMUDH#3seJ@-ity)lO07a>Ht%xmhDBjV*T`c$3^og(Ok_*Mc3X4bI5tLLlY&dqiE9_wZk&*oVTU+yKctaeWw1J0R`q3oY${o`nL` z&7WUnD?mr7%0}^Uxxa-3;SkRnsy2IjEeX=-gS3IXDaQaSPHUtgvZK_`SeoFgv&F}G zmnXbjp^nxq+z?X)tqtr+U-Mgr9YZ7uY>7Uv64Hn~d|y-)SrHyg-9SUpvbscqIuOJf z|9FFK&P?$}@p!}i zZg$+LjC@+ejf+YZBtw=L;cc=d3T=E>zD)Ma%qI!2{O+Z7eGwe}QjQiMhKM(xffV%8>*;mf}9*Qv}uO*H35qlY6eCf@pIG28yu zGF_FhtXR}$$3>uJMazBooj2m*n_X-*mK8TIf2~lTYYU*vqza)*KQBJFsBS$!uEN*y z$3cw;Itm+RyXq8L2d}TH&v9#)gps?|6ANp_E`LR?`TkDNM+tMUS61!+C|0dOJwz^4 z{L(7lJ5gS6H$$rx^6-$N-IrQC-!XSc5qiPnMkfg-;>APbXe=ASJLlUUa{ z;u=snsXNN>?(Y;fG&5W>O<{PW@5P1J#XG5;Jg@~ZrG_u;HWNyqKHs+g?8$+UhL?o)*WP#h;JWh_iRxoO%3 z$vcmw#zF$hSdxxydc$K69&}Jvc#A!b_Cl=8SVsX7!#H*04tD4eC4!4fx!ija|Inrb zlKRAW{Crf<4ZmIOa4Jvc_LDOTIJnI<1BfCP zE>0U9A5zyHyjdX4B`T$Y(3{T1!ZsR(o1ujrZY!?hp1WM~@CW#QKIqfS9p!AvhWhF$ z{=NmP@Ty*c!r=VW2~}P}FQ1pqR3?{8`d0eShD4c$rFgXk4~BeTrq*9{ytWUe4lUUP zPzP*^O3dOQvXvCoH+6zH@mfrZczpL_Y3uuTVoU~uAtu?yIVFqVc*IK;#s&tXmbN(4 zIJR(;<2i>mYavHG)Mx76<)|qzO>lImIHMP>&Y{+@bB)W2NJ`84La_8=eroCWw>XHg zB<*)`WjCG%BU*A65%E~K<7{+uhhqh^w&Z&wH#DU?THsB|uDIK4KcC|FL!pjcLy|(d zbK4t*O=V_WYX8VYXfS@P*Wk3w9P-qx@^dAOrmSvLRJ3|S%bFzWFhmHv%g6W$ll-mv zwkAB~e7uv{{E_+>4-$CJzNpx(tGp2Lh3~8e1wTNU`=AjwgmfKD?-iRR6c%>`&yaCpbQ+p2*iBT~GQ@bVQv(~U)d9stCbOCKI=p#VlvtqM>a$ zFtd@QTB0E2tn1WSmcLt&Sig=kK~kgx#w!ct0 z*vb7lTlX`PSefRZ`DyuQIJXS?^n7<-z)bJO+Ps76KUjZ>i|CIxp}j02cvu|&W!CNJ zu|1!`-du@OWB1Lvua_>5Cvuc)!922eu%~om*1KL=^rtdk=lFvd8NAC`9^Mf3W9{bv z!^sQ54b3+jx!?dll>!{w)#&HRNHu^G5Or;$Y2T-{;RV)jYIZKCD&dynZf$Kj^j|&dMK^Kp{8jLx7eAYx>o?AtrzBuhUcjSD9V9l$o;urw)Q{8L&3d3cs5d4>lOi&qsdI_X2*OiY^^rf+fA1)5UWXTx9uIYkaR0iZ<-QMeC3RDOTDSfS=qU>Rlv_g=3oRw-~k{);=+DU_m5JK`FgscY}7YT znnTrQMxKVK#bJbgt78ytd$YesM(JV33aI`#w>d=1_sB$PFW5jT9=@o^t`KoV3ul;# z*5k|zD_?ZT4L!$UXBEx~ht(WXe(ebL`~vEygl>uMdu7qg-`adY(n6Ff9L!ZoVy5o(EP5Qr|K?_^$>{;y%0gdUFdwF@ zM6}wr4zuQ`6cc`EKzq4jvVK%Ew;d!mFdQQ3o>>#(@S;!83{JZ$N4`JpqHw247{5y& zEyDC#3-KzNh4D80mTE{|B(YSYQPb(Wp^YA2c$A**t0MIl>f;*=JhLYSMyc+t)j=Wf zk6i7^)gaY74AO@IOdpphva}UN~Pd^%h zS-4ql`eS)F1jW^rBTnYp#m>1&wZCRu%TLHEfOV<~;|SJso-q;MtU2Y0A!0yD_ko(>U7$Lm6 za^EkE#3|vdeup46V%T<`2|>v&06CrH8gbb+cEBf-=%2R`<(z#RC1)zSSlaJa>6=;ACez5Hh%7~aaJ-!XavOn?h zSXyW5w;Jpe97^IOJQLkBr6)D(FY0{OU6#qM^~+=O!s8;ioeteejJVeR$VSx}TAFgg zKRB>aGT7IyJK1$;m@3=t@6TN9{y{Fv#3rw|wl{#K;8qtW?$OlItlG(s*k-)fy9?DR z?RL-hL-<)P7p1%#s<;C469|k1HnMKP_22YQ<=E6wRz6#56bfmP1?uASxo--~dR_`N z)aB<9UPq0W<`Xf(x#oOVRqi9cwRr^_MH;8~4*BqF(_4$D;m#3XbZeD7=t$gtoup?J zjtssLi_m;Sop=<$Yg)O5H!;q$)u?EMk)<+2-k#k1ye_|=sAFh;vxm;W72XW>igmiR=6s@550zccSTE{iF!OX{Gw|I0wbv64p`(j! zz!ID85-WqOS(#3(F}@{BWN2;X8XRsrCuU*u{G?v%R^!DGjOPT`9Eikd}r1 zG@C%SwkiDl7j>^pVRapJ7HilmHu^<;VKDO(hd?(IhA9V=-6xi&p+v_)Lt1@OJQZJf zPG-FMr)_l~d@A)nmuLQ>Ggn2KMoJ4)YCmJE1#C z8?}4aiDN61b|dg5l(H)>e~orca54<8<8gJu(LBlboyFCY4lfr=cU*(drHt2056buP zh)`w1nLH6K$(9xmG-l-VH8g%X_<>HCs(UZ8w;rK8?CGt z2dK83`( zD@dpoBN2wki=5~bhOR0xZ|mrZOqeP12acP0{~+!UIpIu*H0sz_Pc*dtEu+6ey~(%X z>6`!3=-V^FUdQ>keey03xdG)D&cXaF-g@P|gGAWI^{ zk&6Bv7O9qj>vgSup{Gb|Il5oC(0X1CS34P?^CEw5#WWg2Ue)ZJ9{^ zm{HGo#(WIo`?wBS=1J`5UVRcisjH1vO|&*Fbl2@P`eM>d4VA^Pgrzogxq84jLW~nk zrbWEQKgbf+J(yr&TIbumLbRp8{tY~$;^$|=VSd`A}c(Hm02Xo`Vm0&jk zvND6JB7Y(}OnjIJ+hDDzjvoN4yVuiecp<5|+IaOj>#LdEZ) zK1;%cx7sC*NU2j~HWaMJ_`tgwE)1UCd2 zFbsj;TFD|~ey`?9AlW@+Sfit(&VOzE&p}!Q zfPKgDcl(#+RqYT5;&g*H^9)oBG6V|&!8dXMZCHD%0T~McR313X2oZ2F((Yf009tVH zQ2#2zzwY390YbXQg^5VOy8KlfR82Uk7?9c$qTJ1N^eR(4WdIR+-G!y?u#16BC7#bz z*Y_tFZ33#N0N*LNjGTpgU_jasZMBZG~Q4{qr`sNK=W`=jUNJ z0U$yNu+ebDY)$a5VI}9}7zh#Egp8R0vebJFpgI(Mw}njo_d2r)XEd zcRqcKg{Q}&b|C)uXEAf>op8caMgjY8H&d8>t?C5*z*HUB?(}zVeY^wV;K-jn$Zz#} zDNkz}!=J*W0+w>q=Jma`b1S^if3X){9t!uth2fzv7v>8ttl^6W#tI1UVz3uL;rL)Z zs{2vL%8CqzV%=4F9nq{v$|g{Ww8lMGOu}hcqILt8X7qhPTp4Cksc^}hEU}4uaL=!7 zu@Fu#tZx45l|8r=Y&$nydcOlGm9=uoozr`!1$L?>{$t~cx?ISAQ4c%DVD5z}b=G}I z#boj$vFoWIMr*#Wh_F$yf9MTx1aKxI5*j{|iLo}=`~YtEMLd-7M-y{A+uq#dWS=>l zw57)kEjnQQC+U6Y%oM z{4Y%c6nSyJ*?)?>gyi8i@S4(?-4ZmRb%tnbhJzpc|NZz*9Ij^JL}tCoh=rhzw2rZe zoDBcUs0r;p>ywKgnCo)a{o~8|&sh}SqhT#%sirLnXfL$D{)(o-X=9fw+sJSdRl&e5 z;Q!C%H0~&s&_5sqt69X1D~wlL69D9HiFEn_MLXc-l>8581M_tDjM^~%E`}e;g1h*3 z=Hr=XrvhT<Vv8`X^g)25#~LcQKfvC&A0EEYej$si0Tz!(E#3||E_WH zTnn_qfcxo)U%l(nJ^nmH_sl%3@M0Dm=-G@c(uNF8>!1x$*-K6fM%7r-dU}<%f2-<$ zO_k+Im`NN!JDlCYEAY{QN!#Sq4BGc~S1089h#ANfKx(Je(r@sxDG4+>bE*y$+ju6LU|&rAe-VXWe{7jJ1FLxn36|4(@z4(SIf%Jc0x1sZ=1FjbB#6Jv-T)p| zk6@_Od$N0X zkCzBegFI=*J_H8?y$#SAVT}9~1u=3TF2M*jZFpE)MJ`NyM!7$U(JTW_qf1cX9JhTiE;3=?h^0UYZM@1A5C&11l%?o3$<728O5 zm}}nN_T8Fm;4#t;@H#Wav;NMvv2Y9Qx>=i!;DN^JXtuOFwE0g+qIf(*?owN52c-DW zp?FxEtew8%nEO?c&I$gz;r~%8ciSqIFTVlt7iLeCSI1FgKPhf?a)Y+~U1=`AmWn`s ze||!oaIErF`H)$tf{y|ilv-0WRg*1+OJbQ}l*%?(r~@ZJ?-dEDc#SLFQij#J^qAG= z%DeO@J9nebw>xW(W`jihuml4K9(|e2#BT{a}nbwDi9vd?h7FFc)wYbm7+E#DF zNkPV`9N|6|s-~s)t(jqH5Z2ksKz4af(XKy?#^~O+1!(0OIl}09GHK;!F>TGw#~DF~ zO^(-$axOk%1N8&5u}-z-56%#hQ!G?j4=-9tG{HUSpLY%Dq@D3}h4>8g3>Y#&T2iPf zLQy$8-=FuTCyN~6Hg@i2M?n)gv*eR%_x*xtqG_xi$`mGJm1(kqMrbmpxOhAW@%kyb zf`bAMje@=rM%UDcZU0suYO3myQd>8Psez!nz6jp**fh=C3&j%(= zX=cr@IS)=vmorepWim!l?G{piYIjK0x~xHx?r%(teXS0#Et|p5_HLC_nP+2V)wTdL zV>giQDx!LFbTk(x;-^NAgfv*)q@!DTuuEqDP$J(T!sV+D6*Azf1msYs`Hw&K?D70% zi9NB`>Ptwm59}DvmZb&7_k!8SY%j@)BO$bUoCK=~P`^NRg$6~K`oo7;fWcl3NKTdslVlu{xUKqIkcNS0LI)77#{%K0OCq1sPSz zW7h6_B*rt!m)+hM0@ddSWAXAw;5*xcfwNlxfyf{55ZilB_e2=sJ_IA=OuwO?R=Mr|%rCO& z59l8&v9S`oL3CkU4%>u*j=n@;yxW_n=9xoD=e5NrP8G!b+3_wv_)~*p(axMr!37lq>J1)IlQ^eA7F$})-Aoc}?LWwl_ z%N0l{3{u}#T~VN~Osiekd6YWf1on*Lt`M`X__ib~h>87)rc))+j<#`tCi4fiKjU7Bp~1{C{d7D69|yw);4Lc14k7 zV;vspYr}Z2l^Ddh&^UR|zdxB#GqX!D9w}9|2;!Cg$R&nP&T_SH5}2 z$^>l5LJX_E>>B@$rnTVCsrVm%te-DgX;4w!CD9O#Sm>ma}A!X)kGz2n-17!y87Hs7(OXu`J8zbiB-+5!9{ieB66aN_OA zRgS6R^9#SA>03I7oAR`@w3=c*MB_9KHvM$6SRCVq-AVGnG$zfK?Oq8FZCdE47u#03 z#v0m~WE0OXTHY*l%up!*nx}GZEj;Aici3iQh0l$W`yG%-uEXDMPA2d+`K3L59tE~$ z#lO~NaES~E-4E~>eWWSxA+(#5&D2cCmmgtZOxrB_=J;2Ia)?@VLg*lhuc&y{^p8yP zo)9v)^1%nJ2NBH@9(O}2da!&7hg#gvMheXZ)MhrQcW#QOVVfURe3;ASJCLN94ZS~{ zo7T(h*E7k4qdzvLq%Wu)35j4mth9ew87{vxT zAHVh1vIve4CsbOoW8&vy`jp8hY!Wvb?2xw?@sal<++hCb<#1tk2>x;vmHj( z2h)!ETtToD{aQawBRy}G$cB-Y{bKMkmTqly6l|?AnCg}Q4&>+U4sj|9pnA9@UGh^? z4TV4NcY6=h37A2SH`q?4Q?CWKKx(cHKcZ>$>J}~Bx@kjbb z-t^OJo|!@rI$V$9HTDyZt!IA>_}LMSG1w~h!sUtv+A3*;4k=8d-!4G@kciQR#0oDN zONh%bm0yX%ovGa4zh7A4KVgNZNV2Z?5SX>3fj7^gt!%wuQE^F(%7V9r%tB$uK7M}K z;sN7;xfw09XVqc~Akga;WIEG%PwLSTh!%mW(z!?x=k_eR2987EF0vyF}`R z{HTJIE7sLeA<6zEuM-aXA&*<+Ey`wJ*O9@rmY>1MSRzyrq(PODyKPGEyn61|egDyn zbJXrPYRI8}gUg-0yPL-X4LgqF_1$lz(ETbZm!?lM&fB2fOnJ}4s}7X#esPA{C%i+a zW!ubXWNjE#{jK@`uxZGI<^tz~2+1wCs=4rY?5{V*kl1zyM2ch4vkApYa6=&TxW2gW zcpZLIYx`~e3XHrp+Dd(cNxQ)7+&y%Tgi7}EHi&afksO^-#y84!h8~?XANSWV9;@FyHQ!WTIj$*rDg$)>=tO03_9R1uz-YRZd8WUDV!3lQ za_9t78BU=rKymM^)G#0gkP`{!p`<={RGzrh6?HR=)V{vUV?=lmOD_H6oa7gHdL&V^ z%N}3O-_4WUj3|Rwh8GnM6{Fso(aIVGqYMM6)eZ(Ey?)$Dfg4?kPp>%(8k3}QV-I2k zI;|teg9$be)*^)TWFZpht`TSt;W!P`$obAziyT+3-zl%^h9XSL^j&7wYk%-Ek3oZ- z3)UJy5ACO8-++_oxy!#h1Zdg?YxA;6vtfM{$ClSo4WvK`g80aGm<03efy?z-<6~e9 z3{$^nyz-lDEd0J%fjYH?*tnd_EqVRX*4nQu^CsW%Pg&4}+rJ>|cY%z>Y$#2VRbUoM z#URI~9iSE}iH&mXSchBv8>o1RtO{P2Hzz?oU>T8O*F!?W*XU=NP@KOpJt1!lZ_8(J zmqYA>VA0e za(d_3*J+5Qrc>^3=(+vqz{;*lY5Q(v$Qk!c(XVX7iSdH<`z>d=28}sKJ58O2up9UR z?$MPlF6_}?whLDt>s3R%!m{vPy?=fErCy6oRyK$4$-)}R}ZPo>P$0i!NB z!wIV?@z02i>fhMH!E&&-XV=)6kd@FgP?C|6Ax$1RJ#-Ww%ewJ0+CSimdRhBvg3_Ib zOzpOIv`QT4)8GTnOUmfOq#jy*Du%C}=fPiN+Lv!xKTpR-Rh_rncQG@>qD)?w@bfg0 zxM;eMZk5>HZ}t<1;UWq}Lf6NWWofBTWDIQ93qcR`KMW}5Ss&=s1KNWCO3KmD(xlX; z4bLOQv8d&2UQ!!jaI5JVsh{?{dK4c|YQMUcJGPIuajZE4yP|y=U6{Gp=d>vr{o^K` ztqB!i8hz0{=(d@@Xf_2&_6Qv1=yd+rhHEFUI z!Ja^3m|5&+pH8B£Q(|UTuCl_) zBVZQSXz^0%E}p;Na|JcNq56)UH3JV0vHRKsZQseRnd#A&h0?*K9bO}Q<&8z|3xDWe zU2ra3(M48`_uqTyTcFO=W!hK*(Oy{h>)(24sy|FEQTTI$;{Veu*#tcv&~gCav)Z@S zKGiXX+A1wjQmn$m0urt#YB249&#pOBFdAq6_t|naB?tb0y&w1ft=;qv41WE2uHZ#H zGD?hgql(SJiZze63doq_$yoWa`pv9!0MJci2uA|2qjDfQvzf9eC+8Esx|5`)IFrQPpn(S`y}iAdcDz=^Va|UAyyki8-`1edaFR{9bs&r+0&X1p z@(O}CV~y~doIsfi6F1PW1}bML zHF6EB-CDnj+Uor)dWcpYzxfwTt9@t;n+OF^dsWZB>>CukB3e9d*a3%H4naW#R6sxk z4*E)x`HFN6*!3MyzY~fTLdcvn3wHw%6aopJpF!-YgL_|^BEzg7{&WJrDSieXqIYp^ zr11C_HUhTbda}2y&s^A-8FXVlUgS-g-5yKf5E#j%2fRZ&r?-eW_5J?w{0C6M+g2>! z6Uf+TAb+lN8?Vj$M@>YxtK1K}sT#A6C3@tW*(M@^$6RWdQyh7S2{7{3@5J81(1a%i zP+&?8AmDJ{Bn$zG#n`PsadY`CZmHwAmW<3~20@)|k|bQ12S#{$xY_;3-oR5ne;wb7 z<8d5_f>c3~Ka2kmUefr+!GVAAD&74LUWb)a4wImN*Uqv7CSE8OQi=1ue$BJ$!^zY@ zCif4gg+td^&fhbi)qPSfZ~6tS`O}_z1eZH8wev;6HnUA1NiS)r`*b^>gLwzy&%8rL zZOvG}$UG1hU@8X5uGy-)p7!TM10li~(;uKf))T=Dlg~Ce#+JJqOLQ!Zu)WrCT0vs! z;3r&mOvUNQj%AVLk6-tPP)V(QG5wxg_$J`NZ;fPY@sg>Bu76mwuZEwxkgfkgRAN=| z-3KF2GM2rGAJ5qYV0$4q?y#PN2y}k6HsQj80vg2nxzz(H5UPMpjEDv^Ig=6WPYI-I zxi=tj0v&&zC&<0VK-Ei;-NiR2`3PqBCxQm+RQaqxEd&R#^Ss_I`D*66f`g>DYu_p z_ce{b57YU$ncr(E33iAaf~Ne5%t`QqH>pr5lr%!~)Jqx*qzfo50X8!?@9!*WrI2)P zA88PUT&D>HL8u9PO*d3~1iHoLFb;_ODs(t)+O^)Glj+EaiP~MDg||9h9e2NGA$I=~ z#6!)Bm)9NGd7sh;Vrk6h=@bUkFMNK?G~+p6529j&bzr|wL0;T1wuV}e#uwi_>~Qtn zp06i_+Sk(rAStW)O`Eq894K0Z`IvGRKusjBR$ownS-ZvSRhgi(R=X*8%$Nv`1?y@p9f@O*uk+<*H>+=e)lN7}neD0s+kwK01d+WsH zCKFx9_MlO~vuw>2PNps?VL4g3L3WnAD1@88J@ zpKlG7Po7&@2|XuZh0Ga!D{$fG=l?uJbDNx{k3!`G2L}fO!TniV>SqBJn1c(~^yk1b zLfA8M^7nNg)mFwX8No3JMjJ*b@T`xyVSjaK7w^%5c-gma4ed7+V;L8Kk+^akjcc)H z1Uh+#ET`{Wa8NYl8)7+>G{i4}m{BwaGvgpt`U?Sqk_M(zxt#J;8t1+6fizzyfmt2n z$!Y|~7%9+b1j1;D5rrCrJri-3b&h<-G%(^1s2A+Z)5#PSTuWwmY!@WncE>nPNtl%v z^$(I^f&0O|xI&Em0pJwNDM6x06SoEz*B8`eN0Kw z$}V6c^3eBwpA5^)eTOzp4JK>!#4fCe073cWjhM|kmc4WX^cD^E$+RRg{03w$f8fhg zgebJ|)5yyo@85$^m?Nx`FUOQKMBX@w7m2?Y#R?(PLF>~#a*nciRkN%?)G}Z$uf901 zi2Dhd_ay|;^463}=Zdg=lH<&czMVVLC(ZOST=xIW1sff2V>Y3JO(iZ9cvYHvvCXkRoHl@S(LOq>aMtpl^TY#45&?D;EC49BQ~px(x`ZGe_4yN$ z#%r(f+8-FZrPIn|770nc|E-h37xWc3=7PbYB~1iUYp?5wopHsZ!|m-e=bIbu4k7uZ zxF{YZsVTa+d546|Atu=9K?gK=P0h-n5Y$;O|1N<4)>%^w1)%_AWbAhQ>qUZ7VavxY z?gt55wUY~;e(l-(m7bIdp^Z;=2Oc_T?LeS+vx@w(y;TObz4vf@=ny1l*QGL!)@g4F zaz${yHS0-JjLeiqXFPt?lhzZ%p@&|7u^gg9n`M9<({ghyt&-U_<{<7gpwcAjo?jmm z<>g*)t>gKlNGdlwRlUks?f;$D`J+?*>Zeg&P0DO5RiKi~exZl%&yS%;@x1InQ`Z2T ze>aj;4oukT13lR0Y-!M(-Co&cdEeOpI&oobCpgch6!F}4#N{g`$a35m2tI`>$CkLf z`DgrZ+5p`sC;(ByHTy3OLT-@N$tY)Yv@t_U)iKkHKi$l!bgGx95hRu6XDX|EF` zloV1~2MumbqDS$v2456gdIZ2|BuhhaA!Bxwhl)eXQH*pQ$PV(mZmV~@bI?%^NwAM& zAkC4G49evCEoWlW4(VjQ{bR4OAWe#HDosa*b`7}qT=JN(b!6sH#Tf+z3sz5an%RHXMfMWcn- zgz&)%P{xDL-W@N}zXOVzpHT0Jzy)dTm6UX69?ZnqE1~`Gv9jewf@fUm(0R`H@->&n z)oC$tLx-zzv-xMUx@6eRq$p*Fx1_j;?lK^Q_D+|J69%~GJp@SiZrpp*J7cgnK@H`-*r((x-zdM!m($ut*Mja$=2Z9f* zD;mt)OC3HUDnp+pQ(d~DxVn3@n39j5<8?BJ>B|`eL7>&pO218_b^&!W_$7ztkEyZIpWi^Po4b`zyJM$o2ddT|aouD0uW8ai%K(<+*)LQF-+&n+G}WwzPvEh+bHlp5A2K zrEhvfEPc~g7;#LqFWZoSDk`S$1NXf0v-us&hyP-oOj|`sY1VN*LD|?A6xM-6CWeMg zVLE+2uha644&eElV_c#mJWb|@7V)(RyOXEt2- z@G|hsj4*qcq8bPln)DoZ{}AM2{O45wH?L!S&4&SiblhC!h#|_19&rIKUQwezrSW>M$WgZ8@P0)!c6a9cn&u+$U(3nirddgmQI$)2#QdjnlPk+0 zgQNoW>iaRx;kJFtCJ0e8QAA&3daOWrfTp4Rx*lvpV`DzgcuDyqarJbvCEd~YQ7sSV6w7gaqssC>ug3t5 z015-1LZ+pq=`=ta?kXef%UsrV^Bl)Jv6=73TBs-}Y>np83YhhTGK#rQ@pFZUr=?fr zVh-VGLog&83T7C>K&jkSP~UjJoAoS4K3gs%TFqQ7dwBACo^C~0_*)xyW7#1Qp0fu~ zVo0gn=?kusBj8;AQPT2yCXQ`+PP;Jo9h#kzxYcWX;(1ahQeW}LDIBFnq`h(Q2|F1l z_WdY3p~g)20Z&D4@=~_zGIU$lN`RUCEhBnJrQE@M5 z`Yx_SXCYOSB5#^>sa)!ZM7Cs|&=lzpJc17sAf`wKOL*seq?Sz9>LxQHNO2API~9&=8TV0%$q5-8UPbQaysXa$fk7>waCK?iY{w8nGgklXxELPK?%O2$_0Gzhb?axLg0@of<=_=5T*696 zZ>Fd1k68>Tj?+Qxbk1ZZO z<`B80xQkv-{qi%R=st@PX2B4^Xv_XAQOJKKMysD{-mVwx)ug61%tdK$asRUUnYJ{3 zUc_ld&aKRmid+i89FF2*|J)rNA}$bfDk%qfMTUtU9jMEG=-0+dU9!~U@~OVv_k}Oq z3E;v`S3?vfzJW{|f~_Z6%`SHxW(RBtuod}S&L81;@-5NI@geb#sNzhC@6DM+Cs zo*k${d{0IG-XM{SzTa~9IkqVz-oVLK?yOyOx#|`!>$#ttY}|}~`^6Cc2D|#ym`gXJ zB8ZALx@Rx?&o7Modu;mK#9>5)F^V-KtE`52bW71?Vam&PVZk#;0^Bvp8k}b*>p~*% zwmU&ThCJphY-adZ&g=>AE-NWx}Ah92Oa^3g(=>zys4+^wCP2{eoXdiY7?ki|UHy#NG{ zL6!+nX*#Kuo|(Z;hyU+qG@z>eiKP&w9SZ&c!4BxLR-37s1m-sHdvhekfN=LID98ec ze9kgYtE$8U%*7Wb$xvwYY39zfWR~!UJ+D!_(|5Tu?f%HteQutvLB@G;IpPG3?lL7KBSYKwn9C1S9EeJeqzqcAxh>sd6n|B7!0BB* zKLjem_XM0v;nhzVar5?QgY%ijy%z+}r6f-01YT?84=rAilHDGmpr)eQF@M~?P0Pv7 zzLoX9JE}VD+qc_!j(aA&kC~5;j}4u>eiKL*f;X}V=i!%q#|TVs_(ai|wh)EW@x=uH zzUftg8iv)Eo`TzWBt7_Pvna~stHO0Z3mFkDRXYs74vxb&F5Lw*cs#<|H6|zCPCb1t zr1dOL@VQ16@BYaayeoTLTmv4fnr_Ir@x7)utNPQO%W~V9y|(`K9Lbp!-eYB+h$C*g;tFVy)0PfBE_;+7{bJ$z(6uFg7IlbHU1JXNz1>Q9d` zRJHkT``uh479PK}JKd$LJ#|eb2p2L`NK-p&6N%pL!fTl9;9jKcyG$%4|CR8LsPx|GCg>V%YRgW z{AM~t!hNqZR}77^%Fn3PWroB6^X)muGX_gAjk3UsrL^Fn#9S`jku2qFOoK3Y4XGc+ z_r>tSmC7GK5c&BnOpOAMgC=66(XdgI-X2yVjZS&ep5$s9JdlLx^gqxTPJPVopXt?@ z-W7V^syXs>q|*QUqeHZK+TnLhmqPxMMW$XpAxAmKagWx|0pDMH&S$f-rGKG5u=acV z)5xFveq5V;W6E(v%;L@GTQxuS;uy_5PM*7M)64e{{lL?_l-I%W5AZn1xpHjD@ZruT zK2yx7mOzM0*rjsua|_cBnZ0Kp@~@5{Iv{VPqGxW_Sl-N7ch(i3{_$q&T<(SVSJ}e+ zJeHeG*B@3_x}MAn!afdqnT#D*?y~31Vhzc-pI;a_5jCf-1O#5;3ha3&awo*GF!X%* zmIUmRIX$6JE@}GZSqma#W$oEC*Xc*ox|WuoVfH4qF@XB!WcH9<;tZ*idw@=QOPuUuF=7C2GZQ8%6k zA3#;KjcILY5L{ZjE(LP@gZ4@jCck3@lgJJ0VIWXrf{(IWpvBsj%j65eEsZ1-9ZL_E z8GU9ceAx}J!Pj{Q8VB3kAd%GhuEf$zjBt~%h)o0ZFtuS?EOC~C>?+wT@|-e8*O>;< z$xJ=WV+fqjyH;~ps5gfjLMIx_Wx~$!z0A$V2mHyA+wT=mI6l(O4Lm-weiOe?mSF6r z467Qr22p=?AZCS&T)_NQsYQaUll%w7el{}W?T52o7!IHwZ|0Gi< zuZGN3yV;-e`s}hYPQAk1)JuE7LVX0ls9y5&_<_%OL6=Jo$N(M)uv(naU!}H`E+b%5 zNes94=!zF%xXtbM%%~(geIUFcm@=7`1=A|Yo_R&ESfQItR|h$?ZeD}dcq6|Tr0{N4 zF83?6oE7em-Gfx-*E!ly-O35WJLxJ;TFGzaHv)lvaTfb>fhL1P^oYTZN}mZer040n zM2>5ikf>UBB6r9L8h-~5#IxT3;2#E~{9ykXoGgl2VI7%a#n{idgm*$CzbdQ{O`imm zsofD3{W?c+Qs?WJvbX1yD1)V@ToVO+Y(-oDhqd>BYO?9tg>4iIV5ftMia_YSt0-7N zK%^6j5JC$rgkBU7MVhE2M4E{79;AdSpnwEICqQU|36RixOE@>r^Vai!XRUvobzCm% z+*9}7GkfOR*UkiavfzI5Mlb(4Dgat=4QCHMWhE`J(J#4yRzteo6HnqoiL1A0%`%ev)L(i_Wk%a;0m*3LYS7@f6Z^YL7N!I2}dwxr0Ru|b$ zdC-TtyuAGVH3WT>Q6kFDp7T6&OL1@kZ&)`Y010r6_{tBU**KvcQW@$dpLr@zht5lP z_qMPu0wlAKimZ1gJ*A%;ET(8y)m5Im%gry>)WIEHG7A#``3^HP^nUGJjL)0DB;bnr zCN8gLWyJM+<(h7Ylvw|V>ZCLy{!uqo$9_eK5AI%-2p;9d}?`5=F^9wm8*6q$kV(blz6 zc%t=GrS;@SUW4F>dt7`(V4P${`36`(tktjeh(N!S9+3C`3&*t8%BHxzRUBRF<3Y-z zLV#msA**hfW5qPyRk#>lq3PP zXI26Jqer$gJ#`$oKiPAZ==bC9Y$4b82g!xRms_;_>LeXgHz_s+V!Pb|aztDQ=Ey+A zp33(d-6s8m$8FDEIdl89zq^gdar*pc=93(cREI3Hp_lIqt%q)Zikfe(eIuF^RQW6UDf;PS6hDiRDGt9 zy6@LMxyUYYRE=*3ahBmV#{oraho67mB_ZHwCU1XMglAe#*thi?lYMh#j>)fs^_TLv zT{GJ^nibflw_8(!a%QUd@)}(5VGV(EVwbqw+t`D_Yi!OnvjWwD7ij7UZZ3l1!~)&a zKjm%g)L9?{F0R+5Bs*wXj^6R&-+}odb;mv)`gv8xHl8q zQ}SNJ_fvyXx=Kb<(0TiYdw3)Njn%;KE13^1gGU!)>V#% z2tghxR#w8eoO&gsrIoE;r~HUa`N0}y`=BFQ3U@`?{5>QJ4MH*?UtPvwhL%Fc%L0tb zGE85JZf*snZVjU~01Afr%B9p4!#RKY@+)XLENt!!axB)s=6q_^aznoo(Rc5q+f-XR zgA;gTqTff=-a9qumBKq3o*2R~(XR5v zLncO~*Xc6PRp`rW+|NwO9tY|Hv*#1CD_3Ty+VK1sDc~q)tFkrbmbbdg^X+ZpDqHaK zag=5(&)ntDMP}uv)c1e0fp=z-;jH`n`=jlL$+=u%wE(Eqbq9D>@x-Yg?5_>L@tqLY z2AX%J6o1fqyt&$qM$DBn9@VNW84gA8#z;kz!Iu^z$77A*B`&PrIKR#v8F;G*uFNL( z%vN}n6i{ca<7cgh&5ScFMs$hDha}6^d`sOj?HcP6i!|b87qhK9#l)Z->m*?gxlmF8 zJC9>^ZMHSKMEh}}$7eP7f`C&fSWr_Tuvy!9^}^=$=2K+i)FSF}Ho^S$@d6{pf@IJyzz`k`1IUNLYPoY_1isL+IX2()qqEUY{kY(N08HS!lEaVkY6tWR%Zz#N+{zBiYYnP!=@9r zljHn#x%=NQ6Qvr~mkKwfJwyu&F_J(gQ%mUqh2} zmm6gGRfM!X-prIAPwr(P{LP~gnSuOP-HGjf6 z+8W!9?T|t4JfFK$2`fk@I~br&nyrhqPu;A6O$al74tq$he_R4$)`)gx!U`DbGpxlH!a;CzCrX60 z3EBG;R543_R*3b+c&zc4O54m4&f9XAl~zT(6$i1rYnw9K&LCGDf!I5XNa>=Z+~6SR zs=#Zw6*JVI2g((VD~~!Lk(PvFe{JF9mvwy8O^Sf{q?u|F^5tWbfIDO6GS)5dRuTlA zP0aD8zd=uT)?VO@MWk!Z0ht51>(7_5*H533YVz3Y`yk;+zZqS%;;sEj=A^phu}c$O zE!M-mJ(`?Q`ucqi?>%!(y7|y2!&lq~GA+ZF3aNg$HhBs!v%~4{wq+Gl0#Ne|aqn+? zCFekK+th}X1*K5P613RZPhRwtJdk#Nd3UQ%b5|}pa9%MXtu>f~=(m0@yJq%GqLhHq zU+K^gitACtOFDYg`2 zg~brp^NWeq1DySHlSQYZ_^O5m0LAI35DeLm5SZ-vRM=iiZ@(Um-S;Qd=UMOITMfsL zYX-&sVqao2_VXtORO-UZiz^&YA+ZaQE%mP;m#cR*M1wc{2yzNHg-zsm1sQQ}!D{C| zr1C|81kxH;BjgtmFs&HeUe`AUT#LtEciXf=?gGc0k_jIzDNUi${O#-4b#axh4Lt~+ zXVv;!q8VbXgQ_M)O=0q?&ZSM?GU-&|CL1miI=+XeRG z#W>hnfv1j^BJfD*WR9Hfmrdzu^fXDFbMBBnLudFJ!Pd?m!5YK`Ivv{0dJ=j6OZttI z$N)}O2cNK>dREIDCVXZOfCg!geL_i8x71jsrA3I3xVMTY+mh4X+ffsO`Z21K{|l-`%&f4q8`y?~*p-za^%@H8&YWYMe= zIrp$`w_qkXhqV7-&%-nJ)vm#L=W))WtCv7TF&dM5+7xJsIC31p})UGZ4HrzZJ5ud&)nL41@TJa;clX@ zvVRG8^q;8eYMRsxh1{97s%8i2Hd+Pm1gKC`dN;|*^{nD5{+zD+)+}Os#IAR|rAJW! zkUw?!6U$OSa7143J>P7FcFS!P)SaLqy}aH@n8uuTm0Mi+wVkBzjbE(@K~3`v@s8WN zzl<*$kspNW256Q0O{0DZi;DXTipdUY{wur8%j`NIl+EZdq|NuBTFz6Q*bd?IDilN|rqK(b&?M zYqs2@uP4Bh9L0Gbb6XUQY_>(BRu*50=XeVlm+YhV47rPUZce{ajt*X~QY3~<-qcDO z#(Su7RNqaYT@mJXPQ{)-sNWYe=2zUjL)FZOsI~;sy3%~rUgb=;RrIln8A0l)pby`C zDwNp2kd<3(jh?4I+6rFZ5~h8Dr?x;2_UiyfVNG;dNVWj=f*>O%FeqqjSM5(SL`@eh zFUi87kPcM zgVtzy{W?*)-&--9|7aGg3!=NQ^3HZUcai3n)fRfe(~9$3nb^;TmCxtLSi?vi9opp` z#;(RFc1HR0pwo8`ngTW*6>*v+9iMd>ZfkbS1phIh&}LLF&3~MptF*6b&y&hj9OC*w z_Prp#dir#bglmgJrS&ic)Rnq0l*Nh>7LNU$U`4xFuW9+Fhn1KI(hYY@5dR_^?Ku-P z>yWmfNPO^=^au>gS{|4Kh4}XL`OfYBTEt`G*%N;cv8Bj)yO;-1$|c4JbPXf$m~$X$ zokDI>s%^=9K^H+#OZ&b}+iRG5^mL!ZGw#^zC-?G#kyR86uO8o8DMXDq?*fQQ0|}|x z*X~XxP4E;^9Kf3~QHJzPR9x%GmFeTGROQ1>SQobZGvY?nO1LgI1FT^L-O1xu4=Zns z%&YT+)?vA?MH_2143m?)lK19h&tz(1x$AeJhwEE8E=w%bsTYP0&wfyg1+wH!W~V^v zf~ga&ioGd&HuM_jF-?XwT?6ksbGHZHu^|z+3&78-%an8)&WpVc53fRQ@JG0tGR2dv z(aRyUlgFQAm4e*fC{=ah@kSvo&&OFy8F3v1NGy-y7t6Utij0`_EL1&F6E$Q|qHUtN zg`GTnzkj>9$lqna-HDpm`yC;#3SE)n`EyTU`~jXE2UN zDJr$Kg%*Q5;F!*9w%)Oz%{xI;h;;I3YAL?jr&bx)!!%tb;R{ZlpG}(9^0llQSKv0lIF!^f4Z6|f?;|W}-#E*Du)3duM0~RDx(xbPh zz&J%k7!ItTO~MhgZkiane+wXkl7y>ye{zL$B!%GuKc}l&*cr9eD`#Ms=~*_ zHy5EL`!7oIQdZi2>}e-Rzn!gWIQ($@TD4^?z+jH9{u$Fug`+q4b~`7|$!&PsDd7-? zfYvsh)%t57{z@iKa4Jqo+(oez%viV%hZr%X*>Gc1`$e5ZF^teS(iU6 zjvQZ(iq?FV5qF7L+mH?i2&z+Q%GWuIGoax%T^R9mA@0IP+*F?sDtoM_{$sCx_#->TmIp?~`|0RY$P~QP+VG-4m#^}Odpi$^3X9>H8}~6Zno-W| zO>uM#Xq}E#P9`Nk2fz|1tLKybia8;+rQ<`!aK)bQ@4m(@7u0Ahsz- zS6>n83y(b|ul-^M^jyxnCL>vT@*5)#)EubBsi9o$fv-S}7ZxiVe>USSI7)t%+$3d8 zKM1r{$a{*+h0v}?OpMZz{sRlzetWFt1$*AszugH+d%x8eEt28XLf1ym;AI{|&7~;e z;Qg3i6U`{_`$~)}h)mT7j zx*N_=__s-~1t!G6*OhcKzkWR2B6#h%5;aMkeKzv&otlCgOEB2cXzYAAED-|c+ z@T{vD{LLXA7Hr%Q`dK$D#ZQEhb@`Q~^Sh_X+kjSV77=BKAKETNsBNKQ}*M+v@SAhNv< z%oT?NcrXT5i@-Jg{?^u?MdC1GfbVvmB^VIanUt-1|1s&`EEYjO%OCuD_*3AZip$t4 zNLGwaJYKb1TNY0NDX+2{Uy~Bb5M7qFY>nkgZ@1jp+p04Pd^Fpwx*xt-omNR|f;2rEZ0 z;JmJHD*EJfJv4f4~o_3Y1&lccMo009U>wfWyv@KWTjr*w+XJ4OJ8S7nu#! z0dtwCXVwK_(>Bc!*r2fkAfmYDm{iu%P^kvCQz_(d(!^;;?^EAD7Sk^#Sioca2l)MG zZzmn6V&OB@NTEaTp;5f%b3f1Zwct{9LG~HNrKLgZ9okxAaD|yY-7iihv{Vw<) z=50A^)i~{(J3$3}_t(To{hc@koT6pnzj{Pw(G^dF;}wPV244wb3Sy(DIo{7uDUzR2IZ=Q7koyN#0_0e{UT@x3M6sZ*Xff?17sA<%=KfA=7& zZ;~-8;#oGz}V5KabO>K`V zzXuv%1kP@DDJ_l|J&(_*brqL72=`A3EP)aKZgUlVP0=z;>pUpxp2lO1Cexcr60%Iy z&QtlzxgqAaRXUlIl}{mmef=(Vi8*QRmdQ<1NDRer>uP;TA={{?BdiRrbJm~#B=U9E zA72(ez-K)Vz!M{_O_>V4-eXn7Yo8Xv^M2BsTftA(cE3`dgpmq`Vgtt*sm`tFg12jc ztyY3J^Ylr11%K>wyc}MCJCu|z^zZ(J$(d}1v+C_#Nb~g}n4jH!zX+JVE9)wPx~U(n zO|Ns^rpC0wAqmd_Y*?${opju!u=ByP31%cXZCa*NE=Kj6KdpCOCzyInKvahf22G9Z{ zdXtyA1%RhpGY}17%)5{A`kFlg@7KPuqkU4^b9!}fY(a|G|x#_QdGKXD)myC9Ie;$9f z6Jc&<_O_q^bU4mCS>L;v0YaYNZSew5N|&+?5nLeYYBi6kaIiPiwI6>r%)b6)--{{Z z+CYQLk@slgmT|RWenI4!nHq-nedL=mVPCKh7wCfKcpw)eHyJn!UIYX#R3fpbQ7T)A z@&fHv;;+Qm&`wGcZx|$TO9E7?_rB2C)qkue5N;If;`Pb$ca`+WmG`_7fZ+-OCx!95 zz}|e8QM&f^Fhj?P4f*34y8D|u(i3ku6{7Bac`0Cts#W8>zUEIt;HapVQXx^_sb-;& zbgM&|4sVQQMJoCXb4m0;$VuWU!o2_f#xJE;hYWmU%+y|61W54iB|xq2aLgx;LF!8> z{QE1NNVjUQ9Iwd^dE590GVVX9?+Mw%I^>P~;}A;%FeuvFzh;S{<7n9cWbkF#gX>&X zy@Wj0_lVCO|Ivl?P}an9ugQWi=wU68ddorr2GEX%rVn~&PuS$x1eINiychP^9uSh< zOVpD>%%NA9LnYq5vo@VIJ`|igK&dN$%5@hX3L@~IO}AU9?9c;FAW=-0y47_G!Y^op zs`}N5csmD{}Ww z)l6JMEqz8g>^2WmjaR#(X7-I5@0x2hyJT-=996)yODGPboV{RIhu3~e_@dvE;e}po zBdd{b)+nX4jTr0h%^6k1Wwx$Avm;nSpCV#tYK6A4NBUotZtoQ1y+H?4TbeJ3&6v|J z_r9begC+xnrCh)8GE@tXJsmf*ztt|*y>QahRg?C`TmIo%%*2=2Rbri^x1smZHph0( z`KnOTB4Y<1F6~jt{CphDGUVabFHLXT+`dlINIBGUNt?GEl2BgoaIk*lm%;F2MTVW4 zRpE>W(^CR-aSH1nZ|mqnWeJL4`88>D0F2r;PqpjAbCLdLi$`79W}R;ilguGv(89jOn+qSodTM%MZZ)?n1?{k$2&?%t@UBq1 zfAhEYBG$}RQMXU76i|b_7Z=_$juEGNRX_p$OUx?2%#*yIs^?ZY5oz(#*{y9cnWDXG zHv471D6{W9seT}Rp5kNR&u_8!Jo=?#Lj#158f#}v&>7`Q)aDlspyA-@*FhDrquMPH$U5Oz6^jk59%6ZGHu|}lkdQJ5iU*L{cXE|V^ zq$jajg+tm{>sz1bmMXER))aO$Nl|ZJXKsPz$eeX=Z2>{oa4gqt+}@`@v)X$m{vpL; z^ZE>8@?ix*Ter=#m~w6y1}$mp51~qyv=^qPJb`F;AXEsn!L8tM{)2gA->F>aN^{!& zUD25tenUSiNxWd4woc+YgV^>~W)*duN$=^?w>3)v-46~Jdwcs{si-$S#zV+lCkc9%jE*rnARf7Pnt*Xr}h~H9t z;T1t-@3*W}o3HHpSlS4x5)f-yYPH~G`86g>99y&Vx>O*kGjn-&#&8qTi5ZO^iF9ic z-)^KX^vlsEQnIAx({gJIN7{ibkhCWo`%%T8DBd~^^hW;W`H8e9W%l}4KH~nwZu6Ga zB+b;GgFa^DfwV^e%FY~^c)X>)f-!do zURaMn*+)0Obr7l0^3xJJ7?Fufro@t>0AZpCMj55;nbPN|jm@V@*KCu#45ycge{GslgJqEoW-i z@X8AQ>$iZ6G7>?%UPPrY(z?K<^$p+(G@+<=^$}6ZZ1axOQl9XlJ&*Y5@4xbH%LrP$ zqH$|lk2OKZ))$tz+}6ogu+p6D8$oRNR|Fsd54Ey%o5CM=weoD65MwOQaj9sC)dWjk zG8i0Jy#^O}!}6NIZL{pJ`V|^RQnqZWZ5E7HKAL9ld45OG%)J(SsjQ5;Qns<>4BTc` zQFP&044FJ?;X`Aoni=2ILDXb*iP6sTAIzu*di|>LJ(%(Vv>(~g(#`f7m${ifVJQ03uI95r+0Wmy zSQ!#pOI`O|iMP>C?BB6=ES{Z|TN6d~mIOc59PgvgOZhSlY6Mx2n~y^!Ty+)up6+;d*};e^t5v(^vu zlur;b+d`tUlHHFNfwXBWdIX@DD5qiIX4Z4$M4@En>n=xQ|CJ zI1)p;03QDadUM+EhrBk%mcZJtY;J1W+1b^s1L=rzUibmjVhgKcRm;~byy6YmExW}U zq`?mTWsjHKSo(umPDnlSk53e8guy&FLr8*V|mLZ8@EZ!A%q-Sqqh*NaZwmsTE7 zr!V;-qBN{h*r6Z2 zM=ywQn=d=v<*lW|D|4f<^)bHmhO?7ZT{Mb{K&M4(Jw0V>StEFFU2YEMJe=S$+t9EB z4x|wey5zd@E(kuUDzs|b3v(R%K%r6-G#fTzMMR~k67@S{OBqE)tV{I==_0fbUC~?O z(6qJH*h%h*osjJ{#Sr7_rN-A_lG249qHNSR{b`2AuecgLt4Fd$MGDwps0Btp_5oqdsMt`A5&Ia&YP`r0yn|O z9r^Y`Cr9}WrkAFgx1CSma({Y-zkDP>%Ny3Tru=fOIPF!Q#Uo>;5E(IObm_XWY&jQB zaAgb@OS&K`_*=Gph`*-#FS~*#Frhg14%mFhbL5aesfQ3GuCgG7w4*_IF;1eP8ogWd(a3a1T&}k80A?j%8O}5 zb^s@8(JOOb`~^&cy|y_lw!VnF@?kk`BJU^G$esLv)SS*@mrF0G;4@~kiYpH=kn~(9 zE>PJvto^!wEmryHS2PwI*jEmLlHd({7=XJMoQ);~7;y*6|BgsC$aw(9g0hc0F-j-_*!k#kmdR&+xmi*u%7Uz5g@EQ%xc_m7{wcrp6ZC$4gO*P7T5 zh66eqes`zX0^)C!5^c`je{Rv%wpfe-mo4n9Cmli$9FTObzMO66&RPae6)_23g^xb3 zW#yJPETn#RYUz*TrQ#>ODNJ38?cC4xl%{sqO8rw;7(e4I+|Ox_1!c4ctXc>qK zjfC`?b{P)(){#0HstCS8L3lIc@f~){XpguFhklQb`j91G%Yg<`XP4o~$GHp91ap9G z&6bAkvd<;Rr+KYYGr94vw?=&oKjr8E#3c59)6W-feMgW(nzv;_@aoX1%8(R>;w8>I zQ*ngf>OMcLw~0Hx^t$u4JElh$>kf`W{c60=_%S2JlRiYZ8bR|MIaU~24NLZMY#Hw? zypDy?Ri0qKXI})VOCL3DHScygfwPhgB~2{lHcFQw9^|>ojf?Rtwi{=?8X=UAM)MH+ ziX*(N=O0#E)OgSTwB8wocfkm8Wq75>bATn<6=K3E3&J$2beZd`XmI0_z}l&*^Xbhl z+~2&eFgAhX!C*#%g;21@8Dv+Gmn=RYP}D5OmX8B*u|{J}?vc@RzOljzGpR`%ak$P&Z0G|s#kRvk^qQ{_e+T`j8PqG4jgwQ6Fw((!7%Q5U?B_GQc)2>ddwe5`;dmB!h zo9CZ39{4&~7l>QHiEzSH%Z5Fy_R`ONL@&X+mS9$cU&OPuHC$a&s|gN?MOM74qb&k) z>bawTXfK(TceyhFL=SB|6O}?j)C>#^6d{y)l^SLs4HIMWf(oMBr1)Y0=#{FESJ7NN zv@x>(wlNX#kCC$AsGa?uG;r#$spT?RG;z1bxd>9v%1wKD%8S!Z|8W)<6~8*tm{RW< zYmRozSagN^=**>Yzbq)q4}(})X_W-fcj9V70qW9*v$#S3qT)egyadwCBeOHLds9QR zZXq&?_vp8_tE#d7L7y3MQMR<@G~QPWGU_*PlPVc-;6CwSnz_n$iG2O8dKwoy397lQ z#I3$J(aE81ljsQ-q+Em6}`qd&aEk*@+x9_tWg3AM)h6?^)?q>#czQq(0 zUCoWq6B6@Z+gCKRtO{|9yJYzo7dsrrG(Hr`)H?s8kAJaw`$qf&RkK(o zzJT6KJT-q@nlBZUpT4(n%nBYX-gZgBtlvhlW`zPX-Lpo5clzG3#=^QP`#yH=OvtX7 zQTQblf>(2)yjxN;yCvB%2*NknfV$xZTa^5PoLc1{|iTr~@_Q`Wk z#)c{NNW{rv>-A0k$u^Jb65i;OOOCol&LL?T1rX7ZZ+@qzE}Va6C96#+PKh+&^^(YA|tJ#1OkRpR#%<&?UTUN9Fw_M<@U!jH7f9ueeBY)+Rg8U zPQzR9=`7dU*i?rTWtFv#r|gJ-E`!Y5t3n|Hv`ySdZ@E`V?f0RqM>RVL`5E+6n8^ru z@=VbLz2i5CYVFtF?@=Um9z=}N)sj5;z69hQ{wA6Y;g;aK7PtTeW|xPRRy3|YW{OD~ z6gq)Bpv5drzGPZz9Yq_Iz={3^rgg`=YD>&?z+b%Yx&5pTBYL!^Yz+9Og@P-6DY9=wMk5H7!Q4^T_`V^PcCz2-P`=!O7%95+Z8!v&xgFMpD zo38KIRw%h1eIwLX`hcl9{q^H#++^VCp(tGJ1P)bw%tDkA7ZT*I>gqqB%YaLc@Q^4v zvVv}Pm-u}vYwyQZmGZOlqyA8~6F73M<$ICIZ*9pFMag5nEa&EKW5@jL}l~`3M zI+gd+oY-~OEH~{`VvWqrX1Ua-B`&D(OLZG~1=)oub(Gbss_hd*Dev9+wMbVuvbgTI zeKM`Jp*n%{fmHKE>)dVhTJH=#Y359#`10(#8o-LvR=SqI`mM3w3Q!XiBw%yp=G&bC z&$Z0H^Jz-WTvn2WBg!fm+vCl8S3_gKIFr0;Mi`eafYIn%9zS2jk{H~^qW}_P)=CTK zT1gHnL47;ftYNzPu?1<#w^#DUbPtrzM+Cleqebu}ly75MLaW*`JMmyNjF1l@tNP7c z%Gy6Ine6Dp;dZU1+7*REjjen&tEVmo#BAV}CpTi1*sX$N9yK&GcWhMf^K2&iUn+M5 z@-#Xn-=g2b6-6U=6EI2I^6DC1cG+Etq^#64NNfQ@sSz{i({Ny0OT(KKn3Nu~3SPOv z#l^L}Kk~Zdsx`OK(r9Q;h8A%U{>w8yDP$5F%+(?<7Qi^Mzm@Ssb)H$c0HF+cK{Ueq zGqUP__bgJVOu_k>FOr^XAvG62)qD*CQ!5IpZ6BF`4{Y9BuC_l@%V$msTiekc&h6gfv8Zk9|ylPx* z(PME4x>mPKU`}qK+dYq;9w&aXe-8+d(hTxD@(>Hz-hvocGql-bL!a=ztM1o2iZOM) z;||5}XWtPj3vhuy*(~ZHXsJJDD)fGtuh?bQvRI#+dEDN1=e4@pX@GI2bxUyU#TvV6 z;W1J%c-a|h`Z&p+wy(Rrw+{BbL08D)tu;e4HVUa}rXqOutP&Cugm3>@+do*IIrxbO z2b2W0J|SX^>Xv&SRBou#HV#Gy3qPs))I0CI#})r54&Gvl_V3$1a!?rp@GWepPc(@X z$2{FR7auRY@ES_9P~EtusK}tcz0&1AEn3Nq7=MZ|iB<0p!Q>k_pBaNsge|YEG?I)h za*x?PV#4)5F0NYofD|#I*PR0{5ay3@JEitW(nRj{j*doWK1SuWwht%BQ-5^@fnB9C zvu)nsEy{stcczZiK3yGkHR|i_nI9X%3TjkAb+1V3!6(dp(U4c{NS!hKH`g)$6HH73 zva*-xbb1>O*IXy<`jpM4>sM!EXG>>Ok!4cVSVh#RLCL5<9AI2_C$>lILgs~B@5P*x zk*}zD-j`na?A`uc{lWeIctc-U)JltMA+%C7-*RhtTcHNy>h@=0qb0GFV+|kR>OV8a zCb2oj2BwPF?^l=A&UhEBUIgh@??|KQTcGKdaWTEDx}dFcaLG_R&kLa?B%JM4^Hamoec_taxHxvM(s` zeZdAW4`#{l8x`C4dnTNV70LWj_p+~TT^Tmen->bQrjU#+?|XTD^Y?H5C}dCypLqfR zPOSH5E-0}z>9AKN)zbugX{#2#;AMr{R1*RmP}Z%G&|(W;>DnTHW}JYWGMIFrUwl@==s(Dz^ z7z=j)^9~H$Le^A&1eeU~nNJ3c-$&&&e4x$j9JCzJ){a>OZy-42rtX)!ip})?jIPP-ubLK&1m|YF^c6Q3!CzW)^_P(I}jDRFr-7)SMW8+j(s-M#P7g(Ix zRGl_M-N=nBuaXWKOhA{~B|T}~?3Dz^@Ht=;9B_K#=GageyPlD@5BLQ*Mc1R!8|@G1 zVfjIaqtg2KsPco}xd;Zq%ghNl4Z{`&*94MgcY6KmzGFGivYLBw&B5=vMQ9l8VEwUK?+o?=833 zlBEW9JsA@UIEA66Iozfcq|qKJcF2#-1Bk;3i1`!TCD6eyX4e2S@0T$T`um(tzgYN@ zl;~&LzZqfkp41|t@HH$fHZ;75@mzH>wpO-K{>O_pp_G}tF7eDge!p3?DBdV`K8yG*$ z?~=HbKNLU;Nb`dMk5tD}lb#&-JDx@!xSXg`1t>{0uTvbcOsz&MjP{n7v19Y!K=Kid zSA&kv&uR`0e7}p5Mpb5QM2sBEw0V3i;GPmk8IF2#n5hVGssO28HA0jpKaQpGxKFKo zdra`;h1aa5OQXAt>qglq3jq-u^sklBtvoxQH0p!wr`aN&o6etq6v(LYNrW4;_|9blQSE0}=Ufhx>hJTg# z>kr|sebZ!5e}5%_k3Ad+MOHHScNKpZNY{)@#1$46-U5MsU?8}6iHWn?3s&#nzt^*{ zC_qNNeOvPU=cykpEqMs834qZluWO71kZ_v-5zLPsJxUf*jVh;2x5n85LD4`C4+E+< zkE;JgAZ>!f;e%^3S4>RI5I_Jfw7}h}bmhvC&d$zTqN4YMgX^WUeR7J6mj*p1CB<*u z`re)(0uB-p7gx^=UgZE{n!&u>|2dG~9bw}ag8&{liE@|AXn-Que?fOvP|Or_&+oba zHHjdLBI!DThSL1x3T!QqjRj;ztR~H)sffxcf_5i|#2mrBj zOB!iU0aAw>nsP+|#3@ZLk28JLf3&7}{rU+O7M8;t?o(4!7IQe1xG}=_h)F8h)yYY? z!gVa~4DRE{i-xElt*rvruH6-dYx)32RZ3=9utG}!8Bx&UB)0Z_hD^S8_3E7s2*8c} z;PGPv#IU!gCuU^4F^owc42GFU;6Rl=OO^z+?cLoxjQ_!q{NnLWV^?Ak@8S%A-`WMZlMs2pmi9pMb#jGO~#;PqP< zy>vqUbE0jmfB#Y$oIBoVG1$$Pk*3)Y!)Ih*@IiWJeJ&o2lQBgBq3In}FORWke5wZ0 z0Vo7+mpsa7d{E}zm8zQ8#q*#H>mrB1;%NX9+4=a8g_yFkIlA6!|0E7>4#FwPn4)!U z-vg1B%q-4a*)q>$2ZOt>K)7X;(Jd-S$!5+W8G~WA8Y!1BK~{d#yB);OUJV`6sD%+5 zG{EGaTO0eiF|QRr!l)C>)jt^29fXlaZAhhiXxmm-R1AuyxT};43kxUbvJUxhP3&4o z*b;QPngB-AqRmd)BqkNBT}CuRxvNS@=%u{=53ONt>V7VP#;uplw)V6>Z`d9&Sf7mXSa5$@g&o`Sa(NMvu#E?|T1DU*itQr!bl8ipv*cbilC-y)W#lD=RDW#ePdc z2R)5MSq#Lef$)I&v>oCxS5(<+gc>v)u8E0&xtlAc1<54gyde%b0aB>QMK+c`7H+w! z-p&Oem6KlQyG=W>GM&u?2#rQd$z6nj%)UM7bR}y;*3_Jujkm&r`eHzvA0_Vq$d~`Yk_Z4#_y4v@hcnm>`(g3dYxIAJ zP<2cq02KJIa(64w{Z~&8OV7$Z7d!pGl^fIizc+LLk2{y`B8EyxNO|9m!=;G+*IZ{5ugsj-u&;HyOrNy1Gxa>bp&9FXa)?G%Oy_EInc0=dksMG z<5QHPR$bTKtp|PEO>j9hkzoLE1^V{C=6YTIxmX%w6uY>ly?quOX5HOK#t5!^zkT~Q zStyKq@v&8O67P*0H=Kw(2LG{UC+={74x0wH6tbu86=0o{O>67&PguHTzrA-Y9suhw z#0;BG1-4!~+&$98&%$?PX7jM4z_~w+iS2pMm-}saymyw80>D=)=Q{cZu&)XRJl!s% z03Ohv=RSZ-9C>16bJf$+^X$2EFE5E04;7e{!MyqEzx zh@wpZm{Q`{caulK{fMZjDBg^9YI@o*z+ZV@oVo*;Os|Tch`j1*vxGV3#e?@Z9>4qa zDUWaKd(iJ`K9jVdQ>RZi1I$SA@83@q^f2yWyyl+DB0;V7Wn!JCPmPVUdxHW4&+_t) zx$;-Sh*>Q<>Xu*9(;EkT7Efmq9zTBE)8GHK9bjFxnWztP+8?s2FxJz10noJ;n3idh z1_lT7F!ohCd;)7~PaPc{nNOX%3qYH=y8isJD~HAAifIfG2>IS7X*)($4TtU>xicv~ zG0~x>0oY`oI@+&Gvaqok)1qQx3=yW{3JNAE*(z}gYKPb_8Pu9E?-u)C%ia@I&f)x8%+NK!e?{(c36k#5@jqYwoF6=C6aEcpeZa9XpYHBTCN zNP^c2XpD5^CgS`<6xXl<3KvqOixm6J`VvYhIqIQTlKK8NEO(a<Y99T>|CER|cbYjKp?8 zR4;=iy|8hC(czqfnFa2QQhmyw?zp~!n7)onnmq;7N~MveK}w<0z1Rlw@Cwj2fTa6J z!>s@4$%FuT)v=owj_zvBG;N(ZO4YjPep50H(J?dHdqPG7?gpgUX%DYZ+e21!p6k`DNGOfhyC_v`iD#|9m?eA zqXhJuU^&bfJi_rw@BTFZ0GdS$nT^%zdnX--61OVqRXCjxQI@UVRVIy+mB}4ur$=(* z^a2@Wpfe+!bw55}wX4*tMJxIeOqf z1;vU}mxudgke%)a>)Q5jAv;W=sj&=kqG@a}`SHQhsZ#kk2I{Q0DjN5-y!;YC=SVHlM-%$cOIVlrw}|~M>{o+q#H@f9LLg-rBI^i1ttA|zDUEv7 z2L*_Som9d?Lz9JA9sWpz54Yfef9b3m?Qkc$%iqgSmfD%ki2FE){_r7;LU9@mSgNZ6 zQl~8g$&0KvC<8-4KBuzlhfs}#tv?@hpO02~IJGPcL(^j71+>0oWoah-J~P^-e!z1W zEzTFR?-95;4D}_Wq3&Y{!f*bAZKmM$4E|itd)!6Mui07wc;-MwZ(m1SyErtd9j0l4G#8M=qMc=hbH@`=&nfJH15o67PLU~kQ8 zm(W@2gLkQB5Be;OFu1w70a5NDdUM(ttb8gtlv?^Ol|%CR3E*jZpt`7w=C?bSy#h2f zRY7!Z2JX-cb{*`;YyGx~6Z8n>#j4`~2dojT4#*T{81!kB%k=cd7x z%mCe%DRfLdUr(6u>eF#>aL}XLJ0y>wabUD;XRA+1LF&1JPKYyD6|Nv9)r&r6*lIyw z-AsaXWEF5OPK2?k&00851Hb9D6lK*&qW}#7w8Mz{DaoyV7`CUv2ZD};)D@Fy))S`n zMMd~Sv2wS+`cKoTYA?2?!KPjU?1$JwA5z%YLyMX$v`*-NNRL=#**Lw*5`_L7NoO&X zf|IpnKU86{riDo>c4Fqkm2PRmJ`+J(xfMeAUI;)*;{p)&bf;_JKNg_@PVSx-QK;k$ ziInSAB%QKjv~t=jW?ZeW(~DqHaTkvE;}T0E$c~Cp%lJP5CxmNCN?eDC{dQZ`$mSDw z6h55&`#`yy+9!unmX7~vcX$j9mt(BPYWJ-+9PBleIt>Uz-yY9LbDlr{h0i8k$22CD zbMz8?2ar|6xXI5#c|DMFMQEAsv#_k}0J;zEezPi-PnCAa1L}-HmR-pb#)}kIwRj+P_VQhOe5dFfA0JaqYi3?>)RGOGp$vrgR(0hhmEKl zPueR1ZX2~zRZJ7m5;n&+=ZB}IB4p=_#hPskZNOvoat(l+90g>!si~ND)K=g#vQ67^ zsQBdpB;gb9UrR5Kca=*SR@-a$_5&$#F&&!Zf7;WngBzkpFQ{&waYn2YQqnrh(p?{+;dIhlRX3jBi>z=Mdk-d`RE&`c zS#eai8G?p~s6A244QK|;EKQVYv9h^+c9VsI;`D9f0Eum36Ti7T%hsNrWwMuu$y=&d zueJ_cx{37kw8Z5C3649Q=*UkJP-j<}P|GkYV&wFQ#;Y=1^{X>9s0YSS;n7@$tmKj& zwwo2l+!jMe?0(m*1u4v?WM#Exy5eZGrqt?`n&wQ7oKm#{0?@x6-HUmP$F}g|^60-NRG-eRvZP-(&h9?NMeX zZ$>c&={0B#uaf)LqUsC(Rt_ z^z41C6Q>y_q{P3zEk``v9i zIV;80-5Mw6==90c>_VKFt42);$qa0EAu9KM#=RnXBwAx#4+(Y*{q82|O8>^nrpW6c z$3k*EQ(j_SzNC2Qbbsr$XA0(uTPDLzo{5C{*aCC!34jhW>p!fr7vvC^%UOt5r~O$i z%ceU^qSU^O+*|03la521ISsG!%k^*#&GJs|v`I0`QDu5P`H9reB@b#2<<^IFHwV&m zho!1?DakN*g<#-629=kfa0?NTV87W09_m~WZ^ABrB_B8=v|+qPgBrj)CP&?u7UY-P+wNn?vG41qM(*^Hk;NU#kF2 zM3C2Y^oi`Ja{Xp2efiww~3{5*Qpc-`6N{p$Lx~6f0@CGLL~k>cSM3P7R{^EG1P6;!_>f^d0NV9nm!6Ot;-(4F?t3cd|10Sa#oRR+HJfjC`9feE|U; z45rVnQp>AUZ}8^gdQkB%M?5P9!I*`e6K3Y|jo~o+#*8;_->M55AKZUNb3~>5p>#p4 zmemKn>~K_w)z&+3{6?u-5yNHdlI!6~!pei1_>yXXJA{7B%K7j0!_52t(yuk=TTCy& z)glKCqi#-IoSdQ+nzJ|rcezBIO1iEV(M>uvYYxBoXLk2jiXd=vo@yVdaU=WtwkK}M#W)+bb8LUi)uT8i{8-h=7Xun$UQbkm|S}IHht8)o4w>Iph zk&+vCbL`R*3(XRL3-@G9CaHEJU{uuoE&2Vi@AP=ASs$8;ildNtI(GM_ntn(>QAUcO z0&QfHHfpn~+mPN3{?HnZ-C@H~gA7%_GPVk5!eY6=KEHc>MQzELvd2rx*I)}owYQtd zm=u+UL`hiafzz?en1lBK}6_nb1;1P49YJ|T^&=^yk+;fGF{<;S^mkr5( z^&YL-fg*6bykE%XC7IE+#PUJRv==4VQ*T&DcQ!(x=syr<{eN{KP>p@=g)cZtZgJYk zaKCJNNliIhDe>xFL}(C#sv`mdVe__w_J!%+mfPXama zXq>%xIQ#YCUfV*;`vsVAFLU5@nQ=xYspqW!)ivzc zI_U8R^IoV*#;CfszkkhcjwV~?BH_!yvwdj~9OJu&)X$IvUH=P{pr})05ir*Sy6SE2 zu78VB7-NJ4t`rJ1CrZyAk+B zA+uPgVh7WtaRdWRKGy>P?hpxWxTB*A>e;t%ci(aG^T&2|-A5D%rH4Rr=>SZwA~)dw z=Fg^Ogr_PMxqAG8fq}U&cVCEmt~QgLvhv7H{kFHJc`w7m>waAhP`yYWVP+H%j2#~t z8+!qRY2XexLNej={+~Zi=BZvI~>;F$d<0TveAva+(!IWr&I#WguKcVNOqi8oc_ z0~l)q=%em~tM9EU@k4@!Z^l_1w#QPAUJN8|DpM$x?xV_^j$i!}ist0x?3TxGZYXQ6 zXJ#1jgX08k*?MF$@RgO7-3bcArLSI{olT`+Ih6%@QPy(gjZNbIWi@IMFkkh<+J;3k z9_NtBpgD@1#Jv2cz|*wN)^MBWcz?8*CWDTj59|oZnO^E0+^;X(WDb3VO{B8&Xxf7vk^#K%{dNMe*Gk?^VeKVk4{sUy@G_3DN~ z2gXsg4!IPe5KWRMsd33AkznvKjS}k~f!o{#{~fmLX0Q<#F&ybhXJ~AnlJd)Pz7FoP zh6aA1Qe}D^HKOegN2dOF*qLmCnr9d#!5mbE%tTV<6miRSSH|x~MR4gQ6#CWexB7hP zj!t4OLf97GA$dJToR^vmaE0F~(?peg_^{tBP|<+CA!ZxfHqUW? zpay`#;EG%e5$K|tB073$br>z1l+sO)t7ts6^_;d)F>ae^4_ZeP>4QP;o*KkO9R5Wa zfZ(1%oc=eqV4?;r26JUKF0E9YgvoXK#)|H=B+Br@Y61IPP6jQCC)QW=VAuV<*tDTS zhAkHYCkzCMt9`fL1!HFz#hc^X5aPY4AOi>xUu84qZm(jjdz^q#AS zo6Apv-S4?GvjF8q>QQ1HQtNmN^9Nr8w|jsmzbsVei=ggf2{~<`=nQj2 z1_d<~+H4N7=hD2Xt5f25(^;<&IW?|PDXMct5}vGCC(j5$-M|Gk2CtYT{W>o>W_2zxh-@kL&7)o(tQJ zZfN{V!r+ywVmcdH6&#IjSS+5BGY~(dIDN+$JkOhY$Hs6mikV+jq_yi^;p^mAS8r4R zMe#6VJO&>=NYd17cIN9I4^3H;YTYY^7-0wlR}yWd5Urt7eh61V4k z^YE4v&=cskO1~h0iyW|K=RU1z5u^~GXp&P^a*QpGBsn0?Lzep}Q0jW;xsigHCdh9?9gtH1`)-LFJL-xJ+34Y^#(S)3Miw-L-x1;t9(3~eE5~s)G61qioxg6@O;QN#K!puARKLBIh;5G z-{!5w29riu4)GKa=XrrH!FCI z7dg7RB;#fC{>HBZy3S?#KG(yzuU~I%*qZM(i>a>07&T!xgd4im)aMhxF-)ym~qEsFzpsb3*1#WZ)j#2^J9%SAwk&$YK9a~@A+KRRwq1RcpjAH#zV+!#Wx`lg{-1!6@Lf!sY!+!6Il zYgI_C!d-u+M31Pi-S01k2~!>RGyMHM*zwRzCX2GA_pdL7I}`RyQX1{&s*q{X(Q&J% zVj;1n@UhDKD{!!3qR-fmV2q?{$ z^hA+O!GD~XEW-q}y1jC5q0b+=YrH!Ker10+Y_Mq#2=Ra+=PENzfD_YX9j&A-?9>GS z9j)@1h$p+(vxOWoCdP=rnp*2h_h4Iq@<@L_wUw2=+(3Wm+dM6yzl1L=Z7Ntx?o^}u z`?A!paxqH+>nBJ(C5S&zNRkiI>uA-EF$ocA95rUWhe99h?R0-EL5cYu;eGZZ{~~O? z=IaTy(10S=alXF|EdWA2C;m0g_qe@BLm1Pg;0rCY7?!L{ymi~EC+qiABWtLtkqw); zNZhK}4=_7r<@KZA{OXQIJl*u z9jtCdr@d^Lj^2T zde9JWsGW))NZXOcMwP)ZM1N#&F9`vkmGLEiw7*mK9BSlVNM^!O)bE}6 zFXiD>x0j@QF@clZbOM%SKFlUe8k$|HI;3HTx85G!-sWhIe}!s1>-YLnYw4QiPvqms zz}_?OE;L2YTOPtCLIhrWIp6Ij>RS1od&Hrd@W%AX2hM3j$LCp^l^L(C9o%v*RwNgj!;za!x2b)|J9? z0!@tbW$lXG+VBB)w54vmJt^KvZ(}^dnXp+mgFX+!p5x_x4(rI!XHWH}S`vcBH|*NF zp}BK+D6g4WlQIM5MSa=MBB7}SCl%Qw3#a&5R0@1}7MO&TZ#gJ85Y7QwQgBTvO?n)V&nuOUE%a5T4VB_E)B}I2 z_oWK6x-rK9XVgCqi?z1>(l=_n&-aEZ>+x%kxuCGDXh%ots5^qV`d?1gF_%j4^%a&z zFIn9Y=+bq&57DHs3&}zF0uMKl*V5?naIxi6vA6EH@t%K#dYzmYp*5%bN~QD6fbqc@ z9;qNEmbU3KRoM$?gy_7KtS7AKNz*E-DE$&u;J6VsKVHjiu8C;C-I6q;yy%cAR{T+D^ z@*-4bWVr6|EVWcUl83N=?)59A^+Z8IDkbtX_BKq5q5IMzYfjl>sW zj=@0NMfOx{`nEQ6<}qRbYPMS&gK3m4s(GlN39(5jDr(b6`Pt*`sGeRjB&?tMfz^~( zV>I3!wmRKWvZhvw7D%PZ+9nA#nC0oEI54h1Fn{l*_x9Zo1mxTn6pZTs78wB{TzU{ox#tY};+@nbm=Ij5r64~z&)?dnnAN|SwkicVyZ$`1e_ zJK?z-3)_^u>)aB6xw%JBLnOL=rtQ$MS&~iAJ`6iUuaQ?|G$QWC%^kqT*Nz>HJZzDZd zRU}VP%x+9hKMgH+)4j+Z-Z?#98L=9}(Rz-XH{x5E#0E>qmGX#l7g5|^`MOh=662le zX89UU{b10kt%wj4GfU^7WOo;5#D}I;@AEhGL^_+7M&c&Y1349z*-cKf#_HPns{smY z$+W;5u2~~5`{B#@&wjS$Q*0ID4f=t5w9@}54 zCijN@y1=HC_AaK5vWR$j8h8alW3KE+1ds9@cx4{k=wj^$a+9M-clp0SCy?hVX^>ID zp0$eZ+WWZrpbxs)JU8?$~(`A9o-3?{d~q=b44P@k82BEl{6+jW;ghzo%|Z~HVymdw@~t8 zBU_<)sTl^`HWIF_-SMd!fI^&rCbO>HPkDvHq3C(54}$k~k@_~7I9A{pHG9AxNN~20 z?lOQLxbfciKrc+A#V+;e;ZGv}7pH;8@3E=9K-;`#w>f{=-y{C(jb{JtmmjbEw&P}x zZDM9D@839YyU*-kyUm=P$&h@MJArK*LEp7j6Z~$Dxq!}uz8q~3vf%gR4hc}_Cu{Yu zeE+4l=WKHJ#%`F9oa{NHsEC20ne^MDDa!A9Z_hoFzC6`Tj> zQY`93`CXrOI2d?}wNg;8ylc*)PryZ3clm`wOHOFIYr3v8eY&^JKg0RX>F&;7K$D7HHJljxm1&w#eZA}?(pE&c{6ux=lCnR zBJx7S3?WHKN~&jskEQr#ap%F8_vO!f-XP~e@~mpB7XQ>!S{(ltIJXV|x4vWYNn40k zeF&qXY}W2?KbAa)ijb@9I*6;H6=!v0#EpzhBkFt+OuFMbTHCO@22t96W@4vfqK%9m zzj*UP;`gj$R?UZtc(M2^TYv2NZz@H<`RwrfH^Sj(UC5NyMB!@hddykgcVVyour8dw z-_q3Uvw`qkewZ91m9*G4_$S(L|DW18ev7GU#JKXq)(o_~u&{>a$)o@fXZN;E4cqJ5cq$BIT2sFQz zyy~dl&sJ}v`>4|Gd7NLRB$(_^)!rp3jN?y>dlpSA@tW6jzKGXprjhw{^Qp1?!t%{qf`9+8CT~1A0wNLN+mPRw_pDhnq)*7>^RZYX!2$mt zA1Udd5?%h(xy-AYxm#W^i%2Lu__e5OaQENp^X$b&q~wGj8R?SpoMmX1gv%QQF7>#h zZoMe|&72&R6fSb8Xx|!k%6(^bb=95fjYI;j)rGeCvT~ZF;S@rVLC(7kQ7SO_TRb$G z=19SX&mTEwK0zP~eW}fW!p~)dm9e+gd^pB=t9%roO++3=en<#~Z{jO3a@zF$$Lhik z?`uLrOi57hsQWoa#cb%-_lrPV-wX|q78(lL;BoG=z^tgw3kGUgo6nuyw6O2E2xDG& z0hbZA$8~9$nVH~@=MRS{vfjV%ssUr4YXFgzNgd<{Ka*t0jJRzJA`=tdsUx(eV5hPb z0T+$On3}%pdT{@~_u?5W2p>auI_8_yg;0*Kt}R&tAL_--@>C<#JplflMOsO%-cDZS zSH;Wc=4wBlj3a0}=v?_6pOE#(LVli#&ax*RYJKeS=&f7AE7k7zIE`SA87iF;Nq_d% zI@lxVWVb1GExVU29Zaj_u3VR8&D`)9UF)9kn)!zEq;1p7HRRZD_oaNhDS~eWES5H7 zI4x!}Pc(mVBt!l|cmKrb+?-&^btC9P!6cZFj=I;6kM|4bf0<0(p0UCkWEY)LF(b>* z@FBbD;;o6FKC?GpOs^|F=~41c%g&0kfH%!!khw$tW^%1KldYSEn>F_Qzd`D_Ho#+% z+dG&IIbb>5pE!&I7#;PoIu%BifbZ5(DX?$!CcNboY4oTxD`3~xtGC40r2}Hfi-!kW z%>#7lMF3g>E_MC`TJr$`&h>V#KaWDid6>b0DFa3Wl1x`q8zmmJB~fdzSgaKSR1BPw zqt2HNd`H(1*o-O~M^+Kl)6ww;Kq_gztfFGYb2D&r!Dt6aQ%up&1Ayz2_VKyK!7A2$ zV`I}I3BX|3h5&*@Nus!znCGA+LNqj4dK-3Fb7%%|6=@~)4^O*hEiXwgaY%7VuAb*;~scDIf4(h(AFy0)_0AcVS~< zj>?rt#fczeOzl?+{3#ST0Nm?gwR(%{CfLQ6e5K&*bI!^iT{hSH-iVp}E^6`0oOmDb z9m|&fa(+qa+Bd3Z6S0GYEau7Z8`vb_44)qBn-V;<`G zXx``&FD&zJdl)3=s;&@rQN);BB6S2ntAOvI&>r5QvPl%&a|)ZVkypdONAE%xYp59g zJxm@cR$1^X>y6~6;cQ}^8F5p*wX@7&;Q`X6T1u5e-hPj&nJ{$h%>Fai@ndF7U`Qwr zt^*zqB$=DkPn zKAvl9N~T#?52e)V4MVnk0rpat1a)}W9wFI3JhOUb5My7bkmUT0J{%YrnDgPo9VC5L z<4{==U=J;jt2rii2dhU98pHu=f2B4mr6N^XC}lPRttTQV&Rh;)m2FY?A2Vy4l7a#rNR*N!B>UU#_=vvUYcMK8Ayump_xc+X6V1L+l$h2n41UNPA3z8C4P*bOi{fwx%zI$;?mPx%yZ)>u>()ieDgAA_zOE}ZF!V= zj_h*zjx_hdQ$^~Ap^ffa@fR#Ab6BmB1P&AU&bcD0ti25##ycKBySZV(%0{-UQ*h-G@zPnwY>nj&F8(R0 zCF1Y)D#4X`|Ag)D;x!Jkek3D;_m~N`ek1VtzH?wiw+Rwu2^-4*5D(plK>$Y3mi}}+ zpUB@@{*z1(+er4sLvI9qIZ5AuNdb})*^&CErLO$`dNrBQ;I;3GU45L={{qvV;^uOEd;@Cqeyg5sBxsKE&PmV(8|dv{H9y%D`n9_nkv?hpoH zzw3<$C{m8aY)0UB&X?E6E5w|?>UUbYyMP}x`y*r}GmJ_SF%3^A`%dVVDS~wejOK3J z*9=<(+cg@ETQtqaiMaU;8at=VaBtkP<*69Glu8hm@u&qItZBXy!t5)+GQZ3%h=B1X zJtd`#H^yEBW9u@Jw2B3byb$6{gu8WIipFuXz%Xf8SOe zmQR-9KRkd2aryrZir=gpVZk?z;0OU~&r^)eU|~HnMb-^{zL4Y|w)j=~%#ZendMV*w zoh86GS2ca|lIiqJFK-AM2v)1xt$FPZ(GZxK@JYTI?hLck%Upy zzKPnj&5M0iExp+c7_mD*SnHt9jXsxysfWh zI3pxgcR!Wp3qM}R7u=zjKaKtPxM`89?C)j6v+1$wp(wb^&$~bPXterrk7aeS-o*Fe zr453#JnwLsOEr0e>WB4jQ&MnkU9B(wUZRGFC~cyBq|4l`)iNx-+l|K2(1D#anc;T9_}?Z!H(3V{v6mIp4XakFM^?s|>4 zSGg5pWaw$al#_N&eHYopPGsgz3;{Zx?vp*%ByqARJj7f6G0yzu1RHqWu;hmv2rooy z3Neq(vZ?V(Xin|*qC|dN`~@_4S)XahJk;0Mc5)Iq;zhP|JWUh0u?}h|yDB7P1Nsu7 zl6Jz0GlVPi-MblyE37(?9zFV54hW7=xhF$Y#^sV;W<=3A_mOo%C5_u>j~lx zEzXxqTI_l<8I`nGu9E-thofy2CQDQsrOYiQsqAw9>2gmyHi^=r98s=FFGJcoOL7E) zxoI3;jhOu=BV6qQkRUF}HuCTDf{Y@zIv2mv7#nWZTd=j>bXOVjXgH1^ZbSX7&u~NN znm}|g4V>o9!w`e&9M;Yc&s`+@fA=%nt3&vjSxT3_q(bA@*ip5oOPg!@zJQkC5cXN` zQ-aNym&g?nAc*?;w|iQ8 z8}-6~{A`%jBy$obo|=$=hR&2Ye00zYO4ac`t)nIo>rX+M8^IwuP~cF$aTdw5+m?T@ zvXiBA(L^bBDrd$t8SE#}DSVw`ne)&IeXdiZ@r3J}7hWIB1zi)qOVNvR!XM4+QN0~( z>M>I=8Hgn=YE;ZF)j$$BgYVBLec$r<6>F`-ay5T4*^6W3#r5Ekqf7$*r`6-4lSn_b zN=t+GIdAIJ9VT2U;{0BIiEvv6<@G;=N^sV(?;{Aa?FtWSy7MgI7JO%IW?p#4%zwc@ zEiCI_ZIY&K-zDnWViHAmF=7>qKB>6@vct$tSu35w5;8^6dHQeeNx zMhJF18nT7rVhk!%8HEnflo1SYX@Y^E_<>jSU;e&% z<@~QACq}nFes5pO*v9)a-q38Y9iIv)LgKvdqQ%H2P6JtX&^g&xe5^C}+m%p{uYKNH z_ipPn!E6tG4h8uoT))1))vc5ni}2$iKqo3YY5|*Am;fy@>q$~AG)(>8A_?x|VI>Y( zzt_1U^`cB!&3q>+b^47r5qc@AoF2P1?ZeO=jI31)v%lP#Qm*EoG5MU@^MI#)q$T9{ zEb)2>;y<%=CW*A@>Yqg)mdRv1Y4Td<0!R@KNq8Ab@XG9T zT4SfweWK^#wy*)<;aebacs!c9X-wwYsBZTp!V-m!2a_i=?>i@V%LW_?P=TgR3GOm^ zdbpe|kwP~_j~2~l)(RvdR7W{b8aw@%F{uo#u^sJWWPr92yy9=g$m%)aj)VInQ+uv2 zanOv9xV<3>9l*FvO)qqRuKv8zocCx+ZOIP*w7mD9-YdR`y<|8~)8`OB{I@zO2?EL- zn^lWxrF1GvW$+PaxdZATVI}|TN(0~x@BLo_k0Z-trdQ%0i6!0`PEwU0fVIr~>x~;l zs{>;8t9|*-^&tiHw751zlP<&4j4_#nrh2=94ZRw8PRy`LissZ5HLj6Vbd*``3fJz_ zUKg59m+&j5I~kX2jogsg@AZnPUEnhdvxy4g2P|VNFN8Ga{5}YRt47tTwc8u!#tEdV z$pscU(IZ%Xv9j48h}SC!TP7_!8GpY3r2AmQCn^SVV72c+HtVVa5C-i*Bj%~pgxa1x zPHrKe$U)5Eo;`* z?xsD6nab?G3ZKQQtT;57--8#wCnN@@`Vs&5Y`(+3>s{fd&n^Nea`(laG7h&KA+QxT zqEbD+-bQ6^323}e{NgyUdf_}s0sQ4Wr!?UOuEQJ$N*HrtLT%d5XDNZF&kgyUhs*1KlPY}ry<0jLS`kg6mg62?9&+YF7;{xv z(8^4;+2OVM-QNneypdq8mkACSPx~$6jQd^U4EQ9oiyW`Br(IKFVT)gd9bfRs;D<1ui)~o#mTg_xsZW&OQ zUz|AeQ!gkxb7a98dW(5LZoSH-X$t0xNbAM<3~OAN}}!C74=VGi#+j}fHMaH zc>psiQ0?$rUw>eww4Aaj3T<#7Z1&Q`zOzI#s8-(g2o%eP4E+?)E#EZclzsT+{rkFe z=#RpqAM_lG-ze0QzA0meM8RA=}xMKrx&#_{req@cwu&uJ}H#`R6 z68*`Dh&+{yNre&N!JPa&HuGF?9H0cqv@{EC)BrfLn@KxnsFW3ddgxWUD&zC}y!W@A z5V-*_W|UFm_jSYbI~#6xH_Wn_(Q_<`K2IdcEx2olec8$!diy3ae)c`22TO^F7F7 ztXI_*O(k8GBYXoIcRzjGgC57oVe<5Gxq~UX$p*$|ZHx~GZ|)7rC(SZ`0CGtgKwM;= z5ghjRamdDixeZqEhjRjFVJ#6d|GDAuI)ix&Um_69ligp#;fO*njn>W!mLMoN@*rGE z5U`5DsT5Ol4NoggFC*fpAp17Tc*+BmC#HqUA z<|lPy=(Z^42JF04z{aL8c|ik~1%MqB?{dj9NtC1-Ub=<%PUF_NvCfr=9G_<2koE0Y z9&l%I{KFw)nsP;(RR7DCdrwL5?(^1yCeK&a#eSR1U9N5rRE8fBG{p*Q*m+*!wXgPF zHVsBIIaI`LOHL*Sgm9tIC)+q!Gg#%BUG^^Lli;nF<3XN0-&QTFf*cEKAxXuHeaX|H z&nbv!tH-BV^dKA~teIm(y!tRtib|Or<+~D`m%gxKf{*sKR;xvy^K6#i`->3M)_ob= zvpZNO5o)VCELG2;4YW`C?|#U47BChR-h4@xul9J#x^o3LQ>PNMY%*7J?Aw|jRTlpY zYdX2(tRAl>8Kl;6WcvVXrKjjT--)@vMx(dg)cEb!0UgvSP|%TA3)vZUOwDyvk$tEh zr)y4v*P~v|vLV9Oc&{~3mCUGgt2WGR+;|t@TH%)2U%b^(H`XtozCW#ZB%-KpIKMQh8~(WhUN=S~ZuSBGrL#J-ygEmJ5Re`*xX5 z@vA(H1}@^Ui~W^oC;23K$F?^x`=%R?ND48%F7I%mza8{GYf#*Huz^j2RpMRsAtnj%t6?!DQC=bFTR7d=U4_V z47u6>C_s0<4M&#=Zl!oa)k#nVP$0M{hp^h9Xba}I-FJNkybzjW4AG1Wdb5mZh=vjs z=&$)jZ5bEV7BTJtif29=5ne^``U&fly5+C$eORjw2Gmfa9)cj`Rl1-Dutt!%KovYd zqTb#gw2Tap9yCZ&0@doS-G7e@Ec<2 z*WyJPT@d3d_t260QmsZ5sLCUiGR~Aokt+!~cQxk!)H`{`4EeZgGdV7beT@%Okx7b> zWhE-XqFYoo{0(=R-YaAlmBmXUUJCzBOC?hl994577JJj+Jew_UPHUmOYzAY@Bxh9$ z7VW1a^KXDP17@xnY&{1R6$vYEjX)E@=}!Juh`{rS0}Qx=&nf!0eGHn)VIzT%BzObl zdU+~jEmREQvz9$mH}Z23|BBI~HdxNb7=On6A{{+>DzO^S#i~U(C$2Do3Eo^eJ3Ad_ z+s_l>7KzzWnv@7d)m&F_s*}(FyI>&iZ8^L}cpfT5s%R@cb_DX1W$Jw2V{m5kpKvq#^$PBjx*# zkxPOc23vB#Z8-qQ`Q%QLbU^xY$YHCj+76yrxr37vSR!*yE*P~#!D>`BZk5N5SO@`I zu9ov=8Pg!>v?ptucR|uvPUptMv_AnJ_R8_0;}a#x1lFHUnb{=E-Tj!E_2i1tGg1wcvQ~?Bd;x*HG%q?}fgxF~>!j&ri6f}k zw51RlB38~YWB7^q0ai8`N(JBEk0z=m4j|V?Coy`Uz`_1muIfC}q%ojSK;KdthvDOW zEA^Em>n37lh%l#*s(^q+f{2lB3r?-ZZvfPgakwOH^$L~Jwski38+D7#9p}Io=1YQI zXASnp_~4=ADHeIenT550CtQPokMbFOfdGMTC{XBW8U+OsqpWLK`A@r5xT z3s(ac*(C7q@$ekvP*u%XdM0J1s>i5i?wH<=Q_Vc??h|49&V$AH?%RIOOtR78@zDjT zWnz~{DzQK=WixVM=n^c?euMMs%w5tm8cujl2A(N;_(@{p1nx2D&*^*LwEX(K$ZCC) z=RwsiTa*;lGiCBsj!vlrxhqbF(%ggL$3xA6og6Md5Q+jxoP3%%V=>+>t=2yo0p&H> zWvZ3-pE^N=eLrKp!pe4z_g%x>DJG88*anR=n9#kfiLZD!JN75Tx)nU4X|=sj2m`^eCt`-sIh`KIt=k4`R}?LSu!iiaLEb}#ES;Z-(zxdR+X3f8x-qZ#~sPLh-~7l6aczZ)EpB%v0-DT z>3(yN<)e^N(k==I-kaMCBgbLAo<-)%0kHf<#mm` zFUQXDz~c}2$kPgAJ|B2l&YyXeW;Hgu$ zz>ggNVi)u$uDc0=)iRZFgDRoBdSOEizMBo0@r5S<7V%V@*M+?uRq0GCk2; z0heTwSOi&rDruRxzHgP9A4ks$m}_jf8BY;k;KzcRGNP6Bj8lB!iEF)i_0%=?yxKJT zpk#egX-m^LR(Tkfz&9wVU3}>Ioo7j9iURLDQeMIeesC@wC6X)%Un%?Y>Uwy z1?k~c;dQPs5w2po`F#Rputa@rEwJAx$gZi}2FB0Y!I&Y}$ z%XDA-;p8n7W`!O6l_}2@*};XXK(XvBz3|4(D*%Zs`Nsf9!|~=`z296+tF`PhV1K^R@cT*95)(9b6mxmh0i$ zwSqE@@~{5Iou?m65Pu22Q?%<$!91}YLAV&)VUCV|+dalFqAd3vLze46sN({$u> zu#){GDP>zN{-Tsq2Hg)Uu53Joy1c`x2RVEcgJqtgXgx{W1qDa`rrg@r)5ipDUkJ_^ z^0PgCvN7VnimMNx`T!-s48Tn4j2O}Cj3C=g<-2qWCJpsNHv_qf`^KH(WG>R;(5{>L zix)3~bZ_6oIf=N60k+hGDe(h;k-k1`_6)8*UUA;qeu=dIeC&{7FaO^4u1}H@>hXP)S%=a%%;ul*B9vr7<>$!@b&{^YG(+$Ee8_hR#-TqOcmZxs>t?9eupoCF zGPuuTrXEDeE0SFkKbvGZZy11E_?2CAvmWB}K?u$+WU?%jl+xMoXMxgncV=NaJ|WRI z?kuH_T%~x@wR*QDaD&-j$~L?bSLHDD-09k^+3;XR^!}^@>HfE3&0Cts&U+V_OsvH= zSrQDbTPu*{^$%ZH{7uY;u8N6X$TCV9zVs%3EV$gFS@^W8-%I<>wc@G`k^11&4#?-y z1#l%;!c-l9bcPqPBu$;$asS1kU*!SBQQwO=SS-p*B$W^*K$U<(a0We*l!tw{1{_cH zr}SvNIe#Q+2Mhd1kA7$GCW0RGZoIjs}|-{zgmvX$SeIL0_Z=-1XK z_$8fg5B53ULC8}mHia@``=b8lXqfB3F;;6_RAFN0^wxvS&iP6I2Yl~_6;LuI$!}xY z%Wgqs6qw6X@GGkc#luz38j`q_Vq$E2n!g%)?8)BxuITnmobk$#Zeok7?3teNs*B6V z&6R$s@Q3O;U5iK|8?;b#eg(Qahbth>7Wek*l>KLK@toJ(Tg?>Sf|);*gm71J!?eWC zWpKZ|gkQuTe7Ubn9+GTfDM(i`#%U+7EZu0}YlkHFs}q6_3N}9RU;909XA~%tm&cPKbett-! zf5PB-&{mn+zgYk;y_F4l@_V~|4$|Os;a1kcpef{ zF&yIFU$i}Xe_QzCWeB;inm@;5Q1&Nv#f_|xAGYA)ru-`AW}tU@kip-H9{OK>GL?u> zud|twa&q*`RiL}KO?^2F3JP8Ur0=2egWjr}T_u^0<=6#rhTf`Lc5Ts+y7PLg(6+;a z3pYI6+uQX`m~ObaeVuJ$+ji4ZhuGL+u|pYObs@ql&kY2|ZEYg9%s}`WQ@o7d%dDA7 zZi-E4U-&rGD%9vf!Rqd`OWGDx;_vLwv4QuZ7X6CXu-`Rz`*{CJWJ>3L{wb3AZ z=IfI${Bjr9Pf&{hc(_|sMA2mGJm`7WDo1ojeD}q(u0g@as}|UFJ$-n+O#^4<<%gWG zy`wjO?PkFk&)@cPuY8bA8mV4#(Y?!S71uLn&2-*#?+#eZ6~`){{lc4<1P^zTTs{+T zocmceDelWEt!?#Xhzys`(AD3bJZqX-ug;x6b{KnK&jJ+v;)hjUZ3BmRb%aC6o)H;{ zv~n^#-(m`vc*E-j1K3J~m*O5waJ2YRCfaSLo=%A^`$OfgT$&AN4qs-BzMN>>Ox0J7 zkfBC()cihWt7lHbmwiJ>l{AguYfA`vo!9$0REP5QSnGWY#7R$g9nv=L{1s%gVx;#zw|{)A6)o+q_}oYbkftI6k9{lQdJGacG#H`Fk{G zxmByDF%C@+vP;wXRN!5}{f&ftYh!(}8a@;epYYhCG}f^3D4p%L1*JLH-z+{6qbRC1 zc!IIGpbDyf^M-@}?x)Vk*^KI9k3^fp9CmX%12@RkAL$rz7aGp8DJud={*WzO5L@2e zK^?1I85iJKCaoq@wP2a2+apj+tDCywE5tJ%cEj}2+9yL?10zZm|D9SDhcsPaTIJ(Z z%yCe39<0?fUx3W#y+b84A;2t;`aSuXx)0YTvI5+jjcu(8YUdALxTJ^rD<}SloGNmq%hM;!>@#M7W|uk1Umt&Q zz`nElZ@1_YH82q%l6vbKr+`!caohC#9~bzDAP|xRsI~bxu2~Xi@O{%;$E@}=?hp>J zP^$N4pRA%Npv|#y{{&=!EuRwn7S92{$4eQm>Wk=nhBp|2j{8ZUxY;?obn{?!ey1xf zMbGr7oTyMOG@k^es#N!+kU&zSamj7I7N|0=((Zemb!8WlVXSST{o*Urm+C#ge0U1j zVQ3l?q=T&FBn8aF3LBPNYe7xnDBBo(ZQI{$m`HfNgBy+Q_z13FUFx6BC+c_xY>{TZ zya=#HjtgMxW6S+=j(sXUAsDcRhIcG4K!OIPbOJMS@WB!3KFIir6*YkuQo+_j^)>qBCNqQ8X zUF$Y>X*XtFV7qyL@A`@5 zd-C&5?NW`YKN};c-tT4D{eX=%zoYUd7KTU?=7mnn3&0vcJ;SEY;*1c<|GD}h{u4w+ zyWN;hfa}_7U?eOl4eM0VHmnoYUu9%->A_mfWjjHZ3Q1A9!u=x?FtWa-|OWct|UC>pU+jP`AC z#_d_s^&-Ha`cC0%S9IWaA=We$%ok0x$beY+H1H5Y550t_Vr>vNc^q{Nej`~XWosVN z5K@}qMzZ0@EBIl+QS5G~G40N?@b=sJp+5$=XR5dUB;a;Pds8>g6B;!q;5M^|Y*?){ z(h;Z&o+Tzen%BZnQGI~F5)k~UEimban+Z!#1UD7eIg4>`yiZ7JEhXBi>QuG3owk$b z+I!88V-4iIF$kJq#+QaHpRKMu>x!y~V{Ad44}0G)=#$qg(N0$K_N~+-C&?JYmJ8g_ z%QL~=BsMatmirram`>XYPS+9LTvI{alC?Y9AGGIt|Lpq;VPrU=q+Qo6~sen-TKv$sc<%AfIv&(lY_mnX9%U@09{UdHm zso#4ctH2qUBCwo+`s{rd-HH%e{O0|U;zWEoJs*b8?_2SMhJ~E;TKR|9F4ftV+*=(n z%vh_SmTzH^@y(zo?CNMnQ{`{F2z5ronX9W&U%wovjhnCyxkLIcnQ25_h|L zz~RsTO)=8`qkf1xBUYH?pu9Opei!=nUf!8-70u$_70H3hb#V?WR}93oZf7W@e#B{! zO?sx%+@#1YfK63NGw@q^pJOJ$-YkB&PD>!JO{GW~Q`0jDsMJluO8c1VH}DQ534d`` zO**BegSyU^yiuXF5e1uLzg%R;C5g&;{wykZO)Svv%{BT^c}R4A?>1#&k$S}D7uh}$ zTL*gVcdw}5(08~9e%Gab#%A}uwiEcvQxsDWvG*f~Kpy=ZvGOC-{Os?Ms0i7#suFyI zpLG4KjGg0=`^%xHB(dRNCmi0?o{{k*m;;74+a`#kD%`ma}^l&2iko^})mD7&JnI~?C1Mg;b^ za$8OR*lbRLSu%+Yf~zemsIlBlDiS-u+Bjr|rtiEkPBYXH)!0%6tr2~c2HK?+cGe~! z?LKOGttw6pgi=X~)jNo+AbkOOzm2e(qo}9r=)_F$;=$4z0pyi^Pp$f1!hr{eyqpMr z`5{B3>vu9@SIGN*I^|A#O;u_N?`^!}>}el>SZrWs2*RP-zji^EJU9#fch&zYj%JkJ zJ>9}jl#mByZpTqGj+fJ3*d@J?=B|OYOU6VlEXl*zRTjr}xvG@t27B(}DUt#T=z?O^ z+w3q?(4~KFwME1msOveN=@buH7-_1A@^2$-=;RUJVu`u(+n0&ja)#S|=*Po{duI+0 z187@>c__RB&fYvB>FrLC9A!_7P#vxBT^Z`Z`@$QY)w7Kq+A^2Uv&2bq`PtBpg>7;c zJoj{JC9OQfO&56>H}x#RcdwV^j8^sThM%LkdQw@#OK`~7e<=1RN#sE(0pfOwJap1p zdv;LQ+xtoVx^wNu47AL#i(;BBTIbdXN?#TNjI99GHj&#zHDXS|WXY0TdDC_ILt*v9 z4F8B`TcHQOr|~()fu@XwlKMQ9-Yt_o9uEVCFoYgweGtUXs_vt@$^5M6p-STB-Sd*{ zOZPh!Hw?padfWtqX3yeng9DAwj8{#R0F0C=`fu=?>^}+sKoswa<;)Yt)7s=vtu5+> z+;$Dt?qG0O5e4MP${X~2BRA*Qe57ivRW)b`nkMSrRzW%2LGSWedqM`vQ!~`|py>hY zp0Ff(q`e!S>Kb$y*zbiLrcpYoCb>_5Q=2<+plaK8fH08rv3%{j|3aL|J7cT|-{|WZ zNg~fXj|T`B|3FRlJtQ$t3r_!l5x|^K^(blirZ?C+CJ~5F+!dyv>8eT64a?+WBXhwB z0ke)+U#pz*VU3*pqSRu`_rlueE{($)LIz)qfgDj=0qjD=uhtm!8)1Z7eXiN{~6j?qhEFu<JrOd>FKWlKkY`0%$FMuQZ#5;;kuMw!?e5ZXvPw1so}Xy8xC-;9 zws{5c%%{ZBy2G?eIk~a`8f2|W9eY9h4-NWn1B7p%e+4Aj{zeO9o4g9U>hSzyfrIb( zN!XdNY*j(+$yp6+J7TzF-(*ktWcSsQP@jfVJVIM7yyYT$SATkFwd@Fv#(J5h&0@5L zf3{T>g1hC(tHiD2Uz66TK-}dtJ-*nxvMks01vR1))<6aRcS4i@JD~tcAIR_x8SeQWQ$#W9%wXqAsFB2frl(w6AYs` ze*8FxWIENIg2ea=B@Asx{m&Yo?}RAl$V*sb7)G(<#(WL_<;U@^J(r4+>k-vp_XK6^ zCqcBVA51TvXkWMefY`jL-pXnX^$b_2NJ44D$rru~k?B!oPpm2{LacD|x8X)>=uZdk z^tf9z9OgY>&3DZ!5)Mj_7dSRCm=;wE6Uu&BLxdhg_tU?|fdzCax;HQ(D}@s=9hz`o z{A2|Tc=W6+#FHy+fct;a8l4(ge>Xa>z-j$ap_Af6^(Q0j5gA#~dPq^QQGPK6uHF=r z>?yP*%5eMht~6&vARy5BJii9|tsq3rc9N#26=?cc1kRT;cK9nQ)=D7n$;y}ScRaWN zJ&o5Ve#ZLh3MAENId4!Vo%LRhZ3naOV3lb!Qj-Yr8!31KGPAzQPYKe(WQB(9IG{8e z(&OnuCa>k%8~ry1R=?J4Qpr#_(usPt_!goV^i3T zmm?Brlac4h#x>7wVmA+bz}xtvc2CDbSyG&VfdhpE&S?ujyN4>Qx;(s^YZv_|OokF~ zTWS+Cp9{JN)4Ke=5!N-Orr6zNxS5h&n$D+2HHh zXM}W>zD`ttFhU6qk&cIU9FY4P5uo;<+QB>lo+qySJ0iaqr&&z4vfqc!g|$7xHwRM5 zld3a~&}iz>YS+w`+zBZwP+ZWzXpHh7)>V&WOIyz~290x2@rC5{P?0eeD#IQ zBnRL6I|g#t|dG&C#=KJ2veUXkO^L#AK@LjF;$P{dTxubD;J>i^EMXD8T<#M0p|$ScJ9d zgmfpQJw9%V#`o0j56TH{R-e1U)zwd*eYyoNg-lwnuV^%bh<1ylxnomu?7s9ti{!%@ zTfaxtEHX74);LJ==EBI50tcx*rbb60)=ngSBUz*l33GAhSJ~C?R$lPsqM|9$*VEj7 zXM?=AM(giDm-v)69vadF`P{s~z~ZB-3b z-=&ft;5di2dX1L!IyFMm2=sPnjF$DdEif`#+w4z(B7WapT8+TN66#RnriZ%f0W|9Abc?Ki8%$?p5G#6l_E;#roZ-+`BS<+Rm>HF8*C`(EWM!EE zBQnuh3gPWL{xu>az-cZx_AZ)ebCT%NukA{8h1-_kz|iBVre8OZ<`0Iq@lcR1YUIEg zewl&zhl(KO`-{@jtkmhh62_hXrp@umBxExAWNba9=Iw^fAIF946U>|-mtsNZsy$$e zFF+4^GhVAd%cq2iiugU^-;$|v8=jOrDEcQ6_fXa*5f136pM1GPb2CJM0^<1T3V9Md zBO=r8Sk@HmO`6Cx7nDB5l?B?o6b?XoMx?v;x0%kl3MW?22Ieq1XW0$w0E@>!qBip> z=S>%oA_eYcFebvGal1dyCYxMrF6bLhJLp4G^@nl`_sW%1fdMdCHDz0<3brBC95-5t z_oKu2x~CyB5^v%XjMb}!qirh@U<%VeUl>T8H{?6UI1EpAM9=)l@cxxZX#bT+HHeix zHVCMT%tqAG>5wB3XAzW%Cp7X9%=Z3Fuyh zDTX@*(^KYZx(%92iRRF;c=f60{6qUBvW-POdF4gY{-JNB_iQ;RIi{YtJeIwrkR0BT z9OWXdnF$OycFy8OK9#v#b{*x8{3Qou$(b;+IBnmrl|59{R(>0vBd8@n!}Tjbb~;4+ zI4{tB7p_dxEu>9Rhr-pS0fZ;RJc$fxZwsi3{~B+If&~|S6lUQqM@uzV0<2^0JLlY z0fRWB2ySXn{WFG?oX2t8MS9_NUjhefx1VzCc#z3n24v9vHp@n$Q2+4msgLKl#j1SQ z7!V7gTq?2<>fF&V65NrkRNBuPOw@m4_e3jd&YqE-$(ln;19ah-wUZQo)J_`@yH>6A zi+BfJ3o#WsBTGCL4tecuqq_d2qd(J<(1J+ zmcG%R7&Q*wh*?j|))Yh%q+wQ~`kRBeq^OY~_B1ayO{3F~BJb4a1N2AQ9hSiDyW-svw*Ax+IHb8m` zh79MT6TVoZreQZmIow-lGf%nLs_0iC$@p*`D13Dva2{^2X*y<-NfRRXz8FpeBaZ>9 zXkJgkw3M_ov`T!vJQ0{2z5*PX?N{8{6cL`86KJv5+cw^S8O~!9x;&wVJEmy@#NiwU zT`h2clFkq+sjB+(?=}p_Snr^0D%`nLGxSdp%E!Y!0rqMKpf){~t-MA1XAp6Sw+VR+ z9Hwb{(`$fSmfwRnE8J*v#~QZV`z>N(eQ5<~0^y#{xtBh6!swD-UEc>Zoov>sVPsCd z2B2|HYEbTDILbFg1us#i%ZrlE{V!+(wX1X-=fb`@zWrIe%QS&6B@Azma9GR+`At8# zkP<7?{x0egmgvmDVLeFfuJyVIG?hKSS2#}|LF`4D&be(A<29yDNxHt90YSK2EriQQ zemeub7UZR1KW*@jo!}lM<9v*WEY09O!smF@m|i`(cKU?GSuhAWami{jwE5>;39Y7e zDn?j2e5YIDDJt&WBXrW24ju-pt&g!`Z=dLznCHqKcFK0@U=F8jV*9QSO~S0tOSj&1 z_0Zf9)m-K=AO__?or3EVV~JJud(F&Sjw92xg9b{x)40c>f5!(vr39oohm*rm`vZ0K zemNE$3w=q(iyfnr=(FY8BM94c4P&*7`D-%l!Ppp2eBnv$^ zrR1U+Lbqyd_3SS3TxJ_qX)dxSnI%o$)UFo)UGm{+xPTF5AKQwZHjdjWHOGr*&EB2! z2|E*LoWO0lh1rn^&Bppm23R?U#i;H}7M5{0{T$*B4>4*!>4Gd|5sMI=o&b`c)}9Wb z@Z}#bJvgjsyx3lM4uUSt`GoK~``V|qgK_H|ZR+=jx~w{jiisMjrkCudDWf7*g(d^S z23NK_N8BiQzweTEZbn^}&A!JB5e^Q5I~h(~GfdCQldW(Y0;DM?A3GajLX&Qb`Up#% z8XRsJXX~_6RFliPu;UW9lPRLapvup8?U@(R`(6SjIEa;J|1OyAz%=qeef~qoui}og zo`1wfzvn8J0 zhQl9#or5Z}n>MW-5Zf8)HQ89tO>;`<UUFjDhvu>v<9;bwb0z@!Y2Qx?1~Q z6(F$_BOgx2`}s~){ciBuD#CNnxG(^@Z{u}H3fSVHfB5jBPX&!b-=r@&2#~avN#wxj z7dQ-+(rfl=G!L;F11vf?TD{h{EqI3A*N3vJJ=4wH$90_ZR{$-2)ws*_g%jrbEw)uH zQZl@HA^CWg7Ap_Bl1Ye92aj+9L1#Riy7VB~=` zbK~+x$P08&c_7Rw1j5LSJmSOpi(7*~eSEH#tN>5qzWnVn(r7BM_cHObo`~|L7Ud z$?Je<-oqkC@^c$BGH6LnwqSEtvf87xsvDvzj#1d0CMDn@co!2wdqrj^1!{<4tp_>|X_ry22q<^K-yOL)Y1O5Y(g8nNsG`a5JWvevhOnmU5P#v< z!{~CVY9h#ryId&7Pe7OJ>C)aU>WW5hECyPwDs^VF$#H(U6x#kUgBA3Upr6M`hb4ib z>w%tP>({Y*yW~zUeXNV>@2+DJ2_ABgrG~m z?;tcqWj$fgSf_bk&~__R9g$>Aw`N=yPU|G-ixIw7_wS9lqO4eW^&r{7eZaJxwJI zJAf`dX1&?2ioNtXzYq=(uW(-U$AX0mjIoEq3GKqm?RaD21zHGgtb1(7tV(4K65cZx zmEGmz`*7Vvc%knez zv+QDG#n;TaVFJ!WrxP}PL}RW_$OD=5=8I#@=3;s=l|eOW$QJu)10W0P7hOo}^P*T)(+&pzk#`pcDx6$b5w1s;Yt9Wl^mK z{MsavztrK$KDEiDLt1grHiRITamb~zBd>_Hu;t%L_q`I+s;2K$J zd*xR^oS&rD$TmjPCo2LIw z_{%&PB}7|3Z6(oab^%W=mIKgckubQM=Ggm?00)Fb=<{6G08VKnpntoXX!1WQLAlI; z5e^o_kSmd2SzTY>$ZN!p_V6$>1XRw+S9M<+aO-V$&T*OtzXlj2j++35wrvt2e7!EO z1KGMz27|YHa*Hn85^CxZM>Uy44g$*zqFjp!2 zyyZ_fwz%SmEFQppBbj$+NjhP3ce+L%fo;M!{lZO;&y6vl(-MTYSq&(Y?zQ8|=OrNA z$SQj;Y0yP?hpnKz?FJypG*gkx{fyWgDa8(qss{H{f)UC2fSlUXf#@@;L}ejyXy?Q1 z*tV#_Z-S4QV8esZ$9k=$Y%m>r~x?mC9)d@YY4ppG} z3Q$TKQ+Nb++{k>znmvT)lyZ!ih*tBQCzHWODcek)l21<{XrF-uAseystGD3)Ci}RE z6;F&uDCIV(AMem@j)A)o#2=kp@*HRF%HDRX{oD`fd_G?d!9y-jxfr zSLFFl@$@mYBL_mwDW+dw#IoIK8NA0(4igzs=!r^pY%;NFcUFb~C6j;1fKsJKew7QI zmh>B&%2*P<>Y0pk{LTxu+)xMV=4{iTid4mBeJZVkRoBikc9 z=Q|+db>mi~cjCV>tq@lupMLlykq3igNTnpBY{r=W&}77C9|llBZD@59T6V=NvpbAC z7X4Xo_TVzgt`W`kL?&36?IqN%E;jLP?{AJhrCAR3=~El63gFRR9+=bijJHPtW<>QB zzbaFF{)`9MCc+gpRmCJGIm6;>nE!Wp^$B97{qy}vZuvi%JIPumELl~>B8is7V+eWB z<0~#U3`WX}O}dr?MjZIbxTvr5^TTm+WQ-^bG{>I)nQS8dKWNV_%X1XfWBsL0RZ8%~XC8fKSqF;mF ziQkAuclNgrcUB8ca^hvLv&VGLMDyLJT`Fxya2XitvWbMDSvv!s0aL> z$eNJMj^>4{zvLKUToOKYscv)YdGyC&M zNjas&Vk+^TqkwBev=qJF_lbeXXWxyL^X=u&icQ98hlMoolwRQv=9^WNK!AVYigC13X(1CJ5ZO0|p3 zDt)@t20PT)oKi8>la~#*gC0vLhvt=J+8-;0@!6MRGqO!n%LE>=Qxm42{}SL>?G=S0 zpC^YlKd@f>$zf{Bw7ud4+u*YJFFB?vk zyFftoHA_MSghE1SZLvryo?%mJVMHZ!K&WTKf zZ-l#%;oBf~EB$Vd8>LM%5M{A=@4|+zvZytu@mZ&#w};TP19MCG(RWk7zFA-l@=rx> zsopL``!R08=d}8TP(7I)@5xGCfhhz;c=8?q5!byEA$Jd?1D}+TmhbnO$D=kU!c{-U zs%O@}AP*K6m;M|D4S=J|!-0U5+bwlEMbxn*0S-O}ns@54Jj4G33R;2CssQ&Qk=V1` z^x6Vlra*DObh;h;%H_Uyhmo4tZQRCXZ5l##&oSfrL`)YSSMDT)Rg@%zYX**GRv8Mi z5z2S{!dd+t#?^Bwf1aO$9LL~LW{YUp7o>d-P_ja1YM?A^WYoeqlJBg&>g!ArE{DYj z!8w{UI+In7ukTjg4QVgqbo_PDV3kq(&-fDnF5w~|&EH%9&x1IHo9N$0(`9uC02i#C zmt|~mD1kpT_p#hEyO-28FlTJgZHiWNu3VA5v84pr=}0WtgIvb|4}>Ns`qV z6YdmpE@N!O?=L;@&Bl`7h6~qO=<^kKK@%1MAgygeLiv*-NkFk57;sbqnqDn-?Z)aj z#E?-A-cW_r|L{&l$wB~lx%a>6j}s9xu9utaQ-`B$kgNS9rqcLW*s!59RIpW57t0;z}oo*}|L%KfHdtz=S*)_&56S&(`h;A835Wp%L&IgGg2bM%5AZN^#$O`I77g zIA=_J`33Ad#fL|<0ikRue~BG`c7?5(m)y<_NKQN_v{0bH*_P zuHLPr50g8tl|O84+P#!(efGeQT=bLQTXYO*^jB0=xDW0d z7FF#wmwub~PGvt#ayQ7oVE%z>Enft!A?^zmzR6LYcSY^R}2|@%25++ zXJ~etm`!?A>_kkTk9#cK2%e6PZ|DZZeqSEWsJP8W$-UJp9vozD&cWEknY3zWZEYCR z#Wv6m^`kavE4TJp-WmRx=8JU4*mb|WuG&QB)T>o@7bY0`B!s*qzHmU8ZEG=rFD=cu z45=OUQsuS7k!Oolr%tVrN+cZgedyCfd!BU;>Ov`Jtwr^DNQTifAvNRy;AU#UNeJkJ zCa`s|H@v(P+~-W1`UqN0zGUW%SA9EwJu>~U1ltonaBUPZxbyi|qv~${JzgKN!mEvm zuwrcjl+3OZjV%SG-0hpwtt6!^YQq)k$M!k&;~c$Sq)j<$ilKbFUK-mHdO!PmJGUx< z#kta=(&P0`M_FVbdFiU1AD`2_6m(c#>6C)B@(lkuD{st2FKd&(iS2 z#JCo_#BVqX?Y}=JR_s0$?~}=@ML~DgEd+RaLJ?fM{8Co@HkpwUDX358B%-1s6sCph zP5b5;H`tf%b(o}P!&vi=x<@{4aIc~>LE|*V{4Yvv2ByEGEVYGE{JXnzaiQj`5Jw|U|;YUw!Z z?LyVka|^nJdo3nvV+5SbRN$SOL6rv?@)XZqGGN zKi)^>{tfW3N0)~}FbP2lN=naCggmDn!|dNu0-o5NeDzo9pu8wx|DvW0LAj|{dKc?I zvr+?WR5yLfTq{{G=N(Sw=M^GZH9Pn9XqPXuFE5WC6gsuATTO8kDCdTY-EDn}J_53} z{tJ1q?;SJP>t{KYvT3D1!q}3$p!#X>=w_tt{?exNtPJ$T70iwNLR{UcWhP+j+rKx6 zpj^^OfL}5~6RC+kF9GurHqn=2c77`-nXB#-a3svSh!(2pT`8Q2f3Kt@HC2AS6Oe4t+acpU?|G8Ncd0E0C>Td~9= zS-pWEJX)10K<|~ml^4e&eQT;J1e=UUzsruaR*nd-iF*K>0*&mDld&ckP`L zO{~g)+q*I)!;=I*Q|!&LaB`})+IT<|T97@^d+w*8Q;OV;3 zv5aMXGBalJ-@ZLlttP}zfUlu6hKJ5M*WLo|)+$L3JXlF^B5zbXH=V(qkr9;`f-XxC zdxLpO7mC@8mA`9BLV{Te#%BeJst)jt98T_2vd6P*dvC5+Z$TO~ZtT$h)o=?hf!}%f z%Dj6zgL#V7o4sil$D4)yOXU1c0|@SU8AU}!wNTce0_CnSmQ3{shm9sb$%ALIh6>@&YsN=hi zo|Pb@?q%3s8K`8EeABo$Z=hN8*8Y@EMOg?^!12dDRqha<`ZqHdOl#PRU=ZAdn?o5cW#E!0p|-4)5^<-%T@ z4_Jms18RyJWWsX>_G~*>#3Pv7?KtOm@}X6tvOoC78toGn4o-Gv3;Uo@C^>4LwF5QN zRO@TdTP;Cha=%U2jJeIR;)*^QT%;}&7H&9~tKHF>;`GQP(;90KiigH;ly}@a$90R6 z_e1qU)37fd8$w|}ehdWf-?lxtc;x!?ofEJzDAC@4_Y^}r$2XL!54e88`9R84npIAo zWBta#bDnW3^)yB`lRGR6lYCr&i+4UapA3){&A6i&??yQE0)l~(gM)(`{5vagdex$` z`W$T@fI}&|`e)9#C8xBE?4WZFZwsyta$ecO@RaOYfynnNcvV9#x54i+6ANp_#5qi^ z4YcYSKdEig5kO&Fc;QI4UXfXWk1RnWvT8&@Jb^ztP@c$e#od1*6CP-%HJ1v1kJ*OL z;1;RNZR9fzM$JQ8-F3w3WiTF#Xll&<=ymk;|*QD$I&Y@^iOMHLjTMS z9LhQ9qW37h!R!Q9Ov4G-%dp3;*+E|J_?n85Xpa~bPZO<^RqgdsM9iOp!2D%PB7EPB zrqX!VRV&I(ju>G_mut3C0!Wdnpx`q+3o@_Nf3tK+G!H-X0=_T-vzc<@6Qmf5k1q=)NedK{K&og@$cvJ>D6iDtTETj!66pY0q~sJMsW*x%`Xj8KM`Gd{87FPxv%tx-; z4=eRAR|%Pbmz?!)3DlyH)C+lCc-DNh*FGTpyI*>HNp3jqmdRVs82C>a@LA&uH9;se zWXonFWACyr;nQ!Lh|ZIK`7A>o28!yww#{2MBSOofXNha0bo{AEeoQIWE0D4Z~+t zA^3~3>F0(0!D(<)A6kIgqQlx^iSSKF#n&5Zz&W;7-*WHkkRPykx2mQ}*xxIjRu4Pi z$S9QCJoTo~AWj<&aFCUVkE0_4wQi`&4^N6|W2=NUJTb4SCgT_y(|09q5m{HDvw~lJ zeulN+xJe}@(L~A~dKzUHQFxlZ@7j{4ZWo|NlGd%Tl?tu29On&|6Os;bA{hR>J!foY zH85kYQmhLTpjm+$77M)6#(wxu;)vz%NTv#52Cx=kOTi98KNyX&xO)1Jim_W*3aAd) zzQUt&G05m$iCR@@T6_>A{D8)1uG+ZuKZ|?CilCu3E5F#*S?vbxtWrOC`2ks)R${vcZ$UsH-Q- zQ!lt$AN+!Yv9o88<>Opr)~>`|gw$M-f?>wmH`*pDQpDMn3x*%T+V}@-@rCcu7))5y zV+3Ru=)X0k?Vq%gKuO%6-Z*2fSJzw-p7Plh%e-tbhXpj5==#X<@wD zlFIe-b0`?k^C$1SI6Qn>H4m1!2r;nM%6EKqCvva;&;D>!d=Gg5aP{M8 z4s`F6KiDn~ZIIQAl()t!63tFwP~VSH`w;WX3REg9tXI+?vnZ|DfjkfoRu@KNSkm%# zCH=M1Jxo;cn7oL>HKC>D&4NO{mRZpW8<(zK)8Lx)jM2#@?Xdt8w-9@o9&2?vi~4YI zfi$!_C7%m13?wAjue~16T-T&=&oH?lUJ@0nzgpLV)?rdC6%xJbC ze!hkZM#lmUPRpBP8JL!iSxWJ#9_TYyoO4=MOua#HyjCU6 zxVAP!mJzjKP&?>7=$CL)2LU_q1}MwHSFKrwu1LPqOq;dqwxU(ov`?E)ro(a8tHMtvuw0tO^U>d zoJ4#*$3()kr*6eY+s&4VdOidtrEf{G2fl@&y>S~B$?hNx^$4q8s4%=5QX#=lk!mB{ zeX3)orQ(@bw&2&sI5t|egbR6H(J=G{Rs@t9w$BL&hQ^Aui`g@Qf+LX)68y~iB>*B) z3A_P;a%N`0b+!wi@fZ8!^t?XE8t)Q9C%^p}$jYDr0+zNx`_9RSyVi_ffx&c!w|in| zOw1On=tJ+y?*YUL;D`sI5Bv<+NEapn*^Wr9%gw3xZ5$gr`)FJpb{}BhymobdsD9M5 zqKDm`ftRf}JXmq7x*Ee7XW%je2)wK0%8@fHF9rn%X98)Iwuu~WxC`)6Q=$XNa%0Aj zzo4Bepamcr!vajA@_Egiid_IgJmz~*QBg5=y+7Axe;D}kf%?Inezps({tk=n7>?oH zRMu~1^x<*L>gOmk8W!sH>wRAAk5B_s*R-J+VHJdec)_&eTRq zNlB?R#sb;-I3}QNKRlEzt?CX?4bA!WJdg2LmX`+xvm{3u`Vtrr;HGMM0<1YVxrCmy z5{8`3ONz23dLvL4PMXUihGXb%f!^)K_=z*_+IT5tM`x#&i80BnpKh7qBTlm+zknyi zqOaOcZws1mbT^S%{aac`p9s*=p(uWo!9^O@IfBEOY7NLIx$p=lot5CPhiHERq zK)SX1Ilcnh;|pl)zwspuV7d`^1B|@y%Z?xPLckG}gVqoHfs{E7B>`Tm*f_Mgr$(N~ z@Uz)JD-8IvpM|Ts!8^_CjQB)WEx{kTLN(`i?Be-Kg|cKIr7n3dp~O+tM6DXf2w>pj zeX*f&4}09cr^DrTO`%a|qdjrgneQ7)cn<_v6FiY5xO?AF@bfg_WB@q=NkcE>Dz>}7 zKleuQ+N|Z`yHu1jowP}#JAm>R(UH}3HJxvQ&;3vrg~4i~Unqrv zEoDYsBVmuehQr%r{Z-pp%7OnKuoc}1Kutz1y?3rZ%9&MzvI5n4+Bg1U#)@TkstV2r zpcJ+C`Bn^ZHl)eLPd?7RLvAxmSPRRmANQ6I*QrLrJT8vR%x7xLE=q~W<9`-wRVj6e z1!8BPAFdV}ecGk;Tsi3XI$`I$Z)971ci6#n;NG5p-hde!`)qMQhyIPHI-jHYY|!h_ z__xzzHWh7rPFrj58UC?Hf~V@3P)U34l{SCrJ&|5g69;m|xqRhZEfYEY7j5r5g~s}Y zE{pgA_X6c+!2u#++aO$2vATvBxCfJ8!`-ps19G#8$40Kf@^?G)LIukb)Fu$F6PJE; zaL7E}W!-q? z$En!H;pAHqZflA#GG66Ipk#~|y810evx$jFS;nt;`ch0FTN%IKzx4F;f$ zyVkqd^}e+r?Ii?(_lm?^>z=oRv6X{ELe>Ej#SJ37R^auKl95qa72QU`acCDKoYmiA zXJ;>F2Nnb6Uub{i#fWMI>Y`UZuPnCxdA-E_bx%y|kIJ8|s#Kr1=~b`;NzZAJb8Hd+~_XklF?-g!DMMI>oJjLc}x2CO1{NW~isqdl(R_kKv9_N-Aus zSs-0>C!1eya7(~4_BeGP&0ssY2tWQ79uFTyN5zQZA;2NIX-yBj&lUGnPeCF5hRr9* zfAFy7{1n7=?Fn@Q-0k{B; z@@LjQ*SZC^7bEzK7bxw}X;`Uk_#W_BPSx0?J#I@vUpt3g`jkq}o)JCvOGRD0`bs!g zbkAUiCpoL1_sJ@lc?3^%ZcXfa3&ScJ56;@}7GJfzQ^8m0qKLoTu8g{$Hh%iOEBJAP zU@bIxnL` zYnihXRXvoeT&-AY7Bu3%!FAzqV5}8+@dzjZ=^~i;`L$i$_u5=6p18Q~rB9q1M)4BC znw4kgVHc;Y-@Vm=xE7}GNH1eVPE=Y;?6T;`QTy~L1|Gj>AdD~6$>#DM!t$ZFzh9jj z#dfvAq@RLcu+NUVu4VZdH*Id4Y+_VYR=Axq4Gm2`lq)|{*c$Yy&IAI2k!AOVgJ z?V?Hp?y9B2YakRji{%fAp{RHDdoq7pbON;1`Y)Dw$Ss+u5Z$}8%07zFL6VnR+&a>kUS>?4Y zU0C>>m>80FI5(fU$pwRP*i9Bk<8S zxJ-Vidtt0IM|tsj38!geIC zPpu1|e?LoWok@Ymr8I80Y5GBll}Wog)ML!aw5mzZpNPEr)!(TgIQ=y`GJN~xi;&p6O=8n6Ms?m?h{h-xp zXJ$Pi0>B;Qe0k!NlL@$Kxid}EzF=Nmc9icHI#BLN98z#|(q%}N9 zht>YH8c~D;`ckEa4`RLH0?$*I7)q?4%)|U15Da&oe^7$sCrojVY;#*u2MAK1O1q@2 z1hAs*P62FaE>^1s$N+E5wJ#b%RSn^Fz-o;}Uv>qgmBEBh1mQ{@8lI0ax-~ zb6{!zh(hg~lF;cY&h1LOOb0uXH>cKxX-n#K7G;P}%PTrKR9?tCUr7pjyxVGga*OFj zbwf=#N6<9vn59YBI7(6UrURj}BPIuY8$2E~ zoRpO+`TiNPk<$62zab;Wzu3&V9e5py2&Bm+i@rw$b}0pBz)i;j$P)RTK~__hABuH5 z=inNzf{K;P)^IW3lzk)CC3#{}dN8}VE9GIcco~Id?oneXLYveV&+JlcJ|=7Y=Zrnf zAo-sZA83hf^T|p_c|4}6E9+&5MInagF?;>aEU9>QqP!|TosU<^5-AiwV5z);j*$N` zD)J{lunbBL*9=S>Ev+M1E!L_c3)fZ_?4(NHQhT^Lw$reG-fHnC3Us^C_f=1t0E(!My&zPPDulHQ+nd&RAnfH<4$ zpoAK50Cvb8v`h7xdL4{^Qvns~|LRg%mN-}bCpBfEZifEP$MJ=&%gW7v27kQheE-MG zP;`_XGHoEm?=s=lN2JDXM8j^A)xwbA=&Sj+z|E8RTR0Si064v+za4KcWTZ^MC}A^b zHP)kA;9nVx{*)!oIUAC<&E+C*G6xdV>*&?~_}l&RTkp!9&229gnY&^F$6ZcgoBiK` z1c$=NQkIq9V0;7_F+91_UqL%I;D1sS-`c!th_BiV;qL$gNDrJCR$8vBWT zC#BPVnpj;+=&rHX8f8-r^AxyKVsPR;Nz!{U9>APHl~j7E+n?WgM+Nweyy&|e2AuCV z1hyV8Nf864{VNU4x#G3c1m7WY@5Z7|D&X>i9@8`UVsm4%HL*@NB32fQM-H-S^QQe`j#kFi zh&q%H`HoE;svX@vkY$Q*OAL(}ZjPWrt`fbjmC)2@h_&{{u2llzw;q(@5kWbgX-Q?H zE$3T2=GVH)!HIFAX=p{wB6G&(<9jr2RpUe??5G>!RwUdxk@WlO(R?sG!BNXMVL@|1 z=-P`=DfN%+;}Ld$9Wz!sU3lzjyBt<1=}j61NsTVbjN6zI4KwnLVNAV#c3pQ$vB{`W zV1M;Ur1smVv~$2}Y3M7J*c#>SSzw}fAj)vAe6I7nyWVx#sBHOuQa%J8yHS6w^a<9$ zC-Unj#yg16ZbJ>;U1K|_Jnogf=PZ#6T+S%EybOt5@CD}0Gt89>R?pp`c z8#3hHz-0D@0J!A}>r_EXDwt0)Ewc##yfI;9k{{WpXNQo%$nN(gj_ zjc`d)S#YTWJxx-_5EGGSsYf&-F!u!1r}H+gI#qOav|o#hc7H?qvgdmveQ{7~4$Kbq zM*4$tmg!OWBempIIhypMu&lKR;UPHJQWAHmi618bzdOgi=JF0GDeqanNU-8;+wr(S z;ro>1R!x(tTh@2WrvE9jhPf%6nLTp|W#nWbT&>ZuS12r$Ld3hWq|oH3I8|OSi}jXH zM{ahGT!QwtZTxHz7GL?uYTbmsD9D-jSns>vV!xT<@G1B@kKEfa8MWa8*ApJYeLC&F zD=1g$7?i;r-d}UsT2xxv4}?_^K)z3+kK#@Kbbj4f*j%c6em0OHrnZ$0TtayG$12;i zI~Gj|HajWwk#5VDZX-Cm+4_fo8?rZn1Jd*SSPXadPvvk{3%C?m-}um`x`-ARbws%N z%>$M7QC#ztc=qMdu>89A`~|`B#;A0*)o4MCl&^Yw^YNJWhR4Q8KK;#9=zH4n+(ZzvvCWsgr*$Dh3_v%{2*pG9{6-0WrVf$-a!j*&nFB&Z`pd_I&Aa3 zq-@VB0k{p=SY$k3OX_#{>X~^cw&Mj{*&Npfd`g-w%po`KKKteq|BtM<4rsD%`+!wc zkQ7mAP*G5j?pBeIM!KaNgfW_-QW67EV03pkj1B=MMt3t|Fk-~WG59W@`?=rm{oaqi z$JkEJ>pYL+cl@Fvvn4B`9Ca}Np)AykDWG}rV;5Op$&Clb(Ku}k$LqUA@kzE^poKlr zpz{^bZA0^RBPk#3^P@0TEI+JTeo9l0?fDFU^yP5WRYa%V#+SqvdUZtuiHT}57K*@1p4tfXwTq%TIuzv zXy~6dXyv_!Wkl2Q7vr?!O}$Uf6-(L4)vt&L*1FjgZOxL81)dy{aLgx0J8{{_<0fRx z#$khY&(b*@HJh_IYnl0?&>qGa2yclaSCvG;Z?}hL-$@*J1n3SyzrT3~-|wNfTkDIP)c5Mh<4YdUzBRC>5+-g3z#QoM`r50ty0>E&&3^J$ulZXB#fn>04C?(Fe-|iY6ej*C6v!?zvvQGozsW z_%ET`GaHuQPW}cou~Pqq%scu@jC$G@J7a?rp>ETke)1|i1AxH{BgO4!bc$$2`L z;Xz^tq}NRFMuJ*zS5*35;ZMdw$mnCQuihHn`AfAG!QI{Bolif}2~)gW%5# zLFHSIFMP#mr2HDP{eixkvm?1*_I?X8wp3jsciqhoRHUgUd|$~Hf|R!H$%c38#7HL5 z3Dd|2*Qf>0N#*l7s#w%u|5&4EYS~iHM@3#Q)``;oDsT^`pSoDiZ_7+BMU2G>e)SioScQhcHIOF(W9c7eq;zt)T z@wife8x^2>SBG=X--${Mv!DSpKOtPay;=PIzR#L&{b;X}_e83Gt4Y2L{q6UM(KaJf zG(PeH2}c_1d~5Hoa1e`=TLX4Wr$FO>a|i(SCOp+eI`XQVpCeCqr7z!=zHHUvD*gvH z(`7$3i+V>0c?u(hD0oIlGrk9%0TQ_6B%+FIthYRu{DoWa$8+{a`#{(3>pMqa6sTQ3 z%}>n%0t8kSoe!)Dbeg3uPm!?+2?eZFUa}^7VAAX--{6q}jJ`l@)&%6Y$-G-XXP<4i zWv)uHP!SUk@0WkSe#N6H~FM$tmbZAh- zUjI;Wb=oVP2Mk*a4jRg@AH4Qq)dK;7KmH8{%zSC#i-3dYJTzhi=fB0-o(;$_Mow}uwL!uqAy0@2G}Qp0Hh`EknzvjJ-!ja z)oC~Ka(#x!r=|VmxyO(8_y@2r3H`NqmFp@Dh82FTMDC42yhU3mehnf0$se?|ykb zuts++((GY*!HsGDQAUIu9|_6?@N7peeF2}+MfLt*0`GB;GSqwRn;%WlD5IO(71>q$ z)sVd$2#wqAf7Gt(%_IYegn@qTjT5116%eR_4&`g-K9DPOMKv4337I)m_pECF6W162vWsjFT-srs`4SbmA?B?dy{-A3u zu|FZmtQ!RAEyQ{i&G4B@j^})OGXp4~3eu$#ye&*{oPsTq2b!bCup2RPak-He63>{A zWKEunt0x0RY?vsHr5Bi+Jt= zTAO<0-hGctPwi&sxjL0#v-i2l{S6P*g5EL=7)yLDs9NV^bp=plk3`@Rs7@v`Ga{*` z%OKZ#0CoE&Bqe1M2W^oVVO@O5AWXxWEAe{#Fm!&-?Qc08_7%Q;b1C3d>OL2q> zja}*`9#T~6c57-#?2xk0H{%I0G4Z&Krqgx2 zm+1NX0V`m6fh3NO|0d27fr|Q#tla@y%>;%IN~{-zWG?VOLa<&aeg5UfSLUNe@7&~x z1ceXgD?+dsU2kjtfjA(3qQK%pSOv4#;sm0Vdl=|mz{1KS>4U9Mp^Yu4SN#>C>zoBi zAw)-ll>PS9#Y>`Y{R+i>e(f7W{zw`@V0T92AMA6@$S`Iz*lU*~2hiV?i|sD9G!@Zz zHZV7o&C3P()>7x)y|f_OxlS~-1^nR!@GIJs+f;8QQ^qzMpt3ng-^b6M$>Q0lmZjDt z_Dr=-qo211sNY`pAXqSx^F1^8(~bXv3&b%z;%;dPB&5*s#-bp4w>t)rGSJt}dOgph%5LpbeS`@H*1J zW`FJ4753fR*IKS~;BQeF8Rdf`zK@Yx(F~$*lwe%iW(D-9>=QP~-Q`632EuR5s5{?S zzrjoDsgcAhOyj*b_RmF^rT)0_^oaCwq^*5Ek;uKpv9!deiz}_y zs92TN{cn5|KDj=M_Ll%yNnogW05{g}+CgWZN6YSpOAGTJq}PTd=)!xzl{3HV*iFJC zb6Jrec2$jTsx>fidiWRoDq#PwcT$k(1hB7q#Uh0-czRpUOAYJu{>rU8Z(eWz^Fj0W zmB(V1EQx$$i|7KCHtpzNvl0{1aXa{@e zz!7LQoksb8RRi3tsH%Moep-&$;zpqT@%D^|bOV$#!JJ0;ldkeIO)Lok(T90#>(roC zx!5Z&)j%9Ai5G-`-d)UAJlX6TzVjq(&S(;MA4x<-we~@|`ERRoLf9^n#rdf>wS)gL zF$u{8Z#@OY$j_D>WUZU`c!37HX@XC~6jthsYfwxd6&X#*GxMoQ?c3x6+gJJ25A7@dh~-&wMlq4T73t}XWu{_a{6O<< z+M4Wyx6bR;QbyYuNUqo4bPIL*xbq0>gXyZEu;j|#*2JAX5soRWSKao~;yN#jVRl>p`OJvMaM!}&s=F=S)b!LqgA&M`2 zn$9kXZxv7n`NFnzpRK!Hc!nM8e&*9#I@D>*^p8_N*Z#Z~mlk)M)=mIW@T5zt-17F0 z)%BVr$6Z{A3f7?zw63@EH=EO>o{A|2^DpHy8wIc|cp;(VK8gCyVd7+HyW&rXlqsaY zSU_XDDlDM+6Cw@e>KRwP`f`WyOw8C94<7$G93SD3KN7&Emd3l~a~U}TyX8JxMvXR7 zusOoUX&5}6D5ZaASGHH3Px4~PUbn+;EMo+>=Jh&e;&w~9-`W;FD+emNwTDQ=ju#JZ z+IG-#4E$1RB9s!I^__2A)FsSE(4RmP^HS>4rIpyCP)!FTTdDGF5#i7iK2u}~;g(U% zNZz%Rjk9W54`bK11mr3Qi}Y12ctLdNl27}MO*mrM8_A#RF6+>^KO0&&@_J`G~h zNj`1Kb?=0gv&`F~XiJ$T7o*ij-XS5# zL>Q;D(Dkebq zu1En76C>22me$94+B|6G;i0@1?SDr!W~v2)Ry0+2bc{ITESEq+|v^}8* ztvOC+O-TB%l_~F`Nk2dAy0W-4RV0^?Xbdw#v~7A??*TbTUii&*(u~gpghlQ={$|$K z{(KgD!Z5`6>CR1_->ZHa$B0yM?S`mD-MhzS!6U>h)H~g1S1bYPb0NfsoF|+;1pC*@ zMdU?}f67WZk~R%mCGhj8m`xLSGV-+2P>fp)XS`;2{7aOA#__^{Xn<$yKr1}ar*2ZY zwW}!v(_qG@$rzu`P_3!jOw2`}o0W)|N<5{LV_MV&de_RXeR;ar&D%~BIP&6)eU>jB;9sE_ zUB(uQ&ycd@{(|z$#a>DMG&t$rOy|jiwkvFFJMPP&3~q$t8b-2)aOw$zMX1A`Mc9}O z4M=#m^`|dodgiI)NV)9Njo4t{`{|s2Q#9s<&;7}rfOMST>=qMDx6;acphMIxf*Yk3 z4jk|WfxQ!dzbwZ#N<^+HCieIJ+E&pNpUOR_qA08gUf9jGG1*nQ^KPub6-n!^kh|~- zkDe49oy={My5IrRi3G~IJ6WcjWRrcB76_y>+$U1v>pZAe&1Pf57t{8fO>Z(~3gKZI zukG#~HKBwW^AKtqp6tfb=#zL?$e!KPyk9^hYa7=M?#QYY zOVnKQoml9qk1BY<8WVmO{Z^SB31sW9QclZpp_w9-Y3xsj83U8G;fafpj1NqNJ&Q%1lB#$dO;EDH7 z^Gg(3*GDm7ddU`CvZ?7$G7=rEY4L}70itqEQiXG0v&K{noCG_emqmsFSq}45n@76h zBi1+{nw(TE_A?6nK46%mpszy+g z9YB+drO#XEgFNm()r{DZI%uMvKWGyk;Ej^hSF{;JjkKsidC=<&p5tdLAr`hHUpoY> zjguJH9YRHW7-4@3L^RfbyM>dW*o8(yB3id%T%dyQj?>DW0PXA(O{bezT>6^5CUDED` z91M`6IAA8?1Yjx_tgKn&6NQ?gKBW?hGCptLzxnb2W%AC@E$U$uG$+`Q;(VF zEXam{%Q`o^)utBPcl)A4ZfX7y(zSJ$+IE0pivVIy^^lczhz+jhNh7v8LE%BKTm4i`NX)c zVDX1`#78Q%qMTA&&YUY$G~s0jk<|(V6}$3xERUxcX@)abwSIr6J*D!){c>-g6seis zWtXK^<6w)mV4UgcHD}_Io3H6i1Uta5TNAKmwzOgQwi8?O9fV!YdZZ16$b9;_LHS7M=CeqW~3c=sg76tHT=05jS0_*uF`tNr%9nDNEe#hc~k_#;xL=+;0jRQV@aY1ylr44r2_(NZrY1s14xi{urR zpO*G29@aeeXjn7_9M|4Cp|Hn?q6L-a&$}6bbWKm<;Bu3^-xB-TiT^YleuWx z_LpSCs#aV>0;||YJ3EU;X%#0{=ejyyo+aieu{WW@Bh@ZPSd0t@vlSPrM-$I1y>2SZ zGT5ann48+Ozy6D@8P~5cw$~wrrXZjm_zyy+}k3=vyyaK>?l`ZR=2R;~^So8IBw3J<&Go2p&PYEI@muI$a zc%%oD%k#~pG7f);^$xpTR-x<`(^g?V-E~p=LQJ9!IwnDV)=!7*GI7mv1MUN|CxU|7 zw2_W|=5A}ZL)hpG9l2zPdT)|0pN9`vDL<-=W<~`|Ufd zS}@btpQ6%l^Z7EGU#(Y>qeH@;0dUhm0X=J+Si+}+K*vvuY6a5H5Gk96rB_yiR*YBoM@WJAV5>kuaD*03^5G*P%Z#l_etEea!)s&dO`R{ahI7H3Ri+A{BN{!S9xPwBi% zfFEtZqcfe$@r`hP3Qxm8?N2^8M_aXH1Z+pGmt^+1@;wGKCV7J=MbCdTm`doCb|1WF z2g03qT?F5EH!;_(*Rt`9o=Rq@KD`$l_s>EF@%%Rkq7e|=sYlf_2rL zIv1U#ZAM}Ckl3JAf!C9fO3$!SXrtEW!hxb#xZhmFxG3NECuHEuJts7us0QMGO92=XWtJs?*os&KR%_0r*P0Z~xlG7vh z_wY16w?R=CLW(D19ddxdh{E|PQb7?Bo=LGKrI@W*vlV$NkMa9F$;=z2#+4gDbF_Lo zf6FD=YF#xaV1EBL=X{*(3(&fHxCXapW0NV3nl}&3bOgPoJ;cI$J#vx89_-7e7!051 zdBxP@S}kN@r{2Vh5Xz7OM+#*}<4*EmTk^wMkru69f6T^D7IaDr9*lcmD>W5237$D~ z+_0^gc-boiBU#5C1V>7>?9{2*YNB8HAWKc$_nxBgLY%*958jdHU>24Mp?e!J5VhI`F5AZc`)Y(!nfgK!XZx} zx-gx8?vyi~ET1^54`RyUXf2K2q+s`<33SG$gZ;1+)6A8CXf4w?MQO4Zzr z+~8d*8QI)oi9^nJ(44vj*yxKXFguf>7Y(YiGUmP@XNM7fz%Fu%$YEj+zIs1=d+%{= z5iY;|D8x-?WK38BZ3uOKQ4rTZQ;9vLNH&^9y8sFtr~mu#J+TFOJ2(l#j6?X6`y8Kd zeY;PO zDKz05{F;QVKx9;+wm{Nzly+7PJ%<%LK+Fc-APXJ)52f_(`oA&)V4?srx>0j=oYSD$>89kd_D;Hb|RiMugc&jzt zuRe4Qt?J&XlzwxvP)dqF5nRNq@tPycf9X&-K64C-hg!w+C2*!PS=&~?jYEJlxdvsQ ztC-yHm642m>;V@*&m3IxY0KSJL@sBc{{G3*bS!e-3W@74yNhndAez^AHOiE^W1qfi?QC zQT3pr3^EN!vD&@~)bjImJo`&Uu*f{HCqJFeNKI`iup6vbl_6E zzG6`Jl}k%D85#OmOg2&wH!FnHHfV85+9SMPis&o$fjCF}2qt=?e0puF%&nAAd1JTl zS({@cnvp~Ik@LGQ`~h)OGgJbu>Q75m(=i(^roN@1mPw@VZi0jb^O=il>Oy+-a z_=}gF>qX{RSj%QMC2bToJzY{&DfB4ob+xCSnd|s!sLOEknDqrbXAx`gqf($1%$)?z z876PS#60g?t_emJ)I5c;w&2KRtxgXnRp6aHQOZWoPeJcN&tp>*^2@kAGuHB>G%w#}E7$B#rVk%2`9?p?mDRxK6TV-cc`w%H z`Euc;>*0M=5y63>w8JBnuQOKbP8?CQMy9aF(*AsYooQO6iFj!olxM=3WvPHRM!?Cc z$h&mTOF}YQssZn9Kby(Sx#T zQ>MW1YR$dqtr7}RT=Ui3mm&-94cct!m7_T+r(8!H<_;9f>A5J1*`#e*fb#ZkroLo9 z&V3MOUkEVmK|E$%%O7qK?kqIvs^kG0b-9R#oK;S_hv%5d~?mir7)Zuk5T z0axc?po+37Zfrjx?(6c5pl0AUVmNK}-|wcLxcUBWP}1N72QFqv?Trp~h-d{Ly}rGI z*6=(2cwfWY71mrbw9-OlzMnRx=dNSpkL_Q~HCz^GL^EVd5LsEZ*>2oIGW25T%_t~$ zcy)PoeGDV1LTz!!o8y;hz8g%ry#-q};MgQk5BJXIwie5dhoN;6mHRJp@wdV3J9d5Z z@G)|6Gn8vcRNj-9VSI-XB|J(tZqEe;dxabs&3qW5N)PxVMSq|K*`*Ts4v9BG^7sZs zu6x-Y(aw7_+SYS8`eRwar_uL*QyXGGvX8nijrffK`Z3NDLcW$>Qx^L9thcU4K?!tk z1x5VALiamT%+omBZLHKQTPl=Xbk&W&ZmeuvOK~B2XG)%38tL!)ggZ2f+CVNptzNMo zx&ByJQc+2b7N4jn%2x8x^8)^(2jjM56d@gO@ku}bU1-`yE z4HUmyX#{VLi>@B=wF4H4vitk{Xd3VRT7?J-l?3L7cYnEOs3GP8QfCI5>1$`%QGaPb z{ccJw+_O2MjG}Hoxg~?#fwNEWj^9Y*9X8Mzb<9l9O`Jn6ATF!y;>ZHVfa7qG&DH>+ zR6eEwNxrpx@EOB(5wW|r>IO5V+?lP-2413X!wSIlsoX?wb{+v0mkPOx5oiFQCnmxp z3D0l&DWv1B`+uuj2yWR4c8IH*)6%Ir{@5e*a8ox?ajb^AaWtS0~g<1WufvxF+R-*y7%pl7{w z&Zvh2(##U2@`0gCucytNK*$};18h^*Y_Rp^UN_irdUY0HP4%+#)W3t$hYnf^KOgHi z>QS^Amo?ol>9X3eGD{|FG5RZ&dn=OA56GUfH0FkIiG3vp1;0c}P1~e^3uXl1Z2{AO zp1$YT8uwEG{ma30TR@vw8@i}?8^hB4g#5Np`_pxRFQavauAmJM8>}9ZD!%LwdCf3I z`6CsuAq67z7|W#5%OQuB!{i_TGPZ!p(KzoEW4TZA-a=ebQc+aPx$VYqCcyT21l}$q zm<b1o`1wSMY~SgD$Tn&)^!~Lj|SWwTw7WXlDB%NxJ{b%@UGX_ zuK#p3{hXf;Niy->5j+5}YllGGMlQyX#peMYScnzU~8eV>)BLK}Sxk~7Ql zR3WRG2vxX>)q;^K93ayCE1|ok6tAq1n!@<{vC9EGB|9 z2<=3q6NVBhcpcBHUPIrl17xEKNT#z0MeOI~9+Cy4o@lF_DKe`Tu2WB|PZs!4?t^xA z$MN8;d?kR!B6QatMBC%K3%?pIK2$wV?72H&nb4Q2lb-2vvKJlN7YH4BRRJd@$o9t_ z+rQ7EuS&U%YMcgGGluQ!RrE%IjgAYA+O+kjt(I6Z^Cvm5t^+>NnYUni_$frja8EMA zr|LJcNLyE^KYo2eK1G#!s>7-MiRu-^{Uj_(H?;}8wf;P`+usl9oYJIO6GVDX1WgwF z!+x_S_s>&*dqgxb)Sb{zrHi}IUes%J%omq=Kx);mw zAYbDz?Sl@818wwv`4@9ADY95Q@RX8N<{o5MXFZ6NOdrF9qKb4=0%~f$wk~n>o3S=& zQv#Yi>~bK*Y{1K#r$h07z0(B%A^}Ixcu>w?Lh@%`FV$;-_;WKFi>ezHz0#Os<`Q`1 zZ`H04vbg=(eNh>$v6CeZf0 zy{W;}&a5GQ_J;}_X~U4=7e&zE(HV5-*xs~--1#tmt_RS<#I%{90N+h?rH@OYT;ZSUL}{cn?h`z8SS z0pOmSj|U2Oop>wWi)L?Jc{>MCDtwXVi312{4ykw6J`+Bycbc0Nqq@1`b`MyFQXbY4 zDSHmBph+WVlPIYJYSNXAiD}ar=F=d_xRzLaRN)t)MeC~nQh5rJ{)cC=f_>HY>Ym@8 z{T!=G(sLQPkDd5zhk*oMosvgHuw)K|QB+&V^XkuS93VBfh~ulP zBeKq|GOTj@&o7&?0|yx`jR>hZ81N^`V%iOrVlFGT?R6sdc5pZ$$J7qi3q58t6b3rAO0G1i0e@IS$SH>-&+V{ly=p#KNDG?K2&~K)8 z8E2jkpMaTiX@a_|p1FCJ6WuCbE_CaR$v8!y+R|1z8*74_`}XmTqv=+}h+_Il8f_PWWjHUgl$b7myErKt2U9E9n3kW*T=m1*szu4nn5I|c98ZBO= z#Zup`cfyjT>HqRbNPAjIQ;h;lk@4^0m%3s3yX#TwedAboid+oX-|)f0u{m3xI2gfV zymp`J?BU=HWS+mQueOz90;+r%)$}%3b}~29um#DUoA8yrkRHt|ra__<0VIy_MhQG9 zdpNQ3NFJJnsT;9(sD8ZGe@+j!WTEo*P3%|bbuzCk zB>sqS>dv8*YfOvZYS)?s%vtCUmRqkYgx=v(cC3k8IcVT&gb(=VasX(wO0$OaLc-(_ z{G~8J4l9l>T)djjzvmwe0mCRVDTb+cFURM)*ZB^X>v%V)gH{GHh-4foxC`C{(D;cM z|CO$;djh?4akbrfqft`hF%1-2oaxI2Yf9$}!v9$CnKVuFeIfH;JKu=b%$J;-Utjlg zW|y45W?5-7ob<=YSi!*Xz;~i>-p&uU5~m-G&jDJ!?3A%hutOeMzEaX$>bf%hJ2m`H zdDKS)PI*Ph{!}Tb?L*L3USu4iVC*l07kNRMBuv3tz>ko);+pVf`yTaEf4$07a3tXe5Z7Q_r4iQGc?3mQkK^^-P0sO0L=1YP=xE(?5h}mxzWm1 zf;6iP=di=3VQ%A<6lv1MJA~nOT?y;%V-p5+x{`kDRZVRo3s9_cI*lSN?#V={;Z!)% zL9x)%8xJS!Zf~wST;Xe#QEL$na}%cEiz*c> z@a@%|62BTvWhM2Cfb21*uuyQMnxqprY{W$8PlG}1A!)js%$aaD)nrz>DH(d4{36p^ zdDZf%^Irq$V@rqX4)&va*U#e_QQP(U5eAxC7Z1_iL*)!p#jWaV6PdVlXjYfcf)Vl| z+?7T4xM$jMe?xbxb=iS=z`rs-KD(Jvq{l<84jd46gTG3*0~RY`2RkF zZ{NA~B&D9@{DF#asv?x52ZJ6zwo7I|{7Z2z2;b6(y!t-43H-xTPQ%GDrZ z@o8twKU>UyZel$7IeV_6#M3gljEzp9@oGJzQSQaW0h}N4MehJVs7D_nJEyxoEhj+D zXrdkOnJ-V@{23Hoe*Np%n0dwm2W)2fXAW5ppYyfl)`#szJ;b^~24DiJhC!>G*Ty$; zr^vKxu3H`0o6dW!T_20vDnd~a{TXz+)o^w+(JHnuJpryP}mJ?Pf9pk+VJBiXHj>1WXqBu(tF2 zp_u7g{!rP`s!Gm5P_&O@+E{Y@w%BW>WXMn(DGT1eXP=qAE?b7J#D}(uOt*MIjrC<_ z8-5ndIcjjEKy!YNQ-L%0)S0KtcvCBhCfso{=Dix-R7TW>LyL4|MLyHcTeT%rv(TtE zMQ@)K&L_b^r*YMYj@Oyk>3rL6D6W79))Z~3bZ9tLJ+~|bL-`+&KhwLNy|Cm%`wV5f z-@IP~UVGkD&SGBUg>3vI$YOU~(Tc@>OSPWyG1R|4XvJTypV;H-@ltZpF-(U-CI!ZO zTpbed#%0ofo(qPXR1H91JE|G9asZdjpKGcy~!e0ssJo~NR3aiqE$W8f)ELAh!iZC2**A~@k%q*WV zE#qCm9vMVsSEFkEDD!u5H1~7 zVvdXYf9=BMXQ2%L4Bi%B#ZJj-I;e0GDEMB>Xf-{ojFuRWeSRV%<2AhWY{SctLPnoI zj(gHbr!PyEkxo7Eb{^eH+8eeZkuJJOg^UteMq7b_s8J(>>D)L#jTB!WEhx1a7kp0d z-K7QJFJpt&KnqT$Yqc7DqY~@oCCQ!ARaEHRGY4(>@qG$3W=!?l!k^tD8caf}9%>M( z+StCErBzH=><37_vZ?1i)`lq2w4GNAqr$4WL=T*?)T6UbJYC^AzBm$ZCu_m|X ztB@Mnx|?=%*VMLimSDUs&bwq(9R1r#I9TGS;Wpz#jra%kz6ds~dit7&K})2@oTBYX zpDPv;m?pQ-yi_fN1QkBAdkkGLcRp-CLit_p9~9S^YfFHWT1U77*9vrh+QdT6OKikd zooHo9z7rR?pBUjFl^AYL|NP2IcU587KBQ{a=W^gq(tHy&=L|K*^Xj9qwC!Br@zbBP zXRn{Pebl)rn1aAa8kb4&3YeVX(mzL-KiWA2 z$!wzp!nnSwt6GVYSh>{QN;Dv0o-%2WvT}mv@+u)qK~4cWN9C8f?jm+K7qUA|>W@v1 zmbxZV^ILBbjb0Jhx%hq-Vi3bE;GN+v;1?o z`xm=U#bp0#Y{lDfNJ7wQt!XA(O+ko&T}o4eVC@p^+MUsgBBDiyXjub?tQoxfsy)SaTIi!b2U+>c=PYf27-@x67$gN&UAC^%;o0X@8p#PZ|kXVxaa67^ahl_-z~MY%%cSC{xC| z@7GxGOAC83@8Xz6++!`z1#Osf8$KV)c%&{&9?b(Cs8R6Q4qJ&0yojw>dXAyC-;uP> z5j?zjb~G2}bmyXfW|G<}qr`z>#iJ>*QHmBm!6poV}(TBohiXb3iZGCkx&5k1QGq~k&AMnGhR zuUNSjo@&L6X(udIF@|3SMC-dadzSula*pjCr7&oLtH|au+=E zx(v}vtG_($E)h3og|}TzMdcX3rME0$)R;3xf6M!=HQg645-pXsWZ-r}U-1Z7_$~cB z;|$0SE^IChQ<7WQ)tZu!8%f6;(QC%#ZP2Ks@THALKPZ-}yHYoYa+p+tJ7S)tN+O4u zw&C+xAooKbkC9V|f5BKN%Y=Vn zXKCYfIRiOprZHgfJYk3T#As2`|H>_2yR{Bhshuw^xfs!N;{0|AA72eolpw!5U=_`` zw|I(5Rk#8Y9bRa7iPQvrDv{NN|Z}!enxa6UjPJ_YDEvQ=DhVBVAXK=r3 zW2U!(3~|nN#4!iJ6MtLyHwl`C18XE!RyFQd)Yula7L_Hm&Xr0x_DI-DXXo#3zgq&A z__%UC^o{JVfi)hiS5?Jx@*#$QHZL>@ib8* zeCB?ilvN7-+VW>eZYb>i0^6Kdd^HOiBS2-gg%eSEF^QhUy4OF`(las-PR+dtG%QGu z*F9eUEKqQD*T?tNhaaj@mO6zd$NtH8usa?mkNr3dkHt%Ye$adLN&PjmG(Uw9G{AV~HXVv^-% z)I94*U**Fc(GrZ2ObXo4>9XLnKE3fj>~!@z3|0ucyuQ6$-ka4$Wk8rjdd@_;l>Cs& zv|4_hpQ75L^>Me8u&D~Cx$4-3U6-A&b&M&)l8e5$`SU7yDxZdKKGRDHq5LX4*DILa zMUREtsa@Yfp1UPY#xe_{2cVws?1S{x&(dM+(h znNlS@P2%j@mLh$~`4{=|nvuv0#``0n_-tQCpeeg_2aW|MhtpL^D>fUgcKUlPlw=1h``MUyQ$ zt*`kk6}mm1GxCW4e1aI17RK!hLwiObQ%59`r}Qqht6L|U=>+qHijy|IC1%W;=5;4F zojlpm@;ei{T)3WjMDOsI{RP`j_EOXNbPF3dyN!gf9^a}sRKl{Cnk!_o2j%Ql)Sn)bO(GO3<0yF93T|) z2cUtn$OUZD3cLX~8VbFJrT<>wwQuDYg|H!oFS%QG%e%@$)XOQY8e^A6=afA-04eR> z^W3~VIx&T_?p!TDKA38Xl$uSn&FIJ*eihft*M}mkUzj%TIphpxG;4Ot89ipyo_Zr+ zIINhQ&-6`KdB)C8?(}82R}J&d>OuJ7<|lt>X7*WZ0M7(F$rMc3@ z9dwWaHYq{>_ReME)Y^yhbU_;|aAVMq;~mn*EBi)b{$;Vm(dV6m$4_>M(b#cD_g==3 zv>iDIignFO?N+s5cZD{@Mps~zpW^0xB2uT#S|7i>Wa9&A6){c2L6L#-hmj}Y-n(4L z!|y+IB>C{?25Ql+;;xH)M?1KFt>eO>!VNE>9VJQS;4%@e{F*-uYgSeoi?o+rpAv^U zF5Z|f?TRb-=0g-E>u^0vYRO4Sa{AuESZ}jB7v-IO&Kwr@Xc;X%ztIhnD_{BYlaV)m z9v{=;qiLKu_|U@=UjE)i=g`a_XQHv?iyW7(&sih^5fv;g|4WHGC%KjW8Vx?lY^tj{ zWUJe3eVRGr%MHxsPaE^k8qrzRt-P+-+)TWD)R=3(k;gnU8uI6mR4k-!8eiZqMAIwV z8$DWBod@3r2QY}ms-ecuM6(?a4|@;j_DGt=*7^lyKor)su5 zM2;m4Ah%|eZ>i<=EC?b7@%vBFt@=(g{16axEBU6Vy5L?c4~x|4^EqjO6~m1s&jW##kKhLhBWKc^I&U$(Q)w_TNA% zu_~uQO$FlO^XI>UN-M6VfGfOC!MkFe(pcaQ?2H2{zDp9me>zEI`7^PLsyw;NK1bUP z=FG9jELY*NE`As<0G+?(z-2f`yT?=@?^&K*IHo&HE2(m;v&}^OG8dnfyL05dP+oxg zlB$)}y+x5Bp2(ld^ro@Nz|J?%V9H=ee`HJa@S@|=1LxSS=lgx}fQD1CyDiYcY7QSG z2dz9oyDZiW;l~T`OulY0cY?!@fQ2zFa{wosml(Oup(9+X*L$8GXXs zczVpZ@Y=Y?rzSgI@!#eJFigFuf0r5XX-QkM+V-GqsPtY7+`+O8ne;V5Q%8C2*We(T z{aO{d4sSmi=yy63fi)glw-EuVY8x(78TVyONZS77W&WG|$b63S=IG`@%X%)iAuA#E zNvIc0$MTUx*SNli%KBpYu&3Ac@$S7rFO|W6s?o@PrM!GOX?HA9o+xP!Jxg%vs60#+CC>cB1D@A3`7RHvwzQkC^mK0^JEMwpIZL%9{2xZ@8k6{>N zi81!!cj><0@9+Eg{Qm7YI_5RzdR^Cbp6B!VcxtAIybmMHDk$3xZLLaQhsGy&CKW4= zkygkIzqmleBg=Nw+}7x2b8+EU(6^P>&|%VMshX32Jz!aBHhSzG9VEN;C3pN{wqWYh z*0Ee^H4!}GZKc7hxTn>Tm3<9eX6X^uxf|&w=QWaM-}&Vqyrwaho2kiZ?y3-WAQwMq zQ}gp}Bk6C%47gT^HN(;lyVobzSJV%m?rL_J9{ucWg>m?sJcv51%yecI@iBiYuYEkW z>-T^mb0*iWDHNVre6Yvrmd{ifdEqmY_OxDWk6pNsZ}-QY-lpyB;zEkSs7QnYn>{+y zKDWQ=c2j-B@J8m+GC(s_0W6v?v3@iDQ;A%iTfBvkO&422)8Fy(%FGA!n08dsRqR%w zEbVtwya%`OGgrEUaNV2&rk2V>uend++espL)^mQ=Y~72o9I&4x7xsn$U*TlK={C0p z)GUXiSV)!NidjrJ-gsA|b<74nBYbW5GV9{8?@nSNq7OIs#L(qqpB^r|Y*A zYU2}H>q;UX@4g$)6&}9#PVS+oi^c(waRu(O?v33iq}sp|7vTo}o(tLuzsK>e#A@F$ zoJ~}ateWVTvEM^(e859q@!rWi8&TE-IRm`YUZ1bJ2+Bl z0beAKo8vu&y=J;1yCcFAKpp;fNs8}1Ym3BmYJv-IhQF^`pX$YiX6otwjq`HSw^B`# zbngjv-_h)l+y!-%vs+(l#pM zFcVu8Jo;{hEv3?pQ!2#vmn-nnOW>RG3uWMC~_a#jiZ@r;wNWzL9ysVJq^%S5K05h>DEzAjWHR8T(@W*XZom-dY{UxDJ3W5uNQ^Y!J%`7*Ps-k%wDD z4Lycd6VsecmTLr`VkQSQ67FQ|W4xb*XvNlX?lmZQCOW4`MEXtJ2Ph|qNt=Fr+J%kG zp>@bPIOxzF4U$S7teNv&{=oG^uU;FJn=uMa*maX9#gl#y%a;xg&ZZhq`FC8c%*hi+ z>(rJYpQ2`)j%Fr>>I4PUq|6t_zdg?MtxA{8R9JVELh`7wC?C3nmsWSWEs5R%8VoR4 z4vCD+ee>olUiGvSb?*6oi0+rYbhh_`O-G*-x@S!JyJ40KJMe9ii2-e9we-6+sRW2z zw(12?Fg8Ew$8JrXz80WhtQ<>hFCJ7L;TF`cx$Qcoi3Jnmxf`=9iYN!+hvKF;+j4KY z&**gO(D@dz6nxKP`tT6crDT6d;pvF4k@J7lWd@W>rz8}WnyMn`&I??C|G=Tj1solB zl98@X&pAB$(i;eJIDR7F|K_m&1ugUYj(otKyQI2pqjRRZ!KI=}y3 z^9l;4;}Wz4T#E`YwDzu?0@}G~VB2?AT%P0OOjBo-bkylMv#%)qUFO!UC&iuQraqhR zjFn&4pYkvrOKgU6@`YZ%D&gk|H>$FyszGI+QeMbX;X+ZH+$^YrB@+jUKc1D}H^9cy zmn8O|lKWEf@^h(X&0~!hi^LJ^Q|rKdf7HzbpVIVqIlVn1Vl%m-is78TBsIpJP01L+ zAJ9=fYS!AdHuY$al_cd_6{afkUoIxgO{1dWsnC<1h?p$56(8hE!=8lP?&K2RV4P(7 zF|xjPIFqe%sZ4*O>+j(wBLmzJ*~R+m60aA`Fz=ip&YyA0+Bc5XXWPVgW?CBMoJLZ* z4l&EkvxbK%c85mgRoyr>mCqV?TRMjpSH@NwEO33+t%VkHn9@k6C9TOKII7qjViMy} zew^Z4;!$Lkkk+;#j;a}aY3t0sBU05#WS-rsaM2Mp^!P3V;bS*`O6Q9=ia@N;G3rVS z#cxw)Bv>po=~twNIs0xgggb2?%_{bx_51$nzv!1ERdc_P55HMv)ssH*J2rM zZ|>;==MAmks`mYwcUMT8q-}zgQDKFR&A@Q&=Ha#$5;B~VK8M{m1p((MisOMerG(i3O4At3*Voq0ftj^1CDDN#6{5 za17t7@fj;?`VpHGmfIo+c@C^@#&|2!v>kjT3(gezi9A@8GeXZDcPwcOTvrPmbwuJ@_e3!d<6A)tiGQRzY8`%bK@NcY`A;&qy z%24r5x4i}Jx)g-zD#!1$4buaUWqhd|uJy;wNKQD7d9_3h|H7z=q5ABGuaFwAr%2df zuC`hn*=VdxIGtTH9*lBy_+5IN71kgvG$^0qu89wQl5A5Z%#+VBliOb0Q>#AxSus(f zC@V}Au3?$#({3{`@b}8_w%W>`v(?JhN&~j_3a^5STdLUlMa+y1VZt=OjT+O)_w#;c ztyng1c&&Zs5aD)qWu|;qb%OtkaH3L^gcCdAa(I~hy`>^}wR7%l;M&zy=P=gxGiw{0 zKX`|8#`q>GYGRhW&-t(NsTwJgTR~oJ=Q>7nsI#d%$<2H`mO_+kVfhUEEV=mwKAU*% zkdLfGtntOMXq%}G2F;Xo_YLvP<#*iS-e0FW61vpc_s+`M5f6`UUc{~O^b|`c>?+JI zS=(7v5HXI!ezBFaRmP3`DGni9hhbUYx-lsmH%&R(z1?@z-PVtxj}r*em5z={k%mvb z^f+(KocO&%AANG@&!Mf?_f<+aj(qrVFpr)*-=a%hZ{N}%zY%=(#3u$DzM-auyi$l? zJN_jGj^E|`$+&cXF^NIe-Re<*PxRe=4cO`#x15H~Aa>sE*xDa;!xX)Q!}He z!iGnFfgwF77NIy2#it5xJ5jZ3lBwz`qAf+GUrdWDcz4^i%11|iEh3Slqmmq%%W>zn zk=4Jwx_#rZHM2Jqe328bZj}OmU4~0_59pJ(G6#`$W4GR%yI9058lf*@F}PUiVqh9T z-3ro-3<&3^HvJw#xpja@5EIdr=C-{m|rK41_9uHZc!i+?D;#gw{W8~ zJS9KjIzXBK^wFQYVR|iy&6>e$=AFL?A2;XoX8CUNLe#4vT}3=v|9~16tk*wQe*D@nR6_sl0d=@&h2?i^+k@j>U;Y3fjR+JhD?y~0-XDChBHjVL6|5V+&e*CgGn%b? z=sUJzNrm5wKySOhtPq{KP3cAZGcS8djBM++sZ1V@`%{&0W=oL^wz4J$yE-~p+a+vb z4)I{G{!WjomNH*f0cZO(=UvWEW^7KZuwAYWg7e&f&NZ<-8Ca@|N$yf04!VqygFS((cRjoh z9Qy}Zyz=fw!-^mH-msM{{*bKfEgI^Bi>}vOgh;Ndc|51~^~8u)-0olsIzUg_p`a!c zI>fpQV-vE{t;nknrirp2t%k2!)z8e{b{G&Q-fMc&*E=-D-<9h z((2RJL3WF9ujgoL`2MHwR}Q7WNv%YezL{Yu?Uk*9`CMHo{3rmA$2j}4ZV&0QH37#1Klwi%o|V%he5|N}_FYJqBZP?vPv|sl*BZxi z#!uwk!WeVUK;xnASr?6e9$mbxa=;qHZd=e2U6#PQAHGdxWVUSSlE&DX5N~fAZ&(S{ z6B-sl3c4GGb@3@M{QdBPmXsqL&GW;K(Q@RXWkO{`K>AiyTOO^hMq;aGu%s5N1X56U zgqXsp%Lju5{~+A~8mxz>tNbnhe-PlO54Y5<6AWCjlE^+aF*TSPtb;N>Xe%f&&t6|H zV=z0%iy9`Y#xy#!s(o;%v}bs`3zy%Gy|}56bJ5P{Hb1i}Q-o`_lOBoAmtmLTz%o0% zCN%+7+Rk6GcTg-wycv3Ixdzv9uYmW6{&U&F{8tDGvad|49j9+zG?M-kq{96i zzCXm`4caTn5h!H&p^nI`NKC0yS*3@I9=!I;F^~4)waX;Co50?5pGjhBUMv>llv5VS zd70!b9s~2JqFHpR8WGhOFq$-uW>iZn<4#_F(5{@bQ~!wRv#D4mX=A&mL_cqJRjf-V zLYVkS%=qW@r^fN$XJgn8_1 zm1B8!+n+)Wg}o5FVg>#kqQkb8m6C*;%a2|4%Q-llV`3}C0|oDd-(am*Wi|GusH>Df zTwYUulCkIw$!530^;eA#H*DG!Xv7#Q4=yZvFK4AdEUt_+;7khoY&gQxXon<+<_JsH zy4zw;`^0z4Dq||gOU8DV%`1d4(V~sg6~!_m4oir83!APX(-v!MY~X?wHpJ~A|9}Qf z*Up2;g?HWVAeh|Br9I@WXB#aHQ0Yz0{vl_Q$;8Qt(gD1-IxfT*iIX*twKFeS_3;=!PTsn?G? z8Ms06cxVvViZfe-Pu6YeLj?exdrdI%-?t5>NH(#treSMI`Y5m zx+5S@9t629#pS=6i6HZ%3;~J`u2{`9I7T^Oq-iRR0 zXTEF(G{}0JZ;VWdZ`&6>@-sSrodZbzuKukBbi{0937eJ&SwOkdTR^JF7@=vDQy0)? z^s0brm7=L(9Xr{PvDV&%_UGPh*E%L|q-MmXx~9_(6$R5D#8(BWv!|tKi7v0AFIyQE z`Sd1tr_&l64(%xN*6+f^x9kTk&sRny*_#IMNDo@i%WflX6k%=ZW|H18lL4}m3Uu9M8wCE zsj1~x#P9(vw#?gKk9%!|6Oz+56g>D_Pfw=uZi)WZ)cSA(#%S0+fcRQs{UW|HtLCH9 zBln!OiIgs=X#$*u9fY!}%eA-pa!5EP-;dSK zfAfsAY&DwOv_Y-w#%!9wkkWvtqPz4&2aG}tS?SlfgWMg;WjD!nV*#(d-x;r3K@EJaTk(by@g^sw!`otR&fS8{gTV}jh$(Ujbi(5r1S zgYhD}vq5Mm!k(Rk@%MYVn{KQxe?pwK{?ThskbWC%y>VJm6JN_2Q0c*&f6me1DHt4B z^zY}fzen3YV}b9tF_~`PA*Ty%`-@*va_qw9QiRO9CS7k^RxY66c8XE`l`;`7Q1I6? zy6ICyv%RVw-jHif#oU~$;b5h(GpXSG6hGs%DDrHT1d7~eYON&JPK>}CqhC83m+g@m65MOS9wsNZ5il-=C<7Llt zJtOEBG#i}(&sMs-ZQnu}Nev{JOWLh#P8vgh?k8FlcKz~hVBULQ103?G^*&uUZ*S$8z!-|t+T@N&?^iX`3^dK8UbecDP_8zMFzgSLN% zA4?FSiBt+d9Pqe!j=Wo+DBxws7Pp1^}1=d zby8xtDn2OU`l(Ef*m$DSwQ=}cE5I;x+I6|xEg<%L(SG!sE)N7<*w2w|nJ-qeP_;Re}K z9tl_tR&{P5wa!!68k#gpU{{HhGa!woo1fq`mlYi|WBlDj!gZYd8K!k?<2{o2h!qCw7KA08`&lwwD+ z^g~BC#1(%G$=Cl4_rfQcRPc@0_>C*OPy2+V@0K*gXN>+{vG%cir1_Sg6G+{iM-M%g zzDHE7$8EBR?$dO*A(CC;<0X`wtSI1>F~2PsO{V=*GnZvk>_x5JqsGsckV$i9$>}(W z)(N@Un8Bf|Z@YCYftmkpHfVR>M)xMWNB0+Of$Oc!21)9#ZK zr_%$eu2EyR%;0DdAi;JV%%TFeBm=8ThOi%}m-2GpIR$~RndfHdK>l3jEFDO=O{QW3 zNrcB>Xz7vKIQh@ek~pFh>#2;+fMV)8fLsZ8$m3s*)w?Yt9KFZoBZM58`B4<3kbV)z z$?Qy~$A^UEl&x~)+)Cb}HGb@=ic75YNCcaQ5w0agGCF=WYIEGK{&@C#VV?b@pkOET z>WDn9J*A0OhT}_aH>}SUY1(BZyKZ$SxUh4B&>zyXXz^%fGvG>IuSw7`V{X#lsp!>^ zKyw9&Ru=3{zz%qS@lITOT70tJ>dDab4!L-S<^Lx(Zzf4Jg|(%CfSuRVraW zG1$wOc^0aCQJ+5#rwCuTazenOuUshdu5T? z^t+Xel$M!@`c6LPBI8UmejqT zue(C>>=LNX+b|GhOw-yti1hm5yE3<*0=ig!WjFKr%0uM!0gsL+q$m6XXYccv$t+F^r^>mp>3C} zu@2R+W9aP{=(^1PmB1kg($E@;Yc%{fLrwEAAZA!b<8{nj%~)JW_aYSo&rbsR_CS&p zd|0>|A8(bSwNx`JJc^j9F$I1!t3Gj-Zi`DZWiS=Di2ZZzXW(?(;VF~{XBJ!R+vvjV zO3+FToM+m}NtD^SxrNds@SUqSoWiJ9zVEBWi@ZA}<9nAj*EnNV{m#~;YVt~GJG0Mw ztp_(Ewg;4T(NKwDxazx%8mf_{ig~HL36<7Ybe(iBSGZ-zGhsooH)0M-2)H|CVP3|Q% zufVcLo>rCCuOnUOp8L-?L~+3&g~6K!bPJP*0h?q2x*ZVheHD!NfaZA9RV@RYPlmru z;pdUgg|^tRJ{uSh>p{z7tNc6uuWcY32a29?UA!W={>}0kXRiMI)rJ*cq*q3?`pb2p z$ne>RHd0oyLu0pDe0?8P3}q8|X|>hU(J&=G-Df@_E|IB1^4dvrKB?@tT!TVwUx)3g zwhND?%;~0yO4+Q4e&>f2!L~b^E!uq@yHS0~yT=hlMSx;WW;TDmneE$kvwK4K!W_?I zbR}WJY0M8*&+m7L1%9}(^#~!sMaEaBz0Ghco-u}bPVSly zX4Du)vj^uDe(mS;!!*9_{#SmlFjcTFV})BZ zHAo#C9dM2?`H~vSenG^sY{d7AOUrPHTcBev_zfzNABLtjJ0jsU{GW9^zkfb6%xj}z zH`*&u;c5h@!i>a4GFI8WB1>?@@=6|b!r}z;n6}=Yy7pkt$iUm{Ds)Lo;M?pcM_^XV zqQ2vU-;(wy0az-Fs%c2MrtmRik8zl13}t!J;Z!mcmJEFS^e{P~h2K>= z!IL^>`{JB_9j(`GZ%dllcrx_pMMZFLb zmY|;7iyqX~6Q&>bZ0DNwf+{1Ni+0HyJ9P)RRwmaO5exbB(djKB)~iF2%o|#S*~UH0C>=#5DGq19uIzPArM6*lrp#PNlLHU*jfP z?`sM4Ji1_Hv5?$fRl7NuvcKIG*?ze0rs$O`H)tFdwi`B<(v|b2_#3O(4?d^EPMhJ1 zUCq9jE|Y@oPGYAIN5;vlXW&d-y1-4AB`R*|1JvIN)lrBM-z3YI*E;qSmx-h0%M~0O z>0zHDhrFHYl_MjEJ0%Y=Yjb#;pIJ81@U6ia{3-5G=%N8L+gA!+z5W|e$pkWzW{@fOT=*vhj%b8liqPEd@rn*zVPOf{At}`0B51TCiXa9uJ-=9 zOR*n6rt#ce_muGby7_%Rw=ygFk+SBBj&t0`0tv#x-gF+O@+z6G30p7{G!19gkpDa z4iA!N5O@JM=m>C~$yN~4gE^jce4XY52a&c#2Z7Z?_JE52VM8}ey>OTDp6q;FqwnG1 z6dGPE%8NLOwSr(O-SDFoFMnKS?A?u@q2u&FDkTMwa8eGE zG($7!!iK#J&b4O*F*&wZ$-+5tP9W3D1nrW2KzHuAPh_F6nsNy+iplh#7{j;cT9OrV zt>F8-3i}^0DfeWN!H<|CWw+i-Q=IRp^r7?L8Mj(tBv?0uuM5w|w4cFkZ+-NC#E%3+ zzoH1Qr0qj8!Vf&EDJ6)OyFa54Poz{g+u zq3B}JmW$#+2q4R;!e%clmd)quxcgj+VYk1}^z7sb)8%UeV|FK&wm*uW!rryUq^p{C zSG{wc?QTr4o+LhGnY}qdApPorVK~0}nymzHzsSW^qOFJfL zH)2tL70o8)%+sLIg7_JuN6YDSYNzUcpRplsFmFJy1Le59e=8eNbX2m(qVHHTc|ZMxsHE2KwnfkQ5WTW%Ixhi zy$UA^b>MXB_Y|A_l#`W>Ca)FYy&^Xdg^fwUK$<(k(!t7&ANuar!Pj`m$wt&)G(f$x zv0EOmBG+N-9K&D0VatGIV%E*Xk+0?~ErwWCegu6N!%uU)! z^WF+N9``+ytt9_)%(M^xbt-n-_7kjBu)SRAdUvnQZc>5{&xO=^gIow3V(N zKhFGqHQ8FvpAJ6$bnJJfaE0fBr=e%u?nm0R){Cq1RkP*iC0DqyTa45cZ^N~lIk(lW zx9S5_0uRWQeIj(4j@Q!mhO^w>)%3&HuWg*sUzP(-T8m}j`%$-kfG#)io7?$6c3q%K zEnAV&m5w>;UVxW(7ek(N(9H#U&c0kthq`~c8N-fO(GhzV|Kr%3SEjn|6-v`Rv9k!3 z>94``qRB44>p9wo9)v}&{_b47huzB5I=n509O+y%9>V2wH3oNZg(sVcA{{U)D!JdV zTk!F^S&H8*nLeYx0DqT(Pv%8y1qX7n(nRbePTtAHQ6}0=#YN z=a23wOhd6^?gkMOi7wHByG_nb#Y6McsZ{kYz$AB5?6!O81p*2|Dw0lHHS?ab3ndyfQ$H zQSGwtty4u>l3%MC$=&7^P>k2-Ni2-&if~PLik+Pw>|4fX_Y0`EJulPaq#QgEaJOkp z-&2lh94AT`-~Ac89BL3`X_#_e~>BmN%{Ro{ec58iuVXbDg-z|L>zE8LeyL!)? zVkDcV_JhmKTWX@nz?gwxf^_2pR)XyO!;A!of++FwH*A@H(sJ2<9acc37$y)8(XH2g z_a|b->{pqW5epnm$od=9IFI!qR-_*PHW#ev`(9c-%d+aTPR`~i)ngwBxR>3BS>t;szG(lu3)>TH)xwUx`aE?8x`M{IcVBH!Q?u9o)MyfUDeZJeMU!6 z5t{gT=>Z6ayJRcA@x=qmyz;wVPwZu=$JF98LsvoK^^q=JRG-RIYt>+@ye={LBCc(D zH78w+oj*}-9w;o>B3my`cp;6UkDZ-`qvK79bRKmt(X&oo-Zs$gw#dZCI=~ZY0CYQ- zT23|Sr#6qdK1M4D0E5H=L~A)$ec5Hln}UkK>pjUIF+#qV#Q(8W?cC0j#xDdZ_{K{` zm=`H;bwOxrcBREX@gm$!B#Y$-5DWE4#N@k{8Q!M>QSxS*Ei~z($mv2ly5elh%x-@o zo$_W=o_8DWM8Z#6AxeI~MmU=%j6h1f`?8`sBF1v*GnE)(!cw0D7{uOZ$#aisIos5K zLRBI2OENzUdljKK2#e32xc=p4iWn9xfdY3?ebz0aVai%+&RMB;%#=-ng2P>hzM^00 zj`trga?Uk8kZ^b`x8Xh4?VKRtMxAYWxKX_}bjxsp^eE*0sJzU!z&U&KRbL}|v%|L+ z^zpIP8Ds1oe+Nj14OHji-bfWzAojN9|dUY?B zanh25lY!HR(yUvP?tgzA%MG2v0vMfQ(gDFLaaL8- zgT*{Jr%*^PQbhvERoEkgbj>v-1h!q*uPqu$1 z3~cuHw&&?^4Nqil!PP|-82U;&aCffVb-C6PUNZ_&Zi-A{{=6!REUssF5NWCBTwba~ z7ICem^l!91Nlr~82A`4%!cr^amPC=^@a;hE@J|~?#a2UA(N_+p3V6r#*Y30BCkD=d z%c=6;%;q05*Zd?GYaJXx3oQ2(B=dYQ53L2s!C6CYp?QWPV)+M8iqe+|d zi#t&Lr|3cH0|>nS~xzstNrS2hP<63kes3l>c`*RM^9^^6;$V^71x)-m8YUEi|$1e^kxrMiym0gi6xYfqF z0AEtXT(V5;8bzB>jLE>-9$o|2%$Vmks$Ox?l)2D@&PDR5;lP1c;ile|pvv+s_4?UW z;pqfwI!otSD~IeIi`WC>jnvuO8Vpr8;4H9ZfJ6%Fm@z@udwooe$CfDD<2lEd4t#YC z;NvF&ekRy0F5>S;GSoTA;t@zdo0fVa2C49C{f+uz%*gr1i zuLg>F4Loud?NK<(RY2Y3E$H+2KUu?XrCvbvQ;Lf2 z*bZczi;0fTBLJOY?OYJ+aA3hbP`2=ihGOEoB?%N+LsW`hz|ldS{)_3^>Y6E zJe^5Ls4_4+D+W<(y|~nyBODe25{>zX{;B~9dv_d%^FFyL0oRhpUFw$rM>f-i*gx3( zd{ZTwzBfpm+6oM_yVSm5U4oq_*)K4T*g{%YiK5YNqT^kfkPg+LqwbfFC8K#+wnU=1 zQqxsaBP+8xu*d_sA?S=d=}|)0o`-`EWy0a-t89a`n5j{A%_Ak2j8KLaCc z=zdL%B6mt{@3Dv5k&JxH=EkCcMTqs@m&OVSfj)vMiC)4iQl`I5m?OQM~o8{JxK{Qt6nu(sKejIN97h;|q(% zr@WB=5^aAkhH$pWfDpufa=52I$-Qcq38}EmP#94W>XEY&rC$QSFvMpKNsx)UQ7V zi4MIxnO360J)~lD(%C%RJV6()Ceu*F$WYh+?Nb9dXmn$fu~SbHq#bT#bBOE)S#k-M zJGd=7Ib7}k!7UsSoV!WP>$ofNOdLKwV3IlGnZ~)((}wPx>)=W zNA(Z`--BB=*43b-ysh-!=OZ@pvI^}L? zZI4P7K0?ghJ6tHPONMtRtGO<8?a1|Co|BDnpSKUmth!^@?CTn4ChNU5zPvSL?9k1$ z`{A`l;b}L2TN1r!5XD2;7paq^4@VC(4F48JqOPBEM8Q;V)L`WGQRC5;%0KFF3ZGIA z8Fy8Z_3l}Pv`yHQPqVo&Qn5Rj(=U(u{Hd)8V)W z2&39pU*uvI-7?GG`02Rwge((;{gle`2ZEHwYd_AYvdkhKA)Fa*n1lYprUS-?2`e@S z1?a;cn*(BgP@@pfT1kOENOp2mN{*H3nj)q>Jk!Lf{xN2ZXCPxdYQ(EciSC)Q?1EYs zd@YU+*F#q~z|8HZ%na43PqqxTbh-LX zi%`2}!=7r@m%f{F95?Eea9=<=j<`ZtK}FjH*D6(r5pdIs+J^FypZyLEokTZc>9@DD zl9dvah8wHnEvM>ZT#Ndx?yV4CBeqwcd@#rj7eNjM(+lKlNS14S-07FjV!5BX!}jz^ zA*G>jMZ}BkBbv4nLvw|G4N0bbPYt#~Vh&bdNxMpyE?W_=Q@2tHeMq?*Pq(c-7duc; z?bdn3cx5D4Ae`Ae$!Kl3>$bs`1|ogr`n9p_h7rm}J1J5v{YHOC*t4fBM?tkrmpVv> zwdIl{{tcXJtO^MTy1njtT0@Wb?zFxiuNio`+3nDUOg4oYp5(=!aI%Lv+mjwL5z^uN zg*aku&n;RyT?_4a)8cI*B>LDrF}%#gNi-s(RwCUp>T>ef?^3NXkA#S{7IiqLa zg1gv#>*NaLd&Z5QdNWnS!x$$lBJg*w34LJ-XWtX9+z=n7-w=C$(Z;I|nZJ%#w8@RB z#vCW0-|K1Ez;+|2Q%A{X^o+*dKNL3x2&6M+7s|gBTp)j|uUf#ILsqYu1*X5u+l9xY{|e_+rNz)(metSejVn) zIaz=@O~&wmLpMR10%1^Y+4C$)AFS*N>c*EKC1y3I+q2CJjCG|^0{lo$pWn?Yv5m!V zLB*&^1jFrW_VS)|O=kl@t?LweRro-rM7v$^ril{=_v)|RygO@kI#*8=iLd3q+qG?< zs2$MzHWWa7|6Iim{0QcLx@9f~I_WPe7)Ql5cRFE_HP>#2k?X~rY||%1`FxWJ2iXqp zAJA;ruV(MY3j(QTKvFQS5Y_l>NeJPUs+2VnZpgmyuHp=X$U*=aMNJCk438t|!|F=@ zmDphNwI9OA_oX-K>+{jwdeCBz#^B*UpLuMIk?HmAZEws22+Pc9=2%oM^cn7lRPZ=fC8Zv4B&AjQ9sS#6FxqM*r<-V9iB&mAhi_FpsJ~ZpETjN_vjlZ;swNIlfu@wLC~};-pxqbP zxsrhKu=}U;sqf_Nkd)_=BtH$5{nLYIhyzK!_t-IYSQJQS7vYQp zH#jYO`yv33P1li3-~6ND$-}33uS=aKXtqMzH-X+_8560H1Ey{Pj&*AiF?uHvSAjh| z|8y~ORF3?kv=9%2#&znxytDCI4D(av=T$`}5N-LbIj*aoCg`89UV9oJ@TX4zGDA)! z0Il}R+5A@1;DF_<=cpRiPD@%kigKp%1fpefosqJeg8(5pbQ&E*OA3I+AG zeGg2K8{~*78i3=V^*T1DbG=y59cs~ziR*c}3n~@|CHeo5CjajTj)Re)4!)a;`X%#^ zxSz6ztK}59jiu0!kU30#^hNUt`2%++l)5V+MEsvrCiWjLDr=MB`(#y!fr!q)= z{6eDy+Gw3j*fK_5Y}sjSZp*2A=?_(d8+1)!f3)RugPY(1omBd-SM9 zg88syE56H~ryLz7q^o`oyJdp$ME<)VO~9Md)!e#sx|`uw2Y&_c=~Bjh%aF|j6nQm( zQgxDWlUfm*|AQCx&ah zWny9~w5WHPXbq+-6k`8|hk>FspLO73FQvD|{I#hX>G!QKnWLVnU+kyz=`|NB-G}y3 zF2%{hYfStdqgXvse@Uypj%1g~;b{&tvFeqSk}^mpujitVJa}O0x1YUI4w%Y}v|KcS zeh)a9B^Qb#Z}rkw+l@iIq1#n}ZvlEQ(1M8BbpZ zp)kQVsCq*J9}Bk3`Od%JA29a7{O)Lqf`{TS^1m)cQZcfAb-aXP4YOBj@oX<`yum!j zcM)e!UANiENvAqrE0jbVCBJ}^P$BM^y;yPN+!`W0OlWC&fbUkmF3RFdR&z)7Js`L1 z_`13h7#TDhI6!5}o47BuCgq=o?5M%heUzMe&PUlU7n~k(Z-Yto^Z4?kySZdSNatQm zkju90whM6wXAyk#iFWt3J_%6v6#l763QoOlmWq<693n@EzGX}qQrPF#8!qZ*)%Mt{ z!2T2uYCsP}Tvz_=ST_vw{9m*(;0Bl6|9bwd!TS$asGk;9z!Wb>-A2Xa0z|WD+`|_! zVwtSbVL+K?HW;j1m7kxl_uikye35jth+;fmK@H^z$?itl=be% zdn%@0VcZKdbr<*{Ie+IWL=mklA7Jlx4xvY(W2n-Kp@WJF41W-qvDRZ*l=f7 zzS?Lhs2WbE^(HAvcDU6P^9A>qo*^*u$FO{JHsMPgz|++D-dU$(%cMC2bGh3;gj*&C z*Q~w9OpW14EyRb(+tQh+eolJ`cSHxnuavJu&!HDd+oem#Z$2t}xn22-tNxF1@qQlU zjW{w<$>FrrE<~@wE|`XVL4pLM(Q|MX{#Y>FjO(z!-U6rzct1zY#n16=>O)4W|_p*nBMZUMxy{B&Xsj6+xoh6S}?!_P|Vvso^Y} zd4))HeaCxHR{y~R{}*liKX_mTwz3&;Iy{4qJ5Za3OkqorX4Lq>o<+G?NgCL~q6BjD zoaXLPj|J`AI&AI84vCQ<_-}3inViDr#5F<+LsV++9g}JN=pd0h6Hk7 zc9HVo6Qyha{CYa!|8vHi1K;Y@8XbtN0C(_IfQzMJ+!Q6Y}1y=qJfRe8R zy``ndTX@#Lpk(Cz|JjvKFKxz9XONS;`(bBVw{h^;^V308)6NVAoW_cT{ehmVgJ|ymY(9_v^Qa6@!GIuE zfEGx@jD#zZAgw`LOY4)HUgZK7`^?3qOhl$21b~bSWzE;$z5%Y>XGE%Y&YbS-HwYe} z2vI4qniZvM?2!UC-N*yOF^Xg}QR$s^1+VwN`@TMWLaB7!PjhvmvP&HV$#d|> zE(0l|>#wh5uq!LeBw7a$#YlQ=-oGKM^k4*(@JG$B#s3-e)e8hoD2`7!X2@>FUS)hD zr$bj()ySvulft69Qb6fK_e(qc#U%XU?Twnz$GhaSu`Klh6i(yKlP~Pi&Hds39>|9O zU0Ug4Nc?cVqG01*hRCJs)y>+hUcUk;t&flPK^1y76LWgg#dfrbxGrlRfccWz>D6|L z8L84EdWm^Ma@Hp*h=w&MqA-JcA>bfG(Dnwagnb&2?u_{fejWaHxG>gqEDpS+vt=FU zUINYLmoXD>wQQ<$MEn@abw;rM_nQI@H^TAZ#?b7^u}Ai4Sdm`d51{8;9=A%(1`pM8 zoHTHp-Fn(x@0TyLYAF;Rmoy&Ojwo5KPocMyH+*uHPPn+)z%{|o|Le7X zUUMHyKzkQ3S(R^!-qD!pt1K+vAPfZ#X1m%Yx+NJaaEGk8MJ+3Fa)ss4u zChXKU_aT_OIG)>+B;MPT@YMgax{v|$^DmyNsAwyE>>^jlsw3v6}Z(N4L!9e8lkcNWpSUqvn=(fN;Y35gU zqebaPP7S)rbpam+(iJIV1WT+kGBWZ&wnC@<8+u}>>CuCD_Sbl4(8$WOL+q?RX*w7| z4Zl^2>>vV6bBk1B*ZC#S5(06|R0I4?^*7%uCSHp09A-5KO02u5Y2|HmY`$k|WGl|` zt7}=ECo0}WQ7iimkid) z=F}0+J<9```QXb$?2xUe0`2P%=kagKI;Wb3$DtU|-4$C^O!qg85& ztY06&?05Z_T)>WJfbIqm*Vfhc`U>3j*%LY)p=N^s1;ddpwMRhS7O~T~+0N=Zq$asv z%%NOA_WS~qMnBf&WCXm6{qbG1yc@*=Z|JFCD0*{6ItbqW+$f+Fve`LlW@bd~i@#_e z6M#upy6Y53w(k(?9BCiQb(-{L`$yKyGrImmw)=f3S=7!g?VLTenZmOu1kcTz2Fd}= zYCvS87mWTK6_x3C222^CRKHZ1Oe;)&1rv@*hxw$k`j21}vpG+octN0?6Ut!r@%YLX zME{rB@^zX(s+Lwdg`zMXN&7VPqC~<^s3WLa7+;)?GTU1CQJ~5^RO3#-_T26@rptQd z{oD8lHu~`JgFb{Z1o-Of3_s-a$SKKon(ZZk9D;nfBWrb=F=tWUTXcsd2YFx-_(xmu zJA?SKS1I)mfVL9zoHOw>Pf`dWp=I4ELw<%7h#18ihXI&G+8TmQo;O#A{e@O9iCx?c z)(o9Ey8}MYF~koW)S(}d+$!H6+Qn_@PoRYS`_4hGx!!zb(*IPkiOfl(W4s$d{Lkg8ewY8YwzhsSHqKqrmphln z{LyV_Fl3lRK(BqK?E8ezi_1V?=4vll*c}0a@7KB=n{#utMCm2dvgj!j9t1gWO=O&O zh|lySaH^5f$MFS~8ltcMDon-Nh)GN|*AJ?ml zEmIoZv-+jbeZC+~zq=b$UK*7)M?W*8S?qtZC?Nb?3PD==#Oe2yGDaolv3MH0Dcc26 z`cH#=+s2tF01d?6&wVPAxA%}lGL@=*Hi=CRXa;ExR7m5MLXObEO9T|x2Vcw;mRU{b#C;{S;N5%bgo{UjWb z0D+X5WYefstSB{yGZnnck==BPx6y|F=HYPEp@dsCvMB1=1>U@%hOSfW#dEYB5#Yjj z&UGROXI0zZxtd+erApHn1GfwN^7WVu=+^|*c-w}L_Oss%+L#Kq$1DwM5LbI&Em59) zqIouTpB>pILAY=_@BLGoWgC56r_xl6)3~Sf-PN>TO&Tz0)Dh6wPk0j#UA_Wbp^EW4 zBwj8zTpgg^L{5iQ`t-mWP405XIR;l(*T_r1UGgLBMSa(00>S47sK?1!;PBbc_aBl$ zLu{|2@10`q^uJvJ0SF;$gMs+M@==`_-;Q1U1VF7;IGxVA6uPBj59D3ZK3GDBQl??d zbg;vLYdC+U@clzb_{?>rD8l3Ra$aNC#4|F$eRbAlzN*jvI~CCMIoq#(H>ty%)ut}v zYi;!F40AQa=qEM$GHRZ12&*8L(dLX5Ym0oK?Q;kI^_Q{e?e>##fHllNz9&`h0pF7c z=nt4g_MpU~@f?FK9HiLnJo}}TpT&I5!YF$M*x8O^QJolg9>i$O@mcXbz`O^IKFaiZ zfc?`n$yOg;$Q>Nq47o^8J>z(KsKtgMTDk9s!>a~}`T&UT&vCYZCQcHg@MrVpzQ0>D zFg$%Pi(q+kdtegjkhk%$p=1p(AnFML(HEGK`qy%<*#!Ss@WKbA*XSOK3l8`{1OQ~S ze~r7wiRs++3%++eq#*rsf9cUU`_5GQBgpB?S@c(T>+N_tNBD1=*E2Nqz`Ar z0|Ejf_gjVTr$39|qaiz`$6{n-k7^owSCrqr<<9&3o>C~DW*b&Y!!nbntzK{*a z_LSk`iFdXXDf{!CPdk+UStUCbt}~@MPk(_UTfQ({`0Wz4B3Hw(E;d(1Z~1}Cx1YkD z*AyeWf9c+a&%qa7FNxp6Ar6l{`%fSIa!*{+T;p{4`S9ws7;zNi&7SXV{O5hfkL1KQ zJU08DAES|1ia+^+{x#48uUl~x6|=EAVPYx33Qpe?SaCS(%bAm6ZDkZ88h;^(CpI1g z9yqP26F**B0y?O_2>)$U2J#go`hzUIhdxa{Pr@kueNLLh`I3?W3BkiiN)kPTX7sFB zZ;yxHa!Aq6nsC-Io_x*-FE?1L^{xcf6aYfpvBQ=qhO2>JM#I49m#h7(v1bR4r=&w@ z8*-lsCf@s591Gb!yB)v<=sNQ|8W>S(P?vLrzCjvsP&w>tQG`EJ zP&zQq#_lihHeWtCzB!m`Tzv5n!Cgwm1doZ(&`SxoC<7(*m)R$1yrE@Le^WTx-HwDV zmq+iePy#8*Klgp~KW$7Z@ddSx2DY^=>^_T?JEIkR(tPUU4~jl5RN~ye#T)~d(DwjVVg)!KWV5zQO)z|!FXCkEX3{xa-A4rG4NBF6`o&6~}C2##C3DcfgHC!mSL zC~RH8^W?>U8{f~j8=3BEnue@(SPOEo@aV0ar@eqFEMOSrlGp)Dvcdm1L!}2==h=yI zh!cF&(J-?w&~-kh{{U1==5PKNNucAY{_mh=D-N)ZUX2=^j=>qC$u>;I+tMlwQomE1 zx>d|Jf*@|^NUN)Ed(RU|Jx56Uq(d~fd{(N_eTV4Z-vtlR1KJB=^MqPZ(U%foKkPjs7n%a*PYe)q>0M3ZL>>N$3NaTEb^_2;DE z7?3^-IGn%9{3iJBd-nYCKg*5oXjrN0CU zuhSbo)c8EH0qD2lif$mt6T6cZhoPNTQ)&wmKK2X0u;gy*MB2PWvxUS@~OeCBf@85|tk5KH~U4)Wu2 z6Ce&=;{->69B~4JK0dS@Z%-r0e^{;YI1(@?YDW;4Y%{;1{jtp=RJGjxGzU@po+leo zJAi1~o4#lsP%N@-=Lk1in((yFW}G(tQ>Tn*!?`o4I{r^vH&7i6WXvM?4eQ~GbN^aI0p7&$prNgf76W8RCV0%aKx*JnK*Qj1S< zcV=@rdbqjc1oZgbfXu@>s|>h4PdG7f`doju{9R;s)%vGAIib)h!8vSmejr;gHsQ>=(l0edEF1=qCE$TYv+A0IG4ve+&DXaHR`_UFz+12YIa> zCOs*awAqfzXI4Od^&ha0)&ar$sH{b08VUnUDdb2ZdhcEzGA&*?ORC^h2dI}6y;IPRG-*+{X z6W)Mm+nX4pA$GO$TqqDeWxNZDy3*!4SVbc3=0|}W3?UPaeBE&mF z`r)ruJ`N7$bwm2Dnvyq7k0Lkyf~Fw$8WdN4aZSBwqmJx^JF!A)Xmi15_tlbo_FI?| z9*Mn9+W;=X^DI(vEG$9dw|D4@V39M%ae~-6>={S9)!Pj4Dfd+hkc$OyUA@%~T$))S z@v{daq+TjA{FBhHSi6q0bMy+>U1JVVBZ3~Zmf~U@2{|6w4^WH{qyzZNS*_!3l=!s< zpct$Mj9aXF7A{}TYj_lw#IfjnCn#YL;lo;=`2`;Pd3fY}v^gGiSJigHn%Q24l8^Lz zrY+1hIlP#$O#$$FE~4t5oA>=>YziSw@+G~|>GabCI5PagZdyz8{^pMKXZ9blsAN%n zJR+jJo3mfXZ~5la9y8f2gN6*{XQ=dBIRHbGd#Bhpnu}gGRL@T7HbRcxXU!+^t;F_f zk`%#vp;$|}*pT*?SR{F;v=V9sB=6!0b_728!9WL*osf&;YX5J3Qen5Fy)6f7KA`TV z0mQxUZQv93P^Q9zlaJ1wK)WoX1IZ;F;ETkE=r21Cn3f;wa|!*|zZs|=K>7gbOze|9 zKLRbyrlwq0^rwD7A(US1)WY=Z_4b&eZ}z*fZ^Ye-uv#QAAKVQmySVS;BduLj(I`KpuYo2$~^73jdM{L?g z+6H?QKll^oOa;ERLm4b4#m45ej#IJRzLyeRaFb8O?RU+HTqdax2K+>`W{L4i*fs(< znn<4-6b(eJDg9}&5*N)XCU$w=l1*VFvZGU>`~r`h5fe-qw3y^|g}C!wtWB zG_gHpzznC_X1+w-r<@}gTA#MxIMxfh2XqJ+=CFvg%#4d)O*Vfbk5@9!&jUDK~4;DZeXX;i%jBIoDs(%Jnu^Te=^%bn!Rm1KWK?nP2m?`jUS% zypNy#IR8D|o(mUuUG0PRS_7I2RRI3i4_^n~v1Oe09nQNruUcDk!e;_zmLKf4tX?8h zLMq$6)N)RIPShxfrr2y&K-V`z@_OGLeto`QvY&mj-1x%t;t2PaM82Go6r{7x z3*WhKMAl1H%_QoOP{P19tffw@NFaPb_t zWpl!pk+i4}f{vc$QM6(!Iep;1zCI~n5bl>RU#Lo49d8Egu~ohg%4|FB&gp{1N0%5S zUAI?2DS5NCP8IKR*AiKxM8&LtpxSq=8@&MpvQ$2E@kqLm_V^3xC`Qkz@$AU(aL1Ix zZ;Do5O)WPI`bZhSKSIaMSbA<4fG7%%Ud(`U}@31I@CXPLGMDnc$ zKMj^a2$+BNE|0|sKmPW>nAIY#ZGhD#1KRj%SB2>2v!q76gzhuuY%A@#=84>!&K$Pa zWD4{ZWyP$1WdpLbttv0;nbBL=vGBkXU{@p5ovqUe1 zw^S~NjN&ru9m~I(lC41^t;x0z5I3eRHhGK%w=!>cq5y2P@cv`I6@dfR3&%G zDhcUky2VQB{&1~g?)})+qu?1gWx(>yFaG*)A059kd!wQnt(c!K~|< z7KP?x<(fWmKUWSIit|3=96o>$!A7SQP+q(nL&8`MkWV?vPc!n#gHo5GOe;_t=)bHIL@ha=`92l z%ZM!;|G}M^5LGt;HZId-RxkZijhr$5j^U&78>m7YGTT8qPU+Z!>rr}ZuFYtRW+9lM zz#p8w&`TAf<_|mwGc7D!L{67&&nTbOh@HS-zPFt#51b?r5}*ES#r_E)IhWa=6pKu} zkK7V+p=)6ha*3sy%yFWI4he0BWtvT2ftR0WmFot){66rBh=Z0OtyYjRPq`>nq%np5 z6A3tvNKS%0XEaK4dTi^DrYw9~DiQpgHgGYbhM1ORiL)O%WqghD&F$ibCl3rrK%-Kof< zZ(K$5ki>g!&2e1J;izU{evNXuJA-<59;9~#?CHkNe&Qr{bnt7J3D_U^Ab%ga2!|*M z#Y`C1_B8H_7oO+-&&EsjD)0)yv@wO(yncN8f>;2@g|;;urcKzw?T`@HRLT-YZOk;x z3}cEwSS<{fjW0PiFY%?EW$yxIYdi=CU@TF`Y9pI6=9 zlse#{J31TMADG{*=t6I~VXm{RjlkTSI1m#0ga@wm&tmM#kUhXBDKhBNcQ~(@&jr>+ zP>0+ack6!RCay)N53HjOhjP%#-lTdRMT_MJC!K!c_hI8Ht!^tn4h8k0B-PbHAqTq`TO2mW2H@wiG$JIG zurZo)wlB@FSiNIA&T_y6%U2 znW?r6 zM{a+If7n1AeDv6NDazem7MB-Sx0>%>8U-UnhK=;N6(TrsRu1AHZQ(+Ovyay*X2D}4 zoR^dg7YdqNPccV41bNbxFc@-kepC&`Iv06p&2?)pcmRfHf=P%9DL3K?Anas3_`8`5 z18V+rf`1~nWYY239b7Ny_)_-X;vS^W8z_^+bHZccM}r6^@YEDNE%0Xz?em~iGLy$M z#SU=LFlK}s(RCWIp`_UAubtV922M^!*JcZd7RPLkqEHu~T;gbd<8DmyubUQ9W3yhb>?DmWcL99ij)|Qb zAJzWVSq87M$&VQs%4LffzL@mj}Z2@5$`DJQmf#dInN z({!HzeOp&$_Opwa2It!1C!hi}3A6G$b;BwvtFG(?fcWNs^?y%}w}WdO5IKMKz-&;4 zYjKFZK;r^TZ+3Xahq%TMaW$oEt{LrVdLLw|4m(TdQHDV1V(%gO^*1nSQUm7ocSn(c z`P_=NI&E7l9iPwP+%P$^7O9C_5fuOdPgzk6Tf#_opE6COvpQ%6cH!&WK2wyOGqffB z&lU9ld0rr4y8B`5zzGImft@lAf{xXrNgKVzua&_^(?TnJVzWmHIfBL#mciG5~1tFJ6s(*iOd!V?qUSfh)}IIQ*&@B)`dSla=sn}J@1 zF%Xr919%x2FyXHD-h z%c&Pe5}AFZ!pD92@}ZtX0)#m5$#Y9qI8{zg4&>r!-OwGV#1Mmw9;^S*V`+W`vN_$J z4gxC8(7t5;#lW!c4?>=@%JI+Hd&9#bBB~6j5jpqed94BO=uGmj4bRP8uFm!s1FZoo zb{gH{ush%I!RH|tESm@>AWXK!&=~!gwnW6_V6LF{+x&UFgK4`!ln=js9-LUCrlpZ zsR^eeJr>WpOaI=BXu!P~-}xbjGzTav*x5=&yrf&~I*Sb~ngz!NR^qp@fNMU?1V1C? zkteP)8d4ECm*KS>Y4>@EA<^)?j5#(rnOX4#2o4j?&hNP!IroJz1u4%k>i+~!B9Z*X ztkBnU<`$KqBJ~7-h=}b5J~o~7k)ZUSytj#{NaF;_2X|kn@Ay!BOn5d`D7_L0uBj^nZd!2qZNTk z-9+f6MbPVu<7SUs(q_O(TR8}S_E)!uqiPK>=ElzOtE;@(ov(L@h^pv&Bj4dCch6vw z^==T%I!aH9eOuN}a3XnB3d|<5sRW#^B}*m7$<6z3DAQCxDQbL!PM7_nxA>=2%!GwT zC>w`K{(fN78TBqVzwCaRN8`x_kKh`WMnwGzm#99Z?KP1KzF z|L*H6)ZIs02WEOm$IvSjebG5ei#eTfh$46+GN?bpN7m*NraH4tlznl$3EdbeQ18S) z*0>qP4{H-}{{w7~0L~%c_c{XOc*H#Dzc41JA(@~3dC-3u1wx4F&3m1^u zh3R^8i>G~)LgxvwHtddNV%Sil>-|s*SX?1NYiv&0uN6+Bt(`>xBlCR?(5p%B4L{v- zMaC)YAv`6ag?){8<@L2nTsnzy@igo0`4;0Pch!;!#Hr6oZ1a)cg9|z8DRl+6DHnbU zXJx%f6OhRoTl8A4QUrstW~80i3MkfltE{7yN9IH+j#AjI@~j`tJW9gMzUY1I8?|Pj zFisV>ky&m&Kk5Oz)xCphpviFF?`?r*?=nq%N|B#lt#mL?eLU*BPjUyCryG|7@)w*^ zwfs-eEqR-SG9vpi>54TfW!VjViDyI~Q!w*s$~pPgV$P99bUj>EZ3s;NFbk-HF6K&b z8^I`^7QR2!98H)Ha6)9n2FN-&7{b%T_QYD*F&j-<* zF4?cgFyq<|1zssoTIiPF?B^UVv!kzD&`jC!RY0`YmPH;yw$vPtGQW28lYxNp*M>#n z94i=mVf=)T0G!x30ahO%ZZ-+!`lcqK6Nd!Oxgk|pX)ic6DGDi1&-XX@fB6r-)L=Je z)gJ=kv6!qr#Y3)4u+)^y%I?c7EHJt&*IFTh5-jtmo)NR(8~v_^$4jK5rKNQSly7k< zD6HGw_OxEF=cV~87bNB==HUS&pAu_0sI4YS#o|d{dH2E+ufY|@3U*NOOsC5N%Aua@ zV?WXBBUN~rf~<^88DfS;-0wsz6l++T((|Kb4DKN?`XLh_aWi*SfJ>itFnj@!rG#1~ zRw-kUNa&4Id-us9r4EG!&qi& z8els#FYTp|k7x_SMa zH%Vgd1&(6xVc)tdEL;f`)Ac@Xr95OBjL;if1^#B*C`H^&Lk9KlDk2O#>_x9m1_t_d z69aEV)HmN!K>#?os#~QnY}kOIdXgRCZH55|-v(y% z-j9m&ZXfHe0(doDxeZ$%1CyuPpOziqk#vh*?fDS^hp>$iNI&|N|6YfA`hmk?s7vX^ z7)j}7RXze&QblP!%vNxeYO^WpLy7r&%=JyQ9s(Bv7ME_cy`6&Nk4bBqDEkGc)x!QIGinKcFyHx zh`mg$oLrQ)kwrw+1#93>2GWnd+Oq29_9M=Y@%UC)jBH_9x2d|#0 zdb#<06Hb*dJ5UN3FVWpJ_Y;BXI<_b*G3mdP%yc{^MpXjUJ@+G@gD!z}l+rq|hq?ZD zs>(VD?3E02Ryn`wx5gwB@-U)r*2OtR-0%p;sgo{ns_Mu}d6_~kD@jlLiSsCUETKVa zhC%;%yW5oF=1zk3D5tVNe6iYu^0PQc$*9L@s!bHkl9dyy<=f+buG*^C>r?|xGIDZw z)9dT&i@8w}Qj8?QMiR2L-y|Sr6DoQF6Wl5InSTKRH>Xrlr@2T)1Z9t_?T7#HfI0c^*CQGWL%)Tn3ZO!=po zkc^|BEN|+Fi@>_s{QDtrZmB%{nr01nh5OOyHRcmvw;(SP)*V|4L)$-(rDc1mq!lP! zeA~1c5*hF&?nEqesPsb3SW&mcR0ZoF6}K@*r6K2(_sXql7#KRb0mu=m;{!~;zJsMI z%RiB1OaEYBWIBxF#gl0j!p1Leh1A%A8I{C_u9!&Xb}&pUoL_3*>q{avgNRt#izd)0?pLvD)C|=T#7Og8oD3rQ8SiTTTyG~7dY5$*-2pRG<07ud z>+PX>b6JVs8sh1?uG-x7U#yJ$-%7%Q+-d<(?@AobUp#?|#Nt-(B;sfuVO%o|6Sa+`i~vo^TeL)XhoH-0q zm7z=M*R8o#?_DLpj>chYKQ#j6X2o9r-@}zX^Xe z^6HZ2FLR;F<_mUf_DgtSF&X+6bS;paC~5Hq{vr+E#m&piK?_TJqgnf6@u+@i2gYt` zMu9R6KH~%v`t`ut@cS-yRcF*o_-U4=7J6mVGUkKd7fsdO(`A~A!cL562jqPFt8lg~ zk8!llP)h$={hQ#0TatZmuMqo>QRblCxyS`?J`U%FcUPz4uKqg9A(DkWv{n=FPi6MB z;gPcYLe{e6o0%zRZTtk&MpG-0v-FR`^6+yq2yv=e4#3E;-w*h|UuYg2`8RivXFCc* zcKGZ0YhWcOdS$W40z1Z7t0HDu?!p+%fCKz5*HB*4bTB>MZuk4`rAyr+wyYU4Us*)14q^ zu*S!KsF*wt!N2If6MzYf_lEA;W7ag<1pMacVm*2Dwk!;4L zkC9>r*OczrY6utfvE#ZlNfJ?Sr34b!u@9@yHPlN^^ODsZHV{tKLaPzv{V@Qq1>OG6mE;#12zV>9Wmv9;N|$FA!`f?E*6wu zM1*2ER{_t07f=fSd@z+NH;(n@`T zjTLE8z}C<^^`n&)jKdTG3PIZ1niXL^`(`ThI+xE7$obV-?-*Hya|>1_89_39dNzKe zuWmRoD%b{w-CpwVr^4()>Tq#?;z1YfIouX_!b4|$Z!>uypZ*A7B{V#}&NWIuNk=+7l?{Jhx9Ig z#kiiRK$5v7v#gYxuc1E$!Oe2Z`##3WCxF_ruo8aW1j|DctF{!3sD1!x@gG1fm`q^t zhKEP}7l0`<-T=@n?IsfIdBaLZfdOmc4L6a(O`>1BcVBaquyN)fPB z|7V%@>gsVp1*DG&+4RB-RP)RgU|pG#VM5)1{`}DtK2oT(t`y~jt3^lmRsdJA`fHTF z15)c}yhp*+j?2`ipTM*-{YT1YIZF6mI~8x^`;7QD!&feJ88YuNaA;`r z)%l@rF0jvleE!w<{GR1nE9r%6HtlqkSevSKFT6J^<(j++HGRC6Qst3&G1kAj3dWx} zB!~pakeMZ*Vt(-UnrPc-C89tPJuqBE53HLZ9OnBs1LylEm^{e+YQ(CP$kkOv|J?}C z$4}Ki$}urE4&5fdV zYs0DPFVZP5KY-w)HD5&#Ce4$8N&8fTJMUPDZWus=b0@T`_e5$g@yVWN*`P!Eu2a`3$llc~ z;U^cUPvlp0y9Y(bFzDk}n6R}U^M@`td}}0FsY#|rCY>(L3ijHmbb0pxJJRVNdhGr% z5Qv7u>S$&C_7gVZ4mxXCKD=Vwaxc8-mgv6(8WzTX-N4-wBHIK(5Wui%cFQtIE zP&a^7@atXv{AELEndgKiGV5XTd`f($oD};A-pgFg23$_VvQVI~9Z%r$p`KCA_1ShC6&P=7j>)ca!n0)-LuP zx5X#&$9mc2-~M|*P5hAZ*ov5h%s6T0LJ7f^tQgPhkn+Z?3H3?5HiVGG5Lq^3Qb3W6 z!F3rslqa9yOTeTaY&FY~0aaMx(B0Z|1bA{S7Wq44L(ZWyPV*P;gB1!l7CYhsVD}ImRUQRH{_FkmAlFSJo0#9r9 zi%MyQvPK%J@91IeI6v~{<@fDEJ<_f)wR4I(OkRNLmxiNE zqpmAkvrH!rs1V;_#bq8_Wl&?zMyK*i4lZRUicxMREIkBnJ|qjD3~ zhwj1=z$jOI!N4M>ibU&uO~Gyc&0+;4cKd{?+LIe@mZaCrW7LVG@lvcqQslt{72!Ojx52&Sb!%w$FU*J3M3NlYro#Hs}2nUn9KR386@dWS^ zHjmYGNQ91knb)v$(R9r-i!m#ylZ|7|xT=?3a&e2}(U=q9zNqb>y^tl~L+4qczpl_O{N3rDR1em9Iw9c;yxM&ARW~oH2gm>26Rz zjSrG}-LveBQAWRGn|d(}a|M)2`QsqG<(_4ykW{CUTiwJ6*LoRSi8U1 zmUt7`Sml4mL)NVMC4d!97zRcmow2*C4(kVy;1WeAAei-uCZ(N)Kew6i3kh75lZO zzZsY>9RP*?I5GIXQ|Ys7TCD0Q{nV@cszk*1Of3ip?s=~)!5z2413NQrr`b20JQ!U5 ztRjXNBIWU%UILccB>Fc~lu!Q`Wd0XO0KKGlxg(k!0Qv0-BR|26<{@VWor*4CXR^7U zb#yQLs+-FS9v9;JJWfc(4pXNfWbP61575HEO>(+dvADW$_@e{jalqOmH|>KgnC1|K zF&WcaHCLWF#pBn#gs!kkHe~$O;Iuq?`u9yr06HdHb~=oU=;|cY0pu&Ah*xrb^uOzn z1lCajdhW`=jj^Csn>G31sZDc~n!v(pr{l;c7}d@D`LO2znsRD&i$49q!-AtO_+s`( zL9#l|JAF%IkT|J~{O8C^PJAR= z>W+WnL&Jd*@27#SmaX}s0t@9z^w7N#tPv7`rMg2Lf7g3=1nsz!kSYIbfrDB>hbA{4 zh4wcjuI3u)<|vKZo^ASBSV(5b6lM^|O4#jxx-E$_B{s{^SvV;}njY(VkEE4hD<=eD zE$+?fvJ4pP-0#tEq*Nv96ORDi-_c@9e8ShTCKm5zn9Eh9^OGcYy9I&pFztX_W0Uk9 zoPVf&V)_sN$=m?*yT4z}h;>+>W3qP{V2eXA-np>@@+$@&o4Igcq6xKK@4|zG-Lrtzt?rgVYGNoWp*s`s$|CRtVlOlr|cmn+)8?Ds5n@5I=u7SaePYYOVvzx=7OlQ z&_6&P^5D_``K8&3C@yy`Zus&L@f}5q9SStPwudT6`!*j$1fijL$eM?aG0Gfg?`N-W zwS47v|59#G^tIf@z;4C)74v*(O->SSg^}&;Off}(0BGeAzXl9r{>g#k@BJHQ{#&b;mvP|#NzyZ9Fjoc*`h=uR=;7z* zUxbMseL&hT%L17N5eZOU@dbQ_AVzpV-!fjHv$pn26;;*fuU~xu-~y3i1Nu{e1c-~5 z0t7^vJ7K{+=?Z!J&ui_;|00{s=_WT)95?}F!XDn_qvO3hzPAyWL+YPo)D2FO^o00pAR@i&1B zZM>p5(^lR#!KLgBDx>v+ypX90nfKGB3XGHwvIP!LsQ!S0+Rp-5Jkj1mc%N;>GtFx17 z8(|SrZgc;^Ea|YH{$+Vx{lG`eFzHWStj$D;-xlx#?b2K}b6}lRk#$iXlb-ktg{=NG z?;8?e7zfcU;|7b;>CWsRV9jFn(sM}v$u-bLW;#__FfMdQb9fJC$z}BuvS=FsKvT2U zv4E$4s>))pP=oDich~YSC))Oud+;Hsw>&fG_(}r%R8(oc{oe!d#*BSB!q|zYLLf`) zUAqGn6{ij>N-UR0IDY8i8{zyREOSuh`jl)tXF}hRfxIziueCMD)MX+ny03eUhm+ts z>Ga*k++%+oV>yYMhYPrfE8GQJf9d$#@RpQR{v5`+qA`4}q#~h@L0r~F_1+SsW`o}G zW+Ra*sT=Nf+LV8aQv6)3-JkS*WSVPly-~zUNiYty@=SN$^&Ah0V@ZkUjT!<u_lsz55V0J2#g4NMi1n*Wt04b;M5o37#3A<%sIYtEao%_KSz5ytCK%>r$j+ zA~9M&U5@eVuQK`LzK2L!dAc9F1m^*IC!zMv3MKSH`i#Y#e)DP9lMN8@*SGr>!tJ0@ z5@QP5sXS@@=41jX5A)Tl>1e0A$YS@OySMtn%&F&aru?mi9u576Q&g0sW#0996vVB(^TM2t4?we3Y1Cl{uzxN6&c#jO@W*Y_}L zRZbL0{Rofd9j0`c9Bp*($?snfb!w{b(Hyt&l@|U=hx_Sw5VdhbqL;+gDPFTTnRz?% zq@^2LYMG1o^Lj-hb{h4Ek?DX0Chx%Cz4WPe10-_mGW{@E)36nGG<4FGwOiuJjflN@ zrDUIZ`0IYY%P{xU(#cT(QC2?>XaGee37<~zU1(4)GX_?25p8LlMi{YzUgdLhp&7vQ551L!f15&OX>8E-Bu=XN^ka zhs~+R7bzB8&85ig89UjFlSd3MfyOnYHbxa5x`}@Ro4&*3M9JCWuIBa|3povHhjUj? zLAIY4L0TOLVyUnK)+v2xcv=A`8L4ElAuE%sM!$K$hQ4###g;bq zs{XPK7Hs>*3wg`aZ>N3`4E@PF1q~m$QFr}O?YhNz!*f~kE%y4XWL>j=ve3L%f*bC% z-d^^jkiy-a;<5)Ot8rp>G)_c)btyXFa$v}*Yxu+D_~S>nuCeE%P!DyFvLx<@t|j~w zW8P%(w+Yb1I*00#x6|#4tyW#fMe`SP*~-c0tc6xO3%)(eXcan36>PNzv2I%tj*vI1 zqTzd6lX&d$H|A8$C(~l*5skO85X)7G#TJ+PQ)nj+1G>E8NwC8*hiw8%?I4Z-0@aB} zX=NRJi*=npFa6) zFA{89>7{Qrvbc=%b+x3n*#H0$P`*YZR}sIykRXwUpG%_oN{`SFfEAh44#a@D{!W)xG{O`81g=o2Y`(nfD&QK*(B^_xwa7Kr*b6sCY!giXHE+hr^ zSt%d9MJI5&{GJR=8xdRe!7SyxR@$~hL0Oq#um($3cOQ8uHgxh8cP+N|SW%Gd4-G6c zRjp<~M^1F@N<@<5cqqZEViZ5b%mcJ>cmre}CEG!Cw4lolxQs>8?vYF)%JH7e5eXjN z5~x51U)uFGTa_d_*L6sOZVZDGAw$?3ZJWRgaT?W6K;M*MlEgLL!vu*-PC%cxziRmk zq_hU3{GM;MfsrsULSzUG+F(^p+(@r7d!0H4&!}B{Mb2U9&m>CSYcF626qgHM1$#M| z&9YqD*Z>v2;k?hn?SM9jh3b$tW?Aj?46gA-AmUdo;R=u34+Y^KJ0=-{S_-~o7+R&g3PQrctyWrZnZccI(9B1w7hUW4Jb&oNzoh@6Xfo7Lf@dld_YGLG{uH z&nLkmm=e4al{kC}4V7NR3VmN&CcsyssfZ0%XB7AXDE25;K(n6< zRzSTkav$0du{>5}>-fNJ@avvk^Orw8Fvg9aFLOy70R>{{i7CXcR_3E5WCJ5-Q=;NU zXL_6zcStz##zP<+q(nTeK_*||*iyAUHI)G5I<{1Y4{3L^RuJE<#Ctv&db%?W;k2=N z52rN#VKjhWx=~52mv1G~qepzsTJctYTCi?jXW?zvfhVAR6QSrrUT2c9zp0Hxb@4HF zEA6ingnO_EPgkza8~n-fr0w#I)jnn^t&J?}SE@nfFG-NG{}`nBdaYKq#qA>asw$EU zN|ycS=DYUvNX=g2ZPO;TIqk9+6*5`*mh>0(rl{NUjoj98L8ibTkzzBfWTE)#s|d#z+B0@SZO9z9>R~RA~LQces#W#N2J9w{)ioEtZb}{DH5?P{S%A%X(RVy^V ze;Lzbwc#h9*VqYdfL5NTp&isy|2Z38-MCoc0Xjp7<&;xKM2F^xU0mOdDbXzP09u@AB|T$dDiIDbZEwT`rhAsZKxBC9&kT8)2XoLu zXQw&JHF(3LP(yhbFD=q~=~!eRC#meIHgF0llE&;oQ>Z96ed9l1+|6r9?|Y=+W|y2M zZ~9>XxqxQI3d})Nw}>Mo;x7cX3Eq3fG)}y~IYz@|L0}I)AETOnj{?UoDI@qYWRj{Z z#*H1$0o!Fw`U|)U&Ys7iyD!pHAL~RM0iA(p3Obm}# zb6m<~Dt*^^gPMq%?e@MypG8)R*Vv65Oe$%fkB*6fr9Ax8u za=jdaIUYpdWvgx30_eMIO|4-r+jUU{qXLC!w>U(l#LjE^bs&d~@JV4K#}wzqJD8bA zfp@v*ciQn9rAZO|iHY9u7?sOf(YgFQM67{KWb8=l`=z?`T7uG$1B&-m4+2N7zioe6 zkY8;tpxxn9%Zsq7*P8F#`+`FF%wpuFi|3Nm_WWcSl56z%xQnL9?*1> zx9{IkPHgf3Xj=hXsqk!_Z94WulZopF>XdOm6nUO}D$wy-i)(w#lk|1q_w<8{-}~=G zpPg{SF=+-?(MNwULl@ua5@zxBDdieG@C3&>4yXM;y1p_lsfuXyk zrKM{IB!=$J;Ydh>QbQx%AkB~plEct2G|~++^ic1{ivwe8p>VD)I9|Z2vwF8edAqib}a+VQ>Kdw za96VT4W@sDRh!O7UnF#VX*v|yr{7eciv1>fKt++IG-*g&9QgX@DyH(vxK#B-54no$ z2t-r};EAEfNSUgytUUq&wSP`X9OmB0JpqpHH#~~8Z3i4G+^do7@L)A6d9hM>s^_7t zJYAJxt)Sa0A=PWNL3%tzAXT`ityvQpnq0TzD+g+OOxNVq zSs0E(eL&ex)_F@c+HrzET9T&+G}i;4`uRow8jqb_S@EQw)`NeXa)q^B;7vY?t5#rNat7L0v?X(IeG!nKw6GhERZv3wAQ7%pTe5g3XZ1ts>^D1UPZTB?peq?Pa z^p?g(pVlT@X{3*7fUXwLS4%&5i)rT`s+qwKOU19p0m-BlS6$u9G)?j0^-Z)wTsgoxZ!gwTB#V+I=&S`c*C) zMVE<~12(6|FMj5d&cdeW?O5os_O4hcR(_{=1_ySTZ?h!ngy((IpEJ3aalbVWbvOKa4LahNZzrK|Kvb@irExMul zLf7FKhK&JlYWpesv$WwPby2QQaq z+H6#HfFE57HPeFG9*zjMhAuVs?L7 z%l?nnlg&Q5zpCvZkV(Sjg!^s%Q@CM0n-^You}d{k8A)Bnuz0Sfy)cZ^@@*X=b5UkH zQEgOgnIkWCR{J)`h1m|Aah!)JIaaSV_i1suHV@HLp?7j0VlxU68KRccnwvSTEno&X zFl9aleET~_eKOvug@G~I=?V(96v^FE?%(%<#w5T*95 zXahMB?Ano&GcJ=uB;qT?SUl{^ABtSw}Gs`MhBE6Nco15n^e zh!Se;DKR~I)01AN0*%7#q^>adk;q9Zf#1pIKSs{O2MKUnTcpH&ufh}{2k$aPyImYu zt6vC=crAPpGys?`6mD;}S9d%QNEhHah$f4|t8=NdZm``?DdRFrvz=LvXBk88a9qo5 zQ4VWgU&5l+Y5F}+(S3ceO~m=|tW1*?Xd1iUR=Q`b9K~U#aOLDTZ%S<~WbOPq*@pqS z(^ea~^;Pw7vdFwk@X%`daV(s)l}biODDO3){W)F{CW@d`Pk@8LIzT8|%}pXrVZY;K zcF-N{-$?Dx`N&n7U2={%Q*qA3I@K+Hs+Spo_AE=}N0V&0>xB7KI9#Q-t z!ynT4Xx3td6!=`S`P+espKp9{){XSqnmKcd|98es;|n{+cTg8Ic}tF7iBKS z6iw8x%zMD9DCgK=iwtwFGe2ZCL8t~lWjkrlZoQ|EHh2qZ!a{zP?dW`_T+_Wz zril*=Hlnqoju}S3UpwYWUonNyst|H&+5VsotD2$*pEp_GPXI+>A`TeE?yH6qhbJXY z?Q>#S3D1a)SF}tFx6j`PIYV_ibzPB;vn?DrNyWTIb;&BmN8T_O?!{+tinSV>cIO#& zEqjtPK9;fV=(z9zE+zNpTk|P?Yd@j50Gfx=g6S?hybdo*jBp zZr_C3@-nDHZF#?UIswLKW12K7`dYPfR-R8M-Z()&G1Vro(6eM`1~UDXWi~8j<% zh@r9;vGrtoCUANEEZujonxW$Q-m6zoqmD2Zo4#4g)r$C8u0}FZJ3+#&`0Ija9zGeX zCUUD@2b4J&t;fNn4a^bs^)0h&WgEUIU#+5xIqPGS0lVdrK8b#_6>qi!ot+Ny zwRC>o>B{C^F@og(+Syhr$GLb9vQqSNgw;X)-HY zUvDNO8(i$WeK|y13q&X>cJ{62s**uK~pFUwf3gzk>v;JJ&W3m#eQ$Of66#lBnaJ<6%#O|rAQK;2S z%tJZ*sGO!a`mKCnrxZJ^nwr`Vr3^@AKaj(OQAod*^^MJ9&sC-B>FFuEXlTeOfYe00 zsV0{MD?3S`RHiHUIBCR9(vy=nA0bU7R-lxuPRcQ^-5yg6n_RZ)R9(^Dd?BV}lMK4b zVNp!8&(*0ol_ZSFWjAF3lpVA34!-S3f$W^q5vuSm+`S#wTx+T>FFRW z!+9Zaln@=ddg6lV5e~+uA(o*(3c||qMa7wSgb|fpjJDWxm0k2f$)kaOnQE}05WG)E zaHz1{g+M+lHhnX*X}GU$08BrUie);NKHCVF$Qb@YUuaa6(W2uvl=yBwXVfu|en(`fyt(SM!%1$_p5f#nOB3N|s2l+i;)A9W|_4?h0dxWDhiCjd>mcF$UDOzB$n>~Crr`f)5G;yBT());QV{>YLWtO>qDs}qU_b^@b zZib)ft~WIo>bb3(n2*X%lT(JLu#Im|`Y0~m^i>oav+u@kMswMY?)uc179q&$=cDb3 ze?+NL6L}*S57)Z7YElc-yEgL$iN{abW)XL}?z#Oyk7|4FPMlXTJ;W2WvKW^$5-g{T z-#?*s?la7!qP{KdE5DmQH5PB2U;ncxR_$`vdEc(fgeJ z6yv}Zj{&t#w>5f>^ky^CwHD1i$RR|#waOZ8?78_a+R>#3n!3d^fAu&NllZzz0?)j7 zwQ?u%9V9x4M;d7+mZh@%+E*kHIAfUD1{ThT`@wvP;t90 zW5xa8JYD4Q-?=Hg$pDWlf0i-+vK!bHLlI`1IAhXkTlq~zw_d;6`gE?y_sKM&XlI#0 zx9qv9sB7PHXgNVHK+rK9i^z2xtdVv+=7=={+oE-ElpO!HaIw#dC7FuR!Fu7o{vX2u%ZosD`UFuIB!o6)U<^m6pbcVi~Vwp_OPUT ztCderpj0F86?ZODts_Q#is{lU=4$YhMb$bcRNODAyX^Ler7kW$u3Z%$0SRb?`bgxC zUJ;^X+&0L(-z5uDj#!iq-P}LyR#>eR^yZ>hLH62+djJaYZ|+>5anULLi%f~wza z&l;MVx-yC|Psu9bE-Kx@zh*$HQf~&65tDA1T%A$#h5iycBOR8${|7=7|Ng(RH`4}W z-y6|+A)PdlD~BVful;_xbx0>)fjPu=h*Sv1QM)l5_9#2jNRn>o8lRyP)OV=EzqmsZG*TbS`YSO^YEOE2S*9r z1vnWy%K!@hm3l-5? zE%8Ee@k)HlbcRC3u1?8lf@a_6>TVr})hZJ3dc9`_vkmv^pBKMh_C6aE>m&KZN|O_j zy9N`Wi#&{9+Mfv`sb2(J50RhI5IFKJ1grLx)uJ%Fm!GXc0OGE?vwFBc9zFlzIwsOb z;r#W|3-pWHcYV<4{jV6-SZk2^#g4(67A1ZS4Q~6Xzu#)5H+@BD!?F~op4eH=Gq(ZC zmi0}FK_hT-2#wZkMAZP;Ev^CI_NvdC)EWh?p-lRrH3w+91OzoCA+tbrL&8~O(H2}T zwY(_9{}g8a{sUl3+j0Tzc8<#oYVibVb^1OVt zGKtOPqcMAL<+B&ajYNS8DO<`=KHY@#%=7z^7AuF3~kf%-a+4H=yV{cCY(ts}( zqrgDU?O?qBcx3R&PInXaQR|YOeu8#Sltca`28wdba%VI; zjwt&Apdd#=rc-%w%3H6Sp^PyfUPo#;uNJDTV)k0I+J9LLm9Yof+Adpz^z&>7NO_by z8_$RB3!lmYY^Hg=&OF_I6Z%6L=hez$n7-jWtmM@&G+AW!{Z@DRFN3Ytp~}T;#3s?X z30c-c+w$B;rX4?jXDNMV#WM@~G7f{Mp1><>noJnl3r_EffNIfflb#tcs^dTGJjRG; ztdS`stswxuP}KMz{wojurp2W&j%z;DwRWbN>P2{uf9li2hfQqCJrQUoIq|g7hc{ zk(!#?$FBG^OCH|OuDI}4ULNoZ00GEI0)STj=F>j95s3mYshSNgAB`RXt`NxS6vYSa z#R&NS_xb{0wjY@U3WjsJaMk&N#|JL)$QaO0(P@Q=5d3u-1iL|O8~^s8|JTKUTEE%6nG6`&_+eW&doQ>>Q;CfQkDU9P z^MFXcl8Jx#YlxtF^`NKUP7S)D4d@1U0#h2-KQrjOYXp=f2lF`0AOHC=r#7Ij6R9&y z>C;jLWHcb7VN|fo7%d)d>3y$Ao5oB5|GCWkqZ*a}Qa)el00}LX%l5=mU<_^f#MN4c z-@9CSq8}X{q3mSFru?nH+Hfr9TbjRk9c@~S7CZ$=>Fhwq`SaDB_a0(c47*M@TBNBk znwgAr-5T%Mshi)m0<;-hJg&~xo&t^RFq7NCH_y&Jc;~S%!}<#~xH2vo=idtp3qS?1 z+(5+VXiQtD$)n)b0cVK9FFdw!@l{uv$MLND{_b@A{x^|5lfK1P)tZZQ z(zt@SaJ$Gb6Oa~8yPklZ43T7%ZhK8ubVGKwrSJAW7LVYLnD#CDaZ=T^ECxY2u+>97Z*@7q!1Q=oO63TR6g}pqNhg&Bi>= zjtnx<%U;=wt(Yp(t}d;XTu_dGotgw!=%H{u-mQ${Docu1t$E)3cI{)NXYLm_Ee+3b6PyasaT7K-9{U(N=|H zW3A&`%o@VIlfIO;tGnOEFBwV_xkz?MGQ-*k;CodPH#ULM1~%H|TW8(=%4)hu5F|OR z^$M#{(x{lH-3q&`_DuYi`LEvsaBny7?*Z^j0T10J7#q;OqFHXWYU!n{=*;QtpGVrN|g1*anv;QC^h+$!t zUf^kr(tUALQ1!k+%g0dyrb+gZiSiH6zyg4_aD*z3T$q7kEvFo>9&Zbqk~g@~X@+g; z)*O%uN_mkZ)%-v+L3rL#I0xE1wsL^_UL|UmS2AUB8yDPk|9({3Guw&jOb7AR%26v5 zLjW72!Ic(QyAmRM8K-=vIg$!sr22XPZ>NoWQ>6nd(guvCAcQT?U?ZO(wfLbFkHh&b z+otfATOKx6Sk5~h>a6qH9cV;hYH_(OF&5)IxpJx^R*5gC!@4Je3z?6NVxSspb*(H~ zU!?GP0HI5ww|~UpVxBkLH~ACk@PQOOeP-3W}pc5UZdmTR67%9scage9Wj ze`C`);{S-P7oU8-8ddl+{U;~6iCj0_S*3sfUkrHt#r*$Gl5Q3S2%VY#l9yI)F8cq! z@{<%~$s+J^vkCssz@0#ob)Ou#=Xc`&-`{}{u1Wdd^F44QAQ&eO2L3)PU?hR)8Fupl zMB6PeAWL~uqy0|-7Z!qoYB>TQH^Dk>>vahtH7zYt>yPbzd+zLMcPNpQmuC!=Oc%x6 zoSmG$8nyqMQy_125IX+IM7WmycQL|%31$G}^af%NNOV2Tqxk2B`sxAP;1Lh7CO52B zp!DlQG!9;casUrXO8=E`tCAG(a9x0u&X40v$>2eRv$+xHNaXDfbwS{{f@1z%;G0Xd z0HPNgx|nYt?o8C#XLvZ|-q-Q^lpCz)_05**>AwPF?SDVugs-th$a;ARa&mFqP(Bwn z?53(80u&2rKt(Q5N)c_@U@+o(9?=JF=pF#P>;=A)v2oUe*zTdI@Nfe4g2Ja^`7XVD zz?@8u(qzEI!}R|gK>&J?A?Ds*f0?n8djpt|{jfi$JD^O>Z2Sk`m1@Ew0l_vRPL&h1CoZRoiKI7n#ssZyxLsCM*N1#^hD1z$k zeTLRKS0f$P$+PCXTw{aeZ+I!8ceps=g)zX3e8iPx#^Rk4uecuvI#4ygIq%i~A&cDn z-nTsPhkE4gDc=?GD-PM2&DlqAuGR;fEqRHWo6{4ZIj^{K765x>rH<FOXs5h|ds3kndw{;r^4^wvZd6fBOmZm=Vn#JOCT5Vaa* z93pkK0_db|ih2F-gmZzdpv4&azb!U5Joh^b+CU4>46Cm1<&hh#BM_dH&bRRbZuU+t zJ1JeD$0m9&3eVcTesLk|GjKH=7d-0>TN)_n0BdNzE(`+%7K zrUb-u|JUR-eTK>US`z!5Sk1g9a)S+$hZOO@aW{rNA4&QWZ1Ve>7~1l9%oG#Kv>|V} zCcdnyD3b;L{fjjxBxOTT>E;IkngW2o)%~AqHmRYYjo-IXrg`_lV-~e3s9}fS3)LAI zVPZ+Gu*?%%mJ!Gu_b@H9q+ctc6A)AaoIvUyM{;8k%$A_yd(PtYRaV>zRk}Q>uQ0cM zrvs!aqg$^aV!27F8JR3fP)io1HSfP)Cc1o3`JZj9d4VzGBq$nUp|Q)IwBbwD%sKn* z^dcCJt@D}^rckC5JaL-pNnf`9d^!H&h3Rhx&|yqeuHmdJ?fXwWe$BJ9ugt16fj4=~ z$9<}Eo-r6ov%D+Ns}!IC0dA=(Ml9sUF#^w9G8l*bl}vLSZ18)*E@a&!$1;C!8`pmM zD~HM(-va!fe9Ja|%WsoC?M(XZ-CXiK#fMVB=gP)T46s>T0 zASs;qwh{s-$@zA0wyEO+6xUG|2Hs7>IS@}k=Mn{$mHy)-9lG3Oezn$96_hi$!fdtp zGH$igaX()1vk|4=2ar;h0(>Qm!n@V~1DkEJZ*?}3ZD>U-_*1Lg@mG~~ShVjO_t{S# z;MR*bV0@mVvp^Oa7VZ;6g9^Cn*2BMAB8qnttt!THjqOitr0V9sOQ18devBoo);IPO zy%HnP88ykEX{h9-_BeH%@tK}Y->-{n#(#A;P3|VS7-n=_t?WV-2PNmN5_uG&4eqNu z4UyGnMtChbgR&bx#1-HNUOCXOxZ+dXk~a4WBqd+!Y}Wx*i&MV!w*`%mZY&N+yO@YO z2E7qjYsx|vk1w>%G02H;nEOw`VC%hD|1uEGyRKe}2B$za&#-4TA{jk z{t6Z<>wc*|6#sc0bDsz$qMbQ7w!H2rla|KgNcrH-i@A{rKcC3|bqFKq)Hcli|f_M1h zRPBAj?h3dyR2xgVOKz|=cr_b~NLkT<$W&(TDZPtak*N7C)-`_{VXMNXY&yTaj=6dA zP*Ce*Z!#Wm>cn}Wr1mb0a z=kKSpi3-BFomte#XA#yuakj1Oox?#O$oDz7iYy^N%?p&_lVfbZs>@oC6ny^UIJl)| z+n14PU6C9J|1mP5oN!l5=?`@cI9BTJv7a)G0LRq4a>PSplEvj9Np{qkuk*gOaM`2vUR>k@EPrH+loun2^;W(Sok0AyU@H)l^rn3?A zjPvN2$lbbvzjDM26b>F9CI7tNuoWIweilZxGWYuB;L+!YEN2moUj64`r=n9!{c&&7 z8IBtcvVT@ai=1)a!zK6cRPvKqD{G|_ctr$7imc1GUTj+bvJTfuD(t_dmbD)<+T9j_O0Ch9CWcqQx$8?OPy3M222u z(ZX8PE7TsOd^1i$pr%oeHzPG9Z{_FjbBsK9V!K4XNF0 zAGSV(*4|MF0*!=GLWDdWDMURZpxzTQD<>_T_I?9zyxc&Q=pFInkF#&}5qAo85qFOG5%&iRbc>;MP#G&#L*?D9^Vx^= z826@66XmQgBAu=YF{i`s-qfpo`~i+*zI+-kP#+nQRY4bMQzo;aj?2;3i#sk$ok|{O z@n{b7U16|$?0%D}Lbghc;xsVNCN6dHsjScCj(b~4p6%-@U+*&Z$Q8H7$7w&eM~O%b z-H3W;Ja7_N4WsDAE{#{tXBhLR;cY)B%NPBR&jI8@v37YBFmv7rXm0a6Er%RkNvNdp zJKhF5{G@^|jIirV_a^LS@l*qF<_e36sbl#V1Tqx$IX*6(NIHF12_J1A(!_IgQlk4F z8lhcbzmKziXd)1Y829)#6n7N0bK9CL1XAGHWW;>1ZnC1A%kS;izJkKW=1hrX(S8x6g^KvbLv z!{GBvc2G(sepIM8uysQZt{~9|$&WuQP3a%Ho`rcWsgv&dPLe8^fK#BveO&Vvo1aX~ zqfg*XN4TWigk(w9pK5(HMN2dsx?Hj6VttWvZPlKR4#!v$=WJp!zVK+zQNz(0$STam zr-fBe!y>?qNH25Nx%AhxGwaammYOHmhDNmTNaUQBy$mZ-c9mAfC1E6%XbRS$Vht6Hc1*9ZY#kq2Xo~{1p(g; z=XYt96g9raf3u(Q&m#=^7p~Sv;Z6`HJ)dR+ZzRK#!t0jZ@Z^DXbUHC(SOe<)iJ=;J z$4l}!|M?^RGRBIN?>T*ub;d`@JfsvH1}VzR=AcG%ipC}DvBGeG+JZyl2q<`!Io)W_ zBHZU;9v40NK>|uggCed&DagP^!;T=psW$^ooyETC5+r)H?R+s*Mba5X5nUfB#gQf~ zW;=iy8(+Z@jP2|Ps-O%Ji|gwaM%4MaxeHYTq9d!NfPU}lKn5Gu6%ech^i#Cras^$^ z$UX|3kcz>4()qE)!P*9%uT+}K34;*Z#Rjky9^13`?3*XD4#GRHDCNDWy13@Ph2|1( zuq`czS@AblhP)%o2KDZE6R^mo^6 zl0)3A|F4Yb_ZwEvP4K?5biEh(gm|h`GdZK&GZp;-klJ0H-cZRpwDtJ3Ci7iZz6jx? zNyeXAHOO=RKsi;^HZ?81M8xB^dL6Z7ou(|i*Ahq0p2!Q#j3N@ zaxxPD3=1YggPrj}^*?WOD7()>v}PWhk9V~>p440=A&Z}BldlCE=vVSC#WT$P6CA4g zqag1W&TQUNse$vaonJxgBxymm=a0i-EYnRC*|FncwrZQ$Gz&3Syo|@-fB3xmj|&0@ zYhp?2He$OJkK3kc(BG>ISgL7KLx_Dz5bHd=c;5Kbl5NAKiB0eE+_psmbBLxZTu;Qe zMSO6*A5(So2grW)y?$Xc?foR>gz`t8$bEKGmq1nfyQQJqc%}OZY=U>tB#-nBY#YA_ zx_B!5)r(L!CDbTSE<2X)oNhnnj39Ao#d{Ib57rt=YJY}u&3f}lzdxucp$IL=qa2Ag z8t^7|{@&q`>i43orGap&);7G^`y}lAE;h%ZP%T%gp*x>>Pl7LsTz)>{z>8sNr#`@< z;gG$EG=oHO2Cpkn!~wVGWA^x-LtK`(o|10H(2?5;${C5ib<^Tl{+bc!&v=vkyPg*~!E@l2HBrKQ_Si#bnm(wK zZ_5`hON}CpLfV9;?%v)uKzh4l8wwE>QW3l4{)kT#HPR_*1I&dj2-qB6(L5`#v#z$A zC2z$i4c(XY3b7U6aj!lLPpBJo`R3tLRH%USoK5q)_E_;xPl(=Ib;YHQI1h;qFg+eM zC!mR>x7Cy0)z4S6`M_B>fo=nHH>~1L>sWHfRi(8wi7?jBUH6EbM5BCpCxD@W(+*aE ze!ye(xT|x6bztSXDbaIPdZWmr7rA1ammfJyg_lcodthVq~>#*%xxB zQzre*V$6}nBry6bYlTWGtwGe|#ekw?b`zh?D#q0|W`DN6Ch=1R&cm%^li}eskLCeR z@Zg{=XpNfvIv+BYX~HnXst4HNQ~;hsgNx%(`UGTw|~Zs za!q9>oH=j1eXS>WkpAF7GK+|RiurDPN9;+a?Wz%_pyQ+bh>JT;QHzyK-i~uZu1B^W zH@nk#JNC`P`HKgXN@@!QToh6HErCl{=!H`&PRf&}oMrU~G;s8L7?znCGH!3*MS@`) zS*<$;ISX)dK4aCdCA==Y0*+~qVi7>N1_YqEUuzUR?^_9`_Ij|=8{bX^Os%+KjtG;c z`&|L^6o8E4`rz_?j-tH8{DAjEXT)WAX@y;n9&RDuHz;UeLxg~=Y6M)O+oYG;niI*) zn>D;tE^h5c__T!rtNwlxErU4WeV%dG;{E%QV2w2$~HO6{_( z%I#gP$|MnqpMzral}*-jh)xT=Swzn)>0hJMLzE?Bep&52Bqc#Sb5!6n`L&$8jvX-W zlh+B4Y{dT}9jxqeQD|Oc>-hv22dSMfxPpql*!*e_e;4Q6WsYI?qd&sRvrjQ{Hu-5E zO&r|6mG<3QHpTF|afjAWQm3@53+o>SWYi1XWNm~iws-Mi=@ z5<5Rq9%349K(X_wN}6cUI#t&Y)7FE{d@2d}cKh3TZ%S+YG^xm(0RBDeC4ARp^i_xY>StvylWz7}k4 zZAkXO#aA?-+w4vRnQH=jK`o6!t_FX~R&NbH74bTjn7_Ki?lAadplOrqACN($x<`-4 z<1|j!>jaftCeM@~u4?v4{%m*Cp)Nhe~%+pMFf_oM--Ro}Xijvye6Kmt5Rcd7$Xg(HgIHs{2 zdxZx*@u(q{+NT@DRJEl9^dat~NgmfP0=j))#a1hEr?(z(f9Hea4BYLMw9S@jT|kgv z7n4Xn{``QEbPz9`bBLq9*L9S=P;bNuYH+2VE02#{ovqE3K1s7U>!PmSK;XAt`aUU* z*a-?(d&hOboIBTK62le*Ox`}HyEBbX+4Zvn!QWaa;EYf_kXqgr^hbNKxh5f_-5~xG zHRl}yZ#Mbe35syRA6y%w7qg9YuLf-L?mzHDOfaHd9)QxC@KYXVaC$kC%c`VFWbnxT z;3Q>Z6aJ^~lHu##DHA2vq6+DcUE!$hI}8!`aZhm9K+KUBRC#1wt6siBf}<2PtWNWB z?4`LZOGRXB{o&r_f9GsA&YHEG=f3) z58nv5`v>n*9^ZvP%qbc!kDrzrS${HY&@%`wi;zn0y83dK#zx%)G2hvD^Ffh#9n$bW zn7uwFSTICCLz81iSD3jweLpB$36p(me7r|6O;}zk`@Bnlri_KojLBZqX}DmA8_=hF zy^AmQRyYLGrMwv8*!rpIJn$_Y@s8kQ*^DOZCE|!-HY^U%pl#TjG_c2!CCXp(or#un zXqqR88jx+<|J5je=Cg^qpDeDwIYsdU^Dw7z7h&kLDRs7zPwh?fvZ2WiRDbGpxFz-^ z!%r^ud0)MJ{QQ%((W0?p$L$G@=!@H4wG~~S-{;KrWF+kPtY!!a7?ix?`~3gBBN|?7(M*GRB~yJ>Q?b1XHKHogZZ4PfYfr;5Yku?e~5jF~6ILJaot|9w2d{ zk9>sUS5{Oc-0=arjZ?yB;#EFx0gdcjWOln9NbKxoQd)u|_9De%XbE@?YRR)6FiaAO zYMqif_xaZ>a{=bd!mo8hS-uoaXZ}L{Ke!co3WyirqT&O7LV7#PrE5C_eo~Fty){bH9 ze9t>2`|wfv*)l665no}3f=9a%?#xWkziXS=G$i5QsW8W%jaYIDfteg73I{>XLtxPc z1pcsAq{L>?(A^ljg;Jo3$9*)c^{@d!i?J@Mu4Cu+sV3|PrA#K=mD{RQp|QG3k$tFwwD#?_arC$?=yJZujNh_w_Gy8Q`e+CRZzwe$SfePNt|nk(YuOcCx+Pb) z2YUxzb-GS&c6<+aESZ)bWZEzSv0bp;6JWB2*g!UTJ%ag2{k4&;c3eW;&zS@@)axe$ zO^cx_E9M{?K`$^%e&+b^;OqQ4I%(@JCp_hnD%g9D<^#n%=|>7&E7vgMYXRq9-HxUu zQ=vrG?nYysBHfd<_$h9b-^v1HD_r+p9Fiu5*-xW7!g*v(^k(!*x+f#>i~T-e288#F zsI678Uyi4P`u}oWK=o-ZX^sj9eajamda=oW8eS#}RP1nO&s=!3rriw($B1Yj1fa2m z1+BI(B6i$G`3ul}&N!T(Rme`Hi41)@ni$j<<*t(YFfHoso@)sD-9o|ZWTb<_fV(3U ztu0cYHLJjX-7qYpn{D9PnwZ~wo3s_@ywqFDINEW5kA02NK;Pppchp?4TuOA9_0+~l zzQYV@fRpnvMQiA|yL5OS9+7AHcz1nyQwt@ftF1!jq-EvbQC*_r=oLCwKa1xHrjR;2 zk=HGUkA{awI_iPloV$HQm@vK9LIQ|wicdP>|NPvQ(FP29-S=(2SO4?b(urzpEBnNG zaWXPD(j1fo8-i*tTvL0i*}y5C1-O4{0(B9YI=k7yCQoPaDl^otQv#L68ua{|@Ptyw zy~}I!(fspWk9M1kbP`M-FFL8d<)>1IC1@mu@J2&v2bY}tEfAa6S70xTvXxSJr-TJD z$;f*=LJtX!M^s?n>?1|pI*>`o-KGJ$i+tYGq(12DY%XZc1nzqy&X_w5^ zEk9myXta+3K+Bw}ZRxh=FV-kCK}ps2u1p(prbjkaDlL8Qumeq>=0yHgKJLn@<|aN;F9lsv z{fqXZzNM{T+Z^Ro`1|*QINfo-tDvyP01k!UGsa9SF)QTOgL3G22_WYY%T)G(uUV;57wT~ zo35Tvib$;mF;4QfJS-G|+-;X{hPjg@<1>Aoy{-jX! z9PuOW0r+F3|FJvE-$NJU_o+Q0f^}bNqJlhAqdgTijBQODby-yR_(XO^Y)SX4A13I12ZSycQcET`1H!0 zQ(U4rF@4zyA_U#)**qW0TaNEl$T*xwbshj*VkDJ2ovR#qo^nbQ+|ZXwJD~-nqU-mm zx8ET2oW^Uk9RTT<*iOMpd`RsYc0ge7c2vQ;&k1QreUj|_=Rl`$0Ln;k=N|4GAD<@2 z3->Sft+4vW?PmXT8jlA@umXF11KATuOrmG?Dh6^g7u@z!X{;3x+8ZBR1ByH{LE{A5 zbIpyUZxP+X&EI6;+PQi)Ryqi$+(cSsXyM}`1-N$bIGFcz9c@H9alohHJzKv}yVwn; z7O{CUHC7x3fT9*h2K>a=+{C`LahZvUSz$@;T~6P@i{zFs*E>=eJ<|f+$&86c*aYqz zjb30WG>R{b=bVUZrVfADi;aI5qV-d%w$awM=heQXZkN$N(&9Y{pV|~Ep|A?C%veNI zHxISAtu#T~)7#DGM?3OqbZif|!}Dm8EGt`UN(A+~kD1XjYeshlYw0_*JMJ4^hr#YN zc=N&WHfy&+$6Z^Wo)wSVgyxMgrK6yoV(V;V_a0L+8hnDnNM_&70D41AnDt)b9|4__ z$sYSb+I3Qp)aD@=Ocz%NUCK&-;}%*n_}St-pwj)zI7&XP-%MgxzPZt4YW-?%SLh$NEy zvY>R@d=#gK3Wal7W*Z;)RgCLh;fb2?{`oWTu*YXh7X4Ms%(lqeIgjV~;pn~ga0u}? z$CV>&?RIzY-;o>}%xk_Q4|DT(+9Lps9h~#^SfHTiFl=yPxO}UL!0(AB9?*<1Lq0ZH zm0!~1sEPAPe0RottoegA>U%C6J4iFza{35mddAd#`DTCUFMd0ZCsEAHiMo9HrkimM zL{W{*-}bF=UMUqK>1^VijerRJod)RKkaAjlb3BT420ctS$s`Xn513 zijMMs*6h*$jMrOIispR*98ZOClqtcwSCa9LVpGuRqQ6I1NY z;`$6BZB>6oe(oyK?B*fKYA*}Frj(d-UI{Lv%xtVzjr3!~yPekV^?@@&ff-tc67>6$lf)Nu9XOP9;heFtf<(DS?P<5Znf0Sp}&3o>t& z_ie)&gKWE0rYrsJUpshyG{2t~I5D>E*UL`by?DWW6#N&YVJLh7BrTD(@3VU67!&kL zke)bxzQiAgt@&B&^^hcKFo_*O zSK*0T+mv7gi|1t|Uu1>1!gRvpQiRV*^GW8{8Sm==#*=T79>1=sJKCc~qhzVs*xJ}y zF|S)nA@^;kY9(85-Qn;PkMl603+;nKAUB0Hm!`ATls3XF_`%TP0(Uo{0<=C=Q>+u7 z^o1vWqr>WUqpu$b^>fn5zdKMZNQ8Ex^fC~2gl|6SUmo{`JmR2b^$*N6x5QkSmV$b#HK$;SvTtyP#gKiA<407 zFf*HABwwWqQ22jJK@kqw*cmDP+HH3xw7L)1NAwiWXR7XzF~Q=en9otw z0N)XG{jR*F)-FSpZPbk$Q2&3{4h-ZSa(F?B$6_+c3BNQ@M?B~5%rO+crtUwtzauIy z9D)i~@lWW|feOEgm~+8}Xj6-KZPO)Iukh1qpR^5(lpV0gTh{hg6O|4+jqj`zA5q4{ zl59=C8`=pF13NQN&MWQ%!h~l~M5u^CT#eX7fzi=|EPQ~^-yBrD(3YKy+<9Fs(YU6E z=vx^dxC+x6;Fd(@`!PAJVnVaKhVq9GVjFP}c7KbVjR0mtUgG zuR~i_b8o4l8p!rIUE28<<2>UT+WLV3z5&w=v2WMwjm}XIL z+_*`(*EOLfL1>vdn$0ca>}83YZo5+$!w)}N9wSGM!MO1gU1`7n@h85m{k_^Et4{K?Ds%7YI-igDw{BOxIH>FMdn&dwG~VbJnP!-tPRR8$P+#>QfH^nCFjm220o z#pcbMk&%&s)~(y%lFP5w*6TaQ1v@Q{ku= z8T#fjao%}w+;|tx`?MLZ8k~VArfovih4kl-2l27N>kIcIVtHpYnR2x-m1kvj#G0K8 zk+}XJw48ani2H5M{m5RKt*>82w-1Hkfw$oJzJT@kKJ4S?dVIQvAT`bxj56vu;}e?m z&7*yLxM;ZGqAPLJRd?XYo1aFtd#j=L|9yk{Pt-+|@{Q0utZ5!|`OebiwDowPnl<@i z+|2ul&Ky2dbnWDa&PdK5x7qvnQ_tej@=uF34Ili!$Hl_{{mJVWUwwWOV{=JKyCTZwhH z)wrUD%=I_ldRv&qb_1F4W-dSbTm^g?{*AUy9a?kwo^to0q@Xit7=~d=8vdEfgy!aq z2?`fqb`{Fr`vBf~uNrFA{tn;Ps)N_wc*}^pAMd~aAsRMpB>v>+=bwHSvz5y~^^90n zLsyqy&;{D-14BN@JoFHJX=ymFxDJkM?=_7SwT?4IXW$kkWIP)*YWfqVrFGRWi?Q%k zL@$iQ#TOgj5nUZBx_vlf0{Kua>kcFZwO3GjU^wr>%W>hwSK{JJO5w`OuERwaU!~3G zf!)mUhB})tk7=YwXAYk!x_0tIZy@J~-uTUr@=rf6cp~gMVMaglc$nDM<;@RaeA-Ri zK%g3}`K8&h=T-CD!)m-e&W^XTXN3NIV2TUPZ;Cf`zf*n_+~3~9qh2e{0qpl%`JvvQ zc|%uDqRX#CTSjwlS)ABsMXP;gm@}Zl|6anV(PPCjx~tc$5ytQ*)jtEbEF36tBMaCZ4PCd>#YY z8|9yTO1#{UmMGEHr-Sy5&1HsRm}16%bJ-il&6x)UrK@>#X-w!~T%bL+bzu$a1wN4I z4BP;5-g)QY)6YIdOiT=NbGKpZ)-4z}VH_TL^AZ#=^ajdQ-TPD5n-=W;!B>AhQ=@=bmmeBp*N88LvQ>B1HDn252|78E4q3@7X2}0 zEbQOEKz%ROdbQ|&FNzBFxAYvMq~BxM@0VOy_gcFA>b67|Cs6O(&UKV=k>ka9$Dgs1 z`E;KWnYSR+GIs3gGOU(oiUnHFx>T7Pal)5S52#JIToih4u91Q7epTVZeJq*)=+L;TMvfQb9e>73=FJaXIUTyPlKj%` o^@I|k-aoGt|MexWxqK=9AESn6IC5(HN&o-=07*qoM6N<$f^65| [!NOTE] +> Each feature's requirements are further described in the individual topics in this library. + + The way in which the features can be managed, configured, and reported on also varies: + + Feature | Configuration available with | Reporting available with + -|-|- + Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs + Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + + + ## In this library + +Topic | Description +---|--- +[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. +[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. +[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. +[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. + + diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index e69de29bb2..51488cd9a3 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -0,0 +1,92 @@ +--- +title: Use Windows Defender Exploit Guard to protect your corporate network +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + + +# Windows Defender Exploit Guard + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center app + + +Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. + +You can use Windows Defender EG to: + +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) + +Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) + +You can also [enable audit mode](audit-mode-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. + +Windows Defender EG is a component of the new Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. Other components of Windows Defender Advanced Threat Protection include: + - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) +- [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) + - [Windows Defender SmartScreen] + - [Windows Defender Device Guard] + - [Windows Defender Application Control] + + Each of the features in Windows Defender EG have slightly different requirements: + + Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license + -|-|-|- + Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console + Attack surface reduction | 16232 | Must be enabled | Required + Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console + Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console + +> [!NOTE] +> Each feature's requirements are further described in the individual topics in this library. + + The way in which the features can be managed, configured, and reported on also varies: + + Feature | Configuration available with | Reporting available with + -|-|- + Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs + Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + + + ## In this library + +Topic | Description +---|--- +[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. +[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. +[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. +[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. + + From 9ab693cb837ec67197b673ab488903fa1f3ee1f1 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 18 Jul 2017 13:07:30 -0700 Subject: [PATCH 03/54] initial drafts --- .../controlled-folders-exploit-guard.md.md | 6 +- .../exploit-protection-exploit-guard.md | 276 +++++++++++------- .../windows-defender-exploit-guard.md | 11 - 3 files changed, 180 insertions(+), 113 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md index 0557074a2c..6432b9da27 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md @@ -1,7 +1,6 @@ --- -title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +title: +keywords: search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -32,7 +31,6 @@ msft.author: iawilt - Group Policy - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager - Microsoft Intune - Windows Defender Security Center app diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md index 0557074a2c..9e6757f074 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md @@ -1,7 +1,6 @@ --- -title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +title: +keywords: search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -15,7 +14,7 @@ msft.author: iawilt -# Protect important folders with Controlled Folder Access +# Protect devices from exploits with Windows Defender Exploit Guard **Applies to:** @@ -37,27 +36,71 @@ msft.author: iawilt - Windows Defender Security Center app -Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. +Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. + It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. -All apps (any executable file, including .exe, .scr, .dll files and others )are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. - -A notification will appear on the machine where the app attempted to make changes to a protected folder. - -Controlled folder access monitors the changes that apps make to files in certain protected folders. -If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt. - -The protected folders include common system folders, and you can additional folders. You can also allow or whitelist apps to give them access to the protected folders. + You configure these settings using the Windows Defender Security Center on an individual machine, and then export the configuration as an XML file that you can deploy to other machines. You can use Group Policy to distribute the XML file to multiple devices at once. ## Requirements -The following requirements must be met before controlled folder access will work: +The following requirements must be met before exploit protection will work: -Windows 10 version | Windows Defender Antivirus -Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled +Windows 10 version | Windows Defender Advanced Threat Protection +Insider Preview build 16232 or later (dated July 1, 2017 or later) | For full reporting you need a license for [Windows Defender ATP](../windows-defender-atp/windows-defender-advanced-threat-protection.md) -**Use the Windows Defender Security app to enable controlled folder access:** + ## System-level mitigations + +What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? + +System-level mitigations are applied to... + +You can set each of the following system-level mitigations to on, off, or the default value: + +Mitigation | Default value +Control flow guard | On +Data execution prevention | On +Force randomization for images (Mandatory ASLR) | Off +Randomize memory allocations (Bottom-up ASLR) | On +Validate exception chains (SEHOP) | On +Validate heap integrity | Off + +Generally, the default values should be used to... + + + +### Control flow guard + + + +### Data execution prevention + + + +### Force randomization for images (Mandatory ASLR) + + + +### Randomize memory allocations (Bottom-up ASLR) + + + +### Validate exception chains (SEHOP) + + + +### Validate heap integrity + + + + + + 1. Configure + 2. Export + 3. Import + +### Configure system-level mitigations 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -65,11 +108,125 @@ Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows De ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) -3. Set the switch for the feature to **On** +3. Under the **Controlled folder access** section, click **Protected folders** - ![](images/cfa-on.png) +4. Click **Add a protected folder** and follow the prompts to add apps. -**Use Group Policy to enable controlled folder access:** + ![](images/cfa-prot-folders.png) + +You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. + + ### Export system-level mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can import the XML file to other machines in your organization. You can do this individually for each machine by using the Windows Defender Security Center, or you can deploy a Group Policy setting for multiple devices. + + ### Import system-level mitigations + + **Use the Windows Defender Security app to import system-level mitigations:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +**Use Group Policy to import and deploy system-level mitigations:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + + + ## App-specific mitigations + + What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? + + 1. Configure + 2. Export + 3. Import + +### Configure app-specific mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. + + ### Export app-specific mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can import the XML file to other machines in your organization. You can do this individually for each machine by using the Windows Defender Security Center, or you can deploy a Group Policy setting for multiple devices. + + ### Import app-specific mitigations + + **Use the Windows Defender Security app to import app-specific mitigations:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +**Use Group Policy to import and deploy app-specific mitigations:** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -92,84 +249,7 @@ Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows De - ## Protect additional folders - - Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. - -Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. - -You can add additional folders to be protected, but you cannot remove the default folders in the default list. - - - -Click Protected folders in the Controlled folder access area and enter the full path of the folder you want to monitor. - -You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. - -**Use the Windows Defender Security app to protect additional folders:** - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - - - **Use Group Policy to protect additional folders:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? - - -> [!IMPORTANT] -> Environment variables and wildcards are not supported. - - ## Allow specifc apps to make changes to controlled folders - -You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the controlled folder access feature. - - -**Use the Windows Defender Security app to whitelist specific apps:** - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** - -4. Click **Add an allowed app** and follow the prompts to add apps. - - ![](images/cfa-allow-app.png) - - **Use Group Policy to whitelist specific apps:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? - - -## Review event logs for controlled folder access +## Review event logs for exploit protection How do you see these event logs? Are they under specific codes/areas? diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 51488cd9a3..5621c83f5c 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -26,17 +26,6 @@ msft.author: iawilt - Enterprise security administrators - -**Manageability available with** - -- Group Policy -- PowerShell -- Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune -- Windows Defender Security Center app - - Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. You can use Windows Defender EG to: From b325b948873c0458442d54b313dcda01e784cbe0 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 18 Jul 2017 13:10:19 -0700 Subject: [PATCH 04/54] remove file ext --- ...rs-exploit-guard.md.md => controlled-folders-exploit-guard.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/threat-protection/windows-defender-exploit-guard/{controlled-folders-exploit-guard.md.md => controlled-folders-exploit-guard.md} (100%) diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md similarity index 100% rename from windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md.md rename to windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md From 985e9e985a1a81682e3ffbc1b44265d032aa2600 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 18 Jul 2017 13:11:57 -0700 Subject: [PATCH 05/54] file name --- ...exploit.guard.md => attack-surface-reduction-exploit-guard.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/threat-protection/windows-defender-exploit-guard/{attack-surface-reduction-exploit.guard.md => attack-surface-reduction-exploit-guard.md} (100%) diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit.guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md similarity index 100% rename from windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit.guard.md rename to windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md From a2dcf99d30093da40e4912c0b58a461f6d5e0da2 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 10 Aug 2017 17:50:23 -0700 Subject: [PATCH 06/54] add eval guide bits - cfa near ready --- .../controlled-folders-exploit-guard.md | 21 +- .../evaluate-asr.md | 165 +++++++++++++++ .../evaluate-controlled-folder-access.md | 95 +++++++++ .../evaluate-exploit-protection.md | 196 ++++++++++++++++++ .../evaluate-network-protection.md | 128 ++++++++++++ ...evaluate-windows-defender-exploit-guard.md | 40 ++++ .../images/cfa-audit-gp.png | Bin 0 -> 35400 bytes .../images/cfa-filecreator.png | Bin 0 -> 7955 bytes .../images/cfa-notif.png | Bin 0 -> 17035 bytes .../scripts/cfa-events.xml | 1 + .../windows-defender-exploit-guard.md | 38 ++-- 11 files changed, 663 insertions(+), 21 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-audit-gp.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-filecreator.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-notif.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index 6432b9da27..f02c6632ee 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -169,6 +169,23 @@ You can specify if certain apps should always be considered safe and given write ## Review event logs for controlled folder access -How do you see these event logs? Are they under specific codes/areas? +Component | Configuration available with | Event ID | Corresponds to… +-|-|-|- +Controlled Folder access | GP, MDM & UI | Provider: Windows Defender | +| | | Event when settings are changed | +| | | Event when CFA fires in Audit-mode | +| | | Event when CFA fires in Block-mode | -Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. \ No newline at end of file + +## MDM policy settings for Controlled Folder Access + +./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders + +## Audit/block modes + +Controlled folder access has mitigations that can be individually enabled in audit or blocking mode. + +Component |Description |Rule/mitigation description | +-|-|-|- +Controlled folder access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. +| | | Allowed apps |Apps that are allowed to write into protected folders \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md new file mode 100644 index 0000000000..7985b26b3e --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md @@ -0,0 +1,165 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + +# Attack surface reduction + +## Attack surface reduction rules + +Component | Configuration available with | Event ID | Corresponds to… +-|-|-|- +Attack Surface Reduction (ASR) | GP & MDM | Provider: Windows Defender | +| | | Event when settings are changed | +| | | Event when rule fires in Audit-mode | +| | | Event when rule fires in Block-mode | + + +### Audit/block modes + +Each of these components can individually be enabled in audit or blocking mode. + +Attack surface reduction and controlled folder access also have mitigations that can be individually enabled in audit or blocking mode. + +Component |Description |Rule/mitigation description | +-|-|-|- +Attack surface reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content +| | | | Block obfuscated js/vbs/ps/macro code +| | | | Block office application from launching child processes +| | | | Block office application from injecting into other processes +| | | | Block Win32 imports from macro code in Office +| | | Rules to prevent script threats |Block js/vbs from executing payload downloaded from Internet +| | | | Block obfuscated js/vbs/ps/macro code +| | | Rules to prevent email threats |Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). + + +## Policy settings for Windows Defender EG + +The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. + + +### Attack Surface Reduction + +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules +-- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 + + +#### Rule-GUIDs for ASR + +Rule description | GUIDs +-|- +Office rules | +Block office application from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} + | OMA URI : “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” + | Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 + | 1 = Block, 2 = Audit, 0 = Disabled. +Block office application/macros from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} + | Replace the above GUID with the corresponding Rule GUID +Block office application from launching child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} + | Replace the above GUID with the corresponding Rule GUID +Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} + | Replace the above GUID with the corresponding Rule GUID +Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + | Replace the above GUID with the corresponding Rule GUID +Script rules | +Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + | Replace the above GUID with the corresponding Rule GUID [Note: same rule as above, but also covers scripts hence written here] +Block js/vbs from executing payload downloaded from Internet. | {d3e037e1-3eb8-44c8-a917-57927947596d} + | Replace the above GUID with the corresponding Rule GUID +Email rule | +Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 + | Replace the above GUID with the corresponding Rule GUID [Currently working for Mail-client (Outlook). Personal Webmail (Outlook.com, Gmail, Yahoo) work in progress] + + + + ## Evaluate + +### Using the standalone configuration tool + +We’ve provided an easy-to-use configuration tool for testing purposes, called TestHIPS. The tool can be used to: + +1. Enable the chosen ASR rule in either block or audit mode by creating a local GPO and running a test file that triggers the rule. + +2. Enable the chosen ASR rule in either block or audit mode by creating a local GPO. + +The result of the activity can be viewed in the event log and corresponding notification (if the rule was triggered in block mode). + +You can find the tool in the evaluation package alongside this guide: +- ExploitGuardCustomerFiles/AntiMalware.Tools.TestHIPS.exe +- +Note: You may need to change the extension in the filename from **AntiMalware.Tools.TestHIPS.rename** to **AntiMalware.Tools.TestHIPS.exe**. + +For additional help with the tool, use the “-?” parameter. + + +### Using the DemoExploitGuard tool to simulate WD-EG Rules with a GUI + +You can use an additional tool, called DemoExploitGuard, to test various rules by simulating scenarios that would cause the rule to issue a block or audit event, depending on the mode. DemoExploitGuard uses the TestHIPS tool to enable and configure the rules. + +You can find the tool in the evaluation package alongside this guide: +- ExploitGuardCustomerFiles\AntiMalware.Tools.DemoExploitGuard.exe + +Note: You may need to change the extension in the filename from **AntiMalware.Tools.DemoExploitGuard.rename** to **AntiMalware.Tools.DemoExploitGuard.exe** +**Rules**: Select one of the seven attack surface reduction rules to run. +**Mode**: Sets the behavior of the Demo Tool. +Note: If the rule is applied by GP, this should not be an option +- **Disabled**: This scenario will execute normally and complete +- **Block**: This scenario should get blocked [ExploitGuard Block] and a notification will appear to indicate the block +- **Audit**: This scenario will not block, but will show up in the event log. Right-click the output area to go directly to the event logs for Windows Defender EG + + +### Manually enabling the attack surface reduction rules + +You can also manually use GP or MDM-URIs to enable the ASR rules: + +From the rules tables above, choose the ASR rules that you want to enable and set the following policy. For each rule select the right GUID. + +After you’ve chosen your rules, use one of the tools above to simulate a rule to fire. +- “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” +- Value as String Data Type: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:2 + + +### View event logs + +Note: event logs are not the primary mechanism for investigation. The Windows Defender ATP portal receives much richer information that allows for investigation. Information is also presented in an interactive machine-timeline view. + + +#### Event fields +- **ID**: matches with the Rule-ID that triggered the block/audit. +- **Detection time**: Time of detection +- **Process Name**: The process that performed the “operation” that was blocked/audited +- **Description**: + +Windows Defender Antivirus has audited an operation that is not allowed by your IT administrator. + +For more information please contact your IT administrator. +-- ID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A +-- Detection time: 2017-06-21T11:52:29.062Z +-- User: SYSTEM +-- Path: C:\Windows\System32\notepad.exe +-- Process Name: C:\Program Files\Microsoft Office\Office16\winword.exe +-- Signature Version: 1.245.730.0 +-- Engine Version: 1.1.13902.0 +-- Product Version: 4.12.16228.1000 + + +### View the alert notification + +If you configure the test to block, a notification will be displayed from the Action Center. This notification is customizable with your organization and contact information. + + +### Customizing Windows Defender + +Customizing the Windows Defender Security Center is a simple task that provides users with a clear way to contact support. +Simply navigate in Group Policy to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Security Center\Enterprise Customization**. From there, you will be able to enable your custom notification, set your organization name and contact information. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md new file mode 100644 index 0000000000..6b44a7c9b8 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -0,0 +1,95 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + +# Evaluate Controlled Folder Access + + +Controlled Folder Access is a feature that is part of Windows Defender Exploit Guard [that helps protect your documents and files from modification by suspicious or malicious apps](controlled-folders-exploit-guard.md). + +This topic helps you evaluate Controlled Folder Access. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation. + + +## Use the File Creator tool to demo Controlled Folder Access + +Use the File Creator tool to test controlled folder access. The tool is part of the Windows Defender Exploit Guard evaluation package: +- [Download the Exploit Guard Evaluation Package](#) + +This tool can be run locally on an individual machine to see the typical behavior of Controlled Folder Access. The tool is considered by Windows Defender Exploit Guard to be suspicious and will be blocked from making changes to files in any of your protected folders. + +You can enable Controlled Folder Access, run the tool, and see what the experience is like when a suspicious app is prevented from accessing or modifying files in protected folders. + + + +1. Open the Exploit Guard Evaluation Package and copy the file *Filecreator* to a location on your PC that is easy to access (such as your desktop). + + >[!TIP] + >You may need to change the extension in the filename from *Filecreator.rename* to *Filecreator.exe* + +2. Open the **Local Group Policy Editor** by typing **Edit group policy** in the Start menu. + +3. Under **Local Computer Policy**, expand **Computer configuration** > **Administrative templates** > **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled Folder Access**. + +4. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the **Options** section select **Enable**. + +>[!IMPORTANT] +>To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + +![](images/cfa-gp-enable.png) + +4. Run the tool by double-clicking it. If a Windows Defender SmartScreen notification appears, click **More details** and then **Run anyway**. + +5. You'll be asked to specify a name and location for the file. You can choose anything you wish to test. + +![](images/cfa-filecreator.png) + +7. A notification will appear, indicating that the tool was prevented from creating the file, as in the following example: + +![](images/cfa-notif.png) + +8. You can also review the Windows Event log to see the events there were created: + 1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + 2. On the left panel, under **Actions**, click **Import custom view...** + 3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. + 4. Click **OK**. + 5. This will create a custom view that filters to only show the following events related to Controlled Folder Access: + + Event ID | Description + -|- + Event when settings are changed | 5007 + Audited Controlled Folder Access event | 1124 + Blocked Controlled Folder Access event | 1123 + +## Use auditing mode to measure impact + +As with other Windows Defender EG features, you can enable the Controlled Folder Access feature in auditing mode. This lets you see a record of what *would* have happened if you had enabled the setting. + +You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period. + +To enable audit mode, see the GP option to **Audit Mode**. + +![](images/cfa-audit-gp.png) + +>[!TIP] +>You will need to use a GP management tool, such as the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), to deploy this policy change to see how Controlled Folder Access would work in your network. + +## Customize protected folders and apps + +During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. + +See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with the Windows Defender Security Center, Group Policy, or mobile device management (MDM) policies: + +- [Protect additional folders](controlled-folders-exploit-guard.md#protect-additional-folders) +- [Allow specifc apps to make changes to controlled folders](controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md new file mode 100644 index 0000000000..b6c238c73e --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md @@ -0,0 +1,196 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + + +## Exploit protection + + + +Component | Configuration available with | Event ID | Corresponds to… +-|-|-|- +Exploit Protection | GP, MDM, PS & UI | Provider: Security-Mitigations | +| | | 1 | ACG audit +| | | 2 | ACG enforce +| | | 3 | Do not allow child processes audit +| | | 4 | Do not allow child processes block +| | | 5 | Block low integrity images audit +| | | 6 | Block low integrity images block +| | | 7 | Block remote images audit +| | | 8 | Block remote images block +| | | 9 | Disable win32k system calls audit +| | | 10 | Disable win32k system calls block +| | | 11 | Code integrity guard audit +| | | 12 | Code integrity guard block +| | | 13 | EAF audit +| | | 14 | EAF enforce +| | | 15 | EAF+ audit +| | | 16 | EAF+ enforce +| | | 17 | IAF audit +| | | 18 | IAF enforce +| | | 19 | ROP StackPivot audit +| | | 20 | ROP StackPivot enforce +| | | 21 | ROP CallerCheck audit +| | | 22 | ROP CallerCheck enforce +| | | 23 | ROP SimExec audit +| | | 24 | ROP SimExec enforce +Exploit Protection | GP, MDM, PS & UI |Provider: WER-Diagnostics | +| | | 5 | CFG Block +Exploit Protection | GP, MDM, PS & UI | Provider: Win32K | +| | | 260 | Untrusted Font + + + +### Audit/block modes +Each of these components can individually be enabled in audit or blocking mode. + +Attack surface reduction and controlled folder access also have mitigations that can be individually enabled in audit or blocking mode. + + + +Component |Description |Rule/mitigation description | +-|-|-|- +Exploit protection |Provides memory, control flow and policy restrictions that can be used to protect an application from exploits. - Each mitigation can be enabled in audit/block mode |Memory exploit mitigation | DEP +| | | | ForceASLR +| | | | BottomUpASLR +| | | | HeapTermination +| | | | SEHOP +| | | | CFG +| | | | Strict handle checks +| | | | ACG +| | | | Untrusted font blocking +| | | | No child process +| | | | Win32k syscall disable +| | | | Extension point disable +| | | | Various image loading restrictions +| | | | Anti-ROP (CallerCheck, SimExec, StackPivot) +| | | | EAF, EAF+ +| | | Control Flow mitigation | +| | | Process restrictions | + + + +## Policy settings for Windows Defender EG +The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. +### Exploit protection +Exploit protection has an improved manageability experience over EMET, including support for SCCM, Intune, Powershell, and Group Policy management. +> +> Note: SCCM and Intune will be supported in furture releases. +You can specify a common set of WD Exploit Guard system and application mitigation settings that can be applied to all endpoints that have this GP setting configured. +Note, however, that there are some prerequisites before you can enable this setting: +- Manually configure a device's system and application mitigation settings using the *Set-ProcessMitigation* PowerShell cmdlet, the *ConvertTo-ProcessMitigationPolicy* PowerShell cmdlet, or directly in the Windows Defender Security Center +> +> Note: Endpoints that have this GP setting set to **Enabled** must be able to access the XML file, otherwise the settings will not be applied. +- Generate an XML file with the settings from the device by running the *Get-ProcessMitigation* PowerShell cmdlet or using the **Export** button at the bottom of the **Exploit Protection** area in the Windows Defender Security Center. +- Place the generated XML file in a shared or local path. + +#### Group policy + +The exploit protection feature can be configured with the following Group Policy details: +- Location: \Microsoft\Windows Defender Exploit Guard\Exploit Protection +- Name: Use a common set of exploit protection settings +- Values: **Enabled**: Specify the location of the XML file in the Options section. You can use a local (or mapped) path, a UNC path, or a URL, such as the following: +-- C:\MitigationSettings\Config.XML +-- \\Server\Share\Config.xml +-- https://localhost:8080/Config.xml + +The settings in the XML file will be applied to the endpoint. + +**Disabled:** Common settings will not be applied, and the locally configured settings will be used instead. + +**Not configured:** Same as **Disabled**. + +#### PowerShell + +You can also use powershell to set these mitigation policies and to convert EMET policies to Windows Defender EG, as demonstrated in the following examples: + +Get the current settings in the registry for processName.exe +``` +Get-ProcessMitigation -Name processName.exe +``` + +Exports the current settings to the filename.xml +``` +Get-ProcessMitigation -RegistryConfigFilePath filename.xml +``` + +Imports the settings in filename.xml to the system. +``` +Set-ProcessMitigation -PolicyFilePath filename.xml +``` + +Enables a list of mitigations +``` +Set-ProcessMitigation -Name processName.exe -Enable SEHOP,DEP +``` + +Disables a list of mitigations +``` +Set-ProcessMitigation -Name processName.exe -Disable SEHOP,DEP +``` + +Sets the EAFModules for dllName1.dll & dllName2.dll for processName.exe +``` +Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll +``` + +Converts an emet file named, emetFile.xml, to the new windows 10 format called, filename.xml +``` +ConvertTo-ProcessMitigationPolicy -EMETFilePath emetFile.xml -OutputFilePath filename.xml +``` + + +### Make sure things are working + +1. Apply a mitigation setting: +a. Launch PowerShell as an admin and run **Set—ProcessMitigation –Name iexplore.exe –Enable DisallowChildProcessCreation** +2. Validate that the setting is correctly applied: +a. Open Windows Defender Security Center -> App & browser control +b. Scroll to the bottom and under **Exploit protection**, click **Exploit protection settings** and navigate to the **Program settings** pivot +c. Scroll down to **iexplore.exe**, click on it and click **Edit** +d. Find the **Do not allow child processes** setting and make sure that **Override System settings** and **On** are set +3. Validate that Internet Explorer won’t run: +a. Try launching iexplore.exe via the run dialog +b. An IE frame should appear and then close +4. Validate that event viewer reports that the mitigation fired: +a. Open Event Viewer +b. Navigate to Applications and Services Log -> Microsoft -> Windows -> Security-Mitigations -> Kernel Mode +c. Check for the following entry for Internet Explorer (event ID 4) + +Process '\Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe' (PID 4692) was blocked from creating a child process 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' with command line '"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:75009 /prefetch:2'. + +5. Undo the mitigation setting: +a. Open Windows Defender Security Center -> App & browser control +b. Scroll to the bottom and under **Exploit protection**, click on **Exploit protection settings** and navigate to the **Program settings** pivot +c. Scroll down to **iexplore.exe**, click on it and click **Edit** +d. Find the **Do not allow child processes **setting and toggle the **On** to **Off** +e. Click **Apply** +6. Validate that Internet Explorer runs: +a. Try launching iexplore.exe via the run dialog +b. IE should open as expected + + +### Converting and Applying an EMET config: +1. Export the existing EMET configuration. This can be done from the "Export" button in the GUI, or by running the command: **emet_conf.exe –export emetConfig.xml** +2. In an elevated PowerShell window, convert the exported configuration with: **ConvertTo-ProcessMitigationPolicy -EMETFilePath emetConfig.xml -OutputFilePath win10Config.xml** +3. Note that this may give you some warnings, but these should be safe to ignore. +4. Apply the new configuration: from an elevated PowerShell window run **Set-ProcessMitigation -RegistryConfigFilePath win10Config.xml ** +5. From here you can check or edit the settings in the new interface in the Windows Defender Security Center or with **Get-ProcessMitigation** (this command by itself will output the entire current state of the mitigations to the shell), and **Set-ProcessMitigation** respectively. + + +### Managing exploit protection through Group Policy +1. Launch Group Policy Management Console (gpmc.msc) and from within and existing or new GPO navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection** and open the policy named *Use a common set of exploit protection settings*. +2. Enable the setting as seen below and point to an accessible location for the client machines to the recently created XML. +3. Apply the new GP to targeted machines by direction OU membership, Security Group or WMI filter. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md new file mode 100644 index 0000000000..47f6e8b5ad --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md @@ -0,0 +1,128 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + +## Policy settings for Windows Defender EG +The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. +### Network Filter + +In Windows 10, Version 1709, you can enable Windows Defender EG network protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. + +You can enable network protection in either block or audit mode (non-blocking, ATP events only) with Group Policy, WMI/PowerShell, or MDM settings with CSP. + + +#### Group Policy + +The network filter feature can be configured with the following Group Policy details: +- Location: \Microsoft\Windows Defender Exploit Guard +- Name: Prevent users and apps from accessing dangerous websites +- Values: **Enabled**: Specify the mode in the **Options** section: + **Block**: Users and applications will not be able to access dangerous domains + **Audit**: Users and applications can connect to dangerous domains, however if this feature would have blocked access if it were set to block, then a record of the event will be in the event logs + +The settings in the XML file will be applied to the endpoint + +**Disabled**: Users and applications will not be blocked from connecting to dangerous domains. + +**Not configured**: Same as **Disabled**. + +To enable network protection in block mode, select the **Enabled** value and specify **Enabled** in the drop-down sub-option menu. + + +#### Windows Management Instrumentation/PowerShell + +Use the following cmdlet to configure network protection: +``` +Set-MpPreference -EnableNetworkProtection [Disabled|Enabled|AuditMode] +``` + +To enable network protection in Block mode, use: +``` +Set-MpPreference -EnableNetworkProtection Enabled +``` + + +#### Mobile device management/Configuration service provider + +Use this CSP to configure network protection: +- Policy area: Defender +- Name: Defender\EnableNetworkProtection +- Supported Values: +-- 0: Disabled +-- 1: Enabled (Block Mode) +-- 2: Audit Mode + +To enable network protection in block mode, set **Defender\EnableNetworkProtection** to integer 1. + + + +## Network Protection + + + +Component | Configuration available with | Event ID | Corresponds to… +-|-|-|- +Network Filter | GP, MDM | Provider: Windows Defender | +| | | Event when settings are changed | +| | | Event when NW filter fires in Audit-mode | +| | | Event when NW filter fires in Block-mode | + + + +### Audit/block modes +Each of these components can individually be enabled in audit or blocking mode. + +Attack surface reduction and controlled folder access also have mitigations that can be individually enabled in audit or blocking mode. + + + +Component |Description |Rule/mitigation description | +-|-|-|- +Network Filter |Blocks outbound connection from any app to low rep IP/domain - This can be enabled in audit/block mode |Enable/disable/audit |Puts the feature in enable/disable or audit mode. + +### Visit a malicious domain in block mode using Internet Explorer or Google Chrome +1. Enable network protection in block mode. +1. Open Internet Explorer, Google Chrome, or any other browser of your choice. +1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) + +You will get a 403 Forbidden response in the browser, and you will see an Action Center message saying that Windows Defender EG blocked a connection to a malicious site. + +### Visit a malicious domain in audit mode using Internet Explorer or Google Chrome +1. Enable network protection in audit mode. +1. Open Internet Explorer, Google Chrome, or any other browser of your choice. +1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) +You will be able to navigate successfully to the site. However, you can see an audit event in Windows Defender ATP or in the Windows Event Log (under Windows Defender > Operational). + + +### Visit a malicious domain in Microsoft Edge +1. Enable network protection in bmode. +1. Ensure that SmartScreen is enabled. (Start -> Windows Defender Security Center -> App & browser -> SmartScreen in Microsoft Edge -> Block or Warn) +1. Open Microsoft Edge. +1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) +You will see a SmartScreen malware/phishing warning. This is the 1st class experience for Microsoft Edge. + + +## Enabling Windows Defender EG rules in audit mode +Use the script Enable-ExploitGuardAuditMode.ps1 to turn on the ASR rules and Controlled Folder Access into audit mode via Local GP on a device. This allows one to observe how the rules would perform across various machines in your system, and determine which can be turned on in Block mode and if any exclusions need to be applied. +**Note:** Rename Enable-ExploitGuardAuditMode.rename to Enable-ExploitGuardAuditMode.ps1 +Run the following in an elevated powershell prompt: +- Set-ExecutionPolicy Bypass -Force +- .\Enable-ExploitGuardAuditMode.ps1 +Successful output should indicate ASR and Controlled Folder Access were turned on in audit mode + + +## Monitoring with Windows Defender Advanced Threat Protection +Windows Defender EG events can be found in event logs, or if the enterprise uses Windows Defender ATP, the Windows Defender Security Center + \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md new file mode 100644 index 0000000000..3c47d6425d --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md @@ -0,0 +1,40 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +msft.author: iawilt +--- + + + +# Evaluate Windows Defender Exploit Guard + + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + +Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. + +You can use Windows Defender EG to: + +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) + +There are a few ways you can get started evaluating Windows Defender EG to see how it works and how it could help protect your network. This topic brings together the evaluation topics for each of the four features in Windows Defender EG. + + diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-audit-gp.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-audit-gp.png new file mode 100644 index 0000000000000000000000000000000000000000..89abf15424ece411bf3970245e716216ce9e7684 GIT binary patch literal 35400 zcmc$`2Ut^0_b-~)t_Ub7RY0Uk?;u@8dXwIJ4FN*$ffoykROua+o&cc-2u*3yI|vAf zbV5K%KnNjc$M^gG_kYU0=id9=b1u)rGs*1Pvu9?nS@T=JwN|2@YpamoV7LJSfymWV zpXq@>7b=1Ozpq^ZY8>P>7=hxtr>dzB2t?6I`u{71mx5Gz)mKeR>FUxoGSEZLAnfZ~ zf2x#Be4qIFx%fJ!roL%)M+eWoB=}IvT zT&#CSUH@9dA&C0fy07H7&sY4iZs|mMybIbM`pfs0ig%UX3j@=dVftsEDjBKl2R`K7 zjU4pMP;a{ORcZW{w0pV0uM0OEunJRHlu=llUw@zDXUs|9itRo+v@LJ<7^Nv6+P1j3 z>x|#XkC&wtw3_IOrWJqm=wWnut@O@1-Ltgz6ejrB43sv z>dYy=)8O&*^sHw15ECx*DPm!n;q0u;qDN<=qS11UR^fdG(O{P{v?vBsXx_#%AC_eB zOPqUm?RuhY6P;g(JB;{ z_w{56ZPfX#RTalcMGXR#4(Fwr!eUk4P%w?5_V@jM|5{?jQvf4^uC8K6J}Rn}`@FcL z!Wq6)=FzxyY<85#iTJf9xRp=2Fx|t#GEVF6T;SvE+v%sAW67Lz+A<+`A4j1|XgjWW z-4e+9Wv;aelH%N-i1F%Bniash(`%2L)!K!%Kqn*cGnptGQgfXnaXo0G6Ln$9n<4?}~=ats|b`4Kp0SJJD5%C1)6$ zGuo=dHhl5#?gmxQ7?n7xy0yCJf0v(omr7?Rn#u^_i#&RDIIWgMJ$Nb`NB1BF%8;ZM z5<6NZ#5aAdRLqxK#WStTf4pfhu8xNmko1?rQB1unhVMipTDDx#@`Qo>TxtQr9)Z%& z%Gzi#M4x?5Nvkqv{A74|!{L}^5}y@+m=zI^8-fmPb;|7aFYmc{3VjiI{oT!!a<Z=s@Q)7Be}G`zUa>2O~dUq724kiO=z^0k|oJ zwtUH1^y=0brJ4kJ@PqH2b&G`p2-rN=BzMO(KtScJ>a8oLpYGF5 zH)obdX%#h4ee+o#-fZC|2Ee%UA3M*tP2#MHZHH(GbXrHE5MxaAPdmqMh+*e~%FnBY zigIwYxcEBfI&|2J75ds%T|S?P)HMm0fIjWU)Y6&2H#WaV%=_vD)kC_UWefXF^FUie z*L_PlC42pxD-7QB7@lBT0V_4PaqEE?8qESuBcW+RQ&e7506! znriemiF2_{n^^~Se#f@t*{Auz!QqIC3VrD?@5jWjPu2p)dD50`qqX31KJ~$gzMlRG zA%*Suuz+$`b9TptvU~JY?K@`Wkhj%EVwnS3DK%|+jOJ%b6{4D^&fGH7Lh9eD=YoSG z1SQ5DFMfWh+y;yM_LFBCE_WNxdtLY$k3x|=#rW!27_mBbr)9Qr(K_{*g<5gWxlYb| zK7&_g!Y~P;-I35RBLM;lI2!3N()F@SR9u?EWksKEP!c~P+V%}CMeVC(sgWbEbci1g z@9-YzE6n5vEW(VPhjS*gcLyeq&v%Js#500kN~*v(Q@}vAK!Zy(6jrd*o#i<8 z;(;2^7|n8PS&rGPxbL8S=)2m&nJj}@Hwpf6y^iESp{3dxw`#1>t4(jH8+@R;!PbR+ z&bUCyu{*0_z&;vjfjD}$h1^(Gif7e35kB%#^)iI(7FN4S%%nCZQ`1ENs}|?9O4qkf z<5)NUX(#oEmY->g)I#A^r#TSlt^SYQ*ske7F`qTfe#ZJUwe5in(Im6t^5WtipPlbg zcbi3??8=2{biO1mG7;elgud9mY_TV>yl=i9p3jYE1U3eW*L{!9F0~wVI}va{8>L}u zG4kiX%e;LKk~1L3|bd33Jmc40kW+o7i3& z)CJDb()&AZK4W#pnEGsR6MxTEQJFzPX$li_`8|vfaQPOhA(aFdLH4niXn=zI_5Zx! zSdpqM*2!Z=JOXa`J6-4k8BioY{a;Xs2&cZ>78j4$%~?EoGVpr6ZSMtpucaxyvkB?R zjp*rE?#x3eh!L7^r)Z5x6`#j)}O3Y?6(Sjz)*Ee{j}Y%ZJP&FO(giVO3yTS>xJTral& z)&BfWK_>(9HrTw*vi!Au%B3u_T_|X|2avfQ=}W&mrEhhLGb;R~Z|>N5D;44XdkasR ziR*GV@l*I|affa^@d)Ky0^cfj1ug~iY>jG*8#qwX*YykX$BN5p%+TBCXvSL1b>~+B z-GV$zqw$;-c*(R)qC%D9*Xb8(jjYx$i{bWy6EpDB{ihi2^{_YU+x{~!>&c<^D0sbb z|7IC;^{}bCu~&10~u)B}!-Ws%mH94{5x%X9~=AY+^s+;b4Q1UOD zHaVAzXm%&E@qlJqt%_TsGaLkzwM= zXjLJLZ(Q|9ulh@>b#)gMT6LAbUVv$>!WUPxBo3yVCJlBhAzKuA&bt961>Xv#!!ur6 z!rulp>b4w}D0>9ttFJy+D>PU>N*QOr`^Hg_ZJ}P7DDtYZ;Xx|ocC@Lv-8O=iz*OfR z8C>3nddJ<|!uqlm%;SDI9i-`3q17s#1E+}UQF!1{H4pc2e#ujv720!}>Y45iz;QOt zHI7S*=SL{N!2$%1HVOLtbkJINEpK?DG~zEpD?WYU{5Yxav_E4%P&WAY(i_~`>u83v z!4EY23=?O=Tq^uB{A}jfa#-TbyOCCbx-^AP-R%{jDUs6U)$JC7+vYGARrOb_I>9f7ZUZTlB-@m6zRe!erQxQ?i2pEa)P zzEv99e?EB49s0<*Zo3N?!P1Xs$JN1G&u%w%=y;jAq2Opfjmx+$o?hu9<#56#C!iPG z-$n&p|D5uY`Yp%`JR!I`wgUm#v^}I;Htb-%B>A2g>W&gmdzo1Rtlnt_Z&G z*#zWvd3c8u!f`RV(7ts!tB-A(x+<)uX&wIwb`DASnByl3ikTJ>lRGn4e^>=Z}kGq!1)2DDhSb^fLtep z3UgH^aq3LvWfQ8|H$&Ic4)^;7G1I%}M!5>ZqpzcBSNAMN$P}Pc(So&LbiQKl0ZYm5 zgsG)H-cNIN9qEVp_C+p}xdB|H$8!)HDDH@`YYGpknh+asepQqLFB&Se3%4vcg_FrH z@LN0j-Iy?*N#XD3Y9o&tte{GYab}-QwKnl+h~hP~5Ke|nroM&U)d`{@9roSlJP0anO{$^1l7~RjC_k=q}gi<}wdA`m7uL>bt}w*fx6jf#vMS z)mhw__GS&)eyINwlZSo!9G$mS zOeDNI&l7dl`=MnKB|E|b(o+lx2}yQ-N8zHf8DGeCuPLCqAcBc!5HqR>gNQ+DU)+mh z-D4h!V@mSdZJ9c@xo47Bar8pIJj3z)Kvmjz*Ps=M2`As5JIZr+s~ISqBt#Jg{{9*5aPHZw?6~!A2dDff)>Op zoIHEEt}qf!B$V6}^y{tid0bBxey{gi5`3{r4R_hJI?xCNvasS@hn(kd9eRu@+p2tf z9KXQBE5vSB^MF$`El;LysgPWH?>j~8Z;n+no8->ycIHRFkka8+Tbn7ZhlR+^IP?wN zYt7xP@~~s{Vz1A601v->`PgL^cfgSw@Yf^pvJ$vfD!`=AECpyJGc z?T6&rS1GrjgKgdgwov>oDvcd)z9^$^*ku1$u?Vg>B%Uo=saRMTd5L#reT0KTu_(#; zZb{h^vo*{%vU7`R30?fewSmiWvrwj%ZF@Z;Asx2JSk$GsC8?c;T>QvX*lQ8?{#nxQ zq~bX9czpQ_(aqurroza=t5<6m0tg*=!GdQMmzC89;zwN}a|k5NJyo7?C~fJ7b51N6 zw?2O!j9)*ERv^Lw`*++qkB}iR6QG@!BU4<93Fq2`zke5!zF#+motmwpxCrXbzc`0W zUqi47c}{(B@+(0?t0k|WR2@FE&g0ZrD6l2`eag(EAB_L2JVRV#?CXqQnc{8vIuyIT3k4+|A4BrHM6nz=sj{_XXRwy_8~@}rZh~-!K_j^A>IAAtN3i#i z77SVR>g--FtK>%RQQE{bs@uHVN2b^Xjw5`3JYIi$i5#R_k2*BTg&uA( zZ*ugs+*o_$82mMF@8;n~If_|7H@pCodu6i|&5&;Rp*qqZ+9dqL;Gp)6n8RA&2Nh@v zJ!*KYnq03&v`=VerL<|>)j%*XVaM;V6uHZ>$-MYA+puiUHyTM0JQ1xkz04DW=rLCg z3~}NgkCa&!2)#2nmYG(xS%tM#`{<~kHPxasVC-Ynv@@#VRi*|A>`IsH1^gyg-d4_n z)#SvP<=3Muk0v#uccnQsr)EOW@+cQD7f3~;GI5V(8q>`PeSZk9w!Z>mpU;^cS)$AI z&EyVIgK^GiKADkoRj5>U4c8pMahgawyAraxfu5Er%sDsuHmJJf1Rm6A9sO|uW0E9X zBl~OTdhe-}`0{v}C%#rc%`w?y|irlQ8Gu4OE1#drg7T3G*Y_oiQ5r}47;=rfp%i7)!R6Q4>mnRDpO*CsNrkuWgqB%eof_C*sP(l$GlxK$ zb5g#`0$uzxfpJVu(#+zF2_i)uw7d4~y26MO@R$t$KHh8}!*sj&qVDeKQMcMGU zeQV+UnpF3ZsE`+uN~TA&fJCwvt+!tQ=^5|ma=-g(7gE2qA%FGATfBMwd*rfI<+6sw zFo~y|y5cWe94S+r882^d;KeTh6JG2Ds$)nhU(WT~nMG0B=?({&f!ZRvpZq$&CSK1d z6o=eIP_P+f>J4f8r%3|gU z`djoG*MNHx^!`Ow{x2*z+TivzaC=yNz)fvaXe)2Jz zn>16cCI_{iG$do%EJQ z!0_-@gSLAdt@axCw&F1jznb8yVsZ*}FKcEieg>Deelyl?Q{?F0ClS0F4doUqpRIceVBGem+RCF4;d4$WYEUf-6&*0<;Ic7guFYPL8zS zRx%t8cc_`sjIWw;Gpln=(aw>+8zl7v=JiGGL(Qyo#CAaPSNRr=_}?nn?;dxLD4;iH zW}dT7G9}FcMrGf$*)d1h%jdzVH@3`^4&tMhc%U~dR8U#EhQLDtfQN(}ZI32$XxK^n z_a<`8wuGR%7A{PRPxjVv&p@clq4EqKV@Ww)^o3gB!r+2tt1ecE3VyZ3zeGU}0Pk5h z^VOGUG1C|gP&+D53y{k2&b z%#MDVVl)%gCGt0`iokRj)%{j2|DVmzEiT!G*4FeMVir#3MW4rB)W)kBXddG*-Jg;}&My zc(M*yNihuJ`K#wrM-ZAu&HbzZ7N)`TfgwJ{VIzN(tC^IlOy}O;2O?2UQ3y z6)Sh0ylWB@P2~YQ=;1yWvX>zU7cCQES?luNA3IwJ_?X`IkW)~&PFGl()w<~3EG#Om zEz+*g%DSUEP1U07k_?sqW9r!YOO$+?ZxdCV!G^4`{J<`vRIr?ms@2V=+;%6xj$Aef z9LpR4UeF~8E-n@QBF$0JVOh5L9{b=J;A{sz=X2{9J>=rzs(&%AZdmjD^CiK)*r)G3 z#^@)r;>Xkt_1E>P+A5~_I_|UuM7?Nh?W=Gz9XdCkFS}Dkn)hB0kExas6$G=nxt9$9 zz{^O@k-dFJd+E(DugQXU8rLVLr;9l>Qe6PAPW2qt8$B-_`n!@e!^1;gxx*2~%tyjI z_)fiS{mCPvyODC;WC;buxxwm~X(S7Yw^D_V7wb@B&eW1P!GoFN!H1(N`OF~zu-{X7 z{Wy_RJG-sD)re*sqr?o$~v^QJVp7da%z=O=Yi= z4zUigvZc}N?CgFCU2<>utX0`*`|zr(_d(G^U_S4?8wYpeL5mQ_9_gFF_x@+!fzu7R z%RcIV&X@h)pw#~BCXPQnwRg6+CwAu1e%s%KbL3%WNt{|^hnwSdE~5`tS60}0m4Rp9 zzyI;l(a)~v(@mXlcx$UXziIU|Lqo%+ohHoT(i@houkYD{mtNB*=jK+tVGdTM=Az(L zA$gLYve&-)P*kLBY!y^k?=cS#I#}BzY2mxZ79SZs8lD`i4USKhn*++&xU{~0>eH(* zDfR8@xt9QS^epR#L0ya4TCvKkb0I*S0YnjX>{XyoHtwBE^))s6#o9S~hK4C_5?Qme zv$ejPdN7Rn;@DWB#^lr#C*a95L>O&Ol0m)EJ1PHjgV4N%N=xFQgTa2YsoAai?fapF5lh*u_zOyp45&=% zZA{E=dGEA7`bl!ex&R#!esxg#5pdHQiKqBM+IOd@Ijnzddy&U!`j=EL>#THH)I)DSsX zPk#e#Fv<)?0yDL#?aXPn3Yhmh{qd5LT@4Hd7xnx`q31m;L$Gx;9Q4!e5^%BS2923# zWOfH+h6@XY^2CaE)lFZ+S`-2?ymD_9QC9J|Vxe-SiNp!r&D>!D^H-!S9 zKA#@+8yMe$0MsDxtgf8)FapMU`t!@H9BPh^jzvA+!-<5%f{r(om??88lXBn{K#xi~ zZl*&o)s@Odi1cM$kcj}N51tQ1Yd!7*}fm6n{ty8F0PzZ}=yf}6c#qVvN*@pY}I|F;cK z(itg99wcityZxG{1S($k#@&X5Dcc{>1YF2UN+PMDjST19_kdRV-spqd??>`mZTveH zKoHX&aWVL0HBCHV$0A6US?*v!G*iS;{gtFQu!OUQRI8s6;KKNl=GJckp@=&o7tAYO z!w<2%shKevR2MFnRB?y6u;ujs>=NkdhsJCckkJZkG_L28 zHAg}ITb0$7)c~T_k;5fVA*~grYynJbKw`(IPDpzez>tSPsDQHEQR?Y2RY=NqXB4%e zuI|U7A#LnJi+PrW`xxNQ_63fXE#OT|QUc298XHMM9{-FKm(5H{Qv3vjgZ!;~_n3ji zdE4*-7#f&;VZ#6SMQI$f9K-Zcpw_*iUH}D=U`ZU4Oc9`HA!7w z0+9RP6F!Fs(BVhxI4bnE|FUsib_7A&a1IOiH_P_u zE!|4+wwwRAT3U_;g!ae2qxin-clmq&SHP|ico)%$Hw*#>_)&9szcPSyLo1jLOq-$1 zAqUH`fR`Jz{3NhCvuwps{eHxJjdOe|pDERNl}0MxD4?P3r6mB2(X&^iid;unXQhWEv&e#*IXq(0} z`-T<(8K6Yool8een2PbMETOl?t2|KV(^etw-=Dlz9oBmSt5W~6TW}*LS=(4C1l@Fc zCet^0$3!*@S>1G@F}Pz03n-hA*F|_0vuF&5G4d4OG+}lAR(<@eIIXn8CU6Ou!u>`- zr~miJM>q`&xJqb-j559K%}N>OJtj*;8eX-V^5cv6m=0n;NTl>kUPA8wD5;pkrlPA1 zw){Arll)Z5`rof_e^QFBg-iUHoH} zc4ss!iX{9W+GjLA?2v6-1^i#Dm^y&1wY+=I(x0{BAr|D3S~DxtwJWEpwG&#X#)G2m zx7wXIV*W?xB+oDG@J^MpN_hd3&1!OxoUnc#pcz{Ts2<)?U-Z1OLC)3e%Ov>cg{uqO#VzItyA ztm%DW)I=LCk?KNzcJ@6gz(xVZz#E`HNkK*3RR2TEez@U+^6mK13!rv0zWC8ZRh!#t zUp3f)EmY>Up~0%B4A`kDdV}9kwj^Vk6ri>|@^52$?Uad!J2msWN6=#YT5`uIQh4}$ z1%~y6d^Cq>S$$9C(aw{Xn_>mD=p8_RG8`?|1um{AT_E#;S-J`e8ra(?wyJCN2r&bl zvUvP_(RlV0Ah{8pqbyA=iysrI-kfTM`vd5WzqrQCA3cvZ#2zxyf%A~}i2i8H&z1`Z z_u{B#upB(xRfq;FxL|$%4pMUEyX$2g@u|AurgGgaiSB#fXcs7fy*H82{^e=wR8u^7 zDRr2yhDD zV+++WfQw2G?u8$6Pke{SY2~;jFnQ9?x2>myR%;NRV0znFYJtmAHTw%h2Vt*#dta+C z_Pjt~ioM=KE269Pga^T!fIunixBhV!*_l`Yn@<`%-1;LZ-lV+cKQ`d=e>PypABRyy z*NN^HMQ8RO`xd9B2gn?whBy`Pi#Z-_wQ+ryPb3f4r>-&J(u?cJ(y@w>5zQ?R#9{X$ z+SG^o9prF!xx7N;kscIjASWMthgHUOj7xwyx&rzp%<|*BtYF!xg zA#bdDP( zA_-nhgAN@{6;fn7;Frc?fxyMH6h+fP48#%TAajrBlq)uTfj`WsLzE zf_McPm7>y+dk&Rp777UCto2#PMc#SZ>K3h(i1TpM83YU6eq&b64|yipQR?8S1zNww z7gAAgk`CoXq1N3mk#EjCr1w{_O@!VXgH^5pU)M*Q6+nUS+rMPjNIL+rEP1zz93P@# z@n;v43HYOjzD})xt~l8J$JQ=ZT1flHs|3dXI(R_mT_HFyLuUAV(ba@<&ZhO%{m~{B z7jic!1~K;Yh9RGkYPE=mW=_$Z<@~4#iu=|H@g z7LJ&`_ksDIvQ@HJnwbKxB4z7ND%$DE##((#@LucXegBhthO*%O#yn{)R9nNekn3Dg zi{L`>(h9QId9?MGJKQ{{9DY@lZ*CrV%AteO$~j1H1UPq+tT?ap4XmbdL-ajoA*Z>o zrRycE&$*A@Z7yI_EN5=yWC%__Jt=N~SID{SW6Xb4m;$fjmU+H5a`5FTFCXPXr}&Bm z`nbEMR&R2m(O^5T9x^Cm{q&aeJR5I%vcnyLR4aEJhmbqGcCnn+?>VCFcE|pUg~3dS z2*-jEIKBI3@)D!ezB|$_TF+SdBMrtdh*%W7oMV(;y8ZaYXg>ATnv{&C_&J3{3_h%; z>#&4%tuYJDR?GFMj#+w;S;F-@AdI|onzOW1#y&I~tuGO{zh{KfzzV^b(z0w`G^}E6 zh@7{kT<@qct7V#h>*RJSuZ1hYjaBH~Hq_tgC}Gsd@s8^rR**;NzPskR-IjgLH_chw zv7-_KeSCe3_etV-`YgG{gR@>pb&?5{iODZyIJtH|-lwT{th@cFyAJZE?DC+{Hf6XG zVzu?Gj#c0NGwj3+V}(etJL@^ckjtP((_jqCzDRyUaK4fqgU@_qo{AkH00^r|ySq*g z`64p%8IJp#bWoUHHjhTg19G{#(tSpx>)vha5UW&))AJugrF*D7$NA$=(5R>8IY!QH z_gq2-vt9fgABy5XK<`(oaMhZ;ruV7+A)nS1a#y1I&dvv;Jd+>M7gN1_1#Kyu!e}3zwbi*lQL}?$iO#b2PGD7qu>~mJ)_g3ABge=9l4K?CoSIkvh z(_DGpX2iGRFxYi1a}=*9o0jsD-R3jQMn(V47(Emi38}iVe#f;+yM)VuT_*0xQMM#c zE(mS=Y_fpmO?v)2F3Z`5M&p(&$-cY4ud0@NM;hOjlB+YWf<=6SU z=Ns&q4#V_$*8?{Fncz{Olr8&a(^8b-l4ue=WoreS&Xr;?+q7;;msvU5IK(;rBCfT; z3~>=7vK({r!}a89R){3@X520OEcM1qK)2I1MD)n06Sgj%cM2=Mj<%dN5BMUK$W#b( z&m!0FTHrR{%^}bbTxOY~3ym=b$MD@NOp4#DvROX<&?wF;fA#&tWKq+kQB)&T`RC5$ zXX)i_`~Gha>gDJ|A?dL}L3~&b#Ke5XkGE0@@4k=_b`^VN`=gQiW2JfK)SJJj&x2Gh zt-E}NRekRiR}ojqO}@$2c+@8W)_$Ek;R@^UNFzj0-x$zj$dx)FCo+xcV)nZW=VIAx zNgGTp6(hoyk)N5iJ02YnvK;t0nmqo&etpmCoHMZ-VHV2X;4hZ%S>-GAyGH>iEd&{+ z7&7aJP5g?qe;0qiE{<$%r{S8Al$!WaO_H`#YDsr@3yE20gq|{({VE(EHWFc;zzFtB zI)M~&uEe(&qZ33cWT;2;R0wpkz+#(>)pv-&*$r)Y{`wQS2;H0=i^}nZJp9IdR}!45ba-QM^mzf8F;Wcqb=+9c8JX z)cutBD^~H5p*xbMts00he9Iky4M=t&9qw!X{aC!Kp4Wg{SIcW&b1sXT*~QsG#VsYp&g3M@THSr51hut=+~8KiA8i(~ym1IV8n)ni)6h0b^B!r;bUkdM%)CrN#nXhUrBJ}Hh%AVsoqm4dO$ z5Ma#yc%K4($lhg~E~W2tBN1$iELZ;oU|r~^H;Dt?Zvt32)SI%^JgZUW@AJEVg1oGG zCfV<12_%USEwBFb(ApTcx&WN%&hXH$;(}Gz8xD#8z-Y-nlV|^S79j=!XHjT=lda<# zExfr!1D2Rff_FbhvINJ}C+TwUUwr&HVk_?Q^d7*oV;a$7Z zVORfZFNp%+AIURQ&Z!S3%%W7P>9Uzj0Vjzs+AzPbvhXrU=;o>x>-C)kQ#QalyCoN) z#XHHiisPX$otqR?>Gd^qU{uk;)Nu#|4uaFEKUzC_Y?hi<%eDmsSPC^ zX&*mU|C0;y|96q$QfEI2H_WHM3hKme7U#t^{(Zz@T z?qKQmz1P+QvN`NJm66u{SHjHy`83)~5M^bWzb*b~su&)?>E%MD@h1>gmpZqWGm!*{ z08`R{E@?6|lVKcNr79bNohy2fr6sXwJehSp?T(RE%ECkzTwOV%u!tn4`zz)P1`fa%eEpf%gu>pTdWK^ z@22I38#50p&ljR=N0&#t(UH0~pS%oW-*g6rlC>Bu_j}qepI!tBRRag;v&3(2k%{8R zMY$~sD)=u{uh6N2@ognSQu^a>EUzf{1hyJ2lb$NzY}D)8tmbycRtepi97oWY#CwQd|Xon zgU!9W>1S?<_!ah6=mkBu(Rk}kDAc9x)ikx7M0n#GL1yKY>*N3sw?sC;1%WKqKk#Vm zwOg0Ct2I-|v3r_Evz_F`I4vb#J`+M4c#JhKES3yRia<*Q*FsZjUGr3OfB9X6%^8TH z^@s8O7M>QzZ8VTt9Y|UjXMC|zf1Q>RrK-Y#V8}PFL5lvrpZ;_)tvI|Uj1UYCit5R& zSmi&L4>cYR@VK_wks#4!5mw2xE5BGeQ-8G}5AXvMf{zA$`NQ2(au+aA#k_@Y9CE~8 zmQ%3Wy$ZUDpqsGURf6PL*t+R_UX5U-8^>9`9YYovm=h$7z!tUp?@39(T;r@{&f`vo z0^%@rhVkH_AA&^7;NL;uX~uImr<9|Unm9C#%Os@7Q8&>qBS5ZfeZ7kT%Okg@u$QwO zjIG0qcPTuTz=KO`xFY?~G{QZ43!ZkAF-F>>1Y}E*P1>6}?zR1wSk=5tw#!2r(-ZfI zCuFr-n=K3PJ6a`cH8c)$Tudz{ARb=X!c%WyV3%Djl*__+jo}?kjx~^tvb`9{zDyeI z&$~pb7g-*ovf+uMH%^14lZ?N?e{AIRP-7mN|6Jv`htD#sc5hJHJ?)!E^_^7~9L2Ij z_h(95pz1K_w%(9^$2QB$lB#ZR_pvlY*YfD_;p1(cRv})=?(Ae>hpbiP`ZrfO7(%Rdijzer)6SYpTXeXdhrJkUt9h0ag4&F=lrr-)zRA@YILOw` zuwJKTz3|g==(fquEr^>{)zNNxSStwBaOv>ykp1kg+SB;aCP==@uE5OQY=Jtt`*O_| zo16WU)q*O=I(yJOek?>-Q;_REtTF5;wAcxcnGK1y&HOH7iAC;4EK5~qKVhND8uaBk zt+e{F}|z=v3KzbM_^6Eo<-XV)tfW zeZM4O{<)AzxMz)DQjZvEMO+C7hSvUTCO9})c6}&E|1&SOZ}VAqdmP|)17oJj?ddX8 zBn=(s5SN#K(HD#sKHY}R8Xf+9SYvzMagoke;cST#cQ|g;v2L||d`t(jm?ddMSKvlz z?-kWAj+!~rlfHO<+-~6l!U13JJ~Dpb@xIIFR(D!B@#Dgd*(%4KjzBkK5juOF0;bzTVACan?CK+wU`u(N#D!RkvToFslAwlft0OZ zzAlbyCRYP&jtXE-E50r)v@o|`80BE(+eG6+s-`so%yoD zY&9dB`jbpx%wYY~A_UFTIAH1QI7p+oXM$#SW#R`hHx!^DulKaS}sp!G(En>@T^IK(=Q7a$tQ0dbsXzA z_dw(Dfa-HXeMX98_Ao^ZfFbVlEHjuavs7738k~rtm3ROz@+q)RhV_sT)p`zC)E1W zCQ?p@j$yG!IrbU6lS_Lp=+w)_?t-uVIR*pWRI-J;LglE-=C(y0>alvaedfBCow;y; zEAMf&Ut_I;q`7G#bfT}pr_Fx{hr}Mlx$xg0;!}cZyeDi#TI3JY=Oe}6Vi+|0L}Z}h zg%Vd%m&>Cc8D=zAD_V*-ZpqHbsbkGP6gG19u+J{IP;pPgnY@nNzmuZDQ(MWM{p9$O zPgWrIh5=ulAAXTINTP1pG3^@?kC~|7)*ed^J@jU)=by>T>8As1tY?lE7a5nXaI}5m znJm#WmB@1Ix9Gc0KhtLz*Dv$bz8`L&T{F|v^uQg6=;f&?gQo8@jY}<}6d=W^{$14+ zm8#~M{S!ZApc$!|I)?R^pq{<(fjw=;cy+W$U3I>xRHS|L8}@|-B}ZGy(e%zc){REk zw^dN;I3TU7>d-yV>mR{sl~CN0z~9Vp*HB-4)emIEy@WZ=m8T<>R)#fRd27wlSXoso z$fP0fgi_OjesKzb=!TU~wJd}cu1@(&zMN4N816sA1Azsdf)%v%_u$-2rH?!_GE6t= zNOs=icXs6eqo_q-_BW%KEH~zX1XQIEa&SzdDGkWNjwGh0BF6BJ@sB0(^aXS<0>hgv}<3M}7>+j1W$>2Nx48jS~=<0uuR5?J1gD4=p@Wu<01b8Z`2C!<>KzrxoS^S*dsiVQIG0VvwcyR(2jOLl)$HfVEG?k+FwCG<%(!fur_8!s%c4C&@)4 zu0E1M(&pHCxq1xvUG@f?E5Z7ZDqbr1pa`tlxt)!(m`=ne(gOH~=_tQd12uncXDw3`yj8E}0G_BU|L5%Z_KgJbd8 z&VDY6AC*jBHywn`9i}R;xr#x<5G`WBcmwCjsUAYZ`-qeUK|Kxnjm#l9Us* ztzkq^OK8+%VvetekOFWm^df;g{WQuu+**lZh9`?D=V3lKC4E}v3U}xkafF!#mhl}T zvLkb6IK(r*36g8rRuDI6*jE<%jW+2cU})yFo{Fv7@)H;SYB|tOHd(;xp~5c(?i*&F z5Zr^&(eH1HE~)YL@^+UCq#dn0@oMbHCNc!y#sRzY+IpYAK(?B{5^E3dic1W>ZJg8WkmBtY{LD9y#beQ|)kYF8Hz9DZbuh${I*P zJrGyuFY2py3aWo~shrZu}>f@2EXAtnmB{5S<- zz-QR?40v0`S*BB1n>y;eK-Bke(mD?w>eY*1c}0Xara}`6u2uaWnmamU>qCdTei^mY zK2s|rhS;3-PV`a48<}knR%~6#=xle;0;)pY)eKR01tv9Hgflp=o9 zl+*7tZ0P%g;e@|C;;;Tak@Sn|Mcj1#=2ZLsUu~s*#2vnteKSO}+NyWUK5X$24-w&` zemD_NWNp}OEA6zq{^aA%nbk^G!v!aWPb`Bb6{|&2P9MXzzn6G~^PR+IE+59jmEU!R z%3@^37OA^oy({V7a7JtnBYouUi7}y#$pL4oP3BO>+ z3fuUi=L*c%7AjLvOJx)p0@ts}X=lRQ77ogA=iHQ-^^27K$&P%wLw^F37`uVkn1xE2rR|UPK9AEzfQMSRT{+4 zssJ|C1UYapAElC8duv<%D>um)(U7&m-!5{Lde^HH;7tBrifLbi7xe?7mTd9Grcx=U ztgIz8&-ZE7ET-9}Rd_~#q> zA{-QOKp4AwNFKLO(Ii{b&-*LZhl|va_PEqPsnadvBLRYJgF}MtL8^jOQhhO_s!y!8DzC$ zs3&Oif)U+rkIA*m#aP0{Tz=l0<0nh`A1v$oq9q0wnPj`2%xx22`S)kFDbtCPN6nNC z(3DpW8oxY3i15-y2W>C)Um8dyf0au6NRrpQF^7xVA~&H4_!AQn`XK5&v;l@b%mc@`TXVJef=ND1*PSVz4yxpu@^&oWQob_rK zy^pM;S$A#;pX0j!){3LVC44Ve-Ubk%MhdF`!SV=@m{E4Y2F zf8e^gLyEFf#rAV!tqN%!e+^3k?C_vb>WapLSd~9o_2XAkZhxC*^cS+hW>YCwAyWyP zJMIRed~4}_2Cu%=B z$X(VW&GOJ@P4WZS`c7(}Cca!Xy6=m}&n<6o_|TwQ;4|94R~S!kZvOZ$wY_&(lUuhf z9%UmcAU1m2iipx8T|huox^zM>(tDR0A);GEs#2wk^Z=oE0w}#kX%RwE5Ril-H9*>Z zqkEt8-EyA${ho7we~CN+@~*5k=NMy-Iag(5caAQ%`GL;WT;0Sk zysJ~;(LH>VZa)3(^Wf=KPj-W*yoUpglC~~quG9;g3W{LLHdBOB*rl9s;`g!ju~r89 zrWP~{k-gS+J^5d4=ipZ8(u|D@d^ER;{2=4Y(1rjY4b~W!^w=vb{Q+V#OFJlYkT7v0 zjAai-AJ;sq9ruUAf^vj-*lq(G%)L9|HP&x4AIL4t`oz3aZj$kITD!}$} z(pk1%ddBRJtlDD28QnT6;+`exZt=QZGdX5s#ZbA?7gr1PZd|==AV_(zf~R?56&)p$ zgOAf&G4yWRZf^+#Tb=9-@T zrJKipfu?qU6gx@m)i;luLKQ1LIxOf|@~pPKEY%TK58P3J7Xb^~u8HgTPl`6U$v0*7+X_ z0T~43Vs-!YTVrYpNOMp)v+nrMckLgg8=vZoW0sN$m|7`oFAt_!^)(kn;IeSS^jFTH zhY|5GC7a`|uabBi?fm$MP*mLj$LIjEO+pv7hwnB zi}2Ov!NEkK_I8O4k23Ske(Xz|s?kKqjDP#QI}-0Tf_$=VO3hynqS!csg=VKho#_Ee zk`;qDt%hVXyyQrjYlKJ*Vh_72;0F#1ZuK|1N(OVF*Vu{B;GFf6oy!^S@>N&uzV6!L zt|=b7Ju>?_a9b37PTn*!$qBW36hQ$-J`BuEW|r>=o~@5kqLkN(iOQLbH8dUC zBfOgwXf~|t`HLZzi(I=Hr!B^gY-jtM4IcH;dE$$y^430{Mfh-{uRq>>Rw1VemAH_m z5&I#Ou(0%2jr_*3FnvK$^4gV6MdkN}k>}YKC_mmWf}S#PmV~znp*<5|)oFMK^b9b` z$93gGk%;TNZ@uaWcg>o~7@@IwLxqJj=;h#WPJL@BG{o^cwm;dy1mYnpIH{T>+mxWW zbWK2@l-)PO0F#0_7!>DlQxFVsWHRzLlJv7m*U{>kZ7|PNyV;;}W|$Br**Z=<0s^+@ z*e!{Gq;Uf=6C?M_Q6h`x$?s?Um)W!iRt?4)4i8sx+$=6Zt%CU;E?@RG3zJt%(gUNR z`I5XtVOpvv<5o#T_8hK%CP0dFWzk&%iC;>{jJvtX!^F!wFHoF6vB0X76BR1tC0+2g zW)s|k`k1(R*2zdhuOVnDt96O@M(`wb``NT%Z3o&bVeg(I4lPWaGQ78w`WN|i|PD=Y_?Xf4J^>FeP?Ub z7%PK5n0+#{61Geiu%R7El6nu7QS0NlES;Rx#?$|`H=^aGb+h%>_X1}TUyHw*LOL#? zcukBy5*J<1CAgykdV?dja|v9oTX7|JGC~GHx=d;!9|@z-ia?Oxxk9S(ODz9F;? zjj6wFbCNLP{o^z5lPd%!YfIfR{E%)6fvi+Q)^ha~KPt@X-)(<4r$oVWJUj8U+5lQm zgdGe4nHQ6uGsg%8@On6|{M?XU19O{r21NF7lT1!3a; z^SP<56`FhYi(~n&$cBWJ+%+rV8?d&Gk#ANe?YvxRX>}r+!@stITVugd&!q!Hc6{6r z5A+%`&3EJ{%!j(xeEZh*a%N#6cav@Vq{%lh*_7^Bz!S$5@D66M>D_L5u&JTC7=LUw47QY;<$( zm^H^j@tZ2)WUM@Dbex6&f$WTZqYw?AQ;tvuWLj;CEytz;BZ-u`@aczIK_=M6kW#)0<|pm=b7O-b8d9-eY4_d1ZhP}; z;_Z|-4g0MZ5?B>YjtG=%7B=w7WA$DboTjHls-nayL_1 zCn`yZa~AWyTN();&xnFRGC4AhuG9=if6}MN*izG2keJ&c#7NOt+FrMT%O}T^yXfJ4 z*E4gx!y(POu)>WFPD;Q}nT|x#Dj2~LDF-76DI9lnb|-eF@(! z8(gE`2w5EmD^1QXbd*$hYZ}}WULeB#j^Ud1CdFFQWD;wlG5hrsAhV0+7w_y#&ps5! z#p9fN{s<(#PcBtTC9Hlxb%<)^7Ki8iii96EpWA;4CzjS7(TzJiR%qATCs2Z$_W>Gn z_x)t#dEy!xa=d3E7`^~)Ba;#wo=|uvjwfJQltLXv5_}UTQPlxk2X{>T-~_v&q3bq> zF{~(A=8-fwC4r(_kG4sU%ysvQOtJ|teeHHLZ;s*dnpUg`!Y~X!%f!4nvW`o z=;dMl7+_t928Bd=4gsKRbFT$|(nzuC{MS{%4w<>Ycd&TCUYc8m#}9ygwTW|-vZ-Pl z7qB18UnqzdNmEuSb!H1&wTy>f?-5tjfsy-?(mF>#NQ#5q~yx98C~% zQ4liuF@xu9$VY;P4V-L45ep}Pl^~mhTtNd5VfuI)pP}p^xzYe#HOF7+UZUr7sAczK zTUsfB0>aXJ!M3?1)zAR5F=U`T@&>1HvH>y@0AUXy z94uEPZI(cWOD)*rl!C14wT8HqIJ+WRF5EA38j^>n`}b+vGx25`g)Uo)2Wb+#yl25i=X+Yj%daumj0B*$u2G^^ju9`v{Ixq(<2#y6)mBBu0&tlZ z!W+jOCsq#_eRL!z?q+A@wNTRQ`DF#L=Y%(SMA&Y;^&wV$nou5KvNbVARyRev+Up7` ziC))`*ht3cshh-$Nhf>X-v#L?oW zKutpg-c(^N^kykz>Z_mNfj$Zc3P!Gu4&t)D;y zV-I7_UodRS9WP(&uLwyfrW*ibg=@FuZi_Gv87u@q67!9H3C|Xz+=^AIx#9Bt?&xHe zwp7>|1IyKGX<=3ZqwF%`IG}5T9^CdW%_iKegF@)2Tp+Hn((O9s^VSM3SAhA7eiZA7vg5FAz;EO1fAur74 zNZAY;sJ)T+y^aH`zGU5f?e~fnH5pFDOB(27-dH`>Agt8sv;Fw86;=z4U^8g2$@*M< z>ILKSwJme46lVMQ%3;3^N$D_2>$Axh!jOwIf9B1J-XXtzKi05XIG@WZmj4H0rupKR z)f}jf4PgfT7{6&nn%^Sv3<#y#u|;mqBgY1#AfxPXi>1=ny@VBqLzDy(<*pXS%{h+hLmI9nc;iLb9q)5%yl^s1 zZMlhkdl~A|@nvVp?kuy|Zq&TNf>d9wl(eKAd_++_VaCM3Gl=84u-4RfkVFy5Kr-T5 z3Qy^D|4rwK!e{(tuesE!teh%!7d7lE=gPOW9xhq+E-4qEfsE}(yVFSI&85ECk$V}R z?wVUM|Lh=EewBYVx9QD)1rBuYe9<-SqR@{0gj!Pn`7%BId8seq68;rgR@Hmhv8pUG z)MEJP%&f7zygUFV&`AQi#-dB}Na&l~j^okV-TltQU=V0!8XF+&`T5eRug|iC0O{os za5&QtCLq?Af3S3l-1nmenf2YHa+Z~xJ6 zW$wT8W9klNZfxQwVbLPaEz_>0E|-~!H^Q2I`}jRA3h#iL%z(f1DDPPYp9umt7(f_A z`-{U5f|Ja~-#`m8Lh3J^?DV9*J*}Ii3U2UEYXj|AJno2z z7KgTPF-rMNipD94))#j%mFw``(g}DMdSA}RsyV;NXd#}h%dIQ}2VZ2e{h<|?x)f$@ z(yl}%-n9x4t#}Xesi(eoep=7(_js43jeaDrLJcs49P21vrhB?sL4@Z@{C_Xo8O7Ar+z(@>`Uyqofh8F^CKDY zmL_yFIp?nUm4-jyp>9OU!-GYxgr;s0$Dst+KJ4NXU$z~TCPsZSZnlozVv z3JK!|zE-Q2&So;I_bdqGMOMdIt*)E3^lhxq_j6p6q_TF6=bxY1NImA!aw7~KH$QF$ z9`;Yh;=OvTW6sR$4o1i|5nEZkkO=lbH=S?CS;sHznqL-Ch z*G$niTyavt@`#f9zaTjBQtApc65{3zK4Xlt6mxaHNE`ZAP%D|3EAOa*4W0T3kKS2$x3 zUuq@=BL|}_MuU_yjj0d@;y=Q|Y1lLzWzUCy)k2OLJd4KY+f~{-n8j=+L|u^;vLyV( zyA)aRReq@1xPa(O>=Up;eQAh~QE1*6p96mj)ZA5QHwWbTswn>wgy4)MKXB?w${giw zwLE{H*c!PHwx?+(ImaS!gWOVu$AN>MZzABoP)EpWhG>X9jGQ>*Ws`c=E#9)(-+gHY zzJeXZBbQXQ8HakNzr;88VvbW!?IX9r_n^A_PhgwGvYw`|mi{Ljf+gXtP?$8{7cvWpl$84*lX%?vlIwqxPg{JOQG1e5w80U?_`aRVcjH0;6WE_9h<_^^G)p91@*qGq z)9%WPgk_8J0x?4P7LQ`p8b4o=w2(oV_kidbiX%fl*Rdl+Z?{wH@h|{TBI4Ct8&pog zH#^6?jO;Ez$xSsnlF5Z46jl=>j|AedKUJjgz4j|S*oO`p$BC^_9}O~-SolmZbA{-u z5#awzr^p>G-x$<%6R>gBGA@?Ucn$4xWgl+=dyQ+feOp?z1C)e4D2d^|YIDBw;dPB# zlsKXAg2~i-g8k@Ov|_0htM&8C0qQL;4Y@lO6;h=SQnvo(F|O6roAA2mp|p95m$5Xi ziRA@f>x_i8!q6$W_zB_e&61>Vf|#iQveYeiIX^3I7ihCuLK^$hiyLeD{w1nIZ^qqR zZXeO19IM&_cgYU|(+Z~n#ltw(eUe~*bM+80Eb9#|uT?N6lX90&(6pRAK*#3*HIfNClgVJ~QGlyXZQK3~o!RZx0td{i zZ1?tjPmxvfctmb{MG&sF;h-OkMk*Pn?zGknOGTC4pH;{@K4jjiuB*<)ho51oKfu)~ z0(<&(=VpM>Tbwp9!|Ud7Y{)~SP^!Sd9vQn~zw8{!N!NwY@IKfj6J+1mywWPt=5ko}qV>bJtG#P$rO?2@BD$@G&uZRC$?2azzun*1+On~A z0iE~$M-Es$rf}6lq&Q~SR7Rlbb&Ti~E2#-gOAZ)0Yx%@Pw5tYxFghB4fXDBDA4p0; zg>20u`%yMwtLzFuMXvnCxB(w_S>(@MkNs4(dylgtid+8i0c_EGJdNc8UT5KYCojY{o!?iY@?G341TYzM10jA^JlR*)0sVZe*#|e_Y&6PVhcw_Nx1eS5FGhq2Y2$e#Zhd02d{s4=`{|b$ieprpzCa@6A2to4C zr|rh3sCi>46O;C>6fx@VO8Q(NtuD^#UF_jvL1!K7y2J}ezRYsh--o5Tpz<@C-?eXV z_`UObGH=_Mzf-<+gY&q-63Gr~_X{Ed0{inGYH*MXWr1aqwuRC$EP`;Oyp?Nl(Z z1`!;RK@{dx8#@AoQ_{S8*K7Sv7oR(tRx7HbV7{ucc(ZYY)TeEA`k6=R!SryCP{)G! zj(0^Jbr1tiaG2F4Ea!aXEi0>`@(mqyip_aI=>tv01E6!mZtC&(7P(J>JN8QffUy4` z07g{s+>rcBynr@qsej4lpOpmkRh0P^^1GpS#HH0(&Q4A0=ceiO`{-X%Gtl9Dad#_o zF7qHcbm>7F?AjJPx4YgKJ)ND4y#=?89p+7}hkAb~ao~A;p^ks_bx9NJQTCYsBpJ>I zVO<19>`X0bjw1rf=Q;ZjNn6fIU74Po_VdYQtH{1ZKtEg(%ZRk?|KWQ4))YA8^T~!W z)(5W){v{lcc)s-Cb~-na%DjEiWKUy)N2>5{?B~8ec!D??J!7BQtMoZCkfi$o-hH$r zvo!N(DZm4y$Iq{^MK=6c}o%$)mU4b-;@l1_DnVCZZFl0$DyMYm&fn^#Z-698Q38_ zrB0eLNdwQ$zFDmYa#Z;hHc&qc5Jc2J$O5oQE!5~u%geL{&vcYp7J9SP-mFGcfdka^ z3y-|c2cXxqq@$N{!De1jsY4T9axbX3@V#ySEe2)_fe3LD$paEsBgava6T>T5we4bZ zbevOU!ClXBUy9fB#l7qt)GdaQ%dDJQhfUbSJAeRC&9BN1YVx82;R~yJR**VZO>r5B zzR8-Lt>@oj3!ve*V23yULv0aiw2Ho2Rv=QApOgFglzp^puKce9yH;Qd=rdLj)p_5r z(hpxvL1?P;?-!gX^+mY2)n1*%8?+5CXStZVVBe%AWz^64D{O*+T=IntA2kCFSPpW} z7_iB{#OUZcgo>a_App{#xAUdKfTxU981P|RU9f(c=f&s=5V~`&3>c+>Xxxr5pjmd9 zc%F-QXw-_vfsy9{EPPzX`ej?bw>XHg66eA-RygYd}wIfW{V$? zr)ep^;X0hOm1*M(3rbUMmBe?V9ko-gQdc9-3wIfL%2b9n^ZdAQ&a1t$4bT*UB;Cd{ zU0~X_v=Yg9>l90;6fj8ubY|UJ?M1W0=Lx66cRHx4+og3AH-W2Fpl2B_-6);Q^}-nQ zJDpb6urS`yvK+VKEj6pEvxo_;vN3>8Onge+3(Zm-=22e)=5J|O+PpEi+dfx zD9BXwYFmxC&ywXJ37TC_fcik&O{h5Jng5p*!Gyh%s{u^jAH3;6O}*4jct!1{RcVdu z;B2}2Tvz7~+&bYUKpHH1;J4Sv>N6~tH>G?h1UZr*)kJ;zz{%4U$-fht4|AoS+34Qv zhnnkzdU%rO_?P!6B?ZwZI;a~hIctkk!(@NoQ#ix=VoI)&jKJpB37uOjNm1M^^^=RY z;gjzf@&)A=!%Kdpy;S)HFW+9YyHi?$<5PRYxQD_b&!xUuPWM*S;?_bl?h?Cq)5s-k z3U(%KLJ>ZYTsouw2-4b&O5AL2l8&N~N9QEoEJtF%E71DKr17aEH|mtis{j{;yNoA0 zc){NzoaAlk;4%d?=oEQ3&Har|a8`lm8v(pRaVoQpI*dd!cfeH*si$TJg-4?_gCKmZjNe zNUgs&TPQMQQDl-hH(qsXV?Xd*>zJyj%G}snktKjy*x}<`%PxD~p%RJXjy-2gsiAZo zz&-r(XGBD$y=9l?C70`<+-9v(BTBClT6uwZKt0^D1OxlczkKm4DznZp2wj7=57G%3 z?{xQ$bNZg=DOMRsXS?Bg8>0|(AsMGeWrMLVnLI)Vo|cY88!gZu=rT{-`I$&tTV&<_ zZb?6b`rtv2TxHzOzXPg#$>XFN;J8z{MB^hWmsk(}pSVQK(jQoMVfU0Ke@;OL-S6r( z(EE@;lJ%CW?%`rf;a6&88T39`+aM%V8m{k|@;*)|bHzheV&n3c@SH#)&jIY-b&UY; z+ZAX_h4-6ks}JsXtd8DtNS5dLi&J8AzO95Hymox8m(yjuiIm!MfIB~aN{lc%FCjMe zM7L6#giZiZ{>AB;GA7BA)$0jZzx@bF4VI5w*$hjAnllYg#|^55_pPX<&DttES=YBx z+|7t{b=+cqJ<=%aR#;nZnB+9BGn+9|>Eob5L z^g2@i73M0{J|VZ8;QhOFnVFn)HE_3m=WO>{-NX;!+pwQMe`_V%Rw^+S7aP$-b8`om z#0)c2@2~#TFxOQRRw3xKJ&b}-lbZ6-74Nd zExMT(89L0w`BqkW4;iA5Hyhj6xa2(+j%zxQFqrpe)$>}!?~P$$N5GK=MjYWvZlN~Vt#;*|DoDl1M~hZoO?foY46b3Q=?GL4UWjN?f;@^96rWpGM36r z5>GawhRLdR1;t?iXcPvY=t7(d&D_1v#hy6IJ|B?M1dQdrrQJO|5*?Xs`=^)|JX7ZS z#KM%}@Y3hR8PZxf244P?Eucr*+SJ3cmH(Fe%t+A0z}EGL_nCu~;&FMMVKOi)yUh{$ zHq>IJZbop@fkj_ElO_~3(w9cG(!3#4L;AREWlRF+`i6#LbF#D7J`jTTK3jmbrSCjB z)FTiGCTtv_Zp=R#W^-1qeFI$eK4*SOvrtmQ37oSD<9@??>!_2W=>IxOd;L*dsJcF6 z(K$lZ{q7cp>_!0GitB-PHtp=4ph`JF#B2aivt^penDis7hm-M^lL$G6uNVI}{iw+b zKp`LMdq|}&i&JsArzKf;?!O3Z-p1GkEn6!6 z_#8Z$vG}mDXT2ev*-ur38L9S7qVM)NiZLI4RQ!G3NbOtS5C6UwD665!S_ZC52 zOUoW(p_-Syh*P|{m!ZDEL(Z$Vx;-cly=+)nhrV)s^M}7k(2nW3MI+XcW?*?om-umq?0SFO%%4OPViW2%83WydKi$Xj0bmqd~WY$4 zv|+(9fp4=p{hQL*@3gO=c^at|ruzw>^W%qJjLyZs;&*v>yq#*IdK=NQL-IYM!>S^J ztY>P9h8AZO80ii0K3p9@T3ir;xDmQQ$2D?szJM>WGV0JzzvIEuV!W)$AxCV6L704~ zhs*bUQ*WrSBO-fov)ZwzUM(7Gz&bgaG{%R$4P~6AW(UhLMM4-Znb8yX=v$bgg;Rz* z57|tQ1H3SkIbRxB$>%O(_g3G|>J*0;SARg)5cYac@=8nLQM10LnQE_GOI0LRUX;Iiwp^xQ@wZVr@o-(1x-Py>q zU6*7N*XQ+8=AtJQlKFn6^fl5+@)rwMwR|i@@OJpQR(%RS8FYDO>ne& zAU|@ZvG1956E?7YN;7nV3;x*;C=_uROM|z25R#r54RhYueJYFJmDm!h)PeW;|3mAX zOP7q}-SyD(4!14&cHT5Q0Dw54kz_Lg2yOTG590YLtoR?M&p$@`C4T3E%d3~5L-=#t zZ-rzj&9nSCk@?4^aRkmIfw`hS`&v(fS_TyN9$1^8;qPm0fEn(R{(*Sn;KQ&HzUVms zIVo)P0MjGP(+b{>)w#|DcKpZ%n^0SfuBOyEsO z&*rpO{Fl>Y0zchi@GQGXIGg}b*z+~8n}6+lTW7Xl2ZFlxWQqg>JEm`tfDCxEf0jNz zLOb}1%f-Oq=4%?iH1fBq2*eYmJMEv!f*!UaDil(g{YfUR2xZ@mH;XxKRe?Ek0#Cq= zYTArQ_eb9W`RM(iwW>k-TICT}ZPDBlwQQo-@Pt#@6#vbl$DSDntG$agHUBme7VdT} zeJek;IjhAFdjAD-A6daE9<0od(NGZ8b5YmerpVoI2n{f4V{fIkS4i`;-_8@ zyOv(q-(f*eeTz-iPOCg3LBjhIt%K)%%-XiJ5oLoX7SeFoO$acVw27*SA>2&3PrbhR z#JlF{Z;<_;WU_N(N!QiLV*ud)91)HJCT1~;E=6sat9f(JJdtkfxF%7dY{Gj~Cap{f zqg@A1X8XAEB6L^`z30pUFm#Jv-pyA>UqC&2(EY(y;U$D^qIFr9Le@p^z~mz)g&t=)w1fTp=a#A|H8?79F9eS96F{LrinJfJyF416SYeOPN;L=Ni=^sJd+( ze0|xt+%RG|`IA$A3Dp1dkugx54Z6NUW|(l@mNKoTlR<1&FH}t5UhHVqSm-P9A4ZEI z)*mmV)As#^t)4~I#r%4No245Ej-~Hb`X}`lCB!TyElpD12%!N%Ny^%AmI`!vVJk&u zdCtG$X(RxE!PnQ=O6FgmvozT(xjETL)8Rt*E3jb%0fC&VEA>bLG*uM7JUlhxnYM`g z6Cg1|;*oWZrQ^G` z(>al}rO?~)1G4LGv$WjIjYb$oE}?AB;bzpL6l)Tboc{Pg{0rZAmv7R0)suNHx9FYR?huljiR z&ULvXY+AM+-pz2YN_@NJXh*E=Lxl&W9V&_v+y5H0K9H});)7Fg{wJt-FtsrJR-S8G z8!Lw;AiIYp6s_I{T!3ZeQF4~pZPqKl1a+dnCqR_Waa$m5RWb{;A&<-7P)jixD?0kV zX?rEIM)}MAu2Pca9;d7WTc5hG0@D5v;Yop$t+uBR|31BX7~?1(5oyU!E<08PhFfeO zQFWNh0H(!u-(g7}{*8m(aiMGvc|wjA#4YqY?Aw|`BgFjTbavYP18&JcZg!(Rx3}>r zyc6{@>@(Bq_#a}P>l(}8CQ<+5tY)3n;1~t5K*LPt($)UO#%Qyq~EwwD@bamIb%LgfPp4*7o%vr^&5t zDP;fxzR`3`$S_clA$*Kc2n)Glf&zy#>U^hrr-w3I7 zjp!3QSKLpZLSZz?p~!8Uei(?VsoT}!UPp8DO=;UDa3G8 zKAuvs7On5QD$=0igp$29{`hp)x=*AYxELUhZd!g5f}^~gHsO$lpyA>656thbVs0S9 z&!GR*d}y_bDN(5u^@*WEa}`a%@eB-fk@Z{FNdVvTB5C^vVjRSt7y1_0L#svuK%PHK7-d0EC!!|nXsi_;eb1U(H zr@!wNX4vOcYq70zQXa#ot;tNk#z77ic$KM)8*OokoL2qZblycOf^57lQ62Xl%L-H$ zyU|k3aiH190O)%6EQ3xeJrVE^^MjA}dTXZu6Tl-ty>oEsoVey&2gQEh8cI&aun8n2 zZCCoPh8gY9rz?2p-Gn8XVX_hWn^`U;omedZ6Q-u!rHhpKg3J?aWiEx@5V#$Cg&F|w zU@)AQO;*QJ%QY%%D&{}MfUD!|uxZ8yR!K9bJL9OT!zB#?Vj$ zKoK8532t7p5$Iy~*pFoPOqGUwu2%h9nZaL8FQf77W4aPm?yr%MabL-86E zxj-^JR5(ynAR@F(|3DBhf@lKbApiRx_76Rc&l-HdEoWt^8LS_oX;(Kau*rR^v&Q^C zgP(AXf5JFXan($c|6A%A-`JOu5#k7p9JhW1JvM+Kc+?+^PfX7msc;AEe2^>j%%Aoz zXg#G7pzX#7lF9z}&hEF>FCvR|M#J3hXwS-@Os7CNU{ZTNi4+!gFzxIPCj5=A`W2y- z2xZ&*zLi5Kn#_Jz(1cO?fXo&4l`?0rQ1NQ{>QhVv083vh|AVQX3Vk?FofG^2K%EDH z{=a#AuGK)K7}z25i@Wd5M^pY_Mj-}oF|hZfaupXYrt}1BW9T~L0A35CXEtI>l}hU> z@=Je}RpHjmSGF~%03VP9%E$>u65yp-UD9*vV+QPAQ(If{pdw2gINl~}K z2^AnIPX2AlH6Lc1pv555U}~-v}^0N}SI` z=XemY}YMqU# zaxMl&-0ERr_qRNXji9Y^qOwNe+M?%9SAHsMYyd>M2Jl4!BK?Fh)pXZ`>~@3)PMEak z&?C!JjOO8*Zg`P^Ht|Nt8HOvjAed|~iBL^8>s#^K5pVnUH3fM=Q~y4Ji2xc)g37J% zZLh>Y!+-M@MZ$V*eHsbyuT$$6nEv@PpcZ)Eu=iyD`&JWfpz}yPws;-RMC`D@whl9Z z{>%gx>Z|dszw6MTM~rOufCKffCZo=)fdO)k$@&oKsasW$?Cv{cLx#~gY@Ly0^o60t zqMI_CO$DB1$#kI4)P4L4$V}yHgNFHx*$#ZqQ;hWdzgNCp9+APJRNQ|l{cX`AAcqqG zP`$>^jna{EoH82v-d(yxd-`m)wQA_=6Mq7c40P?L=K#kT&b@Qz3UH(LugW$0g;g2pn*xPQKbp4~(_uOyWFxtX8z=Ccmi~x9S6u{}V)a|;>yNfSW zeIU*j!t<+IO_+rc?jS#kITpefsCG{tJ^YssrAYiM#t*Xe~2pX*okF zY$C*uQ}FTNHZr&R?96F!2eXNB#&NpThB?j13vLsc)dyYo3=`U}O;b-o%_$Hy(zvEe zaZA!;_trlRS@B8Hm$A5M+no2eYW{|pXxjZ-UCs_a9r3%S{EfBo{h+3mlA1slGwu{f zhzgCa1q%HPp8aea^zNgo*TJ$VwTbS@g=%Vx+a+0#M|K}V{)WN=F`;%OHN0m};Ts7@ z{+yt9n|VQs)be>@g-@Pu0H9?k0p2;Srfg%rPpw1A=AbdE#&NBXAa}s~oKtpkH;jAo zVd>s~>I0P%H1av@fK`q-WZ=7cW>`D3Y_* zU%<#rTH}Ad@4)as73=(DT$e^iM;&`kfLNbVA9R@#+AA zj)~`*S1}{2#YChs5JEwZ^0uC=%A0V1tl!_wrQDeeud{8d^ZWrgS3t98bBV>Pm2!W% zuVN@0Fq?qWotkX_mK72t+CLt&FwxjS+E~lw4QHE$2Q54?+)`vDE3}~)5B98(>@Jx@ zWd|>hzcs>2GA9R@psOQmBad~^9dXpfZUX5pgcEJB-gpb|IOz4T zxB|4t<8Uc-N}p)T@|nCePEkkvb+#xdOzKw9Wo&7MnZfo3btfrie?BKoGxaIdH@;hi zB<_8q!#-$;lVn#FlllG;T0r{7l>d@zm_hCIo#S`{Q8fgfyKnRPIl2JNV~QPisM_5~ zohaJXrRzoW9c}}w*2dChNnHce+TxBw(*-2!T<+lxa_bcNzz|6aRGY$k>2BE@VAR35 zxZK08vmcR@+(`0==i3c<;Q;asuiwwSaMSg&C*OHj_tzD}OuWg3dnV*tFYpEEO6A4+ zKwci8r@jq#zU|*=Dt{CgZ}Z979Pued5D?+S`Goy#oHsCyyQ!3=KJL20GZiFhJlCzItPoGM#-e%p zkJr|20~hPi1e9;NdhPX$8!Mce1!D3W{PIGqXK=(x?8h=1+WN7?=n5jgHX zL*5SB-v;LteOZBVsYmCMABLsuJEOnaSWvfWIc5mIH`knVYhdd`#@f>-M~tNJNRz$5 z?IOj+bFVx(p;?aOMZjG$R`?z2fH*U*X z8FZOL)yKNhmC(nFd(MQcZa{x`rDjK9zwB@x=S+Uad7oM+hXET`7`tI|HI&|l5D^bF zz`9U41reU%hX_StPv4jj>^r~u(svJAUzqV!ko+#VH}2AM6v{i1Nl8y2s{po>Q$D)> zDW)TbxO|_xO(aFYszd`*WKFKEQ6ztz8!*M-o&u@sDgDnGCdJSC%}QZ^kv6`&)>wxx zRqoj%D;7o6?N%`>;KB`=y&290;A5I2tkc|7VOp=Fli#bEnq9?Z3G9cyCOpz)PgPXlw(nk-7Ig6qD8iUA$x!0+86HYp}%n#wSD*ZOBjA-4Ts)r`Jm0;VOnC7Eiz9&i0v#jLwGa+qf)v5 ze$5=UIV5OnK4s4x3G_Ua#ZxcEQg^rmJs2j9c!%fPP>#{Z`<1W?7zqu_CLRHeMP<}m z#Qm&-Hap0?z>6PQ5zm|=+9JrXt=VS2j-~xgf0TlZ|I^&2W6FNg)K`iYfDnKsnxS>> jKYP83+OYGzgQ9d#TMpkJWAzO94Im8_od<|}kDmPxYvK0! literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-filecreator.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-filecreator.png new file mode 100644 index 0000000000000000000000000000000000000000..96e68743619e619e70c4a7fa6676c35075503e3e GIT binary patch literal 7955 zcmbVxby$?$*7q=U_YgyeG)Ol{H%LfJqx1|VNaxTcEjUPbh;$Auq9Bcczz8Tvqcq4n zc+T^_&-I*heSds^%yrMb_TKAWd#&G!y>{F~T{S{HT08&%K&YXvY=C;U0RU)^aIjGS zEaB_|s0S`o-OL*RAR4^;p=I(Afl)+k9}OK9Y$OgIm7p;HCM{|lMN%>KQSkL~f_MQc z>prNXNCbBzWk+v&FK4KaGsFWxj?2u7qT}7sl_1dPUd~UQd;m4XAEZ!JqCZqGN87up zOg_%;jsVd!VqDY+?%jwXetb z@^JQe3P6Cr#h_?^L^Fi=df7VyPHrQ2{+gx)ad&t0@By5D$m&JWug}A?b$^MrQ)?+#ZF795P<&J|Po?3TkFOsq zycM0tOJG5p$J#G*Z_z+=(PbuEd%QzaLpAGx$(%&B&=U^z4(F$)jm&mQOSF!4l%m5s zD*>I{+n2N)9ijQ&8}=9Ka*fF~>m#egISUidSLk{IuBE@rtbU(|ww`Uu;E-nc0uHke zL+1h+qNvBSgXBkaPT&~K%~3!OMWt}^!a_vcr-y6GPMlB{k)2=0bc~GFbAZQ>ACI}H z#gcA;BpOU>*4NkDe(I%Ag}^)EBj4ve))p-p3PM8A#lM73<(QE*YIBqMbBW2F3UBA_ zFfz;gQRW0P7T3!pEG2H`*U-??(n68_m_9x}PF4juIfycyywr)E&<@ zSHi~yR#pU(2q8H+c|x6zw)R^1cs;T|8lUpSY!a`IGA8tRn{Y!u82kJ>c%!}>JLtEc z&HnA-B!?C*9YBm#B$z1BV%9OxlfSq1g|h}@yqNr=-uJWvxByrVeRq$4$pHK5r`1DV zw}fvRiDkvb=)KZs7BZhMM6dUkA^1G)EFQkOR@`Lge5)Y@1uJd11n5W0lBn?KH4Fu@v1>u-EP;nq^<9_M+_eI#vyQPD3qq=R_W@nU*Q`kEIe{6!)| zK1t3^)k!Mly3pe}gO^0c1gkuK{|4v;+be|EAe0+VzwX1A#A--S9Pw%ZIipoJMo*ut z`Ou-cpg*n<#GdTCXIm{=NNEiO{0V(6h;|yF>GzgKI?#OVEYf&QTb{Os4qjj}`urDC zV^ctN$4ch&_mRqe3?utA$HL_Ha7uzd>`g*%T(6H`nOU~;izbDBvOJf%ISYikoUWqH z{J_*>)cv0M$k7r%ib~-y(PoYr^kGY;nRuN11 zlJ#$PDQn3%wNOvst>@QA0K{_hPTQGv-r-QFbAOU6==x;Bgc}~kZ{C~uj1Eq$^-aL$ zAU#;3tCVvvt)OUY|EW~cPtA&Snt`~Vo8R@%A2`B}c9C9Z0A+zvc$N|CaXiM#?Cc}c z+|1D1-}9kgZ$g2gzX9hH$mX_y|sG5>0HeMiL=ju(&fbAmvwNRJh4my6^b;-VpC<29C-h< zCx71F49v(V5Nm!B5)?$&H%)l{Yg*FsYFDc6aVHUg`m+8cdS^L7@y8GK}w64kMmIq(B@UD3NFE^6t?X9zew}% zVM5IRTumU!Xz63+kBkn`v;BB{a}e5FbxP5u3lH3HzoQ%tlIt0L!B(PR5xHYxj{zqf zm|cifoz3RSf7Sa9kJa_vgD4}ICr=w|tPy`q{xzlFNEF3sgwioMp7?|HJr(R9RL7KD z^EnWw&olhWZ_Y_lu52nl15RxFm@j_V=MX=FUYBJ#iO1Zpm72P+oG{(&xB4;AfF;k{ zOx|Yf^n!5U;KcxSHY4)urYsmXwyCyo@Ir~6>KgaLyuThVa>J{=$GYwSk7J{S|D60Y z`>-}*bxRF+uhdsy{MC}hw}+uc*y|W@0)!RG>nvy^PGE6^>c;(hb}BQ~r2TBuIX~jm zeO2AmiAR0&nFljTI5%?z^vZ1MV_CEDfZ@zGO#Id<%ofkIITYJT@?kgFfOiDN)*6lr zpHnV4iw%inr6%Qrum(D>B|=wHS~N|T$Zp1{s7?dRLgg}x@?X9&oM?;CFQ&FslK4zr zG|C2icA;cL%#@qRVq61_!A94WY;b;4wHSl+YyY-X^`n!IcGX0vjM?FS*A9l;$mad^ zHbRbPgshRm)W@w_g&%(DYG3Lh$3~PEx+J5VPw;}RW1?Q%2c$)0$J689VB);sA z)FFkbSA2ncZXxS!=5>HgE!ZF^Vwb|KrdYsU5h-wv82#eO9qTe`1QKDoaN482OP*Z?W8 z8SAcr#ATB0sVz>|mB61^xP-xZFRlArrJj^hZ2lfC7+9Gz-j&T(`+c6?P+Fj3kvI3l zQs>sO>gmcb8$i3K`-$QUJ7XwjD}ss!t>_t-<)LmL`Q%l`P+T|@Nv0AZM8qADgSG0w zJ=y@0T}l5LQUneprdM5t|7OfmG$z;-fBX^5J27)iBt$qEdWcY zyg^IXqD@jH$@|MR;;qG}xzu6jT4+iC?^2AW@&>+MLTTm`FrH5T>TkB=FSQTO(j{ga z@CRh|Ky^Eee!kOp$^V)$w5@sN=Y3Iuu0x=>#cVhS+`p*mOVrtKn~XsH*oD8+{+%C5 z1^C!Sbw<_5P_z+MonXGW>?4WB`ETxdS10`2dy_nYCIudwUd)yQKdH%%1xce>+5H1R zT;U49Z0$aHhL=nv_T-BBE6Ep#1wpW?mt>TA7PDIj^&G|UuFB|>)Mx(pUsLn)$qjnL zep%Y_@?d3neg!llX$e)0rH5Tg-tkQ@_dN`0K!9-6>(xX+ zP|zhntZbyy`8=VK%K=iu^cQKb5&T0-kY@ zX6mht4i~BK?}vMjPS@w-ltw@$BGjGXn$1Rm_(7!Y!OPeQy#54bsbia|$0d^%IJ>UU zV@fm6#Lm$s2_*gydtu@N$zheryCDt(N$iLRMp9OMAj}B#@gI6cRZYQSFwThR^d?>p zV!CaDb?@+s(GY0DTkOuj5hyM$T@woHaZKNv)C*%xDmP%*R)dWXC>WG^!%AwtP*=Ka z*0jiy;wl**x-CSj-Ue}|>Lem_2I4`0QoWK!#2#AF3g?=qR?Lx6AlakRz0AOvC~l+1 zW<0-*pXS3P;TA!piA?4akLTnt5|x7*cs*G%hxX83gq1_>o`{xPZ@WR9qp^>5s_4?~ z)vF*W0jYRguJRBel`!mE5?f@Syt4n_jk`UrlAE7DSZP>(IA;MtzR%=o+iO{Zt_Gjk zF15HjK_K;Kzus{VhyZ&-Zlpqv(+g~#Ji(HFwu@L>WAf;|c@}iohpk>}aQ=BB1Xfmd zFX(D%b-2T~ELTiWvJ6*Wv5>^0eG^0{>4lLZdrH0EvBMvP#J5H~_WKe&!VpNHmQ2@o zd9ouYBV*Z9tYVh^hzpY^e90vmK>;j4N!5AKlhD_vAR;2-H0SK(ggEOtlkK|N@65^1 z=Upw7TDNc^nPa{RayfD-JT##!BRQ`RIpNt|c%x+UgR-4otODN*kB#Q`rHn7{{^r1r5&(iy+4VZ(?WafL*<(nQ#%rNbS~;4FpW;zW zENpz~l}|Z+JWZFbiLM!2erhGJ&3srNw8^7>&$sm1 z(BL4(e(&w?_gJaH`BSHlYd?&D&c8}-utYZUXy9_WQ74v=XrD#kAO1k?V70{^tP7Wk z1B-iP)cUOt6Xwf2Cqr3zdiA++e4cxxoT=tMRkmyqw4W-TX-l2e8#fGv%7ms;v07iv z2kkc-qm>cqu~#2zHS-sVjD;Nn!$Nsdu-1Q6m(cyK2c=x1S zRAnDUiTg_FX@ayMNz>@n++J(|%VBfH<=b--+_K3XJl1MI`F7SME=cjPoOk1koG0?< z%gc0D0o$ehc^{IKiA2Q2ShB}#?d*UYdT>iwh>)YJ6`NI@StRwxZh30aiRw$=ojF?@ zo7W9gn`-ixq;*!^@fMJ7%Cpr_`JRi95HA6|O6qAG%fjyN;1hf^$<){xdc(oBs2My| z(elr*m$NU(ESo#1uFVP!5YphguM=x0rB}v~*jPV_Wg?7H`lHQJwrV^>oP4;p0T1du zAV3J8;eEgU=nwn!%>&02$A$W1cMya~Aah4eSZ%WZk{{9p^$2(l;jE-E#0heg&820~ zOaL>e(dP1o4N@l~sfWo-w=guz1ZT<9`r)K``L61PiQ( zTKPUesM+&$S5=C9*mM!SwVtxY2Mei9+cM|Ei*FENx%0Z~xICgURZIUpSTieu3!|q9 z{=tAj^C_`gIADrFoEKU&0#adeQA&ZcH@Vd@Cef*wpP)S$1HZrD#f?%y=7~er`_XA& zHF`AV(r0^gH(4pAD1)1<_xdH&xuusYT<>@~Vd5F^)~eSW={WeZxyt@1^#xp^TEW4KMoCsG2w^0xWk-ngLEnaaKkx&D%zBaP+-Lsf#nxa%3 zxCBK8D!3>v&LyHe4<+4x`*((qQku_ocwOV8wLb^Bd$MFC2z;0}OdK#&CvRH|e9&0p zT*}iGbv!3tnc5T>hF(H2| zBj&accIOHMFhc*|7vGUy?JiHv4Bz8#V^Z$qP;^pFp;^705`Qx46CLo{{i8a{a&}`c z$2R-ly~7E)y;`+*aKPZtt{%>6F8UR5%51|1EI<`RHs(a4mJ$+WXX4zMbqz+ozJGQT zl_ko;+f+k}6ih-;I+?Mm+Qn1nrH2K5S-OmWwLtUNHYX#%%L&FM)U7k9H1@oZsf4UmPaBDdmvs}2v? zDua!rpAB<|Jtmk~xL_(LgA_deAE$BV2nbh8qyP2Md66U=!P4vOAFM3AQe8Rh|NaQh z@}WqCBNwvQ2Xw`feQcL?{CLXH`QFwjTfd^-JyHf#914eP+p(3!_Tg4i{=2yPD+t+l zlyjn#%8F8|vl(kMLWDUUnbnLb*UZ~rrz$e_=Iyup(TJqh8p)Cww)YdLvi?$xhd)ZJ zxveCr z6Da{!qF`t%JT)0Fzx94z%xTJ}S%S&SuSXG|%l~N?wZY*4A-+_Qrv~)1DaB!10xBej zDU4dv&@@%PZ=M43*A$?N${oGeT`}o7m?-?+mr8n#s?xdy9fCc$Wa27-e1AF@O)}a<(dH7+nl09+exv@E zu7ccAm67>_N;z1GSKv&f(K}onVh($XX$2HGK>hdHWicz+bCLZGW&`}%Jk!+$xm zN}*%YA7>t;{o~98TC6xs;8U$i3@~_d%Y5^~$EorzKQ6x$iTK=re_BBq$>nH$CUm?# zV_|f{V9lg`)EXk0CA#Nt*;tOrDkqVdqzB?ql$7Ptj*ZQ+!xaC}XzX#@y8kO2H>w+r zEgfw^l-C1u%v_8hdyKf(+GPiigXFZc$&i5CSJVxnUeV9hzE^Z47@cD+I&v|5DDK4= zAc=}2FH1;gbl#k}5!9wJ(Iqn(crx;`^SJ_EIGbXBeODUszy^mpRx6lb2oyu5L9q+P zzl6d_Ob9?;7H1JhrJiL0EC#Pg!Ba}{hp%w>G$$2jP#PE2V6Dg#+C~q*ponl8d->wt za^a;b(zIW4qXASWu*C|7t+LmTp8`aJb%^wAgPKgUZ}RF?w3(p;ysksZ0gq><1G2(a z8KQk3TD>ytdq16&-gsw6vpKeEa|BqGnZVfKw=K;!I+}YzUfp1$O2vrPrx-$~H}5tL z7kMP^5_wx%mS}=Na>i3UrPJY}j8MuFVxN}&NWgAV2%Dz)9QR<_a7L^Cz$w=AT~+^L z=ZoxzDb_?Q4*ZyWt~?4T1yaQxI@D7BV(J$OzM2CT>RdnOCar~l6F0X(NDHCXA4O*66X%L_#h3mv#g z2}SP)A7DU9S@m>^f{xq3R?V)z*--_E&pq#PrK?+`6#D&x2N8_E&>Jd$N-P8H zI_4f;MGs5b`m&0zGGRIN5e?Id8G_Ug>fX`aj*%8G^1JnWechItbbc8O5d_r>Q}`1i zxvfGu5AoWGZzER|$6f>r6Hs%N@ zkHU~H8Qzwl9?QdQEv#I^flWMtapK?h6rhIT%779IJ3GNB z=FyFg3DPuSk0~RUV#4}ji9rser>eF|?~q!9@f9ZY9jI5Vu)Yk6MgOU-M;W^W%ym(+ zTq$(Nyfut8O*AK~3fd92z);jNb8>1b0#y!u7#}xo^{Tc%oWY4ux8EfTb0e5^AVcfq z4G9E{I#39*KN}q;Q6WLsNnPXQs{MB zLo74!yNmXR_>0pb5<8}U)Ej@l6CwyqAI+8>RL}A@hy=kH!Y1ZV264DQ&o@yJ=*Rx= ztGE7(C`W zo>45dVw2#wsTmpqAeM6Rh-d7HxF6~dAr<|3_qe(wI}T{HwPhmt9ohM3jeh{b`P+MB z#)~Ms+yaYW!1|~-uBLV(n@V)5a5s`V%_T|mkD&cXIdqzKR{ASCe`v48S^rHOifTqFg&jAo{VrP zX}$GIq^v|dqDQ|=NRXLIzPll1tUlXgsm7jYw#C~1;hM`!#$n^#X|AjhPq#_DD=eT+ zv6J*OfH1MBmhDHmZg-x-#Zy;o7$?5d@PI}5(^GmCU&UDI_fBD!oO|? q{{MOY1JHkZsX^Tw3hK4zp=n?8f2OEN)1&Tw0U9d0%5{o15&r|cqL6g} literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-notif.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-notif.png new file mode 100644 index 0000000000000000000000000000000000000000..241c064ed0173b8e77bc1f13e94bd0bd89815ceb GIT binary patch literal 17035 zcmdtK1yq%9_a=N0=@OBU4gqNp6lrM$X`~xLK%`qzL}^4Mr8}eqq#HyD2}x-X>F%C= ze((He=07vRO@b0;%LD|=@vJ6i-1799g@$3||Kw6phcw0dsojQC8@BM4jZ z|JmwjZi3vE*4gT%IpY2i0Tz6Mh5SU_&cfNv#L*mKV1I?&9p|5uTREB8n82=%h^pp_ zNZ5>t+^l8dXlrHr9MMei_Z@7*_}B3+j%MbFgR6kG|JY5^?&V8!TW7>!PizxxLr3nW zVdZRNj>y{_WJVxp5s#(BHQbXnrhGN@ha31Wt7dYK64NdHTF4}-f5bn$$3%YfJ_!q0!NW z_Fy9MwG@$8uC04=QhWwH57Qo}7f+IM>IVsJR-;NwOIIJyhwfz3Two$p)YM)JZPgQ< z9c^{;_6Y~L&3LK9HYWq+2OvT|pJbSOPKy1$ybdYR<_eNVEGThE!Dwe{=H z1^)p{T-~oPMmgPusWr5;%+^MV>}&MLYF*aik8X2)>P3(1MvLqWh>eYX?-72V3jX}? z;e*3ZIxGx)%15%Y7_nSNqT@Pr&f{55yk};dFPVc*y6B85rhlZTR7h5dK z(=#&}miJT^EQ4}bUD^68D%`dVZ;_I+`TM<3Nr|Ya;B$6yNw2CR6>{5b|Cub*=W+Sv z%NK5LZojjwCK^Pk^)Tx*3k#Vk+kp(}{uSq?-s7;Io+s5)n>eflIHa6Xj*egU$G?SB zbaHrS?4jtv?XPZZNNZ`44h{}x<;?be;zvEMH>WFoY2t1#%ih$1e5Wp zBbjYpyuF)Sq*ujih31<1raN`OQX_)JzD~{~$W`C8W_e^~dD(Bk@(rw}Qf~Ba(a+T1 zBSm@x)6>Q4nd#{$D=RDFozM8lV-DJVf|w{^q-sdBJZie~{%$TJB7(T#a-!XEdAjz! zr>C9DZPK4XHUfdLt)4?iq`I-ZDfc|E7CxR0uzyI&v!UQjR8d(uw>{VP{l^dg7Guo1 z%gjj8kotOI;r)I|gkLnXvT1iL2jP)P`8YQp-<#G}37ELq*_HrHTU!|=C45A)X<1rj zC2>j9rQidbF~9kF)Agx3(uRfxdGbQdqSjvina^HK=sqJOBdk{E$DLv_uC5Odv!`n% zoh<KF3LOzNn%)>*7*zV!&Yo4%)r3F<*h9OU7!7BRc&?>gbHin(?ZS1Ya&OJPF-bM zT3T!|Y1*B}+-YfP2$@Vm{CB7_nW{QXH8reHvfESK44ls|v}W@KgEvAKNk^7r*{nE+Tl#%dv-^M?fm1@<%EM9 zzjdVH_x6UzH^D6I9~`jwqaYZ`Zg>zd{&omnG`l^Nkdzem_3MKb-W@7T8=k~49uBDi zqzUYdKTkC|+MIGQB6HiC4(}5^vzgqbt0h6&7KLp!icgcT1m}p0i;Fv$w*zt}$G@28 z6%;_^aQyCFWY|FN?d{!VEQOHw<2L&imKNfiF+4J2YHa-I^m9#(j#bC<>Z*j983Q^x z`fJvS0c^@`e!^C&xaGG3apq5)8%^vVMdyIozZfm(n6eN=l&Sf@2^$3A7A+BdmjuBKBr#>9LkiBUe-5-oBvzh zC)!rkc)$UX%dF)!8sVsj!~FHegCe`|7lkOaZXAf_7bOi33Y;fx`JDx+Y#vZ3B@1S2 zB(+8>i(-|G;(&3$=OlQN`Tkm8tTXGaXwMMwz zh*_EM2vs#O28S50uZ+`j(1;T69t*g)#l`O-u8 zZCbymMxUk`u5bmc9?6OY&-q~HQpZL4TO=f=BcF91dL47yHlA2eih7ZOb#!?UEeUG8 zc&x5Y1hYRdIQaV8HyJWq^goM>EgP=o6#hBaMZ4spt&NQlz$*y1a`ZV#LqbAcC;D}U zk}Yt@at2Zfxu!wHL_eacIsU=?{rmU(*x0x8^Yf}yq5TsRp%^q?H<*=Eq{PKhka1uk zoS!vv{Uw~iwu%BS#QmvvtjtVSg*;=B6C4n}#=IM@F3;SLrrb=*wBLXF6dDnMe~Xw{ zx+k@5?h!=XpD7}t5Ly827Xk=Go8jlK3)c0&biW-A4iD!kW{%NoYip6mL6p*W=pdG# zJ@^x?4Bmi%%XR(Y@ZW5@@&RC_WnsZGH#bL)4kF)>8NHy9zJ|8**70=6K!yE&<&O6d zD-VxqO(qc$m-m|9j0DUpwfihec77bEFm)t`ZIvGRxU$s3^YM`5y7RH3M@xa}>2#A$ zeInXTJ|d0B9bDHCUESR=o#eqm%ah<_OT_4?Qc}^8z(*AePWG0RT}guOA~5dU{J%_6 z{~yp~MFkiz2M33EYE?xA(2=Aw+(7Oq4*~mGgrJ~csn^La*5etA@)jT}Sy_LQY+p5o zEb2!bIViUuEqR?@r3H7)`Yj6^myh=k3^*tq2|$!`suiP86hsnaT6*KT)<8KWCDG?+ z6V(n20u!W!iXt`wv>}i9GRebbDypj5;KbmWNHprS#s?f(rje+qT1kitqU96 z|3~lj-<1konY|Y3yZzucZ{EDgGp8t+90GKUS>%kv0Zey@^Kfyg{ICUV6tG3XD#-E1 z3Px_v&o$QCVyH5drpZ;tB&ybW1aK=p^fq8oLy+W!g(6i>W zzOt%H!GPSqlbX|@mYe4xZHTy{B3|OBPY%odba$AUGwbX1b-uc8=tA^Ba_*T%Z#j8+ z2}MQ49xJfZ%#sr26YtIlD#D|S?+lR$vKsf%(NP9oULx5@>JFeB_J`{_A7f(Bo(clL zIiA|`c?YJJ2~0tEWO6cWb=7(?x3CZg0Yv(`an>#i8(SOA^| zM>D=Om6eqbT~=>7Iyo^=@9i#jmwBJL_I%<|SJ z5*iv4!V`Nh6^MamkuF-@R77zxCxmn1)8$P0@s~4=R7hG6c#-0LsPkE;oat^Vu&Q|2 z-TK7~RXx2>kG;Qhonn_f2;@$q0l?4EcY zRPbJtPH)&F^Ydri=Y1*2;rEY>yvA4WJF|f$kS83kwi#6o?KV zH8W8$@M*cY2mot8-*guNdMfX8xHS`rJQNHK2H$U8DStzORMeI2Mn|)4mD$qIWQ2?^ z(GckmSsL$KKuNo1AW;a@6(|7fm;(-@<`Y@5b$IBSm7R@(_^-5ZeWHp0Xeh$3;nmSR z&;um>{P+?9K~`CZS;fw-LR$9TBl=~#^u zb8*w9=YLS6K^sfU=D}=*HtIbj;RK$wy1M$l6BhyN|MZZh%NdTzD=ZAn@3~KoheU_{ z!$VWJ`E7S$?P~jUHCON`);fS_Eacd~ctb=*<}||OxahZT-D}u z{EHZ@^p`L9fHzVKINq_Gy8mM2dQ2f^`&Zkk5Xc!@Z63639kp5V$uFkI0!Mg9?THDr z1etyMMa{AUDF?{-&`1i?QN0i$gg`*{LPbS&m!17OVtulP2>xEGI16PW(8CWhO)IvP z9It#qs;jFD5hGngZQ=f^e!~_R5NlIk0xw3h+#^~T*ZjrNjMg>GxuUA+5G$id;a$vg zAF;-Z4Li0}MrLNo++U9k@DcWq2eWlwLDv0vW&h|%c2ZeQ?Iuv6R&;cP{qeTR;?dmP zT-xG5*W`xlyCQDM7z1N8j*C#6w-`mSecn(^hla?~(-kere-EdF_| zed(f~W!UQ4S`?fL&PXZdL-}IlbFllUSL2s)8)TvZUZx^FK0F*~bh#Th_?*V)crN}h z7vFi_g|oXJGGtU#)WPSyy}ipD8_47){A{z108%R?PD9Yj)I61_(0r>Mh@CVfReGGw z<&A~^PEywuA`Ii~jcK2=my8e7Rzh1)6cu2JApeEjvt1;m7Y`4G%!;1W%^R{ta9mgYPTJi&r&*|M{7o~F-CRw=^9Gm1TKaSs z9En?PCxE)IyTmjzS@!IQ%t_r1rA~kx@jeSo{ogUj_E|sFAhW*s%%kHb#7)r z|HmNb+}+!oJMb(6dE&ESgP^sK8Oxp}@YUVj-BOb_bbZg2Y=mD7o0j~V@J>6Cc7tc7 zTBA}f(Wv1oj=%rnoWd~e+nxq&t9uP^FmwER=V<|0FVQ~v+ z@q^U7ddij&LAVCgITP}{W;x>=9}R#g(uuDx+YUD-RMpi3fPg)u#QzuMi4Q$mG=&JS;UE!u#y zt3r-QVOLKG*$g1SeZQz(@9h?hnBAg+f>y`@^1^Ch!v7OVegF)aao%UcRR}o($OP(< zj1~@Ro8Fm$Fb{L662S}bV_;x#mz5P;_cBeKGHzJvsxMQhwq(62wFW zYH?yLG9LpoBnR1G`|RSO$L<{nfm8<$QW-0LND`}1hU;@DvG^fvR8UaR9b9~Pm1~{# z`(NI8>H6o06b`dqY&g~!S4}Xp@JGeO#Vzcw{3@N;K)ReZJ9wRa-BhN0pUnd^m@{Nb z@O?2mJNx_h@9#zTPP|M;2`WVpkTEi^3&J`qudizu_6ny!0&L7j4q}!l-HP(90}uR8 z>&n(S`|FBHeB@+3cMhF{AgK+|5n zsML+AvmdY#2A{L!BhNmNm{i2tnXbgJr5R(T*Hw@b?YJY6$(ZPZc2M>%laq+&z@FAc zE3y`MXzDs#fUxf26DA@rQJP8Hs(X*s^7e|R;{>n#J9DPBvK;Xzm8KM*8XDpkX;M^_ z*bhw!4%9lC3Xo=;zpi)`(=8h8n1V$3z`>f295iOF z6`~?onQ@!9Q?{}|ZpUl`n>q0gI#lvLf0nYcvU-B@y1F@dLt46jbQGg%g6digHHRVpfu0d3wH& zi6O2~nmqy86(L%(K6G-UJ0qsN!xT%fWM2E-yLT~L{>Q?U5DkI6Wq+pkCWYark6^`M z02eFLWQ(!Oa=KaYxg9rdE-NP|qr9AVUeKQ&&3)j{pFh`=dFg(iT$j;J8|u`8NsR0y z+Ha_NU#jPyQ`Fel7}VWs!RsZOs=;#q!GqSNJvuHfWnC@rmP2>p`1>z3hb}Ot1%i#m zH)6C5vB+bhIXPa;x3OXxhpYa^{TWz?gsz&hGM>9e=|4-34JOA6 z_UK}zS)UKMq+i+wZ`{0j6GYfs`yLPd&m#8?f)@4P=rVH?FhxIJu_ek#j#e>0=wd68 z5`KVC4N$9_;zYX(ff?tNx?R3-xOMA@%~vQ{DVs9mVkW4*Ad-uYPCRk?)QhTFn8ZdP z&58}6Z{9!-sE^}PzU%3})g2}#R^LJ{K?L{1hh)E`pBShH$upKF46iu1TJn7xN-7wz z1W(SkFpHY8Um*ax4qv9VbBQTLH*ea{w+E;7d5fkFIv2+RWxBk)OzRt7jEj%YyUs8- zf^wsheaHZNbwT^fvtTv!a*JLGH#fKM8|v!nZJPE`T{_Mt+U&7ujxX%&-hmK4Y#si4 z73KR3!R($N!;l+YtP_+=7|@^Q=jTJT!6ZMS*+>E`x*lUz(X97}nHumFiWZ<~2cKbu zgQD`x+#Ida4-wUu%PlO-&OtO4q@$ywTK6`G6{JaylZ(r0E+uvGYT3@5LF4)z_m3JS zqmqTg=ua&d7zY_VS8Wk4=65zV!7x5+uH~KO%T6p&7j}e_Vr-bz(`->uQ_HBSsZCCJ z2vf5(hnkB);uk)M_8~c$Be~6;2E*3IMhcWXc?E^+GAYuV$jZl`9rr90xpW|Bf$P*r zv+6gP(hkN^H+HH&7K+7*o7w6Fy=p;TEOs-}{_VSWWyUS9)A}lPUw&s=XlW4#o0d;q zaTc`d5wE@%`A#V}K(jEg*FsWSI&dG=Yr26)SU9Z4Y3c0~hRHINsBWF2oE&t{I5x}A z0aLc`dM#jYyzvYAJiT1MD0!h$G)7&Y;U#+A#4i}c)F+0&j4*UXHJYoe*j2{F7Qd$+rwA~tLP@O@MiPxiHK zZ4gPVe%MyEE$s!?m*48snb>f(tkktCjr#HIwPs=X8mG0rJ-78Q5pG8}lCg?})KnT* zDPLN`?L00u)2#d4gP&7UQ%lY{BFrm(PfVC_lVxESS5({*P38KNoV+9=zy^*eUBFnGIl%0yl3@_voJe$+q->7A69eB<;*2sA0at!Xx&t~J{JM$$Z{L6f`YR&di*fQ9n`YtD#63gqgeTF0IC|Ay zC=4Y@cn7S1+-LrhMZ_=o)DMPAXYG=lU_C1z2Tc<_b0F`DJKyg;iwB>OHq`fXaYy+n z++)8bUuKGS2xkLz@PG6I{3L*i=WoJatA7_474!K&*XS1q@eZOjTIPZ_v6>e-`oXFkZc2D zaNGIG9KeI7=nzMrD7xVQ*hRNSq>G|>>73)IU*ri2{MuK>b- zoCTx6FLsLgNc?*zR_mM(dR}IzX(`v=spW5%x@RhA7}?2CiHLu~1pJ0gz4x2b5o?6g z&V0vUMep1$`|h1LpN=2@`LT9D50QRl@P^xDhAHtHmOqj5Q%y|(MIz4z!^e^hN-ti# z7{c>VZoqKV{C&9apcNci;Ti=8W4{Hy(faf+%{3Uhz-e*gaH)hnUH_3=!0 z0$e#DSRX^7zJzZ*00gfq%x`LHs_SE0+3MC-=VXnOSr<@)D9%BD_0ww%#A?W^ncxo> z(XwVWhvZgNXkg#?QeK|z4d@!*YcaOrY85iQQ*a#ua@70xv@ss$=8V?X)}_WR*N(j! z;|B?sG!4+{gHT1e)*2f{A=iR~RvxmkvBfL^6U7`aqRrtVu__4Qck#$;lJswPlV|5o zcmjktFE3ApRWFKQfFlhb7ov6yb_0YgSYNt;T&RPmncetxXYJrLZA%;&(1!>?Ge>uYQ3BLu_N#%0>{N;K?HP_R0EVf;rM zwR>{W@iDQ)t5W ziHtuI(KS5}^IGr*j+UtZS*dPOS7W`QUB8FQQej@6-0gSs z2c9wJKqY;e#O~g}70z)F^h}ifD66jiD}FF%r_B~E@ethlHEXDLP-s$Zs(`&$vn3$^ z6OZfcx9X;-he!dEv-;qaDo&1B!l5CuS%mo~Q&4g-ExVg}-oX&PDto(Q+07+IB3#ST z&Mxk>ePUul()E?It82u{%1sl%jk{c2al6@^&vSoa<^IZdF2Wp09P8LAh?KtWW=flW z*DbXVBd(j#g)OM_!Eofgw_Pvl4Rl@|u8Tu9*6)E3^(B|^;({Q`Ai@D^8<7USf4~!2 z294UN+Gop?b$O-B(|t@rM0^L7-Y?flgZ3Un1J9Ve)xGxJZ!Lp^YG8>^R%C11U*VgI zpcf8zX^|0iSdE9wYK6q0yz<)lAf3HSdb=z<3 z$}%Hwb-!Vh$~)Vt{n@=a5IH-ye2(hU%psq@%fTTnAtBL!M}8?}*g9}#i{MPqf;|1# z%67jb!5nlCDD>ZvGBbJbX@}-&hX(0wEH8JGgZYR7R%D>Y(5}T28GHBL`MK93^Y$6V ziV%&Jj)#W;33PRV;1c<&k)@)-V@H{@^N8|>V(H4U=<8sTtxv?vg2{42L==jFqo{GQ zvGfcK40oISo!I#vJfLS|!-4xc_c8K=LZcL)Kd7?^WBKdoOwm{%Hvm{*cG=~5Fq$SH z!g839c>k*eimnZd?JiS}(cNzVihzJZOnJ zPk6$V@6k|SPl*&5>^~+a7wIQSGjfge{rG`Zkcav_{MN+vSQ8i*G#0RvgjRUx3EUdu zWkPqw$a~Iv>#SUxosO-=ekEunc5iPl#tZu7G9VZTlI|__X~l+Kyh*&#Wn0D8d0Sic z=;(;e|Fxht)~rn>0dVO31~4ipbPZmvy9%BA_>NUTdjzC9NC0MuToulXtO7-L9G`4OOw(wx zuC5NraW>i(9a%_CTvQNY`dJ2?T4NU|3~t%0D?WgaATohe{n0B($jzar?B1u|?GvxT z2jSu2@~1m$1lNUK*W-uCk>uGC5?Sb~h-3XK*Y3Hxw*}1Lz_abaK&UaVy|;MMRr6LD z5R%tY2Liavzjs0MkV64<1y@WEo&8*;IeD5$t8vEL*j zlKfhb1oZ?UGY;8k--*MH4Kzd%--bS>{D)Kl8kB_Q7t<#HmcRY|?{78-)7~$wWKv;Q zHePnFt^Otp4&G{A`K^Hpk=@O)9brW2RN<&e)2H1edB@ED(Jj=0u)^YF;EdTWeB^jg z;ra^=jkk3uqjz^5^B?Pmg_7At$*hNl)-2BlGk#BGPp`efq?hNwwu4E`{jCcaI~Nz% z-;JRdPe|!^uZYJkZrTYbXK(eNL_nX;^*Nun+Pr662eDQ|AN@DU^7GNim;1g=@FUtIk<8X6$7^<-Xx zf=fnD9wLxzDYZ!YFol6SARs^vs@$huo0Bzkdhc2{)V=GGl_yI+wY6`S?hS^2mX7v}(10^;L+vCG`BzBl9wc`>YDWDGPcI*Q!h`Ua zNsY_+jW_RzkYnt|#nI~X0RZLs+Uk%HJ>fW-$bWPP^z3_>F>j$F4}4z3BxnKLNqmtw zpMtTpyVJG`^ci_8V49Ydzk@D*rq@Pf>_8S}z_4>YfWBG7E;>3o0CIe2P7R#OtsNxk zWD4^42VRi*lazMG1LNjQ5g1O|VusKoubI}xTqxkLUV`n5qr9tp`N#hnotvC!EW zGl4EgSax6~3$<(3pa7|ioe7G;h zXyx=wEQ9L2?|G5;njtX}v@Q<;YO`9sudQU>*$9}8#A{Mcs~T9i5OE-(Vt&bql}Kq= z61PQC{RrgKW#L=L-?RFbgi1ciq0$6g&uH3-&)@+c z`8O&5TxJ;G24o~4|CQQh;Uv*1-H0Ys9AOBY+eHhjk9{ySiM?#WKvQRPeX?? zUlq>k$-*%2_h5Mgk)5#R=^N41C(t;?K%C*pB))Ul0#`ov5{-Y76Tg&4+F1idODpn8 zdk+$ioBEtu-*xb$Qy?0FnER0vuW%R}l9Ha>8^?d!n}gke^AC)VV>K9-WThMCLL~1Z zAWWt}vgVs^*_n9wQjBchID?3ntb%es>q4y^mP{%LTfKS5c7eCe`C=AMc{vvDVwj(xL>2E zCl^9a0 v?U+wud9&M<{DHfG?vZp9opzFyw!b6>a6!w2cTR2k^B+}<59a=1D08~ zh$78U5DpOx7u)|mHPukoqbwMPreQhtwYO&6WV80)OU8Y``d)V-bJG^Je{$1sCQymW z;F$nLy{Juj29Y9KkauZ?goN%|A}gg^ZEbCXU*_gaK%$mU&1W-<0uM%(MIj)-#INLI z^Tgj9iYA!@k}us`j(H0i`S+SskR^yhamDN8{^np}z!!iYemp0@$CqD&!>k7LA%WF~ zS_lPwqBgSsonp;kMXEN;XL zi30D%_O`tWX^Z>PW2CD5Gs84;kx-1s;!zgiix z9@C|!)-JTG4hrIsuwz;~B!no(-B2_~S^~v}5J7ES-9Msezs-ZlZnFT01kmUoU3+)P z)T6xwR0oJE(`9{(hb;VCn!Fm60wHS} zd=3{o?O8iOZy4ZKOOftiAA~}j$&8X^`8Ws=FzLYnHj7b@4>H4C>!>Wsb-L8^cCe9s zU<)DeN>?W$C?wRm?~Fy*vH8#AFrU_+^ba}h-$B&6IXO@b{^yyQL|SOI`~Ttzp&!!0aZKJ1#uJcH`G=O{(Nx}92iKS* zGCCtMTk7AdvwT)5zqQ^q`SAH6f7C^`#7mm){qZCw@MX62=xCc!{pxLPWYGV>^CITq z@LtN7pDRaar9M-FR^xU?7m8zE`J<_}$Tr4-tOR~LYU)?#7}d`#?)~k#Aa!=T($P)% z@Zt4BvTRv#=?$8zgOaW#IM4BE&Q*Aw!h^Y5E)H2kTifp;=TKg*u6strnUD~cW5l1n zD%KSG@#8IX9T4>TUEz>w0Wsfe5w5GoNWh8yCbr%wwB@Xj`c(LwigHUh1oll5a6%uo z;Al$*(LivNy%GK5LbRg(l(n|*3fE4Vptx3^#=&T2#zNZEl-^diM(xA~+EQPPCT1Pj z8Z=SoDjk?uE|g9D`uLaB$&o1gAM#AN~NDX64OF1ldL|WC+Ez#py)X7>O5yagh>?Yrf10I?g zjc>@}K2!2CIi}4#!Sjn+m*Yc80{XpGY2<9%)|eBsQeP_dd-7WJsOU1;{_N{4qOc{v z7PNlhw(#P`C_N)1nz^~&b|I-z`|Rv&HRY%Vw1oz7-eqB7vGhD)G=JmytDB1jwSW11 zbod~G?=NjqH4W#5Z6i%G}sg0zDn)SHrc?$<@PGLAPHi2Hl`XP=AB2#I14 zq3(!KZS+YYy@>SVThi6^$Nk1BwkUsBNFGI}iMQcEEx!n-Yr>AYt#VYKx7e!Ks0v?e z*;zb*sBLA{6GKNK_AW|0N7d)nAJNRRm0QrSKC8vmh}k{L{}`py`7rRuPXytBJ0a?? zka}k1PA$bf`mB77OU4shVdq z3NON;rEIvAuRr~yW&eXQ4uL=#srzLhDFQLlNgY{TbWqkAmEb|FRI7|YM7TQ77SDfB zU0Q^(g_d|N&g@*g98t}6phJ$%IYnJ-$oImM_Aj>BbhE^D^tr)WGc!WUh`8ACVZef2)0ul=`C#NCck9XeY3Bl*!eg`EE4?rM4o z`SB4J**(0xqABm6dvvT5$Yag$Z?sdH*Be|fyFna*iHlF^E@*iYQZG#TaGMV~ zz-_liJcQ-T7qEsATh*w7zQ7fOarQIcqP9in_E>5f6RN6+eIP z{!}WgD7&Oybq(1I^P!yxbI%#)W7AdPp{)D*4vk#Ec%$A)DjC#kb;e_zZc^r?p0zSbw`S!&D*=Y>=sw1o)oBjiua68w|awghv2PIs^`@ z8Z?(1Ia~~T1%=zYSLc24yR9g}QhbX^cFK&1W&#>tb{k__ z$Bziv&#tIekw0l4Lv^Sk-=xA=U6fhSDqBuuMEKQD>Qjn|p1M)0*eE4EBpfo`{=uAT z42{(YKcql(G`WXYzrWj!@N2rdP_L-Eq7F3D3;lidTV$076R*>W${G+q_wekWoVuRP*kl5&417IAE;0lFm5E`pI}7^FjU_9M#!s z%=<2B4qN;R4(Gl63!Xw5hQ5rAjVrzjn;#V2_lo!j_IDNF?vovh!MV39D_`sYCLn#? z@S@k`{9-G0exd2|sr*85T~GCfIX{Fw*0siykxz8LEIkf} z-=E=n;h5$5J!6+Zv*&6W3L^IKI6hv8jA?lXy{mMF7aLny2hheW$gcPGmTaW!_3VKe zWP7LKn^{%tGGtU!4{=vBxtA&*Z{t6Ov)a^oDkaH2MUAu?w@IB_TDAWJnnD{X>OW|@ zx;IKRQ{l)68!|Qa0o?*%kjS8Ho~$=o689~p;%lYJhHms1MPqUa-zI{Ki^e>wH@|Ze zVK?NXrT1Snk&KpguCW>2pIeM0PrvBQQuFt3F>p)RnUbYOK_m%#+?=_(JPH^*p6H*k z*RfvB+xw?|POUu}Bc1h1t~*E2C0mSo3eyZ}X%2n)v^mm^R*PNlQKo-aGM#T$j?(8q zRFC1?Gu0Xuis#?jE2Ewplv5m@A54gw@2#2+OO&}&RcsUqPgEsEZ;fg-TDR71HBx-( zn9a{!?>CAG-m;r`8~VJbnfHpn`c*k9=X(2G@dsSw76Osd7~Y=ISN(4Xc1w3R33SJU@`Xf zdv}#mgavX|lKi&~NQm-hmfA>(n#lG~d^LSYSDgMLpUP|-ZMt+>$(Cz{Pl5=}&SV?x z{&n9Y#rM`wbSAw9~k9MI%(_lY;^+R z(bI1(vX?)FroP7ukph?NUn`L^wB8}>)F=gZzvUhE<|4ZjT6Jh% zbvY(bA`mE|$o~uA^@sCM_ke$0h{85Fcl_4(RNpx?eU}(&B>zIpmUa62Eg8Af zJtI#@&@vex%pQ!U#A`Yw-el#(N|3p;iW0swn49Vo^46#!$hU5#8y=VamYaI%t6Fuk z z5V5qo5<$nnXe*8bjdC)HGU;+#lG4UG%-V?2Z6>_d==?SEq4|N6O?blc(cI`rM&`m@ z&~`5$?DHS@ou((Gt6G@%bm@i!gyWx|^kveF{XjB9OYDAw@4Us;;1 XkuJ@3)x!T=Ks=UKk}8%ke*IqnUo3bl literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml b/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml new file mode 100644 index 0000000000..00649d9d68 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml @@ -0,0 +1 @@ +Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC1123,1124,50070FalseControlled folder access view \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 5621c83f5c..cb323a5d09 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -40,33 +40,33 @@ Evaluate Windows Defender EG with our evaluation and set-up guide, which provide You can also [enable audit mode](audit-mode-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. -Windows Defender EG is a component of the new Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. Other components of Windows Defender Advanced Threat Protection include: - - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) +Windows Defender EG can be managed and reported on in the Windows Defender Security Center as part of the Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies, which also includes: +- [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) - - [Windows Defender SmartScreen] - - [Windows Defender Device Guard] - - [Windows Defender Application Control] +- [Windows Defender SmartScreen] +- [Windows Defender Device Guard] +- [Windows Defender Application Control] - Each of the features in Windows Defender EG have slightly different requirements: +Each of the features in Windows Defender EG have slightly different requirements: - Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license - -|-|-|- - Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console - Attack surface reduction | 16232 | Must be enabled | Required - Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console - Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console +Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license +-|-|-|- +Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console +Attack surface reduction | 16232 | Must be enabled | Required +Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console +Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console > [!NOTE] > Each feature's requirements are further described in the individual topics in this library. - The way in which the features can be managed, configured, and reported on also varies: +The way in which the features can be managed, configured, and reported on also varies: - Feature | Configuration available with | Reporting available with - -|-|- - Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs - Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Feature | Configuration available with | Reporting available with +-|-|- +Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs +Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | +Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | +Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | ## In this library From 0681812436052f7fcf28cece46061770309b3b04 Mon Sep 17 00:00:00 2001 From: Misha Kutsovsky Date: Fri, 11 Aug 2017 18:43:41 +0000 Subject: [PATCH 07/54] Updated windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index cb323a5d09..a99a3d85b1 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -20,7 +20,7 @@ msft.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview, build 16242 and later **Audience** From 593fa6e2582814942bae8bab8431a9894c6de9f1 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Fri, 11 Aug 2017 18:04:17 -0700 Subject: [PATCH 08/54] naming changes --- .../attack-surface-reduction-exploit-guard.md | 30 +++++++++---------- .../controlled-folders-exploit-guard.md | 30 +++++++++---------- .../evaluate-asr.md | 14 ++++----- .../evaluate-controlled-folder-access.md | 12 ++++---- .../evaluate-exploit-protection.md | 18 +++++------ .../evaluate-network-protection.md | 26 ++++++++-------- ...evaluate-windows-defender-exploit-guard.md | 10 +++---- .../exploit-protection-exploit-guard.md | 14 ++++----- .../network-protection-exploit-guard.md | 30 +++++++++---------- .../scripts/cfa-events.xml | 2 +- .../windows-defender-exploit-guard.md | 30 +++++++++---------- 11 files changed, 108 insertions(+), 108 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 51488cd9a3..670f31b22a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -1,7 +1,7 @@ --- title: Use Windows Defender Exploit Guard to protect your corporate network description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -41,10 +41,10 @@ Windows Defender Exploit Guard is a new collection of tools and features that he You can use Windows Defender EG to: -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) @@ -62,10 +62,10 @@ Windows Defender EG is a component of the new Windows Defender Advanced Threat P Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license -|-|-|- - Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console - Attack surface reduction | 16232 | Must be enabled | Required - Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console - Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console + Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console + Attack Surface Reduction | 16232 | Must be enabled | Required + Network Protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console + Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console > [!NOTE] > Each feature's requirements are further described in the individual topics in this library. @@ -74,17 +74,17 @@ Windows Defender EG is a component of the new Windows Defender Advanced Threat P Feature | Configuration available with | Reporting available with -|-|- - Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs - Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Exploit Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs + Attack Surface Reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Network Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Controlled Folder Access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x ## In this library Topic | Description ---|--- -[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. +[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index f02c6632ee..c119518f4a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -35,27 +35,27 @@ msft.author: iawilt - Windows Defender Security Center app -Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. +Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. All apps (any executable file, including .exe, .scr, .dll files and others )are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. A notification will appear on the machine where the app attempted to make changes to a protected folder. -Controlled folder access monitors the changes that apps make to files in certain protected folders. +Controlled Folder Access monitors the changes that apps make to files in certain protected folders. If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt. The protected folders include common system folders, and you can additional folders. You can also allow or whitelist apps to give them access to the protected folders. ## Requirements -The following requirements must be met before controlled folder access will work: +The following requirements must be met before Controlled Folder Access will work: Windows 10 version | Windows Defender Antivirus Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled -**Use the Windows Defender Security app to enable controlled folder access:** +**Use the Windows Defender Security app to enable Controlled Folder Access:** 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -67,7 +67,7 @@ Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows De ![](images/cfa-on.png) -**Use Group Policy to enable controlled folder access:** +**Use Group Policy to enable Controlled Folder Access:** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -79,28 +79,28 @@ Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows De 6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. + - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. ![](images/cfa-gp-enable.png) >[!IMPORTANT] ->To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. ## Protect additional folders - Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. + Adding other folders to Controlled Folder Access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. -Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. +Controlled Folder Access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. You can add additional folders to be protected, but you cannot remove the default folders in the default list. -Click Protected folders in the Controlled folder access area and enter the full path of the folder you want to monitor. +Click Protected folders in the Controlled Folder Access area and enter the full path of the folder you want to monitor. You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. @@ -137,7 +137,7 @@ You can also enter network shares and mapped drives, but environment variables a ## Allow specifc apps to make changes to controlled folders -You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the controlled folder access feature. +You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the Controlled Folder Access feature. **Use the Windows Defender Security app to whitelist specific apps:** @@ -167,7 +167,7 @@ You can specify if certain apps should always be considered safe and given write 6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? -## Review event logs for controlled folder access +## Review event logs for Controlled Folder Access Component | Configuration available with | Event ID | Corresponds to… -|-|-|- @@ -183,9 +183,9 @@ Controlled Folder access | GP, MDM & UI | Provider: Windows Defender | ## Audit/block modes -Controlled folder access has mitigations that can be individually enabled in audit or blocking mode. +Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. Component |Description |Rule/mitigation description | -|-|-|- -Controlled folder access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. +Controlled Folder Access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. | | | Allowed apps |Apps that are allowed to write into protected folders \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md index 7985b26b3e..64162a6604 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md @@ -10,12 +10,12 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- -# Attack surface reduction +# Attack Surface Reduction -## Attack surface reduction rules +## Attack Surface Reduction rules Component | Configuration available with | Event ID | Corresponds to… -|-|-|- @@ -29,11 +29,11 @@ Attack Surface Reduction (ASR) | GP & MDM | Provider: Windows Defender | Each of these components can individually be enabled in audit or blocking mode. -Attack surface reduction and controlled folder access also have mitigations that can be individually enabled in audit or blocking mode. +Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. Component |Description |Rule/mitigation description | -|-|-|- -Attack surface reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content +Attack Surface Reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content | | | | Block obfuscated js/vbs/ps/macro code | | | | Block office application from launching child processes | | | | Block office application from injecting into other processes @@ -111,7 +111,7 @@ You can find the tool in the evaluation package alongside this guide: - ExploitGuardCustomerFiles\AntiMalware.Tools.DemoExploitGuard.exe Note: You may need to change the extension in the filename from **AntiMalware.Tools.DemoExploitGuard.rename** to **AntiMalware.Tools.DemoExploitGuard.exe** -**Rules**: Select one of the seven attack surface reduction rules to run. +**Rules**: Select one of the seven Attack Surface Reduction rules to run. **Mode**: Sets the behavior of the Demo Tool. Note: If the rule is applied by GP, this should not be an option - **Disabled**: This scenario will execute normally and complete @@ -119,7 +119,7 @@ Note: If the rule is applied by GP, this should not be an option - **Audit**: This scenario will not block, but will show up in the event log. Right-click the output area to go directly to the event logs for Windows Defender EG -### Manually enabling the attack surface reduction rules +### Manually enabling the Attack Surface Reduction rules You can also manually use GP or MDM-URIs to enable the ASR rules: diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index 6b44a7c9b8..97eefc24c9 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -24,15 +24,15 @@ This topic helps you evaluate Controlled Folder Access. It explains how to demo ## Use the File Creator tool to demo Controlled Folder Access -Use the File Creator tool to test controlled folder access. The tool is part of the Windows Defender Exploit Guard evaluation package: +Use the File Creator tool to see how Controlled Folder Access can prevent a suspicious app from creating files in protected folders. + +The tool is part of the Windows Defender Exploit Guard evaluation package: - [Download the Exploit Guard Evaluation Package](#) -This tool can be run locally on an individual machine to see the typical behavior of Controlled Folder Access. The tool is considered by Windows Defender Exploit Guard to be suspicious and will be blocked from making changes to files in any of your protected folders. +This tool can be run locally on an individual machine to see the typical behavior of Controlled Folder Access. The tool is considered by Windows Defender Exploit Guard to be suspicious and will be blocked from creating new files or making changes to existing files in any of your protected folders. You can enable Controlled Folder Access, run the tool, and see what the experience is like when a suspicious app is prevented from accessing or modifying files in protected folders. - - 1. Open the Exploit Guard Evaluation Package and copy the file *Filecreator* to a location on your PC that is easy to access (such as your desktop). >[!TIP] @@ -45,7 +45,7 @@ You can enable Controlled Folder Access, run the tool, and see what the experien 4. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the **Options** section select **Enable**. >[!IMPORTANT] ->To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. ![](images/cfa-gp-enable.png) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md index b6c238c73e..8f57ca59bb 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md @@ -10,12 +10,12 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- -## Exploit protection +## Exploit Protection @@ -56,13 +56,13 @@ Exploit Protection | GP, MDM, PS & UI | Provider: Win32K | ### Audit/block modes Each of these components can individually be enabled in audit or blocking mode. -Attack surface reduction and controlled folder access also have mitigations that can be individually enabled in audit or blocking mode. +Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. Component |Description |Rule/mitigation description | -|-|-|- -Exploit protection |Provides memory, control flow and policy restrictions that can be used to protect an application from exploits. - Each mitigation can be enabled in audit/block mode |Memory exploit mitigation | DEP +Exploit Protection |Provides memory, control flow and policy restrictions that can be used to protect an application from exploits. - Each mitigation can be enabled in audit/block mode |Memory exploit mitigation | DEP | | | | ForceASLR | | | | BottomUpASLR | | | | HeapTermination @@ -84,8 +84,8 @@ Exploit protection |Provides memory, control flow and policy restrictions that c ## Policy settings for Windows Defender EG The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. -### Exploit protection -Exploit protection has an improved manageability experience over EMET, including support for SCCM, Intune, Powershell, and Group Policy management. +### Exploit Protection +Exploit Protection has an improved manageability experience over EMET, including support for SCCM, Intune, Powershell, and Group Policy management. > > Note: SCCM and Intune will be supported in furture releases. You can specify a common set of WD Exploit Guard system and application mitigation settings that can be applied to all endpoints that have this GP setting configured. @@ -98,9 +98,9 @@ Note, however, that there are some prerequisites before you can enable this sett #### Group policy -The exploit protection feature can be configured with the following Group Policy details: +The Exploit Protection feature can be configured with the following Group Policy details: - Location: \Microsoft\Windows Defender Exploit Guard\Exploit Protection -- Name: Use a common set of exploit protection settings +- Name: Use a common set of Exploit Protection settings - Values: **Enabled**: Specify the location of the XML file in the Options section. You can use a local (or mapped) path, a UNC path, or a URL, such as the following: -- C:\MitigationSettings\Config.XML -- \\Server\Share\Config.xml @@ -190,7 +190,7 @@ b. IE should open as expected 5. From here you can check or edit the settings in the new interface in the Windows Defender Security Center or with **Get-ProcessMitigation** (this command by itself will output the entire current state of the mitigations to the shell), and **Set-ProcessMitigation** respectively. -### Managing exploit protection through Group Policy +### Managing Exploit Protection through Group Policy 1. Launch Group Policy Management Console (gpmc.msc) and from within and existing or new GPO navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection** and open the policy named *Use a common set of exploit protection settings*. 2. Enable the setting as seen below and point to an accessible location for the client machines to the recently created XML. 3. Apply the new GP to targeted machines by direction OU membership, Security Group or WMI filter. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md index 47f6e8b5ad..428d11bd27 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -18,14 +18,14 @@ msft.author: iawilt The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. ### Network Filter -In Windows 10, Version 1709, you can enable Windows Defender EG network protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +In Windows 10, Version 1709, you can enable Windows Defender EG Network Protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. -You can enable network protection in either block or audit mode (non-blocking, ATP events only) with Group Policy, WMI/PowerShell, or MDM settings with CSP. +You can enable Network Protection in either block or audit mode (non-blocking, ATP events only) with Group Policy, WMI/PowerShell, or MDM settings with CSP. #### Group Policy -The network filter feature can be configured with the following Group Policy details: +The Network Protection feature can be configured with the following Group Policy details: - Location: \Microsoft\Windows Defender Exploit Guard - Name: Prevent users and apps from accessing dangerous websites - Values: **Enabled**: Specify the mode in the **Options** section: @@ -38,17 +38,17 @@ The settings in the XML file will be applied to the endpoint **Not configured**: Same as **Disabled**. -To enable network protection in block mode, select the **Enabled** value and specify **Enabled** in the drop-down sub-option menu. +To enable Network Protection in block mode, select the **Enabled** value and specify **Enabled** in the drop-down sub-option menu. #### Windows Management Instrumentation/PowerShell -Use the following cmdlet to configure network protection: +Use the following cmdlet to configure Network Protection: ``` Set-MpPreference -EnableNetworkProtection [Disabled|Enabled|AuditMode] ``` -To enable network protection in Block mode, use: +To enable Network Protection in Block mode, use: ``` Set-MpPreference -EnableNetworkProtection Enabled ``` @@ -56,7 +56,7 @@ Set-MpPreference -EnableNetworkProtection Enabled #### Mobile device management/Configuration service provider -Use this CSP to configure network protection: +Use this CSP to configure Network Protection: - Policy area: Defender - Name: Defender\EnableNetworkProtection - Supported Values: @@ -64,7 +64,7 @@ Use this CSP to configure network protection: -- 1: Enabled (Block Mode) -- 2: Audit Mode -To enable network protection in block mode, set **Defender\EnableNetworkProtection** to integer 1. +To enable Network Protection in block mode, set **Defender\EnableNetworkProtection** to integer 1. @@ -84,7 +84,7 @@ Network Filter | GP, MDM | Provider: Windows Defender | ### Audit/block modes Each of these components can individually be enabled in audit or blocking mode. -Attack surface reduction and controlled folder access also have mitigations that can be individually enabled in audit or blocking mode. +Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. @@ -93,21 +93,21 @@ Component |Description |Rule/mitigation description | Network Filter |Blocks outbound connection from any app to low rep IP/domain - This can be enabled in audit/block mode |Enable/disable/audit |Puts the feature in enable/disable or audit mode. ### Visit a malicious domain in block mode using Internet Explorer or Google Chrome -1. Enable network protection in block mode. +1. Enable Network Protection in block mode. 1. Open Internet Explorer, Google Chrome, or any other browser of your choice. 1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) You will get a 403 Forbidden response in the browser, and you will see an Action Center message saying that Windows Defender EG blocked a connection to a malicious site. ### Visit a malicious domain in audit mode using Internet Explorer or Google Chrome -1. Enable network protection in audit mode. +1. Enable Network Protection in audit mode. 1. Open Internet Explorer, Google Chrome, or any other browser of your choice. 1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) You will be able to navigate successfully to the site. However, you can see an audit event in Windows Defender ATP or in the Windows Event Log (under Windows Defender > Operational). ### Visit a malicious domain in Microsoft Edge -1. Enable network protection in bmode. +1. Enable Network Protection in bmode. 1. Ensure that SmartScreen is enabled. (Start -> Windows Defender Security Center -> App & browser -> SmartScreen in Microsoft Edge -> Block or Warn) 1. Open Microsoft Edge. 1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md index 3c47d6425d..c2fdb2c0a5 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -30,10 +30,10 @@ Windows Defender Exploit Guard is a new collection of tools and features that he You can use Windows Defender EG to: -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) There are a few ways you can get started evaluating Windows Defender EG to see how it works and how it could help protect your network. This topic brings together the evaluation topics for each of the four features in Windows Defender EG. diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md index 9e6757f074..9dbb92d72d 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -36,7 +36,7 @@ msft.author: iawilt - Windows Defender Security Center app -Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. +Exploit Protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. @@ -44,7 +44,7 @@ Exploit protection automatically applies a number of exploit mitigation techniqu ## Requirements -The following requirements must be met before exploit protection will work: +The following requirements must be met before Exploit Protection will work: Windows 10 version | Windows Defender Advanced Threat Protection Insider Preview build 16232 or later (dated July 1, 2017 or later) | For full reporting you need a license for [Windows Defender ATP](../windows-defender-atp/windows-defender-advanced-threat-protection.md) @@ -160,14 +160,14 @@ You can import the XML file to other machines in your organization. You can do t 6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. + - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. ![](images/cfa-gp-enable.png) >[!IMPORTANT] ->To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. ## App-specific mitigations @@ -245,11 +245,11 @@ You can import the XML file to other machines in your organization. You can do t ![](images/cfa-gp-enable.png) >[!IMPORTANT] ->To fully enable the controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. -## Review event logs for exploit protection +## Review event logs for Exploit Protection How do you see these event logs? Are they under specific codes/areas? diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md index 51488cd9a3..670f31b22a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md @@ -1,7 +1,7 @@ --- title: Use Windows Defender Exploit Guard to protect your corporate network description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -41,10 +41,10 @@ Windows Defender Exploit Guard is a new collection of tools and features that he You can use Windows Defender EG to: -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) @@ -62,10 +62,10 @@ Windows Defender EG is a component of the new Windows Defender Advanced Threat P Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license -|-|-|- - Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console - Attack surface reduction | 16232 | Must be enabled | Required - Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console - Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console + Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console + Attack Surface Reduction | 16232 | Must be enabled | Required + Network Protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console + Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console > [!NOTE] > Each feature's requirements are further described in the individual topics in this library. @@ -74,17 +74,17 @@ Windows Defender EG is a component of the new Windows Defender Advanced Threat P Feature | Configuration available with | Reporting available with -|-|- - Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs - Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Exploit Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs + Attack Surface Reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Network Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x + Controlled Folder Access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x ## In this library Topic | Description ---|--- -[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. +[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. diff --git a/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml b/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml index 00649d9d68..c4d1efdeb0 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml +++ b/windows/threat-protection/windows-defender-exploit-guard/scripts/cfa-events.xml @@ -1 +1 @@ -Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC1123,1124,50070FalseControlled folder access view \ No newline at end of file +Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC1123,1124,50070FalseControlled Folder Access view \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index cb323a5d09..39afdf5261 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -1,7 +1,7 @@ --- title: Use Windows Defender Exploit Guard to protect your corporate network description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, controlled folder access, network protection, exploit protection, attack surface reduction, hips, host intrusion prevention system +keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw -msft.author: iawilt +ms.author: iawilt --- @@ -30,10 +30,10 @@ Windows Defender Exploit Guard is a new collection of tools and features that he You can use Windows Defender EG to: -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [exploit protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [attack surface reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [network protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [controlled folder access](controlled-folders-exploit-guard.md) +- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) +- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) @@ -51,10 +51,10 @@ Each of the features in Windows Defender EG have slightly different requirements Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license -|-|-|- -Exploit protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console -Attack surface reduction | 16232 | Must be enabled | Required -Network protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console -Controlled folder access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console +Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console +Attack Surface Reduction | 16232 | Must be enabled | Required +Network Protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console +Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console > [!NOTE] > Each feature's requirements are further described in the individual topics in this library. @@ -63,17 +63,17 @@ The way in which the features can be managed, configured, and reported on also v Feature | Configuration available with | Reporting available with -|-|- -Exploit protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs -Attack surface reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | -Network protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | -Controlled folder access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | +Exploit Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs +Attack Surface Reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | +Network Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | +Controlled Folder Access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | ## In this library Topic | Description ---|--- -[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. +[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. From 846d7f630f1a7ad8057e7bf1ab34eb8dc47da597 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Fri, 11 Aug 2017 18:08:04 -0700 Subject: [PATCH 09/54] test link to xml --- .../evaluate-controlled-folder-access.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index 97eefc24c9..d06826fae9 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -62,7 +62,7 @@ You can enable Controlled Folder Access, run the tool, and see what the experien 8. You can also review the Windows Event log to see the events there were created: 1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. 2. On the left panel, under **Actions**, click **Import custom view...** - 3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. + 3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. Alternatively, [download the XML directly](scripts/cfa-events.xml). 4. Click **OK**. 5. This will create a custom view that filters to only show the following events related to Controlled Folder Access: From 1d526e25f9f6be1a756898a7d0771c7ea045e4db Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Fri, 11 Aug 2017 19:19:25 -0700 Subject: [PATCH 10/54] add asr eval --- ...d => evaluate-attack-surface-reduction.md} | 129 +++++++++++++++++- .../evaluate-controlled-folder-access.md | 70 ++++++---- .../images/asr-test-tool.png | Bin 0 -> 16822 bytes .../scripts/asr-events.xml | 21 +++ 4 files changed, 185 insertions(+), 35 deletions(-) rename windows/threat-protection/windows-defender-exploit-guard/{evaluate-asr.md => evaluate-attack-surface-reduction.md} (63%) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/asr-test-tool.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/scripts/asr-events.xml diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md similarity index 63% rename from windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md rename to windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 64162a6604..49dc3eb9e9 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-asr.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -13,16 +13,131 @@ author: iaanw ms.author: iawilt --- -# Attack Surface Reduction +# Evaluate Attack Surface Reduction rules + + +Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard [that helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines](attack-surface-reduction-exploit-guard.md). + +This topic helps you evaluate Attack Surface Reduction. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation. + +>[NOTE] +>This topic uses PowerShell cmdlets to make it easy to enable the feature and test it. +>For instructions on how to use Group Policy, Mobile Device Management (MDM), and System Center Configuration Manager to deploy these settings across your network, see the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). + + +## Use the demo tool to see how Attack Surface Reduction works + +Use the **ExploitGuard ASR test tool** app to see how Attack Surface Reduction rules are applied in certain key protection and high-risk scenarios. These scenarios are typical infection vectors for malware that use exploits to spread and infect machines. + +The tool is part of the Windows Defender Exploit Guard evaluation package: +- [Download the Exploit Guard Evaluation Package](#) + +This tool has a simple user interface that lets you choose a rule, configure it in blocking, auditing, or disabled mode, and run a pre-created series of actions that would be evaluated by the rule. + +You can also set advanced options, including setting a delay, choosing a specific scenario, and how to view a record of the events. + +When you run a scenario, you will see what the scenario entails, what the rule is set to, and what actions were taken. + +![](images/asr-test-tool.png) + + +### Rule 1 + + + +### Rule 2 + + + +### Rule 3 + + + +### Rule 4 + + + +### Rule 5 + + + +### Rule 6 + + + + + + + + + + +## Review Attack Surface Reduction events in Windows Event Viewer + +You can also review the Windows event log to see the events there were created when using the tool: + +1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +2. On the left panel, under **Actions**, click **Import custom view...** + +3. Navigate to the Exploit Guard Evaluation Package, and select the file *asr-events.xml*. Alternatively, [download the XML directly](scripts/asr-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Attack Surface Reduction: + + Event ID | Description +-|- +5007 | Event when settings are changed +1122 | Event when rule fires in Audit-mode +1121 | Event when rule fires in Block-mode + + +## Use auditing mode to measure impact + +You can also enable the Attack Surface Reduction feature in auditing mode. This lets you see a record of what apps would have been blocked if you had enabled the feature. + +You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the rules will fire during normal use. + +To enable audit mode, use the following PowerShell cmdlet: + +```PowerShell +Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode +``` + + +>[!TIP] +>If you want to fully audit how Attack Surface Redurction will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). +You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). + + + +## Customize Attack Surface Reduction + +During your evaluation, you may wish to configure each rule individualy or exclude certain files and processes from being evaluated by the feature. + +See the following sections in the main [Use Attack Surface Reduction rules](controlled-folders-exploit-guard.md) topic for configuring the feature with MDM policies, PowerShell, the Windows Defender Security Center, Group Policy, Intune, or System Center Configuration Manager: + +- [Exclude files and folders](attack-surface-reduction-exploit-guard.md#exclude-files-and-folders) +- [Configure rules individually](attack-surface-reduction-exploit-guard.md#configure-rules-individually) + + + + + + + + + + + + + + ## Attack Surface Reduction rules -Component | Configuration available with | Event ID | Corresponds to… --|-|-|- -Attack Surface Reduction (ASR) | GP & MDM | Provider: Windows Defender | -| | | Event when settings are changed | -| | | Event when rule fires in Audit-mode | -| | | Event when rule fires in Block-mode | + ### Audit/block modes diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index d06826fae9..4512197267 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -21,10 +21,14 @@ Controlled Folder Access is a feature that is part of Windows Defender Exploit G This topic helps you evaluate Controlled Folder Access. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation. +>[NOTE] +>This topic uses PowerShell cmdlets to make it easy to enable the feature and test it. +>For instructions on how to use Group Policy, Mobile Device Management (MDM), and System Center Configuration Manager to deploy these settings across your network, see the main [Controlled Folder Access topic](controlled-folders-exploit-guard.md). -## Use the File Creator tool to demo Controlled Folder Access -Use the File Creator tool to see how Controlled Folder Access can prevent a suspicious app from creating files in protected folders. +## Use the demo tool to see how Controlled Folder Access works + +Use the **ExploitGuard CFA File Creator** tool to see how Controlled Folder Access can prevent a suspicious app from creating files in protected folders. The tool is part of the Windows Defender Exploit Guard evaluation package: - [Download the Exploit Guard Evaluation Package](#) @@ -33,25 +37,22 @@ This tool can be run locally on an individual machine to see the typical behavio You can enable Controlled Folder Access, run the tool, and see what the experience is like when a suspicious app is prevented from accessing or modifying files in protected folders. -1. Open the Exploit Guard Evaluation Package and copy the file *Filecreator* to a location on your PC that is easy to access (such as your desktop). - >[!TIP] - >You may need to change the extension in the filename from *Filecreator.rename* to *Filecreator.exe* -2. Open the **Local Group Policy Editor** by typing **Edit group policy** in the Start menu. +1. Type **powershell** in the Start menu. -3. Under **Local Computer Policy**, expand **Computer configuration** > **Administrative templates** > **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled Folder Access**. +2. Right-click **Windows PowerShell**, click **Run as administrator** and click **Yes** or enter admin credentials at the prompt. -4. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the **Options** section select **Enable**. +3. Enter the following in the PowerShell window to enable Controlled Folder Access: + ```PowerShell + Set-MpPreference -EnableControlledFolderAccess Enabled + ``` ->[!IMPORTANT] ->To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. - -![](images/cfa-gp-enable.png) +4. Open the Exploit Guard Evaluation Package and copy the file *ExploitGuard CFA File Creator.exe* to a location on your PC that is easy to access (such as your desktop). -4. Run the tool by double-clicking it. If a Windows Defender SmartScreen notification appears, click **More details** and then **Run anyway**. +5. Run the tool by double-clicking it. If a Windows Defender SmartScreen notification appears, click **More details** and then **Run anyway**. -5. You'll be asked to specify a name and location for the file. You can choose anything you wish to test. +6. You'll be asked to specify a name and location for the file. You can choose anything you wish to test. ![](images/cfa-filecreator.png) @@ -59,18 +60,26 @@ You can enable Controlled Folder Access, run the tool, and see what the experien ![](images/cfa-notif.png) -8. You can also review the Windows Event log to see the events there were created: - 1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. - 2. On the left panel, under **Actions**, click **Import custom view...** - 3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. Alternatively, [download the XML directly](scripts/cfa-events.xml). - 4. Click **OK**. - 5. This will create a custom view that filters to only show the following events related to Controlled Folder Access: +## Review Controlled Folder Access events in Windows Event Viewer + +You can also review the Windows event log to see the events there were created when using the tool: + +1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +2. On the left panel, under **Actions**, click **Import custom view...** + +3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. Alternatively, [download the XML directly](scripts/cfa-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Controlled Folder Access: + +Event ID | Description +-|- +5007 | Event when settings are changed +1124 | Audited Controlled Folder Access event +1123 | Blocked Controlled Folder Access event - Event ID | Description - -|- - Event when settings are changed | 5007 - Audited Controlled Folder Access event | 1124 - Blocked Controlled Folder Access event | 1123 ## Use auditing mode to measure impact @@ -78,18 +87,23 @@ As with other Windows Defender EG features, you can enable the Controlled Folder You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period. -To enable audit mode, see the GP option to **Audit Mode**. +To enable audit mode, use the following PowerShell cmdlet: + +```PowerShell +Set-MpPreference -EnableControlledFolderAccess AuditMode +``` ![](images/cfa-audit-gp.png) >[!TIP] ->You will need to use a GP management tool, such as the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), to deploy this policy change to see how Controlled Folder Access would work in your network. +>If you want to fully audit how Controlled Folder Access will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). +You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [Controlled Folder Access topic](controlled-folders-exploit-guard.md). ## Customize protected folders and apps During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. -See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with the Windows Defender Security Center, Group Policy, or mobile device management (MDM) policies: +See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with MDM policies, PowerShell, the Windows Defender Security Center, Group Policy, Intune, or System Center Configuration Manager: - [Protect additional folders](controlled-folders-exploit-guard.md#protect-additional-folders) - [Allow specifc apps to make changes to controlled folders](controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/asr-test-tool.png b/windows/threat-protection/windows-defender-exploit-guard/images/asr-test-tool.png new file mode 100644 index 0000000000000000000000000000000000000000..569ee7a256827779434b711c4749f5f598468eae GIT binary patch literal 16822 zcmeIacT`hrw=NzVD2T`wL_k1Ax)7x*RYj#qFQG?NdMDJ-Y`{hYw$u#>NGCuDJ%mt1 zM5Om11PH~@0z^te2_$#1&pE%}xZn8B9ryox7-T@^Dp~Jb@0!mu=QH2L80u@XvGB5h zKp-}4tw+Wn(1{t~wR@HcuyCoWsRDn_d23n1K%fiXj$bEIBros*MrJ>4y~oURXV0HJ zD|$vXZ2KS6V++3r{(jD0z92+JuNGiB?+2J3Ilx}{x_JA!czJ>@ox3gs*jbM48eZPP zzAjGAexP#pUM0YK;UBB7gZ=TY*Zf>O96<8B?B{?j=Z?3Scscq7+WR_yY`q!ByR-gt zau?VOcY9!0Ul96BZ319Edu)c-`+B-~I)T3MEk*-2=Kna}-}i+Bh{AYF`mfzIygWP{ zJpDk_-qcpW#&o=!sf(Yx1E^$USQG@h2GV}?z%=O7`gDXl-_q+1nx_7Tf(Hurz9Db3 zSveEMv1>-tp9`;E#$Wy7U0sm%gZcIu$uqvM_&TsLT_B?v_qwzAlTokT>q@{j-ydi+ zs*y^x#(&27_Hw!jUyk{9v9j;ErEZ&^t%q69i*p_U1Jea;>jm14@kmFVn05gnZ%<1b^Rq@^28e9F&prWVBoQg|1GvVgD=8}q( z@(n4Ek>-I?t2*5!+(yTduh&?dTl_e6z^ii$Z?e#GvQnh4zu)}OI<7xkwM@Nvx7Een z-F@f<@N+N{!pH=y_(6XhR}(POZTiiX1%nC~YEta5=8`-uI$~@s`clTxGL#aXP<94& zGt4$-8>UQLKBYVHj@N@;6s|y%4TIH~Du9Zz$C|C}hBbuOgZ)YG`W36RH*{!3GmkhA zqn_cGlv_QgG?ylS2We-9I|kkWl?P{KWgRT#9F64tmU_3L&REN_Nr*}-t;k)>%=uYp zP~kDyIc~MHS;yA69YN2Rj@Uu$L_=Mu>I{t!~#~ z%gm)n#d~MDTOP4|f?qXf5F>?JuFGdHNhj!mX5ps1EsVpOh{S@T$O_XX4l;9&r{NM~ zJ8*T4=4N{^8otUbXgjthC{mCRj!ZSUwUWS)wxwx7P}0Id#XD=w!W!wQ^}wi*ETPfy z#i%#7(aPNCxd-^gF30;qN9d`{6rpCs&(zB_Enim)aPxixwV`P8tI)4~hPszleZxa+ zFa2n@w9ui|&U&yuB%N};52`@CHGN{8*up7huyxv?iUdwo}GL{o&lF90j^D$gSxol$loH$i$e>>lLO=#S* zcnZVJooy0&UsE?)pLGEbB@bRM{$^t_7NF)k^VeEJws>%VrqcN4i@tt=u~V#*)ECVK zf@42*W6@PFwGPcz(&t%p50=L|Df!ISJAa0+C5PB}eZSBb={FW$ieo}Afzh5IVg*uc zH@XhdGJCYcWE)QNu%&n44`xgGn=%8khq)QFvPR`lD|$AEznWZLf3(bMsB=LSukL_@ zfPa*c;NTFXkl9)w*-q6;ruM*JIDGBh??tawY(gs{CQ|fSaX1ntanILZ64IXuTY@P@ zY&-P__whE@6M}_Q8m>KUt%z<^7^qt(oujB5T66}wp$Lew7qKP=E8MBf5e15|d=|r+ z>}x{{g`|jQ2?FEyj^H{yq~fpj4XP0s|5GLKkHfAl7A{B$)ne<7PhLV}{7sDC35*hk z|E6LiFiO|OqxyM58DlfJc`K8lYg{AR|MxIzK)$lE4?2i@C^j~o?Bq{=J6u*%laZy0 z`Zmt@vtnK;iZYyOO^KY}U+T=F+>6j_mS6+n(2?B67+dc#G5<3thA2aKH#^8Og1QS{ zX>HwMPb@G%*^F^B63oM>Mdr5H`7s6^t=r?CDEm!?R=V?S?y&G?Ga@Z2>!qKvD0ZK9 zvUGpxVa~o$Aq;(ny+r+bM}2YyYV@*yX!Ea<^*YF6y!(K`a^Kh6l+j8%_=p2nX6t99 z*LT0=x`!j#2%i$nZ9mf0BW3(vukUxyv?&95m1A$bdf*8GE6RqFSZ3DoXzqlUtc;@s z#!+tgZtjj3S(iZ|SF92uLNM{b-P^2Ro^gVX)a)pjF)@wCRpUKguPdM|SltLw56$G3bjG1)3KDA&`S~ zy^;<00uS3PwH5D15PMF7K-PV2J+@IGkVQ+>)Xm&|fx#im{y$EFa4immn*7$#iUjKT;{{iQG3i$?~qFU((I*KPi-uw*=I?YWQTk#f> zSPwwaupS6h{=#V>8(F5J(FX!usg-!E$hZAtLHw{I*>;8L1ZeP@-r1S*=h?%vFB|O^w(8%IN>bw;3flqRvIDdC32k9b6_HCll6$zmS>O+Pxk)@_D@!tFDVvCHs?x zvlGF-+Zy!~G~$Q(?So*Rxu$1)=A>P;>?V_kS9^K=0GedI{U)%oQ;nC>Id&%*qBivT zXI-L_TuI`!U00{O*IW$S%@P9-<_nbk?Yy4qW`t{Oaj7{=ge`!N2F03Q_lwPh**Luy zoPv3k2MaD1`e((Y*=|_bC5|GbGIh$F%}CU@ynM+%u5KN&rF%e#|RjmFy{8W%d3 z>L>Oq15vG^jM32?`Kyn!VglX5TYerXuUjRAFw&^7xcFSzT zdRjNFZ0-A)O$(iF^Yx?a(uuhKUS~%~Q)ZDIlRBF~!i+CDHrT*)w<+v*C6m({_@k`s zsmbg2!c2lT-hg=>b{BX$&;wySS?TFRU*cKT%W3`_)iZF?y-N`C%iJ8@dbDxtSe4!G z_**>f>yf|lE@@wBlZy8OuT)vd?_VW1Fr6HJW^k$Esq|@Vr%;3nWP2nOi(WqD8v#5s z$tiKmpY~lHxiH;4{48B@@aF^7;`V;#-GXdoH7Py8ag*YJw9rb5lGn2A`(4+Kw@w=) zdG5iqzDir>&hLKSv?)I4&MzMvpRkwIz&7+$D>YKGy0minCporOOz#8>XWcE?Hc%p^ z@ON)eu!0nQyyofY&f>zA*o++yW9ve=%|Wa3C5dn`^S;p_IYXf=`No@qR}cR-$efhm^qHPvA+u^1p0M;OaP0gt)uIeDWe$5A5R5(w63M^B z&MqC^2bly@n))T1!&ebbBbWW-Q$mNb+?@Br%V5o11SoNao9oH_)eu#vpxWVYjpn`i z*zT7yu>w6WW#F3~+?2U!L1{OBJptEjWnR@}_q9T^*ROq+=8>4zj0>fT)5TIt39BUv zE}cbE!~3xt4#k8)asEMibxs;PNqb47(1V~2O!=Y}MSX2785ZR`=||Ym*R%VSTC0&8 zZBT;tr+>_{4yI|jn=&gY`#-ClVzyrYG?fzY?w2y<`;<4#$sRjd+lBttEj&*D#OI2y zc>BVv^yjd+c4LrTqVy!g`vPT}WI4qE-o6lp#}Z~k3_h4mHG57`V`+4Mlkir^=qq}8 zNsu3|tm_m_vZcZXjh?5?zk^$c6t+b|S%6FE{b+}8X`c*p#aaQjua|773p*X!{;3yE zn7I|35=c$Mq~dJ&Bz5IiZ<11LSldvob*q$pvwt(#W|RSMQJaF3kV@XOuc{~3ntu1a zl<9V?IezQeOu;!I^H-LFnuo$EI^7)!cQu>)JIv2a{0(O!A-s#fz8*esb&AMFue3-d zWsJ@%ddsd~`Fp6h*M3DjiTmy+qs2#ar%({l?r>J95-@tTiY0x{sLPuEpKE+oJu*Wx znu4Biqg4>115S%kgw=9QW1k;EbB4ck5KgU%rRtIr_mo1m4yhtn=Tyq01p4+OI!Ql`WnQvh$G=u7$qt4{hj8_AN|#7rsxk37l4dlK zyO7^%>$nH}$jx?yN0Pydj{I(y38w#qS~jf{s@1bD*yhpBtQD$#oZedynmL(jKG2pg&0Rej zZdQyBw;ZNdyM00v%IcgZjwY^E;H`;a9K2V?HcaXw57L8BazVzTImvKV1Mi6hkKJ|i zrI?OlDPF2t>D~b%KRZ~#MfduZ=>rdOlE)X4{R(P{q~WrsAmdk9)H`<7^hORO?`4c) zhLM_;)y>?{mfAWT>z*C%ggDj12H#2lEbR z!bD^d)3hZCcdQqBXOu6a1vPV^i&r04&-FFPX)0N%r`1~H*Vk87KA-9^(It|2epYF> zTq-Uw!XlGI3#MtrP{Wk6&c}E)ezig5IuhCcMxXzRDxwj5HV~gsLF@6r0&zq&bu>r1 zN3n~?wH}X(W|ptXH&*q;Td#)!7cR=o<>g_v``RdL%4ys>NRO-AOKHXf`cCeeHqCz) zvko9=X%cOUx}cVIRRx7xM=DvAAdHoZCH>tofaKMjNh=lG2+@pjpX!c5a>P5|2GaEtOx=X-5xy;diCHm7^p08Gyx>z(eIO> zXBXR8|I3J^&GvoQ*_co!)0?kHt~NxI6D_(X$LGxJvz2%^n<$Q|RE>P7WSODD<;2bf zqg&WvDTI;G3`r9CaorWCP=RYH8);;pd3FO8s)h;;*J@rJGo0CHm^K_gvJ8%@qTEu0fR=07dwt%>iAB$*4ZkvstpL>#q;CHTYb0bEZTlJ;n31H-Al$ z9LH~jS0Uag_Ulq)ip>GcXxjH6n9FKcvnfT-^&8LdR?tIgrFoa4q@?ARg>PG+lqAAX ztjJ<+zmV{~J50GI@qHvq`_vt&@`}N1p^k&+R&w3-pX28j%mX|zq6HQK_C(8$hp-+= z&$OEkFIa+AwrPdKaGSI=!lExJ&?~9%<;@BkY3YbugXx1dWGLpyhNLDA5#h_k6U>dT zCyX$m54tG>U&poPD7BUAp0vFFah-jSGLKfSdMVEL;`dO3W#r5Pvrd?>wq?g*zpug5 ziD0rUjWIoG9t4g`v~;p1&akH7Evn*uX?c?$EedxXS72$=UXdFxw}r3p%e#-o63r`~ zLb;%XZVB@ZLItW$1~ueJ+2)0XF?)GFOtKXZSq?7IxD>q@0lFH4Z@1mwtQ48oyd2R$ z6!}Hc5m#6He7}RsQs>F=Rw3XBwL&2WyGNLFT`mJbK@U~8^}Q#&?otxKK~u&u!$Ohk z#Qn{1glOKc$gd;S?;|gCrFDyO?BMEc+uq4UUI$J+0+uFKNl1aweMB4-p=bBlE<2S)FL3E^vf+BA1vlez1J z0{UoixHa~`=aDk^I$s*aJj`>mqxf4xjY^K;U~mOWvM{v8z=UgZk<=rmu6C`1T|11Y zxb=xEzPN65t{!YN)=1_XI(Ab;b8-ZGFU6^}^~I)0P@u%szXy|r#g)q+u({qXn=g43 zl2V@*7N^jZGoDQfDY*3>>&wuQHekq*NU&s~n zE17h~xTPVRx4uV5;EHf}QdNDwdqG^V+)zPs_hmDREA{Y~hEfW}phD6w<6C@@epU>t$6ReG39}lVT0#&U0w(gxZ_-t(iNDnaQQnaqrV?nDCcL6-MLfvYxJFx z0=J!E+|*Lv#?sj9S^pHX-b=>D4<26l=f$f{Gz3KQQ4)AX6iVv(#6irlV^>}2hU^;ceRxh6hqf*lutXDy4XDw=p;l?nn- zHQCyI^;B@R(-m@=)>k;z@=@q;b2QccDogo^tSv} z+6v6pdL0@}{K%R_3Ptc%k<-SWq=gwFn~5`-Y;GemlNJ@~Jt?dK2qA&-M?u9+ETv^a z$e>0I+cpUg)DEx5s6x5XX;j(g1169#g!X+dyc!GW+BA*Uskm zMNtK{gqCO5WDwq^Q{JoZhB;_?CnJ=~H-lRXD^Hn5AF>KS4bhCh(zL^nj(P|@uF+CQ z9i=Lj6MOiQ3W=x*Da4-ueQDeU@XO~L06N2FL$}0pRm$-I4t_eR(Rc4Q07B?YiBvYOiXY{ zF{mAYX2*3gjvnsUws^~-njlmR;b_1OLOsV-jW))<8hbWGJN3mMSs^r&p?<#!%ZcN# z{Xw^CJv2^hQt|?$^(B$y73V<`Co3s?C)g6Vzu$vz{T#wVjG)7grpQC+*c5`S;s;xU z%vW4rxHUkm@(v}ITdt73v`I$Tif%;8Uo36do6Wr4%I!mdUw!mw{HQ>P#le2sDAy;n zp?#ROW;IoQ0Jl;bPA`<&O0~8Vix~JEl@nO;anb1s=#_j$@FnM<9K(R2kEIZUt4G;8 zVXZ0x35P3{-!HYzZ$YU)dv+OCRKuDk`26x;$@OU=REE`DK5QuvpgwN@=niWrx?|wj z8*=lmz>>*pC0llKCUB#&$})_GCTg7a?|oc|HOP71tpy?t?)dnl>r4G-py+ugUQ?$) zbUe6N+GZSJP$ZN8NVC81^YQPvY+)8M?2H|pI0@l8Sk0`13uGK(rs0Dl88|^8xbDb8 zFT>AF7E~_nq5N=*;^=2&Y~5^--BQxkKRpQzdX87i`sDJG7vMQm6sZ{>$;eTw*w|=@@5FMm>!GKMrB(&Tv3 zo}ay~H0kaoFpofBsxomQaw{?bT#{)-u8W*KQ>hlmKT1u6HQ{rTvQ?T;TSFT^3;Lrk z;M=>lql)mgF8+a<#r)yWAV@F9)XZ z_&`5HW;sM}hwH!u@<@4dEy8P3hEY||KdI@I48`+Z3;UXFfQ5aFF?_`M&!;akx{s?PzJKM(k z?8ptD8)k6ecVpylq4s+I>#8aNb}6t!d$v@YDS26#F--xJQU{)y+$wNCcpWAXFDge`d?~vvbd-|ARWA;Q?J$pz=vi7%OC&>FUO|P>^0LS%EVMwY95P27`bs zK@D{n)EXLn$RaHDl^s+mBCiq@aWInON}g#>T)SQpq$1r@?MLk9vP>-uQmJrPkkp>U z2BPeOi7AtkyG&eqY+5TEmdDA0SfIp7P`Nl8`wV&pt_!72j^EVQOc0Q=Ui?}0BC!A{ zvaYP72^C&vX8Klt=&e5N;y|UG?_+x`n)PDVz5M0hN(C16hHVA$-#%^S{$0&VLIY`o zN=GN_Sc)|J6fqV;r@GY zH1aFM$^Yg|Zf>aEe-QDt+iW7q;unmf<$Zqer1tA+*@_dlgX5w_M=wdn+39v^S+yi@ zHzgaaXc?#85*G47MA+*D0Rx`o#B-hk1MNbr!uovD9i$ zIkSGkmE2!>as`3e{)YQ=81uKlB{3L7sk9Y=$J}@3_Z2mH*F0~ivG3RnQUf$C&H?Q zo(%h@Y^Z5SozxuYX#J44K9+L^bYF@${2SJ3K%n{eS5}tDhX*z4fRafLA&gYL=-kO9 z96mW7ALZwZ1aVH572wf=?-SD~%lQd7J4}k1%pVZV2s=CBtVqiamFQo517aD@X(Bf= zsvB?mYpqi`O66q`pF#sRrwX3j5?@Uz|5)qGf3)S=9o~yInY(Y(-lcXX-;UP3@@I1Q znyE!Nf7gcTjpe$WV(<2Y^A;pPk;MX)c-)65W-<F<07fU23OXOlo zdRErhTzmBKCZsjmyy7-@8o}hs9$QJEvrWurIYqUrri3q*H~N2jKYM1wgMyf^RNucZ zaT+C(93R9v&_zcWi-=k3|L!hxcGar-6Pn#na395Fd@fk{IE&gp+R|d#VY=eVboJ>6 z&}gx^EF|n;r5H}%Uy7B5_y+`ZFKmkC3=qAdoByj9z|GzLLwcF_bc29n#YsafSS_q{ zQ?n`2Zy`>x6ooQ44pWk-raZyJS?0#j{c2C_y25nW?lgR7NV80EFuNceR0kC0}}3_w#SV#=zm5thSAQ+Gs*Jw&jorb{oi6eOi73)F3S{9E7rK zE)}Hzj_$x@&}cOOPX55t zD+Upz%^|xu(*Pjiz=n*5WxH(2iW#)Y}el)?OR4tI8nFfYd7`qy(WV{9{~gi zn^i%G+Hy+D`7Xg8i5zFhah~3pG7z+Wk*b+|l||X0N8<9mn^1{-v2<3sKHwV78_(VE z1E#avOI0>O*OrBNjWon$ zqN?i7@vN$YY)m7(pFK3`QR>3y(nlMZMBtnY8t2Qbj^n|c&r+wmn?G9e*M;m-k|*MUs-Nfo^C!#>3Y;L zdvWkC@L|9MTZ%;LMY9Xy*4Er7WNK<^ltT9^CnqOe|84`k9+|5UVa2aeD5w(fYV|KD za6jmN77H<-YeKbjXjx1AiBZN>L)a$5sE|oyv>hE>Zr%a@%hHk+T3~KoWjLp}alNBD z5}e+JA#R873Yf@TmJlb8CdH*3n$K8nBqwlnbI%B|t}g0IR?6w6-xuPITU|&{$Gu2U zEgC5{AWa7n#!@69I~!Q?>dwjte66Z;2Z*_nym0^m^O+TShb!hl)N(#%l?fBRHX8}c z^e+?=dYjuY#QhIp#H}}8; z!w1Hm3PJ+i%B+@-{3XMSPT0za*#M%9{Pe5RSB`Gop>c{cLHP#<2k&9>j9F&&L1Isu zKi&hq0t^P1pP<%l(|2F02}tLG-^7%-E&CTa$PQ=-q z)qU-~dE-$XZE+PqU;wvn*`#q?@uu_P`aeTD=B_Qh=`dZ1{IDW!$%5PMsM~(^#9+fD zbGvoKX&$}`Q1_WT=<^oj3?-v2AcCK>`23)$O`1YIPkIx|r9*Lbo(p~^iSV1Krgm7j zcA@Z+9+ zDGor#GS~f6fk=Wag_J=*PF=6Vcb4OR6xc*0%m!Rv*itYWagxbco66Hm^b@g@;aore zzyR=GpiSq(bZm4{af0NGM;bYNHTipOP_SE|jguV2Up-s7*2zNKOrsjh_ z`r$LPQ@@q`NJ#YRm)EBNWoP@VVp7*J^#k5EQgGIg0*|RAc8j_u77>~5v`n)xOpy1G zhC`aBJXyCD{fm)*&LJ-rVi?*~Tdr98NTe|+iz24lsT}sCGY77p9y=VbFris$kTo1r zRrTDG){3o*(9Ap{>shZc^jmXHls>ojZ`JErk6L=}0~tf`Y94=i7S*ucQ?x(Kh`>&s{^sN^rlZjFGDcdHEI9J<1<=$ zEGWl9m>EZ7;^-FUhk;`RMG;$eITXlecP0kHarcv6Q5N9ggeLj{X)5ciTQ`u@W`);%3wi)3|M2-3QGhiZ=A8q1A31j$!ft#V>{BF^1L*5AUSa!BX5h2% zWZHk+_86q&`IU)CniIvfF%;>DO8=OzCohD!b(ly|BudqPtk&ch%jW2)JI1N~0_tYctIulx|6s={Y-HlS}-o-G17+9F{}E?;P!^{F0Vr*%P;n zYET!>;7X&|MzP+2sAy57HZUjEdRPzH?vz`PBbzKWu|0#zdxAU_J6@`(-yHjHz& z{3i%U{*n4*_#WG$3h%93EFXUOvd%;*l00|C4K?v6!RH01R?+*mIU+Q+gUeo^& zk<*eNwmGHmzmz*m8a1xC7j#4!&m2q?IZe)14cYn13KrvJacO7THTePD>5(3AYq_Ri z*l67c`NY&vM53@=NJFp=kTbb{OU$$DYP>DpwKP?ZM+r@2>6~t+_BB4%T2SHyvbpPz zkmZRStq)BWx^EF7C%z~d4VY2;K5f*_aYH<&8_hgCJdW|!(aEVN_5bJ5=5y~Ib%k8S zn_zV2$Ur9x9bMZ~m)_Gb`W>JCEG3roOFv) zbS8XLQ~mll(t>}R&jMhE)W?-ns8-b)WqZ}V`!w&6v#DUjVUU4`C=h}x-c8_Iwqz>L}#7QK@NL=Xyc(!EDfY?VZF_XOjGGIJ@ zE1C4;XHV8r5SOW35`e{qmA$;L{d=(g(8a$NZTHFNIxZVL1t33EEQ+&7$6V&7!7Xd! zZ~0dUc2!qjpNLb=83V+X{R{hCI#$HiE9FsOR<_aPeO|Ao%_kHJg=@)`-o_sOxhD-w zs>ged0F(d;+=*mB>&u@cvOab0u9oA{?n&#GB&WbU6%kp5PJVCBIc%My5&9Q&BDwx# zm&`mXQBoeo95R+-5wrfK@z;m$0wJmmTY9gKVhJV#9+(G^pj9m4sKO4uB7E!9WZn<>Qpktg^R?od+7nQBOg>K?7FUHV#6i_o*`c$R0XG#u2nB_mEBm+q3 z#hw3z6o=Q+O6RyJUS_c(*J5s*`&GQjRY<~e+v#MMOQ|>=WZ9QVQMZQrdt}m z@}_^HSsGXBHeXU*O+V`<%B_h4r}k+5DQhyD$8k}+t>x>P5Nc%Qsj#+giYf6!cWv4& zmUnfqxq(?++cIk#Yq=(-;V^RU0pq$JH9?Xic}F=Pi4=8L}E=zA^ z6SKt-awQcP#4pZtd4-J^$_QPz+vT`OTgr5avk=lL+v%~uz+EklnvBxBaRJxn0B3!8hR%)K-ooY-MQrLvOm!9(x<(~S5vxr%6L5;FRdAqa|I~Q_ZQrL6Mt}kU#(W( z306_fIJ=9)*sCTRDczXg{Ba38EAxl3%js|Fkn0d7!oxZat~7;Sz7+8nLs!qch3pg( zVIOmP>8oA=5UIVH5b{b*&QbYmkrSj&%3;eseYbVMrcZMAIFR{!C%r3wo@?*#;F^;( z2b9uLA&aGsPkHtMO+bF}Pene-tk(sa}2$(+g_kA5Xw-&@RCa zRE;3v)Oel4hZc9Be{iwY(e=kYKye1scBw#0(7r0sd!G1#46Zi5R4vQVwAMpbmP;NG za~9@evDG|kqch`Lo;}%7gqpQ5%AM?TFS;8$i{ zUpmZ^czvQ2Vr#OK&mUQKC3arc_c8v2`6h0nWV0;eXX*1j*=k%8(~C2%u)X6z%Gh)W zSJnXLVxsh@3}0+YmbJl3!8|Jt`nRgcKRPhE<~^6=E1yZ*wf12DcWW(nKRaU`lM&TN z4)w4qZGQ0$D0ba!>5O!F#GC?_@;LnnS^-W^xbo^;AN$PII}z+B!YelayEWOIFM;xs zJ!8>Lr95WuV@Duc_c3YDV9=_nSJUqlMp06;kcCgNTVXI50VlT*3kcZKl!W8(HAc9u z?TS+3155>)ED7AATo8jt+HT=t3v=fvoWswJ2nGn$?Nhx?e2;rkLOCpu6_Qnb>tR4@ znWjD;tH&-*MpjS1!@u7H7TNN5aVRw2-Hs+Z53)GQP#?W|whVQ9TMO&e_I7>i4Aa=9 z3`4I5C}LA)X@*5M%@iy1J^haG(yo}=?#nofAsO|V3j1br<0>tyxA&IrO5L6vt|*|v z&5AC#J#t|aBkshYr=6ldDVEah5~6C(opBiWEXngX*{_cpTboVPKE#`wd86f4%8+OMhFRO=;|fU`uRMaMnc^$oi37;~(9-e$7WVO7ulq z2if_kMtX>uKsy%?Dkg0QMYs;?t#TlfbRE29X)S%Y9+Ju3Fty!{tg(SMPzuf3;U}J@ zo8Jw3yUMrh?f7_8l3(BK?-5y`HR+tw*7{%Z=fR;(@jND_73eK@sXF91@&YOkaYAqB zCs8O#g69oVj<4qpWshB3L;P`bK$y}?@NRKCZ(tU^a9E+Yt_$Y;^<0;0n4Jqv(!&XH zu23jj#sdXRgl7+vVzVJ`$5()d*SrsY9*Y7Neh5EXEHx{nPgrEMb$|aQxMAF~0rDzf z2^$(EEGPsB{%$#8SZXf|$vt5nBt7N6>7*&J&+g(t-m5YWYYY7bIzRg-xATn|MUYO| z=8B1A7@)L(`T_x}I)3!YQBStZP_{C|LQ$Nv(WUK!yF=>Oc0=Zx)K-wEtx7xIm*kPk zvR+k<7W;*<6&P6Gdgtjw5V08t>LAwJP#_w7u^O7a)_cLr(2FczsEOO_yidKnA5uWy z)a_mZi{~_!*0z4-W^oCJR@8&9#3jddnd~7x)jpeqq~%y!bzu;m8rOv}pIYZ|d&(CY z;)56^PZtx|8WTg_7Kv0KBz+$9uf)0C^-~ZFc7DtBUESDcUY;zN!qZr^_c5-{Y-ljt z*0#F+((3xUA-n*m>TV#wDKNlYoS?URg)Tnr@6Bfbpp)d~tA!m8se`U!)jpoSiHSt6 zXd7glPN0pEA%r;ceg5T5B5AtBV&$(||D=c6)@$qw!`JNwko|gwp2lK+v58gIOW;79 zwR_Hzc}F#$1RC$5tcw;3)XU^9a-^A^VN#SJ)fU!nlq-nwU@S3HeOu9fcUngz0Vt$c;@scp&c;d9^m|QXChf#QzKT82 z^EG(lCZXw?_u8x>gZbEvV-d)g`%m_bg*7TT(qMT)d}BlYkB8;g&-d_n29)i-Z-je^ zUC_1`;!7blKaaS=tZpnqF84ZoFLL1?smEjR<+vtwE7z@mi%sW==f|&tcZm!!%2Zwf z5$B1f-n!UON{#Gk8aHi{($w#0>}=;7y@Y)*G%Ct+T5V{rNoabXRMVrR+2??E%8&ns zaw(}?-^_%J-;@N(-2ApIrM7B?W+M;0e9Y11<&Ogc%horXwP{o@hmH8fQIm}d56{3n z7zS@KhV4Q6o(5M=0%r}n-n*5SEXa6CFNflu6jEXi-UM6>#-k<^toc&$Refo^o7IjZ0pLDU$Yf6HS~%ZhgyJ6}r_>3E2iroXw^U|g=b z4p~Aguio0VGrGaZ&GU5$#5JpK|MDD+jO;0Aljv9EZm{yzh?8V_>h66Hjd>PU=+NVl zP|?l(vm|>E`999Z#Pu-Wj6(BryNQgK4tb(T>oL>oIxZ}?bZKlU%i<<5<|`Y{(t%De ztZWuOi*R{5rhnb@h5VGQXNpkJYk%VVu+!#;zzQq5a$sP}Y7*kxubFC%gkp!w-tE5s zI$6TumOtD$e|q9c#~~k)#3(uBen+ei8L}_e#h&E5JWv-t7lp~+D#8>wFD7mw)Vmdf zlMdc*_x-~(Q^2>tQ=8=${gzHE)89pkUUHG8xsBal))+5HDvuD1F9J{U zLUUfFCk_ajgI@N*&+?;yVvJsoEz&K{JvkJjn|ims&t$xN+}cW{+K2@z&Xe6NQU`@~ z6K2C@KMn_QtWe$@2OCesfgJ3LOBzeoU0SJ15LBBxxb=#feG4RPCvBA zP%tSefKG^%d@rIld>;b_Np=9KHqYS;7t&D!(j@Vz)ZB|BUePo+VKX|nAn39?t<8>=| zgNwrEZu%_(JD+&+by;FX_w*a;N+~>A&3H6K513T@>o(W+K7Nn(Gy?X4|5AyVx;Koz zc}Brm#uuw{Z=!uKT{2NYqTKq|?$qbp&4-!m;c<`YkFv89t8seL_?l-lW;H{{6dR70 zaRtKA(w8x+Q&)MilYfPKc>;B@2$}NDcVRwB|4|xK1AvS;{_&T-aGo746vg-}bU{4w zln*;vKMH<*7t#678N)6iDt_^-Sn=;eYVyqK4q(Q`DEqTJ zPay^*kS_qyW*0xnH66h?^4I%N1r!eep_Kx#Qvf|&=QpQXhV{P45VzBSgk0=}{24Gz z{#4mn!O8pE02}ov%)Ex^hXI|H<&XOs=h}?DkJ0Pjw_5(IobpdAj8q0@H3ed484~~k zRW7P-{Sa#OLu`$r9Ev|2rbX@Qz!J$`VJ&?m5Wv)JSR985WG>F+*Rg|u272D&V# zN<&$WSIcv=Y6M_%CI5-wrf2a_-c=ko?;Dy0e7aExd{cnS@%IAc|06_zZomJRb&ZWx zQ(wIzX!wJ5uL!qBDFB{AV&Ck3)D-v!XuNGLIGfU>ZLN+`$J=)HU*N;=pT!73b`5N7 d-ea8bdhsqijBOfdqy&MqAL~D=c=+ti{{mr&+ll}H literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/scripts/asr-events.xml b/windows/threat-protection/windows-defender-exploit-guard/scripts/asr-events.xml new file mode 100644 index 0000000000..4389422066 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/scripts/asr-events.xml @@ -0,0 +1,21 @@ + + + + + Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC + 1121,1122,5007 + 0 + False + + + + Attack Surface Reduction view + + + + + + + + + \ No newline at end of file From e93e0546d787a54eac7437ad4744484686ab0ce8 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 14 Aug 2017 18:13:31 -0700 Subject: [PATCH 11/54] eval changes --- .../attack-surface-reduction-exploit-guard.md | 283 ++++++++++++++--- .../audit-windows-defender-exploit-guard.md | 28 ++ .../controlled-folders-exploit-guard.md | 91 ++++-- .../evaluate-attack-surface-reduction.md | 290 ++++++++---------- .../evaluate-controlled-folder-access.md | 5 + .../images/asr-notif.png | Bin 0 -> 14027 bytes .../images/asr-rules-gp.png | Bin 0 -> 31409 bytes 7 files changed, 469 insertions(+), 228 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/asr-notif.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/asr-rules-gp.png diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 670f31b22a..3895a112b8 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -14,8 +14,7 @@ ms.author: iawilt --- - -# Windows Defender Exploit Guard +# Reduce the attack surface with Windows Defender Exploit Guard **Applies to:** @@ -32,61 +31,249 @@ ms.author: iawilt - Group Policy - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager - Microsoft Intune - Windows Defender Security Center app -Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. + -You can use Windows Defender EG to: +## Requirements -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) +The following requirements must be met before Attack Surface Reduction will work: -Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) - -You can also [enable audit mode](audit-mode-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. - -Windows Defender EG is a component of the new Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. Other components of Windows Defender Advanced Threat Protection include: - - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) -- [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) - - [Windows Defender SmartScreen] - - [Windows Defender Device Guard] - - [Windows Defender Application Control] - - Each of the features in Windows Defender EG have slightly different requirements: - - Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license - -|-|-|- - Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console - Attack Surface Reduction | 16232 | Must be enabled | Required - Network Protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console - Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console - -> [!NOTE] -> Each feature's requirements are further described in the individual topics in this library. - - The way in which the features can be managed, configured, and reported on also varies: - - Feature | Configuration available with | Reporting available with - -|-|- - Exploit Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs - Attack Surface Reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Network Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Controlled Folder Access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x +Windows 10 version | Windows Defender Antivirus +Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled - ## In this library -Topic | Description ----|--- -[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. -[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. -[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. -[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. +## Enable Attack Surface Reduction rules + +You can use Group Policy to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. + +6. Double-click the **Configure Attack Surface Reduction rules** setting and set the option to **Enabled**. You can then set the individual state for each rule in the options section: + - Click **Show...** and enter the Rule ID in the **Value name** column and your desired state in the **Value** column as follows: + - Block mode = 1 + - Disabled = 0 + - Audit mode = 2 + + + ![](images/asr-rules-gp.png) + +>[!NOTE] +>Rule IDs willl be populated on machines that are enrolled in an E5 license. These machines will also properly report their Attack Surface Reduction rule history in the Windows Defender Security Center web console. + + +>[!NOTE] +>The tool reveals the RuleIDs. How will the IDs be hidden/how will the experience differ without an E5? + + + +## Exclude files and folders + +You can exclude files and folders from being evaluated by Attack Surface Reduction rules. You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the files should be excluded from individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). + + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. + +6. Double-click the **Exclude files and paths from Attack Surface Reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. + + + + +## Review Attack Surface Reduction events in Windows Event Viewer + +You can also review the Windows event log to see the events there were created when using the tool: + +1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +2. On the left panel, under **Actions**, click **Import custom view...** + +3. Navigate to the Exploit Guard Evaluation Package, and select the file *asr-events.xml*. Alternatively, [download the XML directly](scripts/asr-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Attack Surface Reduction: + + Event ID | Description +-|- +5007 | Event when settings are changed +1122 | Event when rule fires in Audit-mode +1121 | Event when rule fires in Block-mode + + + + +## MDM policy settings for Controlled Folder Access + +./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders + +## Audit/block modes + +Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. + +Component |Description |Rule/mitigation description | +-|-|-|- +Controlled Folder Access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. +| | | Allowed apps |Apps that are allowed to write into protected folders + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +### Audit/block modes + +Each of these components can individually be enabled in audit or blocking mode. + +Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. + +Component |Description |Rule/mitigation description | +-|-|-|- +Attack Surface Reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content +| | | | Block obfuscated js/vbs/ps/macro code +| | | | Block office application from launching child processes +| | | | Block office application from injecting into other processes +| | | | Block Win32 imports from macro code in Office +| | | Rules to prevent script threats |Block js/vbs from executing payload downloaded from Internet +| | | | Block obfuscated js/vbs/ps/macro code +| | | Rules to prevent email threats |Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). + + +## Policy settings for Windows Defender EG + +The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. + + +### Attack Surface Reduction + +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules +-- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 + + +#### Rule-GUIDs for ASR + +Rule description | GUIDs +-|- +Office rules | +Block office application from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} + | OMA URI : “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” + | Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 + | 1 = Block, 2 = Audit, 0 = Disabled. +Block office application/macros from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} + | Replace the above GUID with the corresponding Rule GUID +Block office application from launching child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} + | Replace the above GUID with the corresponding Rule GUID +Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} + | Replace the above GUID with the corresponding Rule GUID +Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + | Replace the above GUID with the corresponding Rule GUID +Script rules | +Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + | Replace the above GUID with the corresponding Rule GUID [Note: same rule as above, but also covers scripts hence written here] +Block js/vbs from executing payload downloaded from Internet. | {d3e037e1-3eb8-44c8-a917-57927947596d} + | Replace the above GUID with the corresponding Rule GUID +Email rule | +Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 + | Replace the above GUID with the corresponding Rule GUID [Currently working for Mail-client (Outlook). Personal Webmail (Outlook.com, Gmail, Yahoo) work in progress] + + + + + +### Manually enabling the Attack Surface Reduction rules + +You can also manually use GP or MDM-URIs to enable the ASR rules: + +From the rules tables above, choose the ASR rules that you want to enable and set the following policy. For each rule select the right GUID. + +After you’ve chosen your rules, use one of the tools above to simulate a rule to fire. +- “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” +- Value as String Data Type: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:2 + + +### View event logs + +Note: event logs are not the primary mechanism for investigation. The Windows Defender ATP portal receives much richer information that allows for investigation. Information is also presented in an interactive machine-timeline view. + + +#### Event fields +- **ID**: matches with the Rule-ID that triggered the block/audit. +- **Detection time**: Time of detection +- **Process Name**: The process that performed the “operation” that was blocked/audited +- **Description**: + +Windows Defender Antivirus has audited an operation that is not allowed by your IT administrator. + +For more information please contact your IT administrator. +-- ID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A +-- Detection time: 2017-06-21T11:52:29.062Z +-- User: SYSTEM +-- Path: C:\Windows\System32\notepad.exe +-- Process Name: C:\Program Files\Microsoft Office\Office16\winword.exe +-- Signature Version: 1.245.730.0 +-- Engine Version: 1.1.13902.0 +-- Product Version: 4.12.16228.1000 + + +### View the alert notification + +If you configure the test to block, a notification will be displayed from the Action Center. This notification is customizable with your organization and contact information. + + +## Customize the notification + +Customizing the Windows Defender Security Center is a simple task that provides users with a clear way to contact support. +Simply navigate in Group Policy to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Security Center\Enterprise Customization**. From there, you will be able to enable your custom notification, set your organization name and contact information. diff --git a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md new file mode 100644 index 0000000000..f21450a54f --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md @@ -0,0 +1,28 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + +# Use audit mode to evaluate Windows Defender Exploit Guard features + + +You can enable each of the features of Windows Defender Explot Guard in auditing mode. This lets you see a record of what *would* have happened if you had enabled the feature. + +You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period. + +This topic lists the auditing functionality available for each feature, the management tools (Group Policy, Intune, MDM CSPs, System Center Configuration Manager, or PowerShell) that can be used to configure and deploy the setting to multiple machines in your network(s), and links to configuring each feature or setting. + + + + diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index c119518f4a..14a5a0a94a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -54,8 +54,16 @@ The following requirements must be met before Controlled Folder Access will work Windows 10 version | Windows Defender Antivirus Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled +## Enable Controlled Folder Access -**Use the Windows Defender Security app to enable Controlled Folder Access:** +You can enable Controlled Folder Access with either the Windows Defender Security Center app or Group Policy. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + + +For further details on how audit mode works, and when you might want to use it, see the section [Use auditing mode to measure impact](#use-auditing-mode-to-measure-impact). + +### Use the Windows Defender Security app to enable Controlled Folder Access 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -67,7 +75,7 @@ Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows De ![](images/cfa-on.png) -**Use Group Policy to enable Controlled Folder Access:** +### Use Group Policy to enable Controlled Folder Access 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -88,23 +96,30 @@ Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows De >[!IMPORTANT] >To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +### Use PowerShell to enable Controlled Folder Access + + +### Use MDM CSPs or Intune to enable Controlled Folder Access + + +### Use System Center Configuration Manager to enable Controlled Folder Access + + ## Protect additional folders - Adding other folders to Controlled Folder Access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. - Controlled Folder Access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. You can add additional folders to be protected, but you cannot remove the default folders in the default list. - - -Click Protected folders in the Controlled Folder Access area and enter the full path of the folder you want to monitor. +Adding other folders to Controlled Folder Access can be useful, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. -**Use the Windows Defender Security app to protect additional folders:** +You can use the Windows Defender Security Center app or Group Policy to add and remove additional protected folders. + +### Use the Windows Defender Security app to protect additional folders 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -119,7 +134,7 @@ You can also enter network shares and mapped drives, but environment variables a ![](images/cfa-prot-folders.png) - **Use Group Policy to protect additional folders:** +### Use Group Policy to protect additional folders 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -131,16 +146,27 @@ You can also enter network shares and mapped drives, but environment variables a 6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? - > [!IMPORTANT] > Environment variables and wildcards are not supported. + +### Use PowerShell to protect additional folders + + +### Use MDM CSPs or Intune to protect additional folders + + +### Use System Center Configuration Manager to protect additional folders + + + ## Allow specifc apps to make changes to controlled folders You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the Controlled Folder Access feature. +You can use the Windows Defender Security Center app or Group Policy to add and remove apps that should be allowed to access protected folders. -**Use the Windows Defender Security app to whitelist specific apps:** +### Use the Windows Defender Security app to whitelist specific apps 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -154,7 +180,7 @@ You can specify if certain apps should always be considered safe and given write ![](images/cfa-allow-app.png) - **Use Group Policy to whitelist specific apps:** +### Use Group Policy to whitelist specific apps 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -167,20 +193,43 @@ You can specify if certain apps should always be considered safe and given write 6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? -## Review event logs for Controlled Folder Access -Component | Configuration available with | Event ID | Corresponds to… --|-|-|- -Controlled Folder access | GP, MDM & UI | Provider: Windows Defender | -| | | Event when settings are changed | -| | | Event when CFA fires in Audit-mode | -| | | Event when CFA fires in Block-mode | +### Use PowerShell to whitelist specific apps -## MDM policy settings for Controlled Folder Access - +### Use MDM CSPs or Intune to whitelist specific apps ./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders +### Use System Center Configuration Manager to whitelist specific apps + + + +## Review Controlled Folder Access events in Windows Event Viewer + +You can also review the Windows event log to see the events there were created when using the tool: + +1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +2. On the left panel, under **Actions**, click **Import custom view...** + +3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. Alternatively, [download the XML directly](scripts/cfa-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Controlled Folder Access: + +Event ID | Description +-|- +5007 | Event when settings are changed +1124 | Audited Controlled Folder Access event +1123 | Blocked Controlled Folder Access event + + + + + + + ## Audit/block modes Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 49dc3eb9e9..e5a4563ded 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -20,8 +20,8 @@ Attack Surface Reduction is a feature that is part of Windows Defender Exploit G This topic helps you evaluate Attack Surface Reduction. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation. ->[NOTE] ->This topic uses PowerShell cmdlets to make it easy to enable the feature and test it. +>[!NOTE] +>This topic uses a customized testing tool and PowerShell cmdlets to make it easy to enable the feature and test it. >For instructions on how to use Group Policy, Mobile Device Management (MDM), and System Center Configuration Manager to deploy these settings across your network, see the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). @@ -40,34 +40,148 @@ When you run a scenario, you will see what the scenario entails, what the rule i ![](images/asr-test-tool.png) +Each scenario creates a fake or sample file or behavior that the rule would target and, if the rule was enabled, block from running. -### Rule 1 +>[!IMPORTANT] +>The settings you change while using this tool will be cleared when you close the tool. If you want to test the feature in a production environment, you should consider using [auditing mode to measure impact](#use-auditing-mode-to-measure-impact), or see the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). + +**Run a rule using the demo tool:** + +1. Open the Exploit Guard Evaluation Package and copy the file *ExploitGuard ASR test tool* to a location on your PC that is easy to access (such as your desktop). + +2. Run the tool by double-clicking the version that matches your operating system - either 64-bit (x64) or 32-bit (x86). If a Windows Defender SmartScreen notification appears, click **More details** and then **Run anyway**. + + + >[!IMPORTANT] + >Make sure you use the version of the tool that is appropriate for the machine you are using. Use the x86 version for 32-bit versions of Windows 10, or use the x64 version for 64-bit versions of Windows 10. + +3. Select the rule from the drop-down menu. + +4. Select the mode, **Disabled**, **Block**, or **Audit**. + 1. Optionally, click **Show Advanced Options** and choose a specific scenario (or all scenarios sequentially by selecting **All Scenarios**), enter a delay, or click **Leave Dirty**. + +5. Click **RunScenario**. + +The scenario will run, and an output will appear describing the steps taken. + +You can right-click on the output window and click **Open Event Viewer** to see the relevant event in Windows Event Viewer. + +>[!TIP] +>You can click **Save Filter to Custom View...** in the Event Viewer to create a custom view so you can easily come back to this view as you continue to evaluate rules. + +>[!NOTE] +>What does leave dirty do? Does delay work? -### Rule 2 +Choosing the **Mode** will change how the rule functions: + +Mode option | Description +-|- +Disabled | The rule will not fire and no event will be recorded. This is the same as if you had not enabled Attack Surface Reduction at all. +Block | The rule will fire and the suspicious behavior will be blocked from running. An event will be recorded in the event log. This is the same as if you had enabled Attack Surface Reduction. +Audit | The rule wil fire, but the suspicious behavior will **not** be blocked from running. An event will be recorded in the event log as if the rule did block the behavior. This allows you to see how Attack Surface Reduction will work but without impacting how you use the machine. + +Block mode will cause a notification to appear on the user's desktop: + +![](images/asr-notif.png) + +You can [modify the notification to display your company name and links](attack-surface-reduction-exploit-guard.md#customize-the-notification) for users to obtain more information or contact your IT help desk. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + +The following sections describe what each rule does and what the scenarios entail for each rule. + +### Rule: Block executable content from email client and webmail + + +This rule blocks certain files from being run or launched from an email. You can specify an individual scenario, based on the category of the file type or whether the email is in Microsoft Outlook or web mail. + +The following table describes the category of the file type that will be blocked and the source of the email for each scenario in this rule: + +Scenario name | File type | Program +- | - | - +Random | A scenario will be randomly chosen from this list | Microsoft Outlook or web mail +Mail Client PE | Executable files (such as .exe, .dll, or .scr) | Microsoft Outlook +Mail Client Script | Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) | Microsoft Outlook +Mail Client Script Archive | Script archive files (such as .????) | Microsoft Outlook +WebMail PE | Executable files (such as .exe, .dll, or .scr) | Web mail, such as ??? (only outlook/hotmail? Or anything? Any browser or only Edge/IE?) +WebMail Script | Script files (such as a PowerShell .ps, VBScript .vbs, or JavaScript .js file) | Web mail +WebMail Script Archive | Script archive files (such as .????) | Web mail + + +>[!NOTE] +>What is a script archive file? + + +### Rule: Block Office applications from creating child processes + +>[!NOTE] +>There is only one scenario to test for this rule. + +Office apps, such as Word or Excel, will not be allowed to create child processes. This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. + +>[!NOTE] +>Note sure if this accurate + +### Rule: Block Office applications from creating executable content + +This rule targets typical behaviors used by suspicious and malicious add-ons and scripts that create or launch executable files. This is a typical malware spreading and infection technique. + +The following scenarios can be individually chosen: + +- Random + - A scenario will be randomly chosen from this list +- Extension Block + - Extensions will be blocked from being used by Office apps. Typically these extensions use the Windows Scripting Host (.wsh files) to run scripts that automate certain tasks or provide user-created add-on features. +- MZ Block + - ??? + + +>[!NOTE] +>Note sure if this accurate -### Rule 3 +### Rule: Block Office applications from injecting into other processes + + +>[!NOTE] +>There is only one scenario to test for this rule. + + +Office apps, such as Word, Excel, or PowerPoint, will not be able to inject code into other processes. This is typically used by malware to run malicious code in an attempt to hide the activity from antivirus scanning engines. -### Rule 4 +### Rule: Impede JavaScript and VBScript to launch executables + +JavaScript and VBScript scripts can be used by malware to launch other malicious apps. This rule prevents these scripts from being allowed to launch apps, thus preventing malicious use of the scripts to spread malware and infect machines. + +- Random + - A scenario will be randomly chosen from this list +- JScript + - JavaScript will not be allowed to launch executable files +- VBScript + - VBScript will not be allowed to launch executable files -### Rule 5 - - - -### Rule 6 - - +### Rule: Block execution of potentially obfuscated scripts + +Malware and other threats can attempt to obfuscate or hide their malicious code in some script files. This rule prevents scripts that appear to be obfuscated from running. +- Random + - A scenario will be randomly chosen from this list +- AntiMalwareScanInterface + - This scenario uses the [AntiMalwareScanInterface (AMSI)](https://msdn.microsoft.com/en-us/library/windows/desktop/dn889587(v=vs.85).aspx) to determine if a script is potentially obfuscated, and then blocks such a script +- OnAccess + - Potentially obfuscated scripts will be blocked when an attempt is made to run them +>[!NOTE] +>Note sure if this accurate @@ -105,9 +219,10 @@ To enable audit mode, use the following PowerShell cmdlet: Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode ``` +This enables all Attack Surface Reduction rules in audit mode. >[!TIP] ->If you want to fully audit how Attack Surface Redurction will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). +>If you want to fully audit how Attack Surface Reduction will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). @@ -122,6 +237,8 @@ See the following sections in the main [Use Attack Surface Reduction rules](cont - [Configure rules individually](attack-surface-reduction-exploit-guard.md#configure-rules-individually) +## Related topics +- [Attack Surface ] @@ -133,148 +250,3 @@ See the following sections in the main [Use Attack Surface Reduction rules](cont - - -## Attack Surface Reduction rules - - - - -### Audit/block modes - -Each of these components can individually be enabled in audit or blocking mode. - -Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. - -Component |Description |Rule/mitigation description | --|-|-|- -Attack Surface Reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content -| | | | Block obfuscated js/vbs/ps/macro code -| | | | Block office application from launching child processes -| | | | Block office application from injecting into other processes -| | | | Block Win32 imports from macro code in Office -| | | Rules to prevent script threats |Block js/vbs from executing payload downloaded from Internet -| | | | Block obfuscated js/vbs/ps/macro code -| | | Rules to prevent email threats |Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). - - -## Policy settings for Windows Defender EG - -The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. - - -### Attack Surface Reduction - -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules --- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 - - -#### Rule-GUIDs for ASR - -Rule description | GUIDs --|- -Office rules | -Block office application from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} - | OMA URI : “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” - | Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 - | 1 = Block, 2 = Audit, 0 = Disabled. -Block office application/macros from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} - | Replace the above GUID with the corresponding Rule GUID -Block office application from launching child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} - | Replace the above GUID with the corresponding Rule GUID -Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} - | Replace the above GUID with the corresponding Rule GUID -Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} - | Replace the above GUID with the corresponding Rule GUID -Script rules | -Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} - | Replace the above GUID with the corresponding Rule GUID [Note: same rule as above, but also covers scripts hence written here] -Block js/vbs from executing payload downloaded from Internet. | {d3e037e1-3eb8-44c8-a917-57927947596d} - | Replace the above GUID with the corresponding Rule GUID -Email rule | -Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 - | Replace the above GUID with the corresponding Rule GUID [Currently working for Mail-client (Outlook). Personal Webmail (Outlook.com, Gmail, Yahoo) work in progress] - - - - ## Evaluate - -### Using the standalone configuration tool - -We’ve provided an easy-to-use configuration tool for testing purposes, called TestHIPS. The tool can be used to: - -1. Enable the chosen ASR rule in either block or audit mode by creating a local GPO and running a test file that triggers the rule. - -2. Enable the chosen ASR rule in either block or audit mode by creating a local GPO. - -The result of the activity can be viewed in the event log and corresponding notification (if the rule was triggered in block mode). - -You can find the tool in the evaluation package alongside this guide: -- ExploitGuardCustomerFiles/AntiMalware.Tools.TestHIPS.exe -- -Note: You may need to change the extension in the filename from **AntiMalware.Tools.TestHIPS.rename** to **AntiMalware.Tools.TestHIPS.exe**. - -For additional help with the tool, use the “-?” parameter. - - -### Using the DemoExploitGuard tool to simulate WD-EG Rules with a GUI - -You can use an additional tool, called DemoExploitGuard, to test various rules by simulating scenarios that would cause the rule to issue a block or audit event, depending on the mode. DemoExploitGuard uses the TestHIPS tool to enable and configure the rules. - -You can find the tool in the evaluation package alongside this guide: -- ExploitGuardCustomerFiles\AntiMalware.Tools.DemoExploitGuard.exe - -Note: You may need to change the extension in the filename from **AntiMalware.Tools.DemoExploitGuard.rename** to **AntiMalware.Tools.DemoExploitGuard.exe** -**Rules**: Select one of the seven Attack Surface Reduction rules to run. -**Mode**: Sets the behavior of the Demo Tool. -Note: If the rule is applied by GP, this should not be an option -- **Disabled**: This scenario will execute normally and complete -- **Block**: This scenario should get blocked [ExploitGuard Block] and a notification will appear to indicate the block -- **Audit**: This scenario will not block, but will show up in the event log. Right-click the output area to go directly to the event logs for Windows Defender EG - - -### Manually enabling the Attack Surface Reduction rules - -You can also manually use GP or MDM-URIs to enable the ASR rules: - -From the rules tables above, choose the ASR rules that you want to enable and set the following policy. For each rule select the right GUID. - -After you’ve chosen your rules, use one of the tools above to simulate a rule to fire. -- “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” -- Value as String Data Type: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:2 - - -### View event logs - -Note: event logs are not the primary mechanism for investigation. The Windows Defender ATP portal receives much richer information that allows for investigation. Information is also presented in an interactive machine-timeline view. - - -#### Event fields -- **ID**: matches with the Rule-ID that triggered the block/audit. -- **Detection time**: Time of detection -- **Process Name**: The process that performed the “operation” that was blocked/audited -- **Description**: - -Windows Defender Antivirus has audited an operation that is not allowed by your IT administrator. - -For more information please contact your IT administrator. --- ID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A --- Detection time: 2017-06-21T11:52:29.062Z --- User: SYSTEM --- Path: C:\Windows\System32\notepad.exe --- Process Name: C:\Program Files\Microsoft Office\Office16\winword.exe --- Signature Version: 1.245.730.0 --- Engine Version: 1.1.13902.0 --- Product Version: 4.12.16228.1000 - - -### View the alert notification - -If you configure the test to block, a notification will be displayed from the Action Center. This notification is customizable with your organization and contact information. - - -### Customizing Windows Defender - -Customizing the Windows Defender Security Center is a simple task that provides users with a clear way to contact support. -Simply navigate in Group Policy to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Security Center\Enterprise Customization**. From there, you will be able to enable your custom notification, set your organization name and contact information. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index 4512197267..f3d1e5d770 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -99,6 +99,11 @@ Set-MpPreference -EnableControlledFolderAccess AuditMode >If you want to fully audit how Controlled Folder Access will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [Controlled Folder Access topic](controlled-folders-exploit-guard.md). + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + + + ## Customize protected folders and apps During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/asr-notif.png b/windows/threat-protection/windows-defender-exploit-guard/images/asr-notif.png new file mode 100644 index 0000000000000000000000000000000000000000..2f8eb025568c724714297ea58062f02dd075eb39 GIT binary patch literal 14027 zcmdsebyQW~x9>(uT0x{kKv0knk94PmfV4Cs(%oIs0tSeJbhkkxC8Z$U4I&~fDb1bd z`@8Rr7h}A4#~bgDJ1zr3_St9cwdR`h^ZCrV=805Oktf2Z#zzo@Na3E0I)YrlMGy?4 zi#Tv4d7!-se&IRZd+357#I5Lm7zrH2G;k5uRpGuY?)*g(1oMW4{Fj^mT$0swm2`8p zbZ|xrO26NOON6d)Nygm8%-PD()ylyhA;Y`I4A=3|*QFgCy_~HqEM1XelJ7!rmH3~l z&gQ1*TNz!g?97q7e@XD*6+HAS8V*lfJxra=5ktpw^z8)y3~uFOW@`$!IwMt0<#BNN zBKoq9sk6P6y#>-l^D7*#;r{FWZq8=r$liI#>VLaU+QH7w+};)0|NgoWuHm3>)3kE6 zHAnI{2G|gU5mAtl)bxC}KJBM#FkH|5r|hql&m9zN6C+WO73G7+SC|!S;)6tD*hmH4 zS#P#x-8Ib?yjd_bRW7ygK(8}{a){m9#kSzB_u#$EdOjSY-x)H|B|Mg&*`8a{WjjCl zaZl~>h5qGI|N@z7?B%a<=JP}0I*FP{Dv`{O6U9Yc(yl-SQxB7<6tOqmyN8Cykq)9wE! zS?oX4W2%^#(EEJ4KZyiJbJboXCnvvSz|53c6E2GDs-0g{6f(Kq9!5m--lX}$E#3DB z4WDh`S=r3TUQ&sNJMupP1*Ao78O0v*2c*jjQsfVqg7efw0-#C@>3XFUthne zR!%P#9-MnWnYAX2Wo@#G#L&=C_rs$$Wt~t2L4Ngj8)iB zAQE|l_l?`ccKW1Au5ojdaB^~v)wr--<tP@^BgK+(a&lvPTy<-_lreJVYD>ypU%v)+EehqWIQGj@ zT;t+WNvd>OXjkA!`)%8likbB4==ivQa4;l0o27umv+Fe{BDVRk&;46;FWN@6wY78Z zbr=%MM>>NlWIFHct7yOo*EGl-8c+Ft{P^+SYLFESdh6jwmbu}=q-lG3EiH0{k(;}h zJK+)qMP9bXI~6vta)K8uS&_YM*_C}y1y*8amc=`hm6IbYWVGVvER-@<<-mZL4CdbN z{BWB(#<6Z%(&tXA6FUcoM(058gW%!bM;~q+XB%>B(tTM^e8W8;1haUrdkb#lp^j0n zAKug8;NXz9u*mxu)7~z}!p3&I{;KWKgV$t}*OIK(1khh{u-bSA|W5P1|=Y59U2kQwuCD<)Rhwyi`(B!js&M1ipMp zT3%JP0KU-{!#@-8>7y>py%x1ez|IWrWH%pdRR^pUMSD#M6lV84k**82K zYSs}u4{!g1O<@qYvSMvJ{t;V2K_S1iv>okfjsfUEF)$!Z>14cy1gZ``=i)YtcX_JmnJHa$BV3yE*H?oPTp;M{nAx|!ft zR$8h}E&1Wux5rXOM)bF?5+o%jn|{!ZUxe81@9z(SS!XpiGSqo&%7M>Po5XZN*|gjh`t~*0h}6a)#O`eok!LogHF9sCR877}Obq|{k@u$7a9>}#uf2_p zhBs@(6VgF^lttu_l$;#S%U7=w;)APy5H5yN7)4m?6Nh6Wf4(xurRU^eC-d3iQwNId z_DRF4C6ts1_SeQkV6tnojSOH`MMg3OI_Y6AS69>=?~0tw){i!%z4Wu}s3$BPnF}W1 zLU`P-&yI~nR95o2y1F8i1R|M>&NbN!m)8yoS1D*{qQR}M^B`gl?`5Yk@v4j;oyp+1 zwYRm+ck|E2=SI3nOq!v{%=99@nD%0Hzi|jSo;;Y|^rzSpdZmzkwbFJxxTv%iUo6c* z(ZASZb0((oWRd%znZ!SEu`4mFun^zL$qAz>0ip{YW6r~bT%n*aJ3l*p!|#x4EG;zb zzA+U!KW}QKXJb<|5RHbT++0>d5)uwGdR9f@IR|#EN$wY6Z+py?T`SRO|0_YqsM%+; zK3q2Xs%-fQ`hPk`UgqknjOqkBhHm7qZ#@i7O-)s}sdKCx^z-LqS}|Wr8h(2jXJ=j^ zAt93rJxm;2*imL?=FX+ULUuH%U}Iw=ft{V53I%2Yd8%nR$Ss3v9uv{g;)j?fx87jz zWCXcJU*(i?cK$fPSY}W|ib%z392_jfnWCtH67X~WO3?l#V^hI0D2zdTse9dJTrB$TeytE^k zH)y)^t6Q=|IHDbO=MLHM@UZ84#b|qlIP#|nlY~)RoPmGFlldyQQSp%I-Mi$l*guE9 zh**H`t6}Rs4l_?rO7!9&!cfI%f4&e@?@!oleIejBf!OZ+ z%i6FiQGXri5beVH`ZP&NNhZ8+pC>01BzCo-E_CD5x=7sNg4qR}AJ2yLz>jk=tB^~W zm#a8cSaQ^Kbi%=Tel9MWu1{2qeJ~40%`R*)^7B(@X=#1!?UjeGzB-ah`{^j@aN=vs z%+e2M*4?wJt99{cgBM#!7{s2%#uBq!zn)QD?P+k#1i)f;yuU8seQr^V}TddG&Qe$^zZKOMx*50 zI~HmN2G0QCKcAl+k2Uz!#gq1pT$}RW`}=pnXZDyLc>DRQS0UhR2A=bwigSBoW^txq zb}uil&S_4)s#$+wY8sl$5Quh@mDgZZqN1Xve|1mBx%jPdxUiyv ze0h0!U>d)^zTRJF-qqfzZrZWNVBo7iQ<6xRj$GQdSuaM)-I3yl%tQhw`&EtIO@R@X zIF8>jQnZY`784X0T<^)q^g|rU+_7fwcy+1&fTu)4Mn;Ad2N!;_pkMgU_y=kUEuBDt z!1vW?^Dm1D2?@>1u9?Nfwxre+2H;Us_J5xyzFo7E>w=vxDX~-UV#$nz<+#iMiqZbr zyceI4kn!mg8KCLQ+*Q|Fg#wz({mKVllyw3vb4&Cp@VOER5Xa@5M7fGmpbd5Pm#Fn- zT!z*V5-|a*J!YmPdyo=>-H$#na&Zw)Pf!2e*pM?YFlcfO1mUBjLjj8NUvj5^WF+kK zXAwj~ODkbu+P-RX-n}ko2CKh?aexAX7qp!Aujmc$=(fyTqr=1G50Y9y->iDLxrN@h zcv__N{**{&ZMDJg7(oEsEp2TzJMFEknxn`$E{xpOtdT)|qNMG6$2xFPRqT)j&7Vk9 zX97o#`TqK3I6U^*vu7r~siKw+4jsYR1n9s4+(0DE%*^`2N^5JWflOP#Vc%Qy(gPQm zjDIvAYYb?d{do88T}wN=whZZTkZ$2+XOE8O6oQijpW4>PFh+#Docox@AM!#)hM?unk75?X>+-=2aALDL#QsPrwnj(xI- zQ=eT*^&wUj-P0WNW64}@1KIour~+*z{#jp*xBI`69i;LGZ`LD;hVE3zTyMbHPIXn* zG!7y_ON^Msdl}RodKhhx7rtT)AW&FN$qGV&5qqBg*Qdn9VrjjQOv7o4^nC%4sD-CFg)(3!mw$rubR8&-! zR#uX*JA^ox$lU&tc9UU4Lz-y1K0G`G22&sPD|f@IXp{n5y047|9d9-=fEWK>S^0uVA`*CV;ydNJ z5TpCq^ENFpE}Aak-7t2OeHAl6?Dgx{c_;}FATt1en!wu>zkFY89|DVI04Gj#|IMt3 z(`azD_snOnJ0Kd~KmJB)J6TCoq+Jr+v4FwzTHK??0OYKMzrTNz-L(JlI>d;Kt?jK! znB>%y!S3#EdVap8`hHGE28PXOsjQ?V2AV`{XB!M_)#EC;GWK;!YHFy!tFE9EDNxk^ z8zqGnl{M%ojHA_ydmWuc&pSyN1aLhBty2VXWKcCd|I{!p2Ygu=9K6ZBY+#Gtjtjl0A$XmaD|1RV1?%uQr zE(OU3t9f!xP7X3xwfTZKxf`;w-)n0!8X6j7i)~^;DJl?_&uo&fh!zb;6&Du=F2!^| zk+!xj1nZtb^i~^iH7-NKe}kJ_URnA3(;j&z;`^iLccSP+AU8Gg-I9e+giLl>o<~%a zE+r-9j(Q$w!<-L9do5yvw8Y`tNlW*t4N4J@!agho{wnV2QCW0rK_Fj?+1RjObg{B3 z*p`#};G56kW2aN_yCE(zGRUYbu9`+n4>F^^)xA!Ob*)-&@y|xwa`N&yhrnKF{?OLG z>ME3?9`;-D>S{q5rHzeE|I`#=cuNLtGz@F*Wk)SzE4|iO+w*9=vs2OhxT2!skEcj} zS(&_-mmm%=Xhl;w-z(GCO^@AxWUR065-Ay3LN9DDNMf+?*UrxE zXO?kAW4&r_gIrl+OPyU^w}pfXX_cIAwbmeCmwDGesBz1`K$Gn2mU#(qmSSy=&qifK zHflyj#0W+}d6v~25l%}yHg?k($;#YZ`ZhDvJfgO@otIstq=G*({E*i;el6>kTJ!m{ zft6;PH!SeIUWw#i>Ab;f*RRVyZ20(*lrNccjxuCmKpiw3yIc9VEfNUoF?|_%^^N7U zNxww9(Il(9{L0?mo@7_#t}qe*FBvSH6=&W%cQDXMq23@i&g}t0@Dh(3bh<)N@(#aZIeNI8C}Ck9a8Gdu$q+`)g>Bf%S|9 zRq`|rA8f3zVX@xuvYEEaTu%_R{$hk)xs_eppzT)ax9vfFVf?o~r_utEHmt6Gxa$ zL72GdqpOhnpp6CvubUk=AUt76!48?tu$K8iqq4-{Ov{e1eUxZK{RKIU_nvjZs6^Q) zuC2uJ(b4myBxd1qy1y%7)a?-Q~tQC3D`6--VxD9#-CHaw4s;d9Ga&%tY7bZ%bQf_i|A zqC8@TkvV~ETc*;VwtO_!Ha4g2cVwidRPt03^XpP9qWI{Tx947vVn~{s=NK>WkrPeN z%`u{*E?pk$sh^*pZoPMftE||dOw%L2F*5JX@O@{B((8Zdj9wdX$<58hfo;R{1WY>JU{uq{!+5IJMXS7v?nl4F>d67$k7hMdOz zQ|Y485J-MUS7l92GkCk7d^)_VHptmGTyBX#HB%~p< z3rtvwN)IfRIWA#?pw4?XK~Y{MeV3n~qsC=#X_Thq zBe#T0SDJ0d$H)Dv7_B2Gi9UV$G{19rV&6!hslqaA#j>)x`an;QJ%PElq^$Y}{vz?k zxQ+#n;+B*%(-Lj(v)F-;yyh<}+ul=F zeiv`XWaNo@v3c9Tua%(vV5F@8U9!Kmp5@Y(<(75$fUNg@T4A~gdqQHOnX9X2p-;KP z<#);x@>5YbCQKdL@$;@iIbpfL0diSR>cP*y>`p4AZhBVK_CZ8IGKY-2d>t2byOOr(Lop^31$l-aayPsWIR4tdwO*@np z9C#H(=!`vi@`OD`7bMwsmPLi$19kP_s3`oQ(NWy*OCuvAisIRzRNjx<4h-A4yH~0| z0okFbq?CYUg0Vpx4e)_i=kWJN#s?l?+~VYv_42CO4SAE0K>o4cQ78rEAfO1r!ALEz zcWZ0w4f8QuK22?H_T$2my#2d1^S}4J35khu3>q66X3FXw`fB6a*VNSf@vg_HdqYM> z#_T=q$kO4ww=%3K3XgrDs~Z8em%u$NvGbmCHwH>dwH13F%HUt$0h;@UhJKDBg_z9u zR%PYL=J|`-20)Fs6vbRu1arwFqyQbp>O9J}YYGbRV2`wm?#^xVB@+SX9yM=nY-rC2 za?=VpN*vZzRZ)OFkaqv4L^vU{d~HS6K_9|cSy|;2F@VE?`C2Sd?1La_+nyhf^z|Wi z)1{wTb?a3#=~r+*LXrUL3j~CTXjV7ov2R1ZQO>HPKz!4Ehz=lRhdwtn6uuTrHS^m2 z{lLo6jPc>ahl<=$`E>xB_V%T`oC8Kg6_D{X?i6KYT>B|_)3UM4WEI#EENtbK*o6(J zT)Vrjh}wt-LzTp=xw-jbwej0xQE?G^l3%@P436V(-cT;r{o+VsixtI{!2nsD^euomZpYRg*YoRK>W#_<=#t{&vC?{%MyHEZIN$-lU26k94DyKx37?jfK?zM( zHq?3V^~;yRkVOEKVqEmq!9^Z}tXkbux#7TYLyHuS*0iZ_+_q=Z#H4|*kDs?_m9{+c zF=8NPP{7SE@ZoL$bPi6A5t0F4&yT4s4Zi>WZQ0}o=zZlGKJbp>^JI_>Rg-idOJ!wc z)qADN%R82Kmj}UMgw?hl9{e9aeQKFWkbGh0D3SdLMV&FYoZZei@!)rJts0v~{=34X zD1LP)vcnft^&X6nptL0~dL#&GO-xQEm~is*>nK)O#>B?r)DLJTubJIcZsUCWiqoLC zQznxBLjmgm4`e<53jvnCZ?qZJZ{E7~v|}L%#Df1=*0-GS+SP`l1#t}bfA?nrHC=0LED(AT@c4;1xL{-L3vov7q)*3;_f zsX9v3RfYQUXL4Dy;NbTatRlQE9agWbM$p#Qf@e}eB1JXyHZ85}yMDd5TdNz{1#GIO zG0GTlDhTYSv)4gk_?H^lMC=Isn5aOlvvfUlxae-oJlADv0Na*>UJ`WodwJGo0zVUH9lUsRZqP>_z7p{o%PAn8% zUGs^ROE>eW{5$b(9WAnzlF5is&Yv3^jFt90<2B@>SaTOf*B;z5748GrXMFsq z{&05L^~f!4bZF>a7xEmZDRjZP=A>QDa_}NBc4tTiR=)sNGWWg<6uk#-_s!r_TG4^t zMh{XO`QRj@0T&!llFF)VreSbdlREC3!0QQbJ}5SMU|q~mXKapOWJYHV8WB56Q!AA0 zr_2YwV(-NK^u{|JSFw)lE2^TkH8s;KE43f8s&QlSxcjy_2c0os9j9i!c>bJmc-X#5 z-Vo>8|CGto9>%ftKTdkqu|wK@9nyJ^@tlNKqgD=OR8No4x@K2 z%f>>}LN~ted!qi`|0|1s)(^5I{rt?g4C%*r`7kfZ~rg6L}cJ(LesI8KeK!W4>g#?}C_==SONMrldNwc-As9;;P?L z@wtAZ^m{0z(~r%~Z#vx5%p*l7nF0bg+?I5-wG|ySH2HsKDpl6i2^UiQz6fe+pesbG zKbLOkn5vY1#ZPUstlInPg&f{;Za43(Hi`td)~=`J_4Jt>#=`Z$QGg+ea~gVj_#w^d z-*p;M9DND(`+kI({EuB-K`5FkYTTYM%MtA@KPD}fmx^aL`pjY(r&YaPWSn{(Bv7#`-s1$CMJwOAv^H(6rnGeAtEAzY6&FpWQE~EYL|#=e~03gpZ6Om?C!j8W^C$gfBT`boI1y(^cq2YAXE}U*LzCXUo-JL>=b>w>=;Qbxx&h8|VBM|-`YBjg)Jc_()EuXcUot+$l?%z!o6A*|1TH{Fb6H7w{JbsK-P*8B$f$iqa zn~(LbK}wE3S{V!v3%f)^BRubIImny&9Tpon8KVgs47`$%8o^OojXsQM8XJa`eosHI ztc<(R3>SgKb)nP@H8lHTbX98r1*ho9N!ib=npBm~ZHpsE8jgy+p4Tj>$iLqrJGR8lV^JDn9m!Jf)K9Vt|` zt*opZ1!w_6p(6K6?`-_h#~B{4quph^5(Z0?BE}2B5Wz#B-+}^F@-E+vP+)wYfO^G%W5FPWHOxp+HSqTZoq&KJ?5DQ8Gds$4 zzWJLj5NGhx0BYSLtvCGp_wVl~O9~2t2A5^DwO^OpLlXg%fo)-?IEwjF^ZvF|~#_`(vdg!;u>KE{xiic#< z3y6he=+K0Tv`Q>f)=d)w#@wRWILZ0MfG#dZPOiu-OiWGP$|3*vRPSy>rj7p3R%uc4 z50D>2hB9#UN|e2!w3Jx8Xqa2#k|+}#wbrcLiBu`!2krBViW-iW4lc)Uj|Ek(Zh6KZ zf?q0nWyn?4P20awW^D|ECI@1`paFlIuJJk#G-n0-H(EqX9FuNv#m~&lMD!Nr=CZc7 zx3hb=04+6|^@H#PzMn45KWl(Rf2=oIiUZNo$q5Y{btJC)!e!~dD+9i}UboyA+;(<3 z2#sKsFsScoWiIHI^W|lZ8Qo6k$8ATG(L?#EUmm-^``?!0_rGf`zi>H4ONN4PGnp+( z5RP@K(MO6X;eQ=0lC}Q_v&sL;w{3^MEk(Ljx^(oO)Z)v?pk(1-=Ksez>&u;A+!3c8 z$~wW2us@l}-Sow+3pm#QSNR{f_y5$|*!`yC?^?TjUf5QDf$2NXzjWDo#er z!_Z?)8Qyl&Sk__FIOlL{YfE6n4=WTK``}MjTs)jwQ!LaapOepyms1(nIb%D!IA7rV z3FjKk9(;D~hXf0K+u>I=Pj}fO;^K6EU1woAC`nB9zg=or?~T9jzHfp)n7-4_ztW=b zu%|f4zEMloQ5(l7CPvSun%X*0yf~(&$-?R4^=pxmdOLGHC$VqxSjTh5k0R0FCB3u0 z$7X)p$>EMuccE5iIdq#8>sutet}{LLhNG^)!94LV25o5ndm`iOD{_@v<%@%d_*K;1 zOUjc<+!#pd!wP)#^f`u6YnfmMvwBs;ar`J5!;zYQI!L=O z_H#I%eG#~MSIwulUN@4>VoK@h+%M-Vo$ z`!}r#4zc2BM#^xJ9G&?D9pjWgXWdW!W#q`Az{+UxH+!L>2UWtA%nJiu=tmfMOjB!4 zx#i6|LkkEr6@j^^`KLTz8TWl~Sz?CF+YQXwQE8{Y_5D-tqsNaQtMA)XJ_1`V#UC7a zmW!Ofa*k*IY_XAY9l50>6YxffU`p+&}XBbM3q4RLGtUDW}dH(%(!s# z@^Uph=`bL3_jD-iZ_c1LYEO>(4Xe+N0@|mAtvd|c|Jl_3hbq%*0j|~pKXAk+nxwFB znmcQ~%q}M-r?qegXvJ+N&P3%T8poQIHPR3B4SD;VM?oaSc#abenh%tJFk$qRKs%&? z=YzRPnu;BjRFTN3gxLto=>lG@*;P+8R4zT6nQ8n1ZF=E;qgk+P^5BYVb@XlE65`DD zIMBk>)E+~_YS82Q^Np;D4`1afs_7Ja+0O8i((|rY`z@S z+~B8r&~5xSIoj_yRl;S*rFyj|023+qa5Y&T_(ta;VL|dw{t*R!Mdm~E{FNCF;_52! zr|x{`inag#=9qca0$YMOHZo9h zr|QSzzPoub20|;mFQonJm&(JGUzwk7mNdbvpImps{X%M%w0$VPPT!#gS6bS$W1)GzrEGpsRXioWmPddw^C8=iAzl!DM&0>xo>LcR<;_O3 zYq}Gfq7>XJKJ6nLM9}YPU#j3poE9 zpz5g)@%sB6g=O~fV}h%c7s>E0JyGv(C$hBnCq~}$^6M<$K3LIVuImb9qPTS+e0NP2 zN@Q@xeDdqm&h<(F4PD#Z9Ik-VBjnt*oBz4fx9gr~;^!_>Zu5aMOi6A%m35@Z+|u6} zG8E6H{dJ!URsQFECnqyLxgVa)M@mAFs?7MPa&FZ86+@cZiTJaYKS`J_4|Hug`y7{# z>=;n2ZD84%K>N~DIFnx+`+ym)cOK|q6d;P2fDlIaXk^MpRzv$1nIYKMp}NQllpI%MUlJHbaJ>{W1fXH5Z~a1VvWBj4nx4nZD?D>M5^b*XdG8dW?Ni(#YvEZpRZK=#}D!G8!Cu}&lg@e z#YvjuiU5lP_`1#oLjUcFSTop z<#X}ny|?d#-0-10K?ZE?`6H4ot1zI=(1Ts4CCI4P0O;&sP$?i@EDd;W(XF%p^;TZu z8KvX6nz?1w;X&%Ozs@$>OiDxZ8|cvSAM}U*vzB#t_+I$>g6n%SziN^=FK_V123N7J z(_(d1S1Km#1swKA9T|%YWqDkG7hS%dGZe=;*eCIxzf;EF(-Z&Jj*f*K@rFQX=DEV)zxzV7owI7}PX&h#BJq`XgyQOt%Q=;jDcXqs!7~IVW&(NG$ZWngs9VpbOPYX*ORvrwn`#=EFPZTA(!?;XYmN9dI^2 zKN@}Sd&o;GIIyVG4rjew^}DC?iY(0V{mU+3>}#u09GA|=8S7y5kcEyoc{ka!5&e3e>}*EZebAQArryzt9NTI% z@!FrxTs`PHIO!zPmb(Eu@oO~;rbGR(aI7dpV-Ga>CNJPZM$ZC)9(u$o-R9AJ^k%Ri|9G-F69Md|oASn?V7!K8s;-B9Vtz&Lr3OH)Q zFmP57LaVL+PW+eNLxY^sd*5;1WtCXK>}Jlk|`3v$A(PtI+BKq3k|i9Xb`|6@&?^Iur{^PAAG_?Zx_=` fAUyc>?Hsr8ktpH%5b1aL%od^`t0Ge>WfJ^vkxzq9 literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/asr-rules-gp.png b/windows/threat-protection/windows-defender-exploit-guard/images/asr-rules-gp.png new file mode 100644 index 0000000000000000000000000000000000000000..fa6285cb5667401323b8141e42db20b7bb8b4586 GIT binary patch literal 31409 zcmb@u2UJtv(>5B#j(~!KbdaWW=^d2bJ4jcN-jv<~q5>klH|e2;UP2F5KKeGP3~kTLihh+Z#W32RnODP&wI< z1Ry2-D|NSdNf^rH>EL1m5*@2--3Daw22U7H{P*Gx9@fq;fuZi8 z#?Ja!KzxHBHh$^u>fmYz>ZDx>2V~d(Ip53O+6IKdf7tl7prfIb4nTH| zFwDTg)7b`8vW?&XftWz53QrAuzicjmJq^6tcTTnM-@Ia~%2x5iU*$Tv`zA#f%RWT2Kw{Dv@FG73m$yd=#yM6i#fx2 zn@BOlDg)C5#f6oB-zNM4(lF@r6dCzR2K=d)-up_`n~GmmpVFS4-13GLAWPHQyQ~h` z(0!)mpYE9(L8(T5lj{l%aDdg!{@tEc0l72cgH68Z)lc;%YfgzbC4nQI1`(86&#YqW z8M@eEnvcf567%9#Bd*Z_hhDHN5cBW7C&^>?if;YGZKQIOMBoZR86cN~nIep}Y%NFI zwAMTzF{;CP5%*ub3Z=PB0vxqX5RZD!ogya}L22-cN8XXzI5$F+MlfDZzUdNhKhHG# z2N9IMH^fREp0NmxcWbn*#y4CA&MVSilcJ97CHJ|)9Kds- z1OmNVzsEE5F^mS!f@rY)m^mrPm`{^?~jmynPss!RpObqY1_w4Vt% zO_g_glp$&MjvXIKs%zf7nlU!Vo%tckuNm)^I>@Fv+vay*aC9FyAx*EtVYQl5j{y!V+v;^gtyFujE;%9=6Z+UX^OkjZX!w;$NB3ayeqE&uyK%_ z!~=SIl2#Ts$mwqtO^RDWc@L9wfENN_ia@&e+2qglc1EidTm!zAeQ|F{DZ@DlNzF$S?2Ndrt*|S0x)Y zp(w)1vR_Z`S|ZfDL)aI;4Zc>klQ}#565|Pe;Oh!|o)n*+S6(h&Yijq{I>oR~pbZb- z3v(t34E!udc+rpJzrma#jB^V6n*JZzXGt!TFErqnE_rz~Opb56T8R2I;0A-6%`$=$ zg`7fgOQVqny1W)mtl;&O$|$uD@&%k1D=(YP=Y4@`FlD5qq0v~N(Yk(WI`0l8#$u|1r3){zhcMg;Zfa^H?2ab`_rZr%%3ekISa-7Eip3Cp?3|Y< zx`Pp}HGos28Zp;>x=pv>o|P2;csQFU>uiYAV(;7iV=YH{^kSWv@-?uwhp~glviq_| zQBSc167d!>XH+`bd4J`&s z+sUWrT1W8DZA4xTo@FI#s&6B)V8T-UbKiaklCEP^xjrGN`%Q zMLi{1S>b%+$R1c}cXH0ltCJV@n)USX66oEF6&;UX-B-JBzfwcr7%u70Pvp@4<_KGh zj7&{B9=?6?YjSv?eX&B_DyWbv$7+)C?6!%Jm6c_Bp`V9^d(cs+TKm$}Zt|~h(WKz= z#1EmScQ@Y8ioRc}Qlh23zY7j%=TugX@g+`lH+C^vc4yIndb;~WYF)Dw1W&j+3i=>9 zm+8dU%_yC|em%3hug0Oh;yYOX9!pu_>7>G#lXOenBdOq7>47x~&!}!pDFppzo09%9 zx52OPiAAf6`}O)+JTzsbf~neVANec#Ze{af#%c5YZBr z4_pQo7HBS238?;{x}hoD=vK=eq5KB%Nw{(=+cLW+S5}?)8J35Kx5CJ)vqPJupiKR<5N_N0_lrt0GD8O_p(i?SDMe_%G~=d9%~&hkYLJ7kL4qM;keGT7_$bso+oaZ100TQy zS2b#ue&TwIU+j_mXQ|S_Z)0&9EMnq=u>9RmSR&d#j>xR`&`4r~5?(h|z4B8I`LHl| z!>#vn`z|Jj6ZyOTTu=VX{WAU){N*?kXlItI|oH0Z^G zl$57xBOs9AL&TSK713KD2rKH|&kwj*Pk(;pV_fSkFg_yK;0W$DfRD_C`67vCn;X^b zMsOw^XQQQ6JLR~OVnJ-r+hYHK>yr}!rj3jKPDw@{^?{0cTHf^~6XwH99S24+n&J|r zIDP9XpDb>JuGhQ>cjp0Wsr-WCb4~AbR}yD^*X`VE7xx{Du^(J%>84_|pkDk?4&d9CM=zBNm^&EORA!Kqlsn?dP-);n99F1zz?vGMN$W*WZp%Dk*Ar3M@xMBCBiSr;YUigXwFAf~i5X6#9rFz^&j|@Z{pg_UL4= z2*t&@qImGt3+4_!g&ArPB+=kJE8REfV#7-L;-zMANjjQwO2NO*m;B^Db8J7w(VNzV zr({5smpWJ&AAgsGjBMlL7&W~zoN3)~7Q88uPuuQSm-5<7c(+h7b-{HQ7KKI_r(!Ul z42yAdgIGqvTmcm zYM{JvQsK+tsp4W8M07(ljo4PwOY@{ZQvo~h%%N@e&B<|=u8zUWz>Qv*vcmpswsPT3 zdxK9yvD!Jvoke^FZ=i5_Rro@N3v4YIn`vWO(`HUht-AH<{rlju9JRLmx@l0sB`mS09z2*b>m9_0PE!~fa= zUjKG77Ynr{OjzU^Zu6v-k*&?*dvJhZ!s|(-re6+WPLLeP6&h8jjL!$w^$%n+4~|7{ zddwQulpAHW7YnmkPIQFjrBaV{&mehE=?#BU&S(9QROOfC5un=$z zd7xX!ovf^^J>%{uP9C1<=C;<>fH42}3OrWrQZp8yN*YySp&&RsM?<|;D7WRYRn1NQ{5x>|h^n zoP3Tp*lH8{D0TLB&oo*1rgw2)Krf?zP;vNUXYnoQb0fa~+g4-OI~ds^LRV$T~gQ}wrPe-fI?Ldf0Q-7kl<^eSe0th?zO4lOw`1|wORFzIUsC#bckmYUo!@2g90Ta_125m$R{wg6eTPbNQZ8LG?ZTxPu^T15Bdi{q; zgMaJh{rk0&;4^6Tpu?ii&*nywR`@fKOot0Ol*ZO|#&@LKTt+4l26{#XD@Qf3_gIsc zsnUO%^|fZWoQv8sj_&xNNRi>LEUIiaPzPS)&;{yqtXK>@|KZ`eR_@=x3s35pBeEtF zoEFgl9t#NI?^=qSw_H10x_v>X`Lm9i`;XxAr-}aDgS+b|A5h`n&VZmxB^z=jL$d=9 z7rDS4O9Z#;7wlMlI`J*>gEKfz@H&<09+2+zTB&}>YoOWrLd;U{J?LPp=vS3-?vjGJIy~{I!sKl7QIEZ0 z@+Pz-k%q)d(nZe?!lj}d=@Hzuh+91{W5OH5wqSSd#D=vZ za#_89udEI%_gToyHdi}KSi3~Hx3136HqE^%3bnhaYqt=r{JJ6bi9|QpX96Rjy=k zyjGAJv)n3qUi6#emBpApkxH`Lz2f#^9r^i4hlv{PhMb$(tu^98fIskF%dH!b%weBB zq5!+m*NoWR(?6Pt@~|w}l0@toQG(g>G{p`4MeD-Y0egVZh{X3NS@C=2Q30gW;+;RTJfuH>p^Oqwp0GB=k_*=( zSr>CkH|^#)Ip zAkR8)(%kR;b}@I8T7RL~tnq&Aa6xslx=Z4@W_%l`um}b^-%)k+Q21&Pc`l%bw>GOPtDfry^DvdW zHB^Is@rV-V^ynE)l!DvKrV?stCLjktSE2sTgol^gkLC(9?9WJZ46G18GdU>HBeaPA?u^Ev z^e6B0721bMPUU|{KCMT28!mInqVOe%N#6k_w|03 z?05mgYGK?o-}jj%gS9gK-wFEC($ekyH?ukfO8fq7uIoNOz624D>|fgZYW96;@1yj* ztIt@^U&zVf^=pNmo*sYv#WBovq2<%o#hS7#B3pDZsWNK7!^WTkx9W2ki$BH}2ICon z%7Lh7!>8jcOU;NUr5_VI&yu6Q&A03gF0{IsUcy@OStRJDuAL{n{&k)Bk~v&LQgZ2> zbeMVziXBDpZTb7=K?GY3yhc@}WvVruY@vyXcc)PDvoNPTh9EI4-H80$0n$Vw*Tw0f zY>pOV;O^6BvgP8!9r7NEtJ;U_6N7qP=pBbe;}7kGNA)mil&MuRvACd#no(*}A7QW< zvV^vs=Cw*zQGionKLd`@?Y-g&S{pxVnp<8@Ib@wl)HHO@jTm-)?nRXHVqzN$^#2@; z%C3eB>wgO&x^D0<#dQcJ`w=plTFcZz6I7d4Xk;X22j3Hm$?D)n;C)Q7zX$o28K@_n z@G!F@QS9sBgDCETU@ar#{$U4H-U{L&oBxN$pe85}_c+lp!*svCh??N=$d^essJiAa zC(R*#kFE4#HZ~u}k{x26Z&@uytAS3Tx1P>ddAa!BxJ$N%R}_W zW?iG#k*MT0exes>Hl8s$2~PzU7R2`;hmkLHp3|rlhbi(MzM^34dhvc#AQZYE2{o04 z0KaOR^!x&U9G`LH63S*@!Fs>Mk%Fe7^0V0;7Omcf(aG*vGlft&ziDs!{p9j=_4<)b zs2;LXFl37?nup)TX?A6Z*U)eaL9OV|U`|eDbgQAr0LepkdPMcGylQbgE!-56626~o z1ygT*mYs7GUAHq@l+ciSk*U7Wu!E?CmU2&LK0Am^%JDN$j&@dzqBI`aP{`F7GW+bk ze122Ebe2sVylkENMOp%^i{0Gaz!p~?+=4#J%&FLv#g~!N$=K0gs3)5}td!@K?afwu zW<^r_PI1nh4#b>_f~hUyqZ{WD-&0yIrSYn^x_Bt}2Q7Hd(SR|AF)Nm<7qq{Bi-tkS z@Vcm$bxQcbqK!qfdqJgndpTDs9~a-T{^NbC%*VM3Bw=}BCtR01VXI>s*k*>Y){v($ zl<*24VgBkd+B>+q!@-bCJV|X-hjXL$KldD$eHai8!cMGN@k=i2Ay&LeuUlGV>(mX8 z+bXUv(#I{d)-N^t@JirC^*kiN4lM;^*=nq#9eD3 zStChTA7Yrw&t1)nC{-l$YR?M^aak0xoGnzIk}40i^Daf_E%_fUTyiU2%-b4pi_g|P z*BC9idWxEAW`Vc3kCLzFKfY-$UPYnx*bOPMU=mnYtA*F9A{&}Gb{(3SCR!B^=z3_e zhK_H)kY4aQ9&VZEvN%?a<)xC&?>KFM4Ca&^7kKO&B@G)dA^>H$kdv0zJ8A?MT8|&a zHyTV^FwRfyprmuvLsmPC%|>m&PKqJ5EjU9hi^=sUBzEz*y|A~={}9_TGWA)p2fLYg zAn_La+12z^b`3Y@4w>kf*tp(-NXVb_96XK92VRs)3?zE&0Tl`SoNUhKL3nar4b9gB z=~b^$#LEg3chlfjXBDSZt1&98pwdj&v@-c{{{*B3sI%!@Nw%Y36tNq37{PmNA=GvKP$@)^6b{~4x>bgi@X+fh73pYKik0Gm zZ+#Mk)Ku#nE768fo2in`T^Hit4Lgi;yT@i~)$d^%*pCkjb|22rGsLez8l%USOb$L} z!+qwXM{`e2cegaaC*SE7Ug6sJ25cha%J1)#BUE5D36WZ0Z z!Y_fA-c)6Srx_TYJuD59C%S7pnrb8q0sJy#Bxhp^5mLG_+Z}Gh==v&1 zoMnv(O3bh*>6Iv~{J2^ZSmD74uJA)y=HdoL(IXpQ&=IwVbrxunrY16$cO|8ER@JjW&FK19< zrRM?r7!Q>CvCLWJCK=!1BK_9MDCUT0hx1j?r)n1rZTl&QX@PP!SoQcMWx>p%LJl*P zx3%d0WQWqFAz3=R=x<6rP~kG?Oy$z zI%>3@9f(r&#MJp8EiOg4WNLUgW2d~Rkak1U&Z-$61u5Lkxdr(1xlT?K(fbZv%Q9dI zyNIa;zq-S5P3+q46L7$?mHm{BLy&ia7GsbF{xCYzp#DVZDrf5opUzY%1Lg~<5Tp=g z#%*Kc@I7Jh<=J!hr7zVD?{hew3yQ2NUG#QeqCe+AeS2}F*|JWX|L3-fuIed04M-0A z880c6MiX8y-JxIjHmJkSHaJ`t7Xla+OfocSdsOtqCC{b6@ku4H64HX*drKO0Kf#2E7)qO zHwY(Ni+}CIIy5bDJg)q!D*H^uVpW6h_K|WL%Y?A^*>ctBI?KVeyVJ)zRqCq`c|JF2 zu5B=no)KwZ(+nmJ-j*%mTGcL*-7v!jO-;89(T}`Kk_S*3CN?_6(RuhJxvyn~=rx8I zbJuVOZ`G0PiIxYx*%fRX+j@)3%oz3>W6(nu0Ii85pR%9peD`nx4-#}~-%knBKCXOT zUh}?zISYLYUMTd=K#l+oxwLe6 zx|+k$N(|!X0fxPM8*$7MqauC&iRE1xHJcp)jrrdIqyIk$5SMDX6#yIktpzaq?=O@b zzex&8Yg)|?;02Hu5R;8GW>O!(J8VHA*93uVy0_NU3!6PvPwn_f)iD;ac(gT_xB!sd zdLs=ka|sJqhwfY^v5lIr%(H>@Itt!~VJ$s=Y`LcxJmxEvjvUo>(+{BjMGShE{swTM zsxCQMS<;HqPbHYfUWAEF>Y0^`6g*wg(9ttYu4e#Nk?EpvQuC6(zyIOkg!V>WI0FJe zA*;d}{8hANFX{n#!h*0yN`b|&u+3+Q&R_Lq-L{Ft$0a^jL=4~+mZZvXHxoFW`+(&y zv&L@T)ut)p1!Fkf-A2ZZ4+V=w`?jUc^V2aCmA5*uOduv%5lU;C?TI7BKcYWEb85tKb+i(20sg*Jf zESUqCo(Pq-!8O8Ou07YU8gTK_D`4&sD`H1Nd!NK$zIYo>sz!&oSpmoclXSF;TRpPG zFI==fN$7!N+1|+U6I1;TDN+#Vr)dItNKs9Vu8E1sY_mu4b_YI)=XteUdV0EP^@|X~ z*RAubj_XO7u_DoC7fK0KQgg@9~O09^OsIP^4`6 zv_|6W+Cx6NHGR8b3g|7?P;x_2)iYA8q+x*w>Q8dp`&W;vU9)d}9wuR{UL;@wPOu@o zWs0ae{Gxq4rDn@euP9?gMsf2kkQCn(0aooX^Lj{8aj~-9Xf`s1$Lw{@^M{qzHO~+K zBx<7pEVpKGG-Hs1?iL+poG5g{l6kIHM*0`t2*qzOCEJ|9qO4vq>8TMmo=cuw($zG; z@nw|&34k5DmtQ06uP!S0yqE-3iz$mudTev9Q9C&~`DTTgiAgCu;8@AT6k624j@eE_ zHYF<7F8Em(h39b35;vt!jtM!Pr=wyN3sb>9lR#I-*eh$@F6f zd;Qi5t)sJNyq`2FM$Hab-9ROA7thO}G`C@o_jjUvIqHm+7fs4V4p?_s4@9VyK8Px8 zR+qIv1|+{r*$2n`6d4RadJgS2{3=PUFmY5{yDjXL6Z4&a|2=z0K&ug-8C+h;3(q>6 z)7AzxqK@C5G)MfD*8W92`6B5`71iP7Zs@SWbYw$S+s`c)nB8m<%n+FIwa~D%?QK^A zPOA!k%BhOIp{b=6bM5+dVCMX{hjV0QM@-oq?YWFx)W11LH&KkTWJ14hKH*63cdUb$ zY8LK^?3ayG;7AHIgK`Yc0DTf1rL!Gk4vVKzd3?uyyJ?A(UM5g1&#Sei#q(^dvEQl& zI15hE@l-C3I(uk)b0@2%@1aJ}v_S(s)D!TA)UcD@1ui(uOKL`emTuq<3C0fFJbgW?W;%6KW+ z%j->k-+3~39dHi1dCXxtL>-Xp8HMVpj^p`?{=Y)0{_OcatXu-Zziwhadq8H|;_2{; zWYw_r?T0?zlO+wQSmE^mC5}2kQd4TYj03}{($%`#*j#WINX&gMN7(cFf4{!;csFt0 zwS?Du3hH;+8Dcp$e|ZB4FW`=V4+{$m4Fki}*-l55*TxjvWW@NmF8mOoPV?Y_j*U&B zQTcP`%whH({z)XVP&(k~k*us$tSqicKp-KA@dNdW4!pv`hPg5N8tZ!VYWBomhYeIU z6;1X=QgOh*-rfy>=PoMF_UGJgxlT%_^YUe0ZEdZP+oIHPx}b8M-KdeRZIOVWAW&IE z_|!b_W>6t{98W4BAYfo-R+gR3u(i-?Ea|;D1}u$GFfMQ*=xhr+9vhT&@@>el?{B6~ z^4UE{7Jf&_8OdTYUHOYwPM@&NBiofF`M@@@je? z6J`NP`)8Brz#^-J`1x}O2Gm?;Y8A!B#c6105aR{P7<5?`=YPBaz5GGKS$cA6NneCT zL^!#))FpkkCkdO_Rbt9Vf`aW&KOG)tjXWpv{XMZ`M3_urwwa=0cFfwa!j_-Y?tE?Q(0H8eJ<5m@tFe!T&-$U5wH&zb$B^zk0T)Z(tFk_nw1ZRrDw#9CTcr*GEi zY8V{cp`@fVi9%IXm^DHR3giEqM5-Lk=}ir}hhBY&F(Jb+q) zQKfk)ne6!+x{5QkuXLEZYU9raCZ9P?YRrA)Ar^XRte87AZ19<~eyi*4Ar)|?PG45( zvD+jhk3~g|6aIKAW!wJ_Uiio3>6)SqwgiHk_(x3~jQj%98}C(AC=E+)?(+`l8*AE4H`~Y_wHhhwT#wHs}|p2Lt*CPy<+lIq~tjzw4C(tk;(> zbR?vtY6<)M`+(sFFZ|=8)YMnRg({%8gn&&D|1l#$0O@(;(An{bKcQ9wmX(F3{Zt*T zX0TuYUBtyz3y&3#jF|Eq#C}a8?27KBhoyBZ5j7X724$r}<8^;SKdA(UfA?L_6M&Kr z`nOq(_>=wwNM$82!8r8mtd-%;lAk??M7t42f*~S~vzJAg`EScBIVDe`B!w>s6TV}N zAR6wAriIy!GBhu^UM!$4vVu+rtsH^CY2e$pvERLsm_aL?-o{i#;(vO$$1_!R9mbrz zaXw7Fc}KPf2-~e2lR4s(dR#6|e6J55b*K~$OLn{VfAK+GOBQL&T$!lXaVHc9Y9#(| zzOCMML1JqWZWc~Tj{ulj0ML~1lVX7Hb`zV{+sCKyTF?}-9njHaa{fNwRkuV^0CdoC z1&a4-^w^~R2Xx@zK%t1oO|#rfu!j5LJAzee(VB41c(C_qp^}wAB2pi$yDli-ea~M98lYO z3DlVcSn_X3!|2G!6yW3zC-t>^Esi@wh&Z{q4UCLZ06x1|++)T5Xme&@XvhHYbLB>5 zz=xYs{RdGgGaKTml2VwXlN0hE*WlP6L*L@Lp0F~SQ#I$-VId26xmQs`1e0hoDpbhb zGi&jD+(oGTldDzl|-?>+2B+z0!;rYJuB3OMgRc+^$akwH_V$ z@1FGk)Zg0sG7oj~t%um6+QESGXxJ|R9vj%MMDx53pr&5ss!$i|<7$A|0qMobe!XM+ zBIQtSVqu}8b-RTt&&&89cgFv#0bprz5sN|M9|n5f4^Fh%*fX;^<-r_cuxo?oKt!*= z=|enw^r9OKgbH$E-M60sA;>>&4Y-kuNG7jEi%>JYgsFkqJmn+JgOt4GQYg}@(py6l zE~#-~o?*CXxned|l(DkE+bpKl%87<3S!EKEiJjec%SB0}TgFqxvm@WVfFKdnnf4!! zjJ>|{<%0~_VB8q#EtEe)ef^8z+n= zjK)yZ$bF?G)kQfz=2YqVtYe?o4NGC`0-3Ov-|QS`c00lGQ5#>s5N0WihNlWT9Z6DwF$0ZxBpnAL~Fp2SurtPo>v`}WL!AaATy(J z#^)kYGzA5CEkpbC;T0#Ss%Bx-EO7g;2|($>CNER;bD+ANV^Qt@SoD_N^)6{|-eZ&v zzzIN*^1l(9#J?V)-L*dl_WXLE9ZT@ZukioXZ_$dnMm-TAY%&_RL)d{F`%OQvJU4j( z0f_wnHQ>@i7lA;1;d3HHpgR^18(oyJEMqTLu3VHj0JaDV!>c&Vz8SF8}wSRT1*g1mRDzN$7+0v$#KmP)`BytUc4fvpWd z96%ubhmw*32z({r#I$wY;z(}@rBM@s(dCczoqhtDt07yBEHL9H&Nup?p(tS67D_Ga z-o72Q0C4`H79*cV>Hn#NNFBC4kU`V8-?!#DfC0O{?Zl6VJKo*_q0SAr3=Mu5EOHB{ z&b>a^5w)N5k9KifobFodr?Eq=$Xrhe%?2zQ#QIV01GQfMwWTzXO*2aOct-8Ifw@6o z3%XsP39yw#E(P3#N*U)I5jw%kg9es)HQdN@uw&B8dMFI3V-{^NVGCG=UiL)gXNl7B zU6(obQg_cBgX0v2aO}ajOX?K zF=I(=Nfi$#-z*!cQ*w9HX5x)#{M$=G&W~qXQYSC z0Pmj#rip_9*4tp@AYpsYYjWmw*~WuWN@!ih#NfrmSo)YWa^~JV?8e!4$-z+v-lif` zr^9yJx2?5|miBuc(m~2DsKq>a)nq?wBhJHF0>AOlv#5Z#djn^kQ*tw>PV8As6@J;P zXw>MN9rx_pesM<78)2p~rkiS$V}w$YkKqosMw*#!p1sF^Jw)O{S;Ts<$>^~RR5>7r ztocXA_sG$;Gt*X_F1!Kd$vhMM3@%aLID4kahjGMIgz9x!OT3^Pv%V@gwj6;DHrWtS zZ@tLLDriJ2++xir+mpusVK*mG>h80#IW3SM+PIluj zEe|AxVL(!N)!1FwNjcYYFfYZ_p$F_&le!Eb7JlKSLtLJ%54syLUI+i-oFdHKMaIF} z6Lc8>h6K@sK^Gvok<&@KzGX(o*>N3q7h7(nC+T*O&Z~AEv#11-0s}ZaDTf%R^+-23|s{iIY=7P82-9h>@%xuBNvh=c(;hDzAQSh${(~H@li4v{w zqmH8z_C&iP%cLb@L|#!v@9h5br;|(DZo%sQMIuM1AcT&Ok56suyL_77h=P$f0gaYk-q0$@FJpNU+;+^7(++Kiga z%O72w4i>*L{d+{`S5KwLD^9!GUOfFn(eddF`+9{p>Z(gP+Bp-GLF%-Tbu*~|(^2kq zSFJ<>tzp9#A`*z=KC`Ua_*7T*Ucd!mwr^?ecNX9@Lw^4{ub4LaH_EEP6>K!mnw{AaA?~!}9 zDyD~eNT>YKIyOM2zreb~AN-OnZ|PbkIgVexB!n7(KEKKa+m=TS21n-@BWZl$usmjG zUeyo>zcsgB1q&m@9fOP~4dn_XN*~^5>{V@`+`ctbvA`Oo`D(dO=uJ-*YQXpOWp7#`^V=9ba$t(KFu8DG_Y!+eQZP zurXq498%HSO4PsDB(m6ks~&Pv?Uwr!662IOaBIr(q5v*2UKQt-El)o+wX^}g@HYr= z6p6NYx7cjh+X@GtT!$AwAz5+=Yy8|pHW5~58 zHNU~(fj{s+k9B6)9h@e___6{$cp4Vh&l>y=oUBpj*Vt*@7+T|a+6>FA=A=9@9q_k?_ybYo*Q-2sx1 z`)OiyESehc_1CpMz+S%)+S6l3U3Kk`SnT||`My>Yv3Hc7HGTI%FM15OsL5$&R-`FW znfR2&Vo40}UWa6(B|JnfW9{gPdBy6?yr)X3;biX0 zj(oU7P6D|^KgH&p0UGcKy+x|BH8BC3N|&$KTZS99v0ALCUWz~Mi4va#U7>+g-&lTm zljnoP(FP1Tx>j=fdq@mwH{@}hT(?@G*MHc+f5|%gd=XVSrj`PD(X}-}Ya8jBW8EUn zS?I7C9H|s?(cWNaMsy(2H?!Jfw#*oX4n94txyy>$yE5_=Kj<&R&pa>r88fAQ@ibq~ zCet6*vEJkW;TqZVYIEk~*-ts~-JzpgmQs?U&xAB)Odh7VbvKrxBAgiuewD3CDN_jj z>X6qoE4V6*`n0@KVSProDjqZ2nAR_IKhPt0NSr5rX}e@%WwGY2FcW=f*n?*z=Qo5p z4NI)?PNwwkZ`X1pf6_mBUWSQfch`RhbCkkHy{1{OL3*h;Ibot2&{~B-2`uLloQpQekf3&V|^Wsa^i zilP*l+WtPE{%#uSW=hpp$GUn+Y(*0BfQW;aPV=JJ$lIazUYVosf~d}}VE*x#R(UU+ z^$hox%x>C)oTn|HDJ^dZ$Fcq^d3CzjwVxRnAi8t_&>tX6epTE0{@$3b-2@J!FCD=E zvNiJdK7!ya2LDH?a|pn)HgQ6J@00?t?1ezW0+5RvJTFuFAVdUeI^uu!7m@j&RWbi7 zDe-^7o zS1rx{WyCr?_kE=ZLFo%RDF*GY9j!Y}OEJ~_6k9vK_>G8j+Mg(^w(IQuuWB^R=Ay=c z`tEb0E1+pg{HNP2g6nn?_+i_R*W_j&j9Phrqz0*I@A0}4F3=R*AA9^To$s5iR(X8J z*uj^z64H=sa%$@J<}U>1h(LP%23J1qrF=<0R?kgmz`Y?~H&-I&UGcIGrM*n@E=f2$ zm%J*51{B9o#5u+~tF`8TB_kaGXvuH!0!av3fG{S}UW|Ij10;veT)#_mAVZy(E)#!Q z6~a%!HGh&C+OCy*DNc|4rr^?rN4fVUP-*X$_u!Vdb_+>tf1-{g?&6dY2cnoI1DaTm zkH@Qwpv$1={2%!DlJo zu<=KLX8E(3x>NE@-mz!r6)HKw)A9@{II(!vv+I=rZKf&?d(SlTyEr`QL7?-d$8u*VPa6kD0K zW0HuEm9(>f2HCncngRHHK|w(XK0`hd>6kpX#Xj~mUM082wBqUN2wo~hg_*tnb~JD{ zTWHu96#!A<5qS(CpHcm5Yb5~23Y3osOG(jr=56lz0)GSeI$LNgf~jR}{6Vmo5PrIC zJ~+l2cHc!P9Js_X@UVLw+hn|dX#uWs1*WM6pnLgUy7<`Z*RQWAU3o^N2_g1Wpn6<= zf_DP040Q139yl>vjYQghO{i1Y<_EAF=J@YtxZoE<%a?FE6cVopeE3&E0fBs=%L4$5 zhckrL5zp_x8(e-k#@c!A=2U+wkoS_Eg+-p4nmWWqUfKTlMQ+jQC_%-c_8zw9!7)aT zD`Wz}bxxCw4T=bE6cLd0C#y1QzLsofiX5WYM|~re-6v7K74=!QD~}yP6*sOn3K*H5 zR{41Hm>i30&iQZ2@0&pC`5-(q2WS1lVCZ}|HS1J;EPuG{7q1;iPp?g{T7|iv);?eR zAy6q^`ncYFKG6Ezn82R>G8hMR@?HT!qEwdc^4RRhgSr5G3PKiK7<#%Qv&ShkG&D+` z2PpW%1zYi1D|Z6(jnJ=eO){;R`t-CfI9yQnpo9ddH_$VxpA*gO_zpONb&mSq4?UBV z^nTgV58l?jR-Gc!v+rE)c6ldCQNn>EQyQB%t{tE_(={q73c)WDw+v zt2*^^f?Nf~agV#+zOyk$3*^3*&pv1X=Iv`0$nNs7&!H-A*p@b6Qj+~gf;>hflf6y+ z9V9|%PZm+DvO(w}QL&1+lCCnBhTja%PLf-yH@2T?Cy}syAP^WUlFUKpNQYSg>HhSHxcesU1f=U{B%QZs9c zoTs`6V1R#X0m_o>{F@=a2vGXB?Js)_msFla4CPV#bpp*d0l4u40K zu6aGwTI&taz?Uo>w6mz6PbPEnLhYEk>MQpY zOs*uIOz5AK{p6h*KrBnbc5?L>1#11p=`b(Z9Dv4*fy}}c_e|&e-r^S<*vz-HhA%m7 zfQ0j=n}>6{{?X?+7XU3V_@UT-Sx>$#Z#7M;tt5aUZt)1uHe*~a3m5FA*MN|vJjCF- z4^uH42%IX$n)C9EMz{n>4r)^KDipVDq5QmLFFZZiZ#wTjmyyQ0OuyMH%E74XH2*O8 zEWCq!oWjyh1d^eOwSth)Lw!`(NWx|vAsHg_O5YyE0yE&AD<h$KU;*Z9r%{mi0 z4Xj?gtuJY4;?cn=ozle7yjo~^YmW8DEH3nN?#o*33tntq*Pj}`@?|VCcG6*ejsgB^ zaVP2+FpzK0(0()qfX7Qy^?r(;X$wgqT!;f_E371EYD7r%J6NFXX12KekKBu*0}mIiE!S5MB}x zX!GJYZCd=vQA_WuaqYl@$2;e*H%DKx&~aE!O3U7)_7<sHkQ~!mf_|+{(xbgA% z^Ba%$W1zl+lQhVKccM+_FMxkuaD<&0w#3Zyz?)H-_F9|4`kcIa4-RhVrmdabI;`<2 z@G;4al^x^CZZxcDMgCZgUrlB_nf22rJ35{9GxL`iQ+e;wcF=}SX{SG7-@LCB2V#u~ zPGVXlN;?IXxRAp!!;nEpw)b&BuKiOjuH*6en$J@3UQ=PUZAgNxV_d{~vGu@g5{IdBk$bS1--bB&IYAZ<7} z;qzxNpV1u8X9&rFfWx1B3`vXgRTL6=7j9}~l~&~KXUG0XstTu?qvf3?O4KtCMwW&p zT9=yVul;frcdpW?R!8T*T3FbZ+f}&_V(kKW4s!n&=(NG1hr^|+hN{gj9{*GnIGDWH z#|doBz0pt_`;$!LvKyWD!+BZH%!z3;DG8b8dh1030kV9BiUlB_-pU< zCUi|EqwhJ3=u-6`JOAmW@eTiv34)-eu#Y3@5#9yw43g>@r-sTLNi@1eZ_8KQ)l&{} z$jXhYvevpR1&XU)6lmJ1k<@3{VV#R%6K2cA}G0c}(!R{-*v9Q!`Z& zWR^FRTCWC$uiSOGAp5<;WyC0Il*w@zFsExV{zK+BY0by_msogqeoG-%asJ>6h+n;t z5t#%5n#Yvjm)^-vmYX*V+>}<20)ndm)?TTu_-%@<|BBw%tTy}GM@K1?fBB~)#a2ob zj&V)^PY;wC{Bds<0=O`M{U`Ke?k^9{{)n&84%*9NWd!)=^^GPEHl^dnMBas&L<$}?|wWICxqhvWtZZAUn}eJX-`_7T`rPSh*iXZ`8?-<8zdbbi0+EXvQ(3AFGpB$oH79szurGI8_sIQ1?=GrU7>j*|Uvf@i?OtSZaaZa4C>Cz>&6KM(&cgloT-=Xkm^H1` z_*Z7tt&}FN%Qf7?7f&V%va`3-$2W#pz_NxG|5tn89o5vf^&9b64vKgLM3G{lNJlAB z3?L}IcL+`CARs050Lleanu2s`(o2$q5Ri@q5D*Xu2_yuLAT=OD2rZPig6Dqkjr)D~ zy*J)}Z;UTvj{(`)YwuO(n)5e*bMB#af2FGs!|aWy#)qSMY$51Nr=v8)!KIp#K$UD)B4sG_o4#T+Vg-0VKK5 zI%gO#jaSphnk;Kp9-1F)X=nMjWINEHe>6c8wHzmHSEo~r>;|SsEBiLKR~Py>d^owH z62&23e%t=T^^E7Mfw?&SUW~%+`^P*Ay$jFin)n!BX@>P86t~yjOcZ*y{TU#>>DE9z z;t%bto>8Br)!v{b=o;kQsG+)3k`ay5pCXSRe=zJ}m8ytcuP5u(r&yx5S@^Qo)NNvI zTdFBnT4W^hMN_9y-(JnHjFsL~2$;uS+HiQaAltby7~=KUr!(cPrVU>nfq=0Tnlj4- za%RLxU#h|t9JPk>8H$6Pgn7hN_K${V$;&dGM(L^pB=P0Od{_VMicW+2*Ni;ai4G>K zumivD$5)qcwAwU@eVVfyElwF3z8$|VU0GDbt2k0|?W!iiUChnQ4n>w>p|&B73lvPC zfsSS~X-Akcd;^rG*DGBnuaeAQNCmx?8|O6CLOJKm$cbMCTXfk^L3Beop?;*Yug2W1G{Ajisc#W3=1uil_rfhHti&_T`7Sj0 zl43metkd*`23lH@Z{Z3NabCv7vlTmu##;VEjl3@*6X(~MOXA1$5Vf0{Y0)J5Wl$~{g` z_@k8v$g1QDGa1(==wOjTr{+CQtSzY+X8bnM!H#(u=Sy2FZmqIg*sJ! z`$nO)v~-8D%_-h;Y}(@^Ep=tK+SYnK>8}w|H*^+0anaT_noMY4&P1yy_)n!;CA?-H z(9M}dXi@T>F-KULpmDb7n<@J5X~aBSIhVjW)j~Ze2^H?LoeEQn(dX+46iM-cr4nxb z%;FwW4e_*(6AHcM(cP-x|3Su4*e6GG^D0#Suc7I07$*EqNBZV?jCQEp`sUK`8{z|a z1`MIz?0J(@U2{ke`SwH=p9^)q{d~j5WYBUY`#=B+dmilx_yQ(BjwV#piiX??Ty7ED z{)Ze`T5VSmM2-^dHB;}~MHQZgR4EN6sNp^4s+7HP{9eOy#YEdpTeYaV`q2;3+S{6E zprthS%}=qK_b|vF&r5t(f$bbx@H9zfJ6&74*Vr5g+70W^Hassz) zod>!V>AD`7EPwlU{fw>o!V4LG&o0IBzQVoNhd1mByd<-qHkVChx`KpKV@>dlY8Wo=mYa3oT>CawU0$9U;g2a#xQ)j@gozCm zSP}okXsCPoUeu`c)n4n~Ozvx0L^zbz`k7Ag25BPd8wV1v9#@D_*6gYH(m*+1-W0A` z707R0X`cKf1zFX1O<=w7=U-uRAWo)1sL3 z7oTm!8a?Dd;PtB=Pqgl(n{ighl*6?=9^fZf)5S(IPgOr+U06;|%QXzlEZVTr(fz$t(RRVf~O^hhDezM#&#Pj?2y@DHF z9t`h1uMu|=v?7u=;DMFl&)8n2m9;j(Xd&Y%&)}TKc{!B?b@uWJezC+x4p0JWU@QmPlOI<*oM& z#!83nf0w-#pg}_x_^$pmXtC-3*nf_*OV(}w0qNj1QGQw?)iXEs!ALFa{U>hsMeGu}nECY2j?u~^S07Bg^iy0zHP>Acg1SDlyOZF3B|nIA23R?FXXoxE)9 zKs4)FqlKLF9He#X5oOfcl)R|gW1X{0-g)DbHTu5CV_6i65YR0;w zFobq@80`Au$R#o8{X$QWyzf&lB44idhTwHxJ(N;|LA|$kW;;w)A^y#7GW^7Yk4S61 zuOH|1wc@m=1-h$QXsccWp*gA{Kf)JK*f^cHgfw#-ZLb!OFi(VQTb)9bYOOkxS*C5* zX!+uuWqHe-?fyr6#a0i=eZTXJSK>)&6nBcXjcQ7fwQdgFeVM!K-JerhNQ3l{Yk%a} zoiz#$);I-vXn~B&WJ|p|;3!kS!ItyRVe&Jay~f2O)i#bPs$%>Ni-H~>s>R~%%9)%| zBRStAjWu(hJX&+iGd1IyOYW^+aj9`Z50!JltH}}%XJS2gFrqbgsU$J@=LaxBcn#*> z8?K?%(N1ghPJ+{=Ttm%1MAJWEGJ!p=gPDgK2DlNu(xY$L( z&lr$6gpM_!A}hGDA7&J{E2fjYCyP&=sNgkSP#$pGMo|{_KN++8+uJ+?+d)|)p>(-^ zW$4%(TuO5wHN?B#F~?>5_gInNHkmS)0OYtC34L^F>j;e;#Y1#wp zxbhypgB%*F8s!xT`%=l})#uyAZ)I1LHNsnYjo471S}#W$ zTKVvvHy1M3@bn}Zm1!okTK#O!4YIXbHM!k?SKfs7k9CvKgy${cd9QM$yT%FTQU(fH za}U__y)`Z6gZCpv6->M?YFKmTdW9AWw%v?#dNop~CbVc(-y^C?o04jj>G8U>vEf@; zij*2@y?NH|lZPD%uS-&MhgPkrKPM$`x!LtMFDLU zFg8eb|B+iU``FcJ;cEG{%E_k%R1B9mvMB_6yN&Ikpau@} ze8FuT53lAR@{~G}*D_A6@LAr1qFqdEEL(z_G^hfA*##6`6nB5BMu-1}Ux-z_;RXj7 zAB)Gg{>k|f*a;I8lOlVGGH`tOpmL1i@u%;bG!`WiKTXMb00Gorhfk=ya?MOTRLP@; z&FMA%=#RSG_i$yTi9yqeqM|p?J+KqG-vWU)95u7gai|twxOSMH1>*3FO?=^(H=*6) zm!b0?N^`yEasH>&2pA|T0iQoi&0;SS;u`7m+{-3|ECfz}u~-M78~FKuQLw?+_+K`W zy@(eh;PYofLjzEiKxePLAtCW%c$vi&@bGPU;H;BE& ze{NK#T&at2m{ml(9L>_ynrFmC#nRDW_EMX6i`7){a0@i%Lb*=05`R~JVscD}$U$P_-NNT; zh0k+aU;+n<**Es*)|UuSE9`kYwCBr>D!Ap!yk^c$T;1qRn>h8J4Z`eTidF6E(>E@8 zFS)lv-KJk|QD|^6q9=nfzxs+WWLgC@LN(!ZlF#Wlxx-3^8qO-cDI8-B@M_!OgjN8f zMGdFmPSeKBlr&*{g2NOj>|?mi(OKQqHZO$;o<5n!g0E6G*&=-aLL6Cs?xVxQj}QEn z$#W}%Zv>`WuDj$7>RPf}l!}qXzYdnY8N3!ETd94*w_4Xe`FkIYQJJ0-$i8apX9lLf zNkTMjwu?K57$LMR-tCk(G*wu7F5-$};D$-qz7`2#Tp7N#^cf>s*u>?Tt|6RL3R4I}8TnwoJe@ppHu*t($`k z@z#F2sLCTcmq1!1>}xqcz^|96pq~G+n_$}lSH5@e9^>&SaL}o{m(ObGgtsZJ4tuWg z{g9t8Jfzx2HXJ(d{^t_>dr`1`Z)AYH5JtD|xT7jxn89E$`s!1j0I_`;)n;g0WZu5w z3$pvW=j%U45T#1#WOvALPu!^_Fx~mTg1b~b92 z?3eeGT=Bsg|6BX3?X4~>2A;U+Yr_n2pwGKlbsm)YSSruFK5BiYQ3%36A_Aq1s@&t* zM_c8RDto4OcKaF!=x}uZCJM0qB5$I!Jh7>{A+5te$otq zXxTm3PE_0;HSVr{ZHisOEe9Y);a|H6)ybbV< zFmA*Ao}@-oC!T|%ex|#A#xLu`k<>W$3ePbfOvI|Xe;tJj)5<59H>c~oCm6bx$OgGU z#}zcDL97D4L^m5KNz7R^J72u<@J>sdJPeV*y-$j8?SMIdsigHr11VWHZ)dAJW^Aw# zGVJ3F$gGFL`TiRtQcfV=MlXv#^}#0f{{0=BMt@Df{T_bn)O*eeoSTnk zx6RmvGT6tvN@ZKp%GpgE*VrDz8O3Ik4%jfTTmPKw{t0zEBd?s* z+t-1IP@*te3*7@}v&K-hJn*PKxOAjjF%p@u$tLlbKp^^_$x>!Xrf3;t;Vg!G-iqL}GQkaBMRFA+h9 z!Ty>85Bo}=j4T3ruHDIe&vLUWQH{?hfbVeaq-sB;T@?<;^z`7%32jE-CY zK3#h?tEK=X?*fP#>i5wdx1=70T+Sl}P9hpm44@|9lksmfl>aPxfF2<7U)SLOD7F5( z=)a$(|MjNwFJt`QJ^bI@^#9G2sCr^;4uSZ-pQHTFBDw^DT(qFSBLJv5KnySd2ErFv z5NZVk5D-3>|Ca0jFM_2*2?uOBiBC)D1Ae@zM1T8qo(3%}FmRJ~#Bt|jv`Pa?R&O51Y|jcJANEtF(_Itf z+0MjH5C4&>s1#k`eEgdXJtXRLRT~Vwpx~~_$j{d}H`paLw-7O8N806MBj$zF82XuM zinq;WD6!m?U*F9<&*dgw-zQ?GYvg^NpYhO}^ZEJ^<@q{$0rrtEg%MFqiw}3o!yoAH zOjV>1!r$JzrE9}RQ7fv~j%Bx=+!b|}eVD}UzdoP}f!;@cxSK&jPy^=l+4N2`8&FIz@xZa10xte6B8lK5BTrf`DM)Xz8 zTNPZxtyvWk5;Y#~Z!&gD$jutet3#`O8@*C>ioBkG0%t<^Pz0YOu zcJvlvN#&|p6H7z&s;B%tA9Ok}l0@8oq+{P2y9aIMIgd+}P4%!@h0H#g3s;wSPw~3& z)$-Pcr>Lh~GM32VB{a}HBt@q#L6n{SRIQ4s?mCTsLaWkq_e)yW%4pFC9hd=+CLFm* zayhN9Lz?hsz9E}ty;NLTVZe7Wmusp+R~sMkBYb8Gi$*)CdNp>-3OFQL`P4) zA;WBcM4!%k8~XnHBKjPO5)}pVkKF7Fc6Ia`>G#`dofFNR4!i?1z1|{I<3+NbU^R2` zd#0tOHah~388Hzn4~shg%A~AlaAQ2CHhST6w3VraFcvOkZ7fo*scz+Ndf(I0ZMWYY zL1JmXwGGH&U=4_fj?98-Cbvw{PH`cPzp-n>-|VLL=+EfhkIuHvGc=a1!j@*S)+JmJ z_Gau2v9KOSJ<@g8L{WNEdNY6gZJyBetWIDkAFkaCrLI!)s1<)Ozpwq_3>IQK+k>Ua zIfp$jfv*q=h9iK#1{f+XO2Y%;8#RXL^yNUM$Hyc806HYyJc5)M)J^V<&zz2Yc~TbQ zTp6a3C1p5V-uR^mP>bN#{ac(MGd@7e0(9L5N5v$~O>){HBMRDXz{TuGObDu#ph|7ecM zYyi)q?J@qw01nH|ukWI{p3&EaL;1i;)ji`5gjr`re*R^?&+no+;`UH30g8D^%11$)R1^GMv!stP z9O2rV5&@_iu#>Of04BG`q1_-gQz|WosjZ!Ve}YE`Rtj>j=p`g1BsL%j0e;!2&;{6z zN;Ng8Z~_&fIk}_aGgV#JQl2oAd{vzMICS5%zIj~~Q6Rf9o^&2hF7`&;=|B+uDV;oS z)flfynGQ2jnXiiz{aWYp1(=;d_0`0H zbV(%d=IwqL$O8WX^XK{V=kz>-Po6ya^!;{s+SV#qqrs}f8Uad;}UZ7^~;}S4{HO_rnu)HTv7}(g@8jZE=tSxfMuQy#~OYKP8Tbv|SzP+kxdIgC) z)>nf=GP+>`$fQa3a#yc4Gg=Z)@uxIgq^N`5=i@?Xz)@jr7{=S&jUD8dy6{m-Ls<4%pUbM#n=5oY#qms}znlXtuSpd&#vz!du zC=Hn^@rV1=js%g%4p3tAMdAJfeT4gcFfJoQ!%PP|MI?IPzTO=Ru2-svAX*n^4M%C>$ha*~a$TnBW+CIyzdjpmWR*V4gQM z8(TZhyH-IQY!r+Q3|_Fh4`Cz$$Z3C?b|Q_9U=m$NE@s7$1CkyXSZA;!WM2L zv`9PDraQ;baF29`W9y|m*$1Q&aocRvYXWx1nryl`Vc0x*lk?gD{^JD#gJrd11nAN( z>lnOC*qu9fu70xk)|sWAe=*ztap!(hO)USgw3IC#`{=E;-b7T~mdn z?Tu)MI1Dq%^JwC63nj4i8C^xh^g!0goRv2k;g^@ZIBmH(_;=^2=4Bnw5Otdj!*_Kz zlqCmKD734jz!-esXPvwuOim3F+07_r3zf=bDB8OLcB!=|M9-|{0nO^RHGp>tgg25F zZ;;@U3#fus+TLpR=^#Hl{<8{$zq4N7ctu$ibywUf!i|Ttpwf8}YWmzuSW#53a|oy3 zJC`KInzj5{z7eNf6=9`9Bvc(6)+=gdR%5$48PHOPTN)Y@?eBtztSQtl){*PA^2!bS zT&g_345x1_4JlB(hp8}!V%(B^rKq<0qK`J^4i(*Cif>yjIun30eTLbFX;J&bJb3s< zz>UQFQow73&>m6;`(%uIvb(!U%4q3nT4=8;*$qSe97exJRC|~c4KvyN9_UXlSrNuI z;2ic~*k%t$9!1J`kU1K!VRL(PpeeVz>!WSyYP0QIV%Jh)tU7EW#DKE0@~5*aek|BQ z@nyzlF;pJbXh}iqH@mNA3NTj$+uq4S_{lbp6)RG1CpqkFMkBHp2=XNImEI5sY}J4r z?a}n$+D?3Zo&{0=-7@}bQB&v9@*z?IcDa#buFdfgnTvC4cOW-KZ;Ecyx zu}&^dPArJ`_Fo#k0n!zS7^-N6nXzV^NQ zM!KPq(G-Z?xHXBz;B6}{Yn&GVbfmFpdiiU-ZsQz~ZQ<1D^)2nic!RO7f{%uJD)Rddm8!v_tk9zw#`|0;4nr|Zm|K>X=c&&?r7 zJFr$7mTl|GQ5vS=;+=iHK7I&gR-SkibFu#C{e!bL%y%e^H^z>0kUvTr?{!j~813cX z<=aGrr|fUMqi%^)TjJn7k19{cr%<;QatG|u13@%W{Sw}V5aBHUUadmsF~4!Urg;e^ zkiG{xL?=IN6(%Bi_*I`i%Jgv4xUI#hKk}{bL z34XbFxYj~UmL<^oeZ@!yH99TQUSRh%xaM?55*GlxYLUBArcfy_sPqDAv;AcKiaXlC z;Q(s48AQ-!2>h?zVPp zO>AQKbp@M&(~q6Q-u^B#w*MmNY+bN^LC?cDee25ny`04sT;$HymSU==*d@ z7ad1*KyL%3KDcX{z)lMzH~1$ZXNH+>PzXPQ(vLuNn!8W`;dP%c`}eV4nb(dSkH5u$ zn|c?Y;?4Z<#iA}%R~&HEArjPPl}`>y&=T)(O15BcXrI1$9TB*oSX@Nz@DZKB=&V`E zu&*~EK07r!^AmkL-=2opPX$Lm?cxsA0eSZPr&bG-6tgT8iN4D-EUx_cyAk5rpi;+u z!v8G3q$fiV=Kz@P<%r3Kz z-($OX`%7Yvx7T*Qkc4D#H|vGu1-5=-@A~ z_|-Eq|BZh~cfqE=b$3Qwe`Xe9|6x@Qz`fy_ZKLwM@~6q`D$mr&kRmR<|^T}!CnBMRxM!Y(gmSUN4KS7dH;YOyxII^itCH99`< zIq>Bf=-@l$oMmaDx;`;)`8R2j1HId^>!2*I%y?P4BWr&Livt&Y;~y)81?&34u7tjv z5EDHqEog$T@H)qInw~`S^5ngK@*^9Ka)f9{qu2ZUa4O-PuD4&6fXngqFB-`^jU$T$ z8KVcIHa%xsw$7HdI&WTa*Zhcos9M}St1tWqH9*v$%vy+fq+D8Xu&55!D5JX!jpt&f zEorDPf4O-6nI;`GxIA!A?DgP~(dK^4)KGDqdhE#PXhkEFWNF}48=^)>gf z6{bXiH55fBTftPZJ6P+%Vm9?E>J(H7@YxivK%JO8$gglZT`a4uGSXsCPkdT?v1rxA z^}Y}1^-XUCgQ`CE%6~x9sM=j-RMiNul8kx@7tgicaHEg>_l7C*`T3v0E5a)0tzB}y zikoV?#PwH|>t2kJv2k+0#20c}2phEZr`ma>ap_2$=^^K-T6q``Y!D``i%51k^vBps zruV6eRc@*M))@i#g>`s+g_z^9c;EEhdsBph};FG$LocydUCWHFF_A#&*Vv=&MFTta`wm4ZN@NGXpsm8D?%>$OK1P z8GE$(ncwBYu(@0RHI!{IQFKkzg|k=R*w%A+yrA`zOVKfWhkk~G0Qq8ErFB6uviz3S z(_;eZ+ryf6^;S6rqT}U_xbFoa0|MNKteThe4>UK&p8{}5ewg&~o!N;C;&l0N{JJ+I z`SWws%PabP3*Nof)|6LP*s|vr&$=5CXMcC|Oz82DDMP_^!))tc-DB?4U{0T&I(W6s zvK?Wyrn>e>QoBI~zHvz(>lU5+wEjIuc@61&*)Y__*t(p}g<}Ns0NK^Y89BImuW-<{ zB>K&uYme0J+pndVn3&vv!#gS}ik@91kxQY(sW(lxLlLZdCy-(ZKAmuDwvi*4ytO*b z7_H)#UcfZmJ1Mhd?5A0;k_dBj3GWwtlSmLKD!t7x@Z0ASCQ+sR)g+L3wBpU1t2V(i zsaet{eW1wr4>BiDPp$&b{(qx58R$ zPvAmwqv-jBh8_LHdK_DnZ(L`zhxAPJK5^l&9g}SPxNB3EdKkMZYJ7_|A*CBt0G;v5M* zbCm9t&EA!ynId|AHWnL@Bo|_@!p6#a{p?BJeg{b^_H57^@Y@zApRVfo=df=DZ?8H1 z!f-Uw#cYN^QFS_z3It@(lK|2=6S1)=J@i)bN8w$swoRgyFXz+21#sUBr`>T?mUJ4! z_3QLZiyrOO>Cbj0O0pS(_9$2K21)_gbW--%v14=(bhB%fgafnsMjp6T``t&Uc=`=k zPX5Mv@;5r@@!`XV+7_wLcGHc$nH}<M{as;IsV}(rF2isd7~Rik3X@08+?p|Tq^m=qA>BD zjoaTXcJ0ge`Wq)WdV^F>9iC1R%$E4T)%Qi_M?{qym#d5HH#%!7 z()v=boZwuw^Tj}BUHSEPaO!g2AGTj^{ou~>4|)u~LNavr>7Eks>HL+&?caH_|6WEj n=>r0JVN+*%=|yxX2S?uQXfAT*7(7l@1 literal 0 HcmV?d00001 From 3388f9ad138c0de4b32abde12754c75c91be1a1f Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 14 Aug 2017 19:38:49 -0700 Subject: [PATCH 12/54] further adds to library --- .../attack-surface-reduction-exploit-guard.md | 229 ++---------------- .../audit-windows-defender-exploit-guard.md | 29 +++ .../controlled-folders-exploit-guard.md | 183 ++------------ .../customize-attack-surface-reduction.md | 68 ++++++ ...tomize-controlled-folders-exploit-guard.md | 146 +++++++++++ .../enable-attack-surface-reduction.md | 133 ++++++++++ ...enable-controlled-folders-exploit-guard.md | 96 ++++++++ .../evaluate-attack-surface-reduction.md | 13 +- .../evaluate-controlled-folder-access.md | 7 +- 9 files changed, 527 insertions(+), 377 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 3895a112b8..9f43493f57 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -19,7 +19,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -35,70 +35,32 @@ ms.author: iawilt - Windows Defender Security Center app - +Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. + +The feature is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as: + +- Executable files and scripts used in Office apps or web mail that attempt to download or run files +- Scripts that are obfuscated or otherwise suspicious +- Behaviors that apps undertake that are not usually inititated during normal day-to-day work + +When a rule is triggered, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. + +You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Attack Surface Reduction would impact your organization if it were enabled. ## Requirements The following requirements must be met before Attack Surface Reduction will work: Windows 10 version | Windows Defender Antivirus +- | - Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled - -## Enable Attack Surface Reduction rules - -You can use Group Policy to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode. - -For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. - -6. Double-click the **Configure Attack Surface Reduction rules** setting and set the option to **Enabled**. You can then set the individual state for each rule in the options section: - - Click **Show...** and enter the Rule ID in the **Value name** column and your desired state in the **Value** column as follows: - - Block mode = 1 - - Disabled = 0 - - Audit mode = 2 - - - ![](images/asr-rules-gp.png) - ->[!NOTE] ->Rule IDs willl be populated on machines that are enrolled in an E5 license. These machines will also properly report their Attack Surface Reduction rule history in the Windows Defender Security Center web console. - - ->[!NOTE] ->The tool reveals the RuleIDs. How will the IDs be hidden/how will the experience differ without an E5? - - - -## Exclude files and folders - -You can exclude files and folders from being evaluated by Attack Surface Reduction rules. You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the files should be excluded from individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). - - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. - -6. Double-click the **Exclude files and paths from Attack Surface Reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. - - - - ## Review Attack Surface Reduction events in Windows Event Viewer -You can also review the Windows event log to see the events there were created when using the tool: +You can review the Windows event log to see events there are created when an Attack Surface Reduction rule is triggered: + +1. Download the [Exploit Guard Evaluation Package](#) and extract the file *asr-events.xml* to an easily accessible location on the machine. 1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. @@ -118,162 +80,19 @@ You can also review the Windows event log to see the events there were created w +### Event fields -## MDM policy settings for Controlled Folder Access - -./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders - -## Audit/block modes - -Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. - -Component |Description |Rule/mitigation description | --|-|-|- -Controlled Folder Access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. -| | | Allowed apps |Apps that are allowed to write into protected folders - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -### Audit/block modes - -Each of these components can individually be enabled in audit or blocking mode. - -Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. - -Component |Description |Rule/mitigation description | --|-|-|- -Attack Surface Reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content -| | | | Block obfuscated js/vbs/ps/macro code -| | | | Block office application from launching child processes -| | | | Block office application from injecting into other processes -| | | | Block Win32 imports from macro code in Office -| | | Rules to prevent script threats |Block js/vbs from executing payload downloaded from Internet -| | | | Block obfuscated js/vbs/ps/macro code -| | | Rules to prevent email threats |Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). - - -## Policy settings for Windows Defender EG - -The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. - - -### Attack Surface Reduction - -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules --- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 - - -#### Rule-GUIDs for ASR - -Rule description | GUIDs --|- -Office rules | -Block office application from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} - | OMA URI : “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” - | Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 - | 1 = Block, 2 = Audit, 0 = Disabled. -Block office application/macros from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} - | Replace the above GUID with the corresponding Rule GUID -Block office application from launching child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} - | Replace the above GUID with the corresponding Rule GUID -Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} - | Replace the above GUID with the corresponding Rule GUID -Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} - | Replace the above GUID with the corresponding Rule GUID -Script rules | -Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} - | Replace the above GUID with the corresponding Rule GUID [Note: same rule as above, but also covers scripts hence written here] -Block js/vbs from executing payload downloaded from Internet. | {d3e037e1-3eb8-44c8-a917-57927947596d} - | Replace the above GUID with the corresponding Rule GUID -Email rule | -Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 - | Replace the above GUID with the corresponding Rule GUID [Currently working for Mail-client (Outlook). Personal Webmail (Outlook.com, Gmail, Yahoo) work in progress] - - - - - -### Manually enabling the Attack Surface Reduction rules - -You can also manually use GP or MDM-URIs to enable the ASR rules: - -From the rules tables above, choose the ASR rules that you want to enable and set the following policy. For each rule select the right GUID. - -After you’ve chosen your rules, use one of the tools above to simulate a rule to fire. -- “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” -- Value as String Data Type: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:2 - - -### View event logs - -Note: event logs are not the primary mechanism for investigation. The Windows Defender ATP portal receives much richer information that allows for investigation. Information is also presented in an interactive machine-timeline view. - - -#### Event fields - **ID**: matches with the Rule-ID that triggered the block/audit. - **Detection time**: Time of detection - **Process Name**: The process that performed the “operation” that was blocked/audited -- **Description**: - -Windows Defender Antivirus has audited an operation that is not allowed by your IT administrator. - -For more information please contact your IT administrator. --- ID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A --- Detection time: 2017-06-21T11:52:29.062Z --- User: SYSTEM --- Path: C:\Windows\System32\notepad.exe --- Process Name: C:\Program Files\Microsoft Office\Office16\winword.exe --- Signature Version: 1.245.730.0 --- Engine Version: 1.1.13902.0 --- Product Version: 4.12.16228.1000 +- **Description**: Additional details about the event or audit, including the signature, engine, and product version of Windows Defender Antivirus -### View the alert notification - -If you configure the test to block, a notification will be displayed from the Action Center. This notification is customizable with your organization and contact information. - - -## Customize the notification - -Customizing the Windows Defender Security Center is a simple task that provides users with a clear way to contact support. -Simply navigate in Group Policy to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Security Center\Enterprise Customization**. From there, you will be able to enable your custom notification, set your organization name and contact information. + ## In this section +Topic | Description +---|--- +[Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) | Use a tool to see a number of scenarios that demonstrate how the feature works, and what events would typically be created. +[Enable Attack Surface Reduction](enable-attack-surface-reduction.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage Attack Surface Reduction in your network. +[Customize Attack Surface Reduction](customize-attack-surface-reduction.md) | Exclude specified files and folders from being evaluated by Attack Surface Reduction and customize the notification that appears on a user's machine when a rule blocks an app or file. diff --git a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md index f21450a54f..04a89fd2a7 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md @@ -26,3 +26,32 @@ This topic lists the auditing functionality available for each feature, the mana + +## Audit/block modes + +Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. + +Component |Description |Rule/mitigation description | +-|-|-|- +Controlled Folder Access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. +| | | Allowed apps |Apps that are allowed to write into protected folders + + + + +### Audit/block modes + +Each of these components can individually be enabled in audit or blocking mode. + +Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. + +Component |Description |Rule/mitigation description | +-|-|-|- +Attack Surface Reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content +| | | | Block obfuscated js/vbs/ps/macro code +| | | | Block office application from launching child processes +| | | | Block office application from injecting into other processes +| | | | Block Win32 imports from macro code in Office +| | | Rules to prevent script threats |Block js/vbs from executing payload downloaded from Internet +| | | | Block obfuscated js/vbs/ps/macro code +| | | Rules to prevent email threats |Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index 14a5a0a94a..caa0110e7e 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -19,7 +19,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -45,7 +45,9 @@ A notification will appear on the machine where the app attempted to make change Controlled Folder Access monitors the changes that apps make to files in certain protected folders. If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt. -The protected folders include common system folders, and you can additional folders. You can also allow or whitelist apps to give them access to the protected folders. +The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders-exploit-guard.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. + +As with other features of Windows Defender Exploit Guard, you can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Controlled Folder Access would impact your organization if it were enabled. ## Requirements @@ -54,165 +56,18 @@ The following requirements must be met before Controlled Folder Access will work Windows 10 version | Windows Defender Antivirus Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled -## Enable Controlled Folder Access - -You can enable Controlled Folder Access with either the Windows Defender Security Center app or Group Policy. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. - -For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). - - -For further details on how audit mode works, and when you might want to use it, see the section [Use auditing mode to measure impact](#use-auditing-mode-to-measure-impact). - -### Use the Windows Defender Security app to enable Controlled Folder Access - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Set the switch for the feature to **On** - - ![](images/cfa-on.png) - -### Use Group Policy to enable Controlled Folder Access - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. - - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. - - - ![](images/cfa-gp-enable.png) - ->[!IMPORTANT] ->To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. - -### Use PowerShell to enable Controlled Folder Access - - -### Use MDM CSPs or Intune to enable Controlled Folder Access - - -### Use System Center Configuration Manager to enable Controlled Folder Access - - - - - ## Protect additional folders - -Controlled Folder Access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. - -You can add additional folders to be protected, but you cannot remove the default folders in the default list. - -Adding other folders to Controlled Folder Access can be useful, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. - -You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. - -You can use the Windows Defender Security Center app or Group Policy to add and remove additional protected folders. - -### Use the Windows Defender Security app to protect additional folders - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - - -### Use Group Policy to protect additional folders - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? - -> [!IMPORTANT] -> Environment variables and wildcards are not supported. - - -### Use PowerShell to protect additional folders - - -### Use MDM CSPs or Intune to protect additional folders - - -### Use System Center Configuration Manager to protect additional folders - - - - ## Allow specifc apps to make changes to controlled folders - -You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the Controlled Folder Access feature. - -You can use the Windows Defender Security Center app or Group Policy to add and remove apps that should be allowed to access protected folders. - -### Use the Windows Defender Security app to whitelist specific apps - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** - -4. Click **Add an allowed app** and follow the prompts to add apps. - - ![](images/cfa-allow-app.png) - -### Use Group Policy to whitelist specific apps - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? - - - -### Use PowerShell to whitelist specific apps - - -### Use MDM CSPs or Intune to whitelist specific apps -./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders - -### Use System Center Configuration Manager to whitelist specific apps - - ## Review Controlled Folder Access events in Windows Event Viewer -You can also review the Windows event log to see the events there were created when using the tool: +You can review the Windows event log to see events there are created when Controlled Folder Access blocks (or audits) an app: -1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. +1. Download the [Exploit Guard Evaluation Package](#) and extract the file *cfa-events.xml* to an easily accessible location on the machine. -2. On the left panel, under **Actions**, click **Import custom view...** +2. Type **Event viewer** in the Start menu to open the Windows Event Viewer. -3. Navigate to the Exploit Guard Evaluation Package, and select the file *cfa-events.xml*. Alternatively, [download the XML directly](scripts/cfa-events.xml). +3. On the left panel, under **Actions**, click **Import custom view...** + +4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [download the XML directly](scripts/cfa-events.xml). 4. Click **OK**. @@ -225,16 +80,10 @@ Event ID | Description 1123 | Blocked Controlled Folder Access event + ## In this section - - - - -## Audit/block modes - -Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. - -Component |Description |Rule/mitigation description | --|-|-|- -Controlled Folder Access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. -| | | Allowed apps |Apps that are allowed to write into protected folders \ No newline at end of file +Topic | Description +---|--- +[Evaluate Controlled Folder Access](evaluate-controlled-folder-access.md) | Use a dedicated demo tool to see how Controlled Folder Access works, and what events would typically be created. +[Enable Controlled Folder Access](enable-controlled-folders-exploit-guard.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage Controlled Folder Access in your network +[Customize Controlled Folder Access](customize-controlled-folders-exploit-guard.md) | Add additional protected folders, and allow specified apps to access protected folders. diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md new file mode 100644 index 0000000000..1cf8f4b7c2 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -0,0 +1,68 @@ +--- +title: Use Windows Defender Exploit Guard to protect your corporate network +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + +# Customize Attack Surface Reduction + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- Microsoft Intune +- Windows Defender Security Center app + + +Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. + +This topic describes how to customize Attack Surface Reduction by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer. + +## Exclude files and folders + +You can exclude files and folders from being evaluated by Attack Surface Reduction rules. You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the files should be excluded from individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). + + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. + +6. Double-click the **Exclude files and paths from Attack Surface Reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. + + +## Customize the notification + +Customizing the Windows Defender Security Center is a simple task that provides users with a clear way to contact support. +Simply navigate in Group Policy to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Security Center\Enterprise Customization**. From there, you will be able to enable your custom notification, set your organization name and contact information. + + +## Related topics + +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md new file mode 100644 index 0000000000..e252b4bacb --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -0,0 +1,146 @@ +--- +title: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + + +# Protect important folders with Controlled Folder Access + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- Microsoft Intune +- Windows Defender Security Center app + + +Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). + +This topic describes how to customize the following settings of the Controlled Folder Access feature with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs): + +- [Add additional folders to be protected](#protect-additional-folders) +- [Add apps that should be allowed to access protected folders](#allow-specifc-apps-to-make-changes-to-controlled-folders) + + ## Protect additional folders + +Controlled Folder Access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. + +You can add additional folders to be protected, but you cannot remove the default folders in the default list. + +Adding other folders to Controlled Folder Access can be useful, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults. + +You can also enter network shares and mapped drives, but environment variables and wildcards are not supported. + +You can use the Windows Defender Security Center app or Group Policy to add and remove additional protected folders. + +### Use the Windows Defender Security app to protect additional folders + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + + +### Use Group Policy to protect additional folders + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? + +> [!IMPORTANT] +> Environment variables and wildcards are not supported. + + +### Use PowerShell to protect additional folders + + +### Use MDM CSPs or Intune to protect additional folders + + +### Use System Center Configuration Manager to protect additional folders + + + + ## Allow specifc apps to make changes to controlled folders + +You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the Controlled Folder Access feature. + +You can use the Windows Defender Security Center app or Group Policy to add and remove apps that should be allowed to access protected folders. + +### Use the Windows Defender Security app to whitelist specific apps + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** + +4. Click **Add an allowed app** and follow the prompts to add apps. + + ![](images/cfa-allow-app.png) + +### Use Group Policy to whitelist specific apps + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? + + + +### Use PowerShell to whitelist specific apps + + +### Use MDM CSPs or Intune to whitelist specific apps +./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders + +### Use System Center Configuration Manager to whitelist specific apps + + + + +## Related topics +- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) +- [Enable Controlled Folder Access](enable-controlled-folders-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md new file mode 100644 index 0000000000..68d4c7d692 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -0,0 +1,133 @@ +--- +title: Use Windows Defender Exploit Guard to protect your corporate network +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + +# Enable Attack Surface Reduction + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- Microsoft Intune +- Windows Defender Security Center app + + + +Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. + +## Individually enable Attack Surface Reduction rules + +You can use Group Policy to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. + +6. Double-click the **Configure Attack Surface Reduction rules** setting and set the option to **Enabled**. You can then set the individual state for each rule in the options section: + - Click **Show...** and enter the Rule ID in the **Value name** column and your desired state in the **Value** column as follows: + - Block mode = 1 + - Disabled = 0 + - Audit mode = 2 + + + ![](images/asr-rules-gp.png) + +>[!NOTE] +>Rule IDs willl be populated on machines that are enrolled in an E5 license. These machines will also properly report their Attack Surface Reduction rule history in the Windows Defender Security Center web console. + + +>[!NOTE] +>The tool reveals the RuleIDs. How will the IDs be hidden/how will the experience differ without an E5? + + + + + + +## Policy settings for Windows Defender EG + +The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. + + +### Attack Surface Reduction + +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules +-- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 + + +#### Rule-GUIDs for ASR + +Rule description | GUIDs +-|- +Office rules | +Block office application from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} + | OMA URI : “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” + | Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 + | 1 = Block, 2 = Audit, 0 = Disabled. +Block office application/macros from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} + | Replace the above GUID with the corresponding Rule GUID +Block office application from launching child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} + | Replace the above GUID with the corresponding Rule GUID +Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} + | Replace the above GUID with the corresponding Rule GUID +Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + | Replace the above GUID with the corresponding Rule GUID +Script rules | +Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + | Replace the above GUID with the corresponding Rule GUID [Note: same rule as above, but also covers scripts hence written here] +Block js/vbs from executing payload downloaded from Internet. | {d3e037e1-3eb8-44c8-a917-57927947596d} + | Replace the above GUID with the corresponding Rule GUID +Email rule | +Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 + | Replace the above GUID with the corresponding Rule GUID [Currently working for Mail-client (Outlook). Personal Webmail (Outlook.com, Gmail, Yahoo) work in progress] + + + + + +### Manually enabling the Attack Surface Reduction rules + +You can also manually use GP or MDM-URIs to enable the ASR rules: + +From the rules tables above, choose the ASR rules that you want to enable and set the following policy. For each rule select the right GUID. + +After you’ve chosen your rules, use one of the tools above to simulate a rule to fire. +- “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” +- Value as String Data Type: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:2 + + +## Related topics + +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Customize Attack Surface Reduction](customize-attack-surface-reduction.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md new file mode 100644 index 0000000000..cc30fb4feb --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -0,0 +1,96 @@ +--- +title: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + + +# Enable Controlled Folder Access + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- Microsoft Intune +- Windows Defender Security Center app + + +Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). + +This topic describes how to enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). + +## Enable Controlled Folder Access + +You can enable Controlled Folder Access with either the Windows Defender Security Center app or Group Policy. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + + +For further details on how audit mode works, and when you might want to use it, see the section [Use auditing mode to measure impact](#use-auditing-mode-to-measure-impact). + +### Use the Windows Defender Security app to enable Controlled Folder Access + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Set the switch for the feature to **On** + + ![](images/cfa-on.png) + +### Use Group Policy to enable Controlled Folder Access + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + +### Use PowerShell to enable Controlled Folder Access + + +### Use MDM CSPs or Intune to enable Controlled Folder Access + + +### Use System Center Configuration Manager to enable Controlled Folder Access + +## Related topics + +- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) +- [Customize Controlled Folder Access](customize-controlled-folders-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index e5a4563ded..1189ff3bee 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -231,14 +231,19 @@ You can also use Group Policy, Intune, MDM, or System Center Configuration Manag During your evaluation, you may wish to configure each rule individualy or exclude certain files and processes from being evaluated by the feature. -See the following sections in the main [Use Attack Surface Reduction rules](controlled-folders-exploit-guard.md) topic for configuring the feature with MDM policies, PowerShell, the Windows Defender Security Center, Group Policy, Intune, or System Center Configuration Manager: +See the following topics for configuring the feature with management tools, including Group Policy and MDM CSP policies: -- [Exclude files and folders](attack-surface-reduction-exploit-guard.md#exclude-files-and-folders) -- [Configure rules individually](attack-surface-reduction-exploit-guard.md#configure-rules-individually) +- [Exclude files and folders](customize-attack-surface-reduction.md#exclude-files-and-folders) +- [Configure rules individually](enable-attack-surface-reduction.md#individually-enable-attack-surface-reduction-rules) ## Related topics -- [Attack Surface ] +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Use audit mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md) + + + diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index f3d1e5d770..cc858ccc0d 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -108,7 +108,12 @@ For further details on how audit mode works, and when you might want to use it, During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. -See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with MDM policies, PowerShell, the Windows Defender Security Center, Group Policy, Intune, or System Center Configuration Manager: +See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with management tools, including Group Policy and MDM CSPs: - [Protect additional folders](controlled-folders-exploit-guard.md#protect-additional-folders) - [Allow specifc apps to make changes to controlled folders](controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) + +## Related topics +- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Use audit mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md) \ No newline at end of file From baf8eafea860a0070d6b10d2798df4e286298f3f Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 10:36:31 -0700 Subject: [PATCH 13/54] keywords --- .../customize-controlled-folders-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index e252b4bacb..fdcb0cda86 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -1,6 +1,6 @@ --- title: -keywords: +keywords: controlled folder access search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 From 3f0896b0e6309580f55c5b0daf669723729d080c Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 10:41:17 -0700 Subject: [PATCH 14/54] remove wip build # --- .../customize-controlled-folders-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index fdcb0cda86..ac0759956a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -19,7 +19,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** From dc265e1976f2c6e573a84221a80b6070ae22d4d4 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 14:00:48 -0700 Subject: [PATCH 15/54] cfa topics drafted --- .../controlled-folders-exploit-guard.md | 16 ++--- ...tomize-controlled-folders-exploit-guard.md | 65 +++++++++++++++--- ...enable-controlled-folders-exploit-guard.md | 23 ++++--- .../evaluate-controlled-folder-access.md | 12 ++-- .../images/cfa-allow-app-ps.png | Bin 0 -> 47169 bytes .../images/cfa-allow-folder-ps.png | Bin 0 -> 38259 bytes 6 files changed, 82 insertions(+), 34 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app-ps.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-folder-ps.png diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index caa0110e7e..ea1bc34493 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -1,6 +1,7 @@ --- -title: -keywords: +title: Prevent ransomware and other threats from encrypting and changing important files +description: Files in default folders, such as Documents and Desktop, can be protected from being changed by malicious apps. This can help prevent ransomware encrypting your files. +keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -28,23 +29,20 @@ ms.author: iawilt **Manageability available with** +- Windows Defender Security Center app - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. +All apps (any executable file, including .exe, .scr, .dll files and others) are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. -All apps (any executable file, including .exe, .scr, .dll files and others )are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. +This is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/en-us/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage. A notification will appear on the machine where the app attempted to make changes to a protected folder. -Controlled Folder Access monitors the changes that apps make to files in certain protected folders. -If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt. - The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders-exploit-guard.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. As with other features of Windows Defender Exploit Guard, you can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Controlled Folder Access would impact your organization if it were enabled. diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index ac0759956a..e7a69616c2 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -1,6 +1,7 @@ --- -title: -keywords: controlled folder access +title: Add additional folders and apps to be protected by Windows 10 +description: Add additional folders that should be protected by Controlled Folder Access, or whitelist apps that are incorrectly blocking changes to important files. +keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, customize, add folder, add app, whitelist, add executable search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,7 +15,7 @@ ms.author: iawilt -# Protect important folders with Controlled Folder Access +# Customize Controlled Folder Access **Applies to:** @@ -28,11 +29,10 @@ ms.author: iawilt **Manageability available with** +- Windows Defender Security Center app - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). @@ -87,11 +87,26 @@ You can use the Windows Defender Security Center app or Group Policy to add and ### Use PowerShell to protect additional folders +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: -### Use MDM CSPs or Intune to protect additional folders + ```PowerShell + Add-MpPreference -ControlledFolderAccessProtectedFolders "" + ``` -### Use System Center Configuration Manager to protect additional folders +Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to add more folders to the list. Folders added using this cmdlet will appear in the Windows Defender Security Center app. + + +![](images/cfa-allow-folder-ps.png) + + +>[!IMPORTANT] +>Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + +### Use MDM CSPs to protect additional folders + +Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders. @@ -99,8 +114,15 @@ You can use the Windows Defender Security Center app or Group Policy to add and You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you’re finding a particular app that you know and trust is being blocked by the Controlled Folder Access feature. +>[!IMPORTANT] +>By default, Windows adds apps that it considers friendly to the allowed list - apps added automatically by Windows are not recorded in the list shown in the Windows Defender Security Center app or by using the associated PowerShell cmdlets. +>You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness. + + You can use the Windows Defender Security Center app or Group Policy to add and remove apps that should be allowed to access protected folders. +When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders - if the app (with the same name) is located in a different location, then it will not be added to the whitelist and may be blocked by Controlled Folder Access. + ### Use the Windows Defender Security app to whitelist specific apps 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -131,12 +153,33 @@ You can use the Windows Defender Security Center app or Group Policy to add and ### Use PowerShell to whitelist specific apps +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: -### Use MDM CSPs or Intune to whitelist specific apps -./Vendor/MSFT/Policy/Config/Defender/EnableGuardMyFolders + ```PowerShell + Add-MpPreference -ControlledFolderAccessAllowedApplications "" + ``` -### Use System Center Configuration Manager to whitelist specific apps + For example, to add the executable *test.exe*, located in the folder *C:\apps*, the cmdlet would be as follows: + ```PowerShell + Add-MpPreference -ControlledFolderAccessAllowedApplications "c:\apps\test.exe" + ``` + +Continue to use `Add-MpPreference -ControlledFolderAccessAllowedApplications` to add more apps to the list. Apps added using this cmdlet will appear in the Windows Defender Security Center app. + + +![](images/cfa-allow-app-ps.png) + + +>[!IMPORTANT] +>Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + + + +### Use MDM CSPs to whitelist specific apps + +Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders. diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md index cc30fb4feb..78ee516587 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -1,6 +1,7 @@ --- -title: -keywords: +title: Turn on the protected folders feature in Windows 10 +keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, enable, turn on, use +description: Learn how to protect your important files by enabling Controlled Folder Access search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -19,7 +20,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -28,11 +29,10 @@ ms.author: iawilt **Manageability available with** +- Windows Defender Security Center app - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). @@ -83,11 +83,18 @@ For further details on how audit mode works, and when you might want to use it, ### Use PowerShell to enable Controlled Folder Access +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: -### Use MDM CSPs or Intune to enable Controlled Folder Access + ```PowerShell + Set-MpPreference -EnableControlledFolderAccess 1 + ``` -### Use System Center Configuration Manager to enable Controlled Folder Access +### Use MDM CSPs to enable Controlled Folder Access + +Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders. + ## Related topics diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index cc858ccc0d..738d3d6036 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: See how Windows 10 can protect your files from being changed by malicious apps +description: Use a custom tool to see how Controlled Folder Access works in Windows 10. +keywords: controlled folder access, windows 10, windows defender, ransomware, protect, evaluate, test, demo, try search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -19,6 +19,8 @@ ms.author: iawilt Controlled Folder Access is a feature that is part of Windows Defender Exploit Guard [that helps protect your documents and files from modification by suspicious or malicious apps](controlled-folders-exploit-guard.md). +It is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/en-us/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage. + This topic helps you evaluate Controlled Folder Access. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organisation. >[NOTE] @@ -93,8 +95,6 @@ To enable audit mode, use the following PowerShell cmdlet: Set-MpPreference -EnableControlledFolderAccess AuditMode ``` -![](images/cfa-audit-gp.png) - >[!TIP] >If you want to fully audit how Controlled Folder Access will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [Controlled Folder Access topic](controlled-folders-exploit-guard.md). @@ -108,7 +108,7 @@ For further details on how audit mode works, and when you might want to use it, During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. -See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with management tools, including Group Policy and MDM CSPs: +See the following sections in the main [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) topic for configuring the feature with management tools, including Group Policy, PowerShell, and MDM CSPs: - [Protect additional folders](controlled-folders-exploit-guard.md#protect-additional-folders) - [Allow specifc apps to make changes to controlled folders](controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app-ps.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app-ps.png new file mode 100644 index 0000000000000000000000000000000000000000..f93dbe34e3a63099afb926c39921ef9123cd37e2 GIT binary patch literal 47169 zcmdSB1yq&o_cnM41*Me+0YMO?8)=miq!Ew~>6GTspooNsAP7iEmxPowh=58-m$Y`;60R+QbQmx z0uc!GJnYMG#UWtoHT=5bDEGt}fx!QU`XB8bD?Sxm#BzD4D2+9ZO>mtV=M$Iuzf02E zF85qrEFGK>xrH5aa2Ku%T#_<#Hg&Rcbg^=!?Pwg(P&c4qc2i2aV(2Do+^ zb(@Bji>(pEmJAoy6$@eMHHXhln}VC(fcqZv}o_q5gcU zH~sG8M6&^vT>Gn8?`97Ii&_<@Jx8Mzuq(90v>5IseDG};mfXeBa*h)C?8>i0MW4vD zFTWV@Gq`jZdCXuODeL%Z>Wv{+A`B6U^{R#Bk)w{Y zcrP|-s>*O1m6ZEfJ#kHE1CrSg)C8xk zPfMoWFVkKQltTTylG@$VkH9jk^EM?7pDq&fp7r}8{1W>zH_ZbbHdB?o+iKLeW{d7k zMUCo85wt0W&N-WFyB{v9@v;>7SUN%$Fm7dcgp z(_Rlx>kVF+w;nWa{;mNtX`x=#_K?x$&w&8uHlg0{kKST(aozqqkYS1%r%R?<8bNA2 zxF1x98RY&>i<@6Sz-^Djm9j2iH6*lQYuft@!@oz#WLRKQSaxVXoOQVL2Osqa`n2IU zNVFCL#FB)XJDuqp5BX5hE2xnZsS>xQuG*S#EQUva^SS@;!4^);*Xn%CoE9jhc* z87gY~UFFO#aWNG{;JEnfBZZcIf{r@U><$5X!(j`j(p(BP49QKH{9#|p z`SYkKA{N3g9$WPGHERM-pFTC3ZH?GsD`Y9P=x%K$kO&VC$7SI<-E1bnTe*PgEUvG& z#?|jK=5ox~xwsJf`1lN$SzVv+h!5)NQT-s|j$b+HdlK_Wy*~0b<@eXGU(b{e88pND zw!Sk&%K1@IP{gZ@WbeqJ!!AjavS{;Au_?AQS0sH!+d8<25p3?g464}>o$#~E6rl4`rWGI>ulH;WK90qkO9$DI(jEtAypW4MnX!D(kFBRfA zrqd(EzuHxf2j6v`f4-OFbGp@bxR@SUY}QVSiH_#t?mk;svyP6aJwIMiD|$1z5r-t_ zG^{T;d?Xs}w$mxd+N;r>EEYy(|K*;%>J18tCPl&V=WuqW<`W%~9ewocy(t{(_DD60 z3?jgemyX)N)LvdvSYA5cd?_&nk51ThqhjZTePz`u)QEBI`f!(-g{2A3n&Zs3D=dox zx`TBG6Je%pubZsP?OyGTyvB=?z)c-}AGM?7FrnFb{n$3+)`lN*Bkh;YYdJVDf2#3l!bg6-^%B)Lye2-Nks zTpzbjpIgeDV7h&KHcFNz3fbttnh zk#Wv6T%0uUV+F^{)#YJnCs?8kp!3$yaw@CTP&CUG%)Y)pRSk{j;5%o)Va|o)UzSF= z!Esso>O1}Q#o^h8UnE@SRK27Zee>VOMM|8L`|Sw&1);o9qzLQ-n8#tZ-|_9kGhc9O z-5S=5M>`A8wq~T^bWMTJ`m&UjxH(Yd`#4GU3$;COqobpuq5}Lb4*XbG51kUpvQG=X;6zO(cy!vHhH#)b$8W}FRqx@8GaIhm-$`XeH zrtxxvAGon5l%t3gKgMqKNM-k{li>qL7y_#Z{@QZCmJzlU&U7oM?-mZ6qos}X^mHNk zfalBi*h$;zAas69ry-YdKv2k2s~;bS*nG6$0-My#CutlosDiUd$IGjJd|?T8g>~uD zrQVYb@Ls6k^e{yXVu8n6`Os#V;VC*QNGuQJXS%ZKeIaZ(8Q;jDdvJPQ)$N1tzwfoz zFMfV#%3`O&W?1VcS$}^0wi1F|nH9B0%@s`@F4srwOWP9#9g=5~Lfj`jv-?Hz%L`z{ zVcO-^B=|RkZ=LDyz7L(kC0D*gI>*Cf(M8>nB%;MFrywJ9S^Q+A8{L0BpZfFX&nkL) zY-^^HM>I{Z`tz%)dpLqn@GEg*F?AX3=`inmZMN5ViEXWgdQF{zOier6ky%d}O^AEa z(&#g?vz31chhznLyJ$gBm1i4TE{*6ryYIPRdV$e|Tme%k zzQx#tj$>5PXo7~oK{WE5<0z(EUBP@+hy^RWd2*&*<&-&Z#D#(!-y}D6n)08dVShWh z64XQoKB$xKFDxqbtW9GKm8@+IL?N3+B)3_5@INrs)A3F6Kgg+xi}2Q8Xd=&ri}~s= z1iFTcaqsV?G|cAzJGX_#mz0!vkOe$4qWcG~VvNYK|9uc6`F~)f)Ro`>I+U{_QVlfz zU+y-hyRkT>+HBDYezvx3GK_x_EIqv#Hy$R%_rHTC>hyku$M}C(rxc?9T03u<|FNF@ zF@IN)`M<5~|9o|m;(sh{|1TSj2M;jVNO7vGtBL(KmX`xtOzu5+@Zf{I%n-xNX6_}L zixrBMh0)Z?l-;iEz9y5B#%ae#9_O!LgzqE5O;YHBd*@=ybu3c)bSR4AVFC#DSYHn`s=8^aJpFcz0pMeol zHcL8Q_Bh)cLPNZG@nUgxRSE{cIb%5r-b3_cwN%LOTy%77Y*wGTw`XGFbp(|lJwHE5 zjr)d-r{~??zP{$Hm5q(I4c~(rp%@j~G40h$LHBTRaZ@ugp5FueQp8q&VBx=z?4?xw z1;ZbOo1SqHF}?+V#V05@i-MW%s&X%}(d`7NUeijvUK^{lxg3Ca6CEAY+uLi!@sYct zWcYfMuYrNV2L-_MLw7C*J|o4(oZ2}mwi^=w-`{9n`mwI=1|a(hX@)ckIzsHmIj5U2 zMEgpryLazyaiHv8AB!Bj^@)uQD`G0&@azsEH7yPOql%n78DrYF{ngTLdg80o@fOL( zS5YUT1s9`9$hl^`c*M3>|NJGbFF9g!CX7>QM7XB9ddjJam;s;T$!AQCIGg}UI$I=n znw6hl!~Aw&6CE3An6a=9xc%*&o%A~vetr^etHU43DaF{?6)QhT9&&Bs;o*fI?dec^JwJA8o}it$0|KJ1%B)xeQp;LrItgI2E!@RVe_ZQ4O1CoIu71~W?It@rdx2Y24~9WaM*TaoeKH{- z%slv{*JW?qxIs=%-iX6lOLxZ3%8J9t$mm!z4hG1*fd(VCw6~YBw!X9KCQ@NLf{yS2 z9M|*vcli9g`RZhYAyL2B?ym=^dn_!n&2voZK2`j71%lDay?@LR+SaMn)uOWk= z`$eNmmexl@wF^#CbJRA6L2bzCsW-~%%F2i#G%_oth_j2?xXyP_*iP1uyLkF7%!K1oJ5y@J zh5fP_Ev5SDy{RqKH@9S-^Z$xJ$$x&S| zl453Kld`k38}^i@ZuZ|6T7_W^t-KgpYlR2=>hI^vJ-+s5&%AVmxJ}>Hl^>s4$RC`M zm3S!&=Ze%=%qT$e5~n%&TqPVF9Mm73R@r%l$0sKxCM{Q=-~U)FJo4ok!vu1Ly>BNj zCdLS;r&?XeQN&N;+z3LVsJpnBvvRms8IWi%W@b#jjN5yNCg%i^FwCIak5$+mP8`%{ ze{meC_Yr|7s;a66fD8F*U2Zb+*(`Ls4oFGD++FWOE;V&^qN^`{O-|Cf5gm=%6rmwv zIrJ$XdzQ<{{I2(@acMe-bGmH6=6z5zc?nT_vR)H*wT zxWbMq*?ap(@lgf5`un$@#^c9J28$AByM5S~gCJ0c3XlGMUWG|ZXfaQlwQspud#o{x zW)Td{*_k(%?a8&0x_2=#jrNr<2fUsMfPjEvfx}M@J~&`ONl8g+kqlfV0-BE>XMUkz^h>J|(y>IXgM2sHft5q>KSO zG%}JD951M9C2w7h!bT`b)~y%`Gh> zLyEWacZaXMva&4f@aNJ}Rek*%uGM8a02aK(X_GzYDLN7L;CjH^A6Qse3_rWrEAkU# zva_bo`dnyjV*{(bS(<_1~JHzPsfGG1yjs3J!GY zp^WyawghGMt#Y7{doLp+R!|lj%qWW5g(~^poO!@urCjeOQ!Y;;in-(KYhyZmYg`%{-UTK{gJUa zWE}642jvQuhs;Z@3{ElLoUiX3F+J9-LkiTSz`&fjyPu+TDb$vCTZr!un<8Qan*cAKL-GkC5 zm1CKFf3y!f9egq9oR&YwYxJWQOV^=}1i{6}_Y_G}u02@fp{b<|rwFW^Nka(%Ga0BG zxtT1&8*Oslh(Ulr00z1h?+e&>JAJLqiYj6;EGjU0OkZNGUB|r{~pvVlW&4s3^LEd9(T7jHu~?rpnWx9 zeJQopsPpH~`)+O(^Nn~jGb)&d+am2VNB7ce+H|C>`#?u5@ji0W(9%+{%7^fcI>*+Y zCB46X`2&w-GpwgZ#ow6vn3R-A0GZ964pnopA?0T>vw9%hf#nUq9txkDyUiROanVy zL|_k+aG>So@0}2m7fq9GTiJ7x3>V_2e5bw+3TjGluO2PLRC8-Y z#t(5S1u3ak)QXR-$+)?>4Kq7igCGo64{F_J21ZkVzeX)!@T@G7C81@U#DRRR^uj`X zF)=Yv#+r(J_wtMH8Lhh2^xF(iPDZLQ-^xr#U^Kw{$X{(-3*egtJA7`(%KEm_hhN?m z=GF6&FJoee5kLEd8BByfX%UdW+O4lN;u4xgYJfX^laz!9aHFuWFvn{!U@3nx*9}wy zH2>V8Z9~p$9$eN4uliQ-lmbIh(8bbpuVPv;8IC`4TK%JH1M{)pC$IA*) z-kpS)HS921-1za@*P?PvkwBawnNu};DuhOYoBS0ypJd^eFWNehi#Phb@YN#auz2Jp zu5~9oBI8|h1ywk>J%mp##ADLL*Y`Z8LqdJ-&mTH|{s9+%cA1X@)sFntl8*^oZiP%F z%LSQzLpt6p{bocnc{(r1aJf{+j5*<(2x!q$X6!HU#(qbRrk~ zyF;niwUl-pFP60$LWLw?)MA$d`yPc)9Dy=4(7!vwxEg)qY@KTI@G?S*`d3CngCVl> z`QQs9h$O-yBANc0bvNi2SC*EV0x+;t)YPu+h|G8$tn*WI^U(l2$+RHf^S(Hl6s&zi zMs|vz9$xIDmF;F0ND$mb;Fwj#tug`deFNIvc|J=Yi#P zIgWRW?u1V-sAobv073k#cO`caw z8|j(9i;b19E9nVwPfW?7Z`QlpClCDMphOG4AEe1A+J( zQj*?xE6d6rS&xI$d;sPT69lTs*YLarXAZ)ht0C`A885HnrEGrLn;qE2w#aH^um&lev# z+6$2!w_V=UVCLkEo3O|dR4W`l5J+UVJv`*M8H6n+0j`-qwg$)Pm%h7_5n*H2X`+-BX2{+W!a zyPT`v^w&!O6j8jTxR`MAWa1#p)|UYVA^?U$dPuWS?-g*B*^)Mz#9zEt*Q1h?Uk70k zqyc$_sS4F!oNYi5#jKn_vU2EsK@<()q;z8?c4nQZ9n)SMwrSV6v7=Z8tPe|s`((Wj zipoQLDI7CT_B;1PeJnsqgCZ@RgQdRg={;oTk+ZXNb{WkssAIFkC8mc%erH z#PRg-S%G#5IwTt)ghtCej2%kU%=4=q>(>|<07jbGL9|yT*Z)#T)&_5}9FQGQL0T$7 zdtBDIoJ0^oYB#^)l;mR5)AzPWI#Sjh&V(U401c3kkf4s%lCqz0t|XV3*bU&g%&e>r zbafMVdrgf_rF;HK6jjsGMo6SE$`;*fTqiF**47Sz;Vzv8UPr;fvWf~5SQ$0P$H1;= zPp7aTXvAy8^;to@Ijm_o5fOz@pOc@D!DZkubN`Oo=s0`jZ+iWXuqiz9qN3~+U*VaS z;in6N^yuG#i@LbEeKjwghD^wZ&21+7+qbdm>gtAT+&K+A=SXs22W;7eyEIk99Ba?^ z#}20n{IDy>@G8e5AW#6rg?0f`> zY+tD>OlxLg(F~(Zxj0JUU+K(Iv>W-%I8!A+3UL=u^Ckp@)K8!A;4mZTZrA`x20#_O zu-MzHru|8?_H?`5(!n9_r&;NUQRP_n9uqNzG4>*vGKMA6?2NM7Wo^-PeD!(B6#&W~c-H(w!=Xh-!n^P%rEjD7Y)Id} zefuUR22(-p8e1`f6o-uzQH(&a%{Khvo8g7@H&ckJ?CtGwKm6hUss;GX3W`n7Ba|%q z{W(g7LNM+Bw`=~p@EhoPJ!D8VlxP?F6|_^mm&Z5y4cRC zN-tro%za}bry}65bZgQ!GhFOxyZV#lx3}pvQO*m?UYu2s9fAF${7WaDV_Kg9r@Vr~ zv|CLSK%tuP*8p%Z5c_LmFTsaE(AnMJx9%F7n81f&t1v$Y=vtsxbq(=rXb7ulC=9|M z2u1n{;t-E*3{NN_l9H^{{8Maz;kCB5ejO}%HY)=WA`PYiG`tmDCQ1*5XF&{rxoL1m z4o89pgu=}2?HCAZAx8u-Qip~!fmn83rguN49pMlH*O`WN=(`G3Pyi?zY6mG9sLf~( zj!1lVK9j<2qse35DKFDo@B|7k?gKz!gVaMKx;9&}Hlh(7Q5=48zmGX9z=(_d8zj6# zQ2GJlK_wg&Fkf)tQSaXI=k6Ke=y8zIAQwLt8(sZEdCU5eF1=*wh%HEQ#;&l)++r<9gc7KW@`(e%uipJ9NU1(WP*YG?_t-IrpuWqS?&hH zbB!K5{1zcL9dKP(B$O99r@_693Wccjdc*l%5eZrXO}f8ASiI}vyKa*bR8#~@3j0Ds z#FtQ~Dv2_~A=1l%L&5JQ7;?xm!XqM<3{H8msc$b&gOaRqIzGEa2TJZzc8UNACc31L zj~J|q;-vt@=J86Ate&i}RxyU~??(TdA!+F;t5r$< z3cL=Kom7}3=)6D(!EzJ&>VY#OQsb5KGC@Xxz1FR;<bObqH)D|?jEkB51ms}|@-V^@w>2FU;Rlkn1urVrs%`gI_EXduqNbi8bO+?w-1q78Zh>f+A{u95gkMM^L~YbVm3v z>E)c?pUv7)RS4(^ROp8Tipoc1A+P^UBryxToz?f3x`vHe49Xs&@%-#$3s~p#%oa^8 zt(To-S6@8JevaPw0*4HNsQm4u&~Nq|6wury$S~#{LfOfhqi~X?ot-qm6F4DTpl9js zkkH!<7Btmt)Z;|91#S3UoOnPcf2&_z`D1SG50|3bD4QTs{2g;CP=>&pX}LMITl|FW z{>L}-iwQCyUBGh`l{t~<7i*K}ox9i{W=86^x3_Zwm8wANSRF0LnLHk>oZ9l(geMw< zmIW@{7|j79I!fL9q+6Mmo{sVO@#A3-DDA7}NDH2nn%`gfTW3V?oOO#|0~eR!f_rCV zPbtH2`BDH9BL@;S82(EZ%i;%B-Drpj?;XWHv+H8-Q0AxDoi2;%si>$33dE*|XmDTA zlhVruMP!Iy!^1*Ld)HAjiQ*P#5DF6A>EKQ9^II)xLm-qT&dPGyTh!2BTrL|F(22}FsT1q+`+;&(nW`IP_>RsT3~qLIra9vA!X#%39G z7&0p#qX!^hNdbO=m7{cAy)TYv5WrD29b2<)QHhE9M^5`t<8(XO10Ajdq-JJkZ<%Qc zLkrLL2L?N{RynCDdL6ubK#||s3M>QUKsx#1s`~Z&H+9A9 z`g(DXI)hFNYIahE;ax0zYX9y99IvBVkB{C!M_?Z_%xcE%0UEB4-vsvmz}0wwawohP7)>@9|H-a~Qh;x{EdHN@wEy4bO#g4@bD5r;ht1_q zvWioC%{%w$kpJ~a^a;pSq7O14pZPXOtUADNkRyY4NXf_)`V!*Blb2UkNap%R*DcG+ z%Rhep%rnE6W*_|WB?E`EhlkKi861+9mKN2x10-LPtLl>{uPQ18nyo^^!XPA>einE2 zN@C-+3tL2zE**xugoo_hjl4;pmfIr9^%@>L?IH{s4!F$pyAhDJ=rj*%p9=(%^ zER)_nL=XuXF@}(L{<&2%W z)8D3L7acSV+cb^G$HQ&{9m+B?QHn95-?%hMn%gciu=L@P!PNw-YHz%#9`Ro}t z4=-{e<{4mMygx0)MZ zpuiZ_D6_g3Fc5uBsgoO89e#hl6M=`7H?xBcF*QvuTTK#iPb(==b@zl7vb3^7Lr9OX zva)iEin6iG7RYk`+CtU=f52mn)6>WQUpv=4C-laZN1d1t5(ee4)4W=>dM-W|j&nZ>e?@l!Au(9IH75HV{j z-=i47*kkr>e0=KCA_@%~CLHx)8vs&9XVFqq_t$ZelEu5ax`x_mVAaBuV3<)^J=P$9WPN?>`Re+Xa7BEt|27rx(^R9nY^3SRg7a6*@iJ?eWFul8MXdQUqj=TA}6(o8!l*9@$vD| z;>tO%Di|azewN;X>;}ooE2$ze8gXxO2*k|H%v_H~$TUCcynvw9QZ=};2g$y#_LYg& ziPw!?lDUNO%d?{V$SkdFY}Ba*gMxxWjf%k3pd#>{I4#ui{rdH0_eknBQ59hFmb>Sh z)6EHe6iK>gz71&+-&evyn4?##S*+)F=|sBD$-n=(NAY5eMu3Uk$xvn z%IvlM;VL>J!Am@5{-zz2&IPB0HOlxly-iHS$?kgvEQ2NMow7QZP;zo|$O&ox?tT`V@M^%gak*W@l@w;r%eo?o}`>B`g$uYG+4>)Z@n_ zuW7{c?nWYOzU?}}MtPhcEo4rvxrr2L=F@*E$jjq-q*^|<7JAHf=g!+@I}ZA_ z*N~S42V!j>J#HVzQBB6K^BkP&Qt9@#)6#vPr%$C+nYbYzBLJVwcIk=YMDSpdVbSoy z@-YW9bK~M-PMO_yqk@4ZyHd8gYAjf7@FkkS#k+CJhTsZ^1!2%Rd3kET9aZC+R`%q( z6RtvT*tp%TN)Jks->g>y1-JTQS5;LN>MBBwkBg5VY}deS1BGcYW@FCKYJG&tDpmeK z-mp8Yh%wrud-np;^kmw~wO@LlgGmF>L_|v{ODXuOe+#!9OQ-4SQcf0SIr~&pq@`5CS>pFrG5~0y$W@239cU7e;$teAD$gd#;J{z z*^ZW7fpZ=N3IN2RjJbvR`Lxtj1jI?Oc_Pl>IWo1z!-_nN_dkEiL+z?U!verea)L*! zckX0NOvv@uxdIBo;HszX-{Tb(4F?IY*bHVxywPwW?!QIDoj#EShFE-z)*56P*>;`u zd1&=7ol53>qMir2vUO)+r0j1iq$80R?U8NLVWck<9m;h`7RX%dLMQiL+dRXN{hfm- zq^XG(QTv%^{=X+U{Bw9p6X70wa1q%)}roC3BKT1_{7vRIyG8V3au>o@L z<+X&hy-vAlnTLfb?7FNmEZl+lqbH}R=w;h%)Tm@eD%Z7VTdb4r=IR8Um?}uJHT;(k zmPhWot!jUBnT)@sxkf}zzymG^T(a#QxkUM>*Uhh(IXGI=q{A}yM+XOkCnhEy#_HLg{&8GH8nJdw?OTSX232ThXVgo) zcWcJ+fq_A0vAB$H>$kRzO@4eQHUo$M99ndBB_X*ouZYth?CP2tycM;KruoI z#7Iu$7nhczkd_RYnjByWP3Y);ib$X)QnHOhSt>_)SU0r83xBsk0>qHo#^u0khR9t5+^hxPIV&X5$%97cl z^oPRiVo7kgbOk>7kxw9iL#4UA>!OP=L)N!Ko${*?c#U1H=0#OCHNgcKj0>c2N= zl#0Rr@5RQ`Q)U&JkWo^PaIa8BU)2EOhbW$}`d;(Im| z&yh}NxI6Q{?ju9U0@dx4)zwE#$Qt@f_yUP`U%Q8|5$QV!*!~XRA-h1S})V4j2FKDB+IkgSd=Ie_F9>#6>>q z^Nm_xC1*+^%=5*bOStI&DxkAQVsM98Wbn>tvARtD%w$`R7fT)&z!*<=|1h4yjj9nG z|0H;+5^l2%JI9H{z~7fjw+7;59otILV&*ea>n^UTncwEV@t;8>wXPAVdjHKs zq`fDxMt4z_* zxjZj-;PE7Lst1VN_O$wFc4ac2zM3?p?wBH7Z>IGG8^De!$h#%g%^Zf2+7+5fKfG@I zIT?JUlY96|;Dx5a5X}Ehkal5ha@l^lHzluGVL<`ZDzZb&guRygGxd^0fDrd8WCH=oH6f=&tdye?N1$RUZ6#KWU=j&D;*T#`fk zQq9i}&PQ@18 zG|JVC5LYOR_0Kn~1;Pq_g!kbA z5CCDLUrkRNqb5;VsU`0Um7UGUdn=iq1UG~;nA>6O8Ivn3D*yx14{IwbNP!SkhQlH6 z-A$`K7M$h~#~JcLb#T!14J<-&U628wM8w6wk^Klo#+I zKxYy-c3=^v_K-dO{iw*qD&A+^XCe{$xxB1QZmwj+_PvB({d`4en3Ja`jOj{?uow*i z0K^QdJFKkyk)@D2x00Y(tAw|v!x@9zX{cGwSQ)bjqS<8%Lc7&uXqYL$dUjd8)X+5v zebP~{n9!H#pJ<;j+ z6^;6}8EU$$gOf89m$$)jl39p{C2rZ00AQ}3t@Oe!UG9W~gF`b$tDq<^Pkz+TGR3Tmml=Uj&Yg#wooqJCYxfmK4#zox*} z0H1@3P$^`@#Fm2(6czD68vWXZ0scd~+Qn+v>Cc?T#)8}m5U94z&EhmMklk1ZSsfhA z$FLx~YHYp8_p`I}u^yf9U$%B9>zQy;FPZ5-!ZscE?le$IPv!m67IG;w4unz?vU}iR zigiALa{`moC^&(RAxU7WfO;~QypTvopg?Hk4aL5|RY}Z<+9_#hg4<@Voak+s+_xD6 zY>L`rXzFa?(`omfjSzH+W0-8!jxt;XIl`dw{N+DoP5McAEK9?ti*S+$WIY&STQ&~T z;kXv8!;U)cE~+9VeSO6N2W9f$;p2Z@a*;ndhORQyg!|0~(+9Fze7#}3DyULd@|d{C z?9g|lItiBl6%+uIgup;_>AN=8*1rIU4RbD6G&nCPd5F^Vjb#jEp{0WA@)G|B&xcCX z{!~g!OC$Uh69rg)a!w9y`>-r;KrNZ^Ty9Pd3fpMJ`8Lp^bcW;6GAng$eQX`OHv3A} zQDb;*_X0lf?I3&ByCEw$kHg46V;lsCfGsMC3vJzAbXk7J>Y8T(jfrMt6LIdc1^*+?V0Jl z^QxXs5q1-=KWi#%vN5{sy~viWZ1GA0JUkX8<=mRx=d~bc2l__SWW}^@yBuZcg3$<+ zhW;{Qxn_Q$D~Y$(3oqO+Dl|-`DpMg&enq$1h2{A87*1mk96~_UAb>S)9GFhjdXiI8 zzD2qsZI@UI#VPJk1wEG zt(Yf&46t%KyTa7eZL!$%BiyB$KF+fTm3+7!7I+wAq0MF*< zm`*KMeXOa`E!EQP1_PTvPz5C5dr zy%KG~(O1)OLk4H&t3lE_kLpZXJM%kh9!TA}t^dAabc%ipItw7D4FkV5-=Uci|GPQgC0#RJ#4_^_!unW6xZ0yx?XLow9~pgIP;?{PxL4j z)J!z?|FY_bz#-?ZIyn%j3D}n&k2!&Jy`$q15KgODRm_J#+rgj$p_pWSal(DlXK`&! z8ix8evx9bwma-_O5my9qW2HB=OkP#!>s_|$)5#M3-nX2zw7#yn%lD`fd?EE+C(QBj z@dQ_<L4a1KQHbJ4elNW`*H|kQ>4&Q~)`vXJNHIbC;8|Z4!nk9?a7vmwyOmkB_ zM2U3LJfj8&pqNa9>j`c6;TP$W9JO=g{V$KnUw00hFVE8F1fhl~s9J8}CO_|jA-j(2 zEwUxmK+CM5e1}iMJZVFPaM<`TRCregM9w=B(FY$wSxeh#U z#*>(vFyu6?6yzaDC93_3OH2$~U$@`g-JMGIT93+d7EUs*OH31;ITGKq42x1*{6kiP z?8}eKleCXjIo}4yOxy=fv_%*s z6sQz*8Ol{UBI!04+xm7rbcvqbg8mO#k4)PkD$}y%k+IK)^c@geLbemOMVvZsg%>@c z&mpwqpagf@i+GG|=MwHdJUcI5SP4gZ46w{V%z5zJr;Itd*^%=ex%v6g$%dsms6Z5Uhri#xauy|9j@AuWOGAGLJzWS` zy@Ui=E*>cf34meEDEh^nql~h9O&z5r5X-F1yBoF}hoCglPGMqxF8=zAvuAY~xuYzm zGGLqNLB{!LWlo79P{o9l}Gx{|2 z>fcJ$Wyti9MZBpiaf?J;lw9fHvA|_gv&~QfT!e+`q3~+5pBI&qiV69D#C1_UplK8+ z5M5qgo{(+>B^*6}xKRzCGfHR6SLpT`o}w;2{!g!H+Is*~Lm~8}LQi2&PtQ%C3CPYvx0^N_DSR146ZATg+-1N6<}Tn_p&`&tB5 zg90v_49a+*v+1i~!;#`CR82$MU7f*cd&4QtV8N3hNje0SZHTOYd64ioK_3#5728r` zyfZxfj`hn?>n#t1^PUXSd8evkk1Z2aiPYA?zuq>45QwtcjYH5EfNH19&9zedS9Xzh zI9mLSx6AO97wVW=p^aKDfgcC@r%~S{!^m=lR2va?i4@wP5Qx|P3SE|K(AON7Ogko+1VMw zAF3r-ur(yEzlR!G6=vf0w7=hE1I2LfF9({Mnj%_*8c~IBP#V-4j7ODWq~gs)Kp3!v z_S9BDmo4nyH^oQ^n4Es|Ci>X^kZj=D{ogYi%ma|k)K87MjBB0?m9Sdf+ImdB^?$P0nIn~H2A(F0vah)MYMu~X_fWAggXz*{05P& zwe@{K$<+8SciD{K1_SRcX%=kE)|BfV-Q6$S=R#eHP-PQ9*CjhJ?n#P}>p^)cJ+_Mw zH89Qvx&N4PpRGJP>P1X)%)cc}L@i@bZX@Zz_5HuJjB^uV?eJKD7NCxz(lnQIsd<2FFDiQiA!>~pvOe1HjJ(c z5ZtUj=HG#bUf=)!zTJI_ztz07r3U-&y17J{{-5^HXRts&GE}kwUdvm;2=HI$gKACq zR;7|VGZ_#MVLO)G!&(BNZ$l_n4oU>y7y6-QkY))MuSgS#1?Pf zP~}U&S${~6=*ThP`8(f)+V@z2a15Yk`(>_``|5DO`T4mvSpd^ROkY&P85AIHZnty3 zRAf-Q*V6s!`fa{Ah7@y4OXivCIJPJBiVaVHye;mA1}&1lvdT&-j_x@pmY+s3)s$9L zb8}WutI3uk`c6IOaS@v}BxH^sC4bJ7)o<8#4eRb7+q@`szv!{kJ4iZ^Nd3^sSu~XK zA)7>m!|S9WzWtd^AfWb-mTD4g|k7yQ`Qu$dC0@Lt2wc)#U?iXDjK}DO#7KIRaPm z+UctU1uR)ib0~}xAqzU{s&j6m=y!K@1#ojUR~ zpvpd5*=Je3rR(e4N~^xC4@LL0x-~(Q0nWqt5MuB0`nsE;dq))g8F(L~xfI{r$|&dg+FXuO0# zG;XW+OLCEhS>w@ z_`p2CZ9MTB0M4Nm!CrZ+#=R&>lRipCl&1T=J$bMLP0|ju>Pgc_g=-F-pZlI{z{sWP ziEfA?`_DVLaJ4AzRuaL+wriagq(gs_POieD-I`o1J;AL8BpD+ z1+{rD+@%3e9NlorrP5WkQsW*ml|%pMkQ02ll3N`u4UMLvV#G@6&!0bQSKQsy!5{a6 z0%LQWz;C0sf!Dmb=Cr&@X?02Sg$qGvtlz^zqkK>VK}>j?0p*G=6|M$(Bd*7Qo^VY0!xt4)1p07@wy{mTB(O*}yW$Azl zN%)CXe%|{SDO<1JXR@djVpmO;@vYJo3Z(BBrI(|xz)Qr`e>xnfDf{OYRE1y4Ji@-Y zLsW3lbW7Pl?yjU(Dy8S6P=lv6Wgm7pS};Q-#X2F2--4=}kmXDrqJBOaZ-uFSEH4;9A0AbJR2P8YHsK-gziXZjrM?Td-x$D8p&#CFyvny;Bg z2L}d*?5*i|OLKB_+hjDkZ^=*}3iXL_u?p0KDiQVxtOciHEJW;5ql{M`KLvR2iDR*? zJKkJWbLQ~NTQ!$Desc)$o;fztpQDZHs$H!6{iiCAKfTfefd;*AKNf3?y_08+IytoL zGTC!1;>%c(dY_H}vl~uZ3JR#2nr_t$xRYlGP}@iAAOcv5XPEX19|d7G)0?}X{x;hd zbs^RCpO*)ddD_<{0uaM zD5-cR-B-LYmJVJU+!uM+1=-efPpgxM%oHdk-%1VQ!d(FlnM5ojrDNe{NwR z7AUem)+KbmL#M(B>LVZu>KsZ|T6`{ngn_-EB0Dqu&FcCLTiU${pbJ)DD^(?EJL#7> z(9@uX)AtnZL6dbu$U)RB15MH+pi%}Kg)!SFN;?U^e$CDPCOPeUclQD`QS!(fKPO9V zH`%V8HWoIe<6wCkTc4?}FIBw?6%2=nT1JzI0n6h5~0%Y#PQ=+2P@%L zrB9W#OHs9JZUqKUL-q2j6s`I7K7(`wIOVaZ=qqW@&(QMupOE(FPOxR|YWP$^YZM+@ z#CdV7HsFU$D)}cZ=^7)SdNJoIunn3tcP0ww-}1^WaQXV(wFP`K}!dr2hH9lJ>v2-~WvZ5FegD3D6oG#hp9NvXh^m6dR~Rvk>_G=C0+( z($YDouLiio7q6}w0aZ!^!@~}m>-_6r)i=+J2yd3Xy3O5US$xPiKpr_64NIN1srn$& zy`DMGKwwImQ(R08=quve43idW5Soyrje1CtjD*g`W_3wtZATmH>tjFd$nB>&bL7RS ztf+=4k-d}g22jrHCpw`IeHduuP4K>u4v^%1vZV|wml?zhW4Ns zcpROp)(x9oaD2Rpk5K(S#dTiB`v=^#v6x~RMsAfyH$ zi#MEhgs;aWb#m47O~OLn8K`{Z=M1+s@hCSs0dw?v%u~;Hs7yi$y&THA%y?9v^y$%A z?{-OS{XZ?1DEE>>xqt*%y-QF_MkDrhm1g(_#UXTnR86j-eqMo7CzFUTc6<&w)e%`) zn>50HEa-ag(*@zh3X&{ zvMwh;9nW2s@sr3s;2U&!7<+osl}uB)5eUy*|3bX6?M*%XLnyy1E&Ghp3 zEPHhC3}76OAy{D-coXwXUN)s&`0x+3Rj>|_5D_`wCuZ7I{OIgGk^`yIwAer(J>^;D z$Q9<0>NY4@VR8=?nk+1ZnmfRdmBh;Zw6=!i^>qYP2u1W>M!|xni^p$YE?5Z8(NP6u zybxb1K*~0t-70VHesOMcOL+kH6Q31dE;F8^oqgub-DOl^dATk~h)}M87}{y?!r=77 z&@8qB3sliI-Q*b}cg?CgCS*bDz-ZOXx#wahX{*|(8ouC1XU-k>38w?FhN2UN`(#yC zRua|u&mM>ARULEm@Jnx!D#~wje(~;wF=@O(Q})V@li{rp6`CBmH!#$R-IDjlj>*zP zX9<;rEtGe-mlm3yCsGAl+;Ys%m7_g#)vM8Pa1dQfm6qMOVb@T(TTvkwuihrs`A*NF zfe`XcR>*#~QjRmcX4aAKOv!rT%1p!ft z{ydXKu#`ZW7kl(Y6g^u(BMG|opw3@9N3Y3W^lbX$>;B%}-vAZse67zaHVN_%mSDJ$ z#5aC$39ty0^#%^vXCjDpJNeD~%gLrI`4)53^SzU9DMRdFu<=)XSgCA@M`WkR1w+77 z0R2>E{AFcj^C2a#KdNnRzE~sIH&$s1bq6S)GxV=Zoh#kEZIhvukD3rt)G$c_N^uZPh=QMadADTm~- z6OGBs1JRC~ZIul&($Xfai54Q$!gbQJd2UUef{y0Om zkSE6yr*Z!FH%izfOlgSUKQ=Wpu5|VoD26aLG(;I@F}$BDZ`ys2?y`#^z#Thxcb(q; z7Dl4{5;B&CCPcsIK-2A-7gMuu4UPda;qNZFpIe(BN$+AotgR+U-->sRy+Neb?V0K3r={D! zg_kB8fqd$g{w!Ti>0o{3{@;Mi!S$ot+N2HTsGXbsRPhrqG4T*+d$-UZL|-*tpaypB zxeK+3^T!ln0hps>M~)=7LvvKt6BE7S>k7%ce3nueO!WDe z7#fG1M!eKg`AzsH~SL|47PRaHuCfMx{-QD9OP8&#H1I!i_q0n0zl5~ z&LdQ#jid}OPlLxVt0~$%G^*E_s>}nE^D}guLO=+?Q)<%TkPt7?le+p8nh4Ut%H%0& zl7}$4b}#)QBzS@D{bacX4$o8%yx3YTgw9tyJBk925$jjXel8i6+H{u8VW#Gg_H{9B zp3*grMuoSH-)827oZm!0*NiQdDOs@|C@^VtMd&G=r-Qy+3KW=0ZPf#BEy}B;G}bfv98_EnOAhre9d5%rkt@2DXVN-{#M@PC zN=y6J@t+|dlPv9_3a;?j>*h82kQU3ng-_Ap1W)UcBSS>41QIiF*d!oA zp6yzYSvJ+vqgw_Rc^$1S4Hh(1z=8Le9Cr%kJbU)ZAxw{*4y2qw0UNa#bb=&r)Ij`Q zU{*Igz%l5$wL0@j{`$9w0+Wmmr=*4D7{}JonSNpZ6FEiWiRSgS?XPchV<}mp*KXXH zp52MqE&-|RgV+KvvAM;EJdDM{223lb#H;I5 zfxoW#0O1l1%h@!l+DEhU^5&C$Fp>En-f);vFZO&kbYz2xuBv+E3_g;cbhm4ZdyRzj z2H8Lk7ra$Wr!I#_7>b}!@-wXb9{c+N@-gsU%+xeXx-1ESF2e&Qen~hE zx6HA*-gty@@(PG3uL5H}M?Z3LPHNLb6dDL1zCFGL9&G@Rm!B6h+T3u`7h~&0Gwc{# zM*pztUH{t0Z=M|8%R&!M6P%uZ2~6O}gqKsbN*Gu!9x4{hk3i6i`XzRyjZaf<5aAPf zvgo$MY=Y&k5Jc6r1$>t^Q#z!V)C8Ed1(-`~&iK~!K%i&RFG*b}$epPiJuJNv>BR0< z+%_OHi_*pDVGW7JtwSDV4}$u^c`lC-z@k}S-i4|QjhgINqNA%w{SuD8{F1f`4R}dU zL~;4(k@+pVw$`Hs zeO}p1izdz-E8u=ubqE>&+g6^Lv`j9OTD(L>5y>4=n$oa5UU#0W%(5ln0g?du2i_f! zbfP)#Axja5j3=m91k>3+dX$XHQrkg4^%$UHUh3DLpPQRY@(eKqFbiZYNiq~Zr@psO zdyB|%swu8KYX^BvC;hwS=xC3wuobHSaF?*QKq#cMtU{QpVZLPcl^559WvJdzf4^1u z>aRPxsEM`cg#GXSe2*QS`Kyh1VeCq9*8`9x)Lop1mn^`Z~ zGaD`34;o~$tzVvZ$&*d?URgWyod~fdl$fN5s>$y3TEB+Lnk<2N*rT|eFAFnU3phN z+N!S7;8w|_v!c6{eKhLk|B>?6eBJ+om7sPl(YpAC!JS;;L5hL$F0fz-mP(y^k>QST zfp(b;K}TpT*cR*@2BWb^6cazH=PeWVvt!FKP}b!DjeSva{m_~BK$8o(GlhAghetnz z>@&UdPz)C8`U3SvEyj=**DxB`SfQx@6s_f85)PLodY!B2>?Ovd+fR>*R%KxET}lcFi2ATZ=n27lFtAY;az#C3&95)ntCXQ1J-U10 z6t#n-VK!*=g{$>4K)rJ4WmANy0)P@GV2ubMYv)fEnVadwN;WvF>q%xi;*J-f9_xkN z2KE4?0|erei6~LcL8es`91;cxR`3BFE?JxbQ&zh#eBcoOhzGi{ zP)EU7%xY3!!NPMr`DE)!f%O^Br==CpzJ;GHG`F%6D~_usBze0n9LVF3k5(d0I?1(_ zI}J@3#Y&pvw``)rc?JLqFMmL=+ULp}ZD;4@wc|O7o`##ANb{2DpqAWm%%+>aq^rhy z3<<;ve(ge7S3N24qc;7g`5BNb`ytdqeZ)WB@Cp|`C@VgA>{Jt3iZa^%QRwU&u7=-{ z%Jx0*km%J}lM3IRWbhOkhE3&54pm@MwhKV9^ zd@{i(b2Wx{xaip&_`DE~IZUAN@EAPU>+Qc*n;` zvh62vMmB&x*UCWYCzA}26b5Fv4-6HU%iIjOa2+S70@6W{gc?)PsNmu+yfRP3dMhD5 z*gk;@jh$Q|J^{h^WSfA1fNyVB!7xlsf51yabiM9fhJErYXabQ7@!JR;ZS6?%UGoUA zG$;bojwD%iifKUa)vC6iL%NV&tga}4yu57+SOAqPdKV0;s$GwVP@J^)a)z8HRUca% zhl{=+AqP3jEuqKo8lbIc`z$l)X}B$LlJ;|5ohb|g5EI{BV53wx$CR`+ z$qz$SQ86ekN7!1P4+n^4>%Jljaz=npE-YUKjVr#3ynEO95rj3sD7;rDaog4@~@g*n2#zm6bWhRgi_;q_i$akWDlhNihn~=2?q(HpaZ?V5#@f%lo;ii#h2xU z&0|k)jZ6q0u*J~_-8KyOh8Q=Xa)>0a*#aP1TMXj?>OWln&seN;y=xri&k36MTrkZ5 zDWOgisK61TAX-~@%i)Vrk6(qmLnME@&ck(5_UV-g{P|`P6Oxm?eb4CVXnt=;W?^C1 zt}irvh_FhvgFF-oG&^gnPj2Kx{002Ra4Pj=t4^bOSZGqrz}#29UNU9_s_;SiE|j>( zMmbZ9HjA^3XM7h&++tn~1da+cudS^mHJM1j{i&IbI^59x)l1ee~22YKe88RqP!_43*yVOJo06?ZP827D|ZswAAmGVAVmw8d!#xfu%D$BTaFxs^p zd}N>BCZM42aSQqFNZ0vr$IIVg%pIJaF^M*iJ>j2rtKi%IvF5)PQ(o!ptFSUy10h=J zv5H%w=<0xt?UvHA~$D|n}f<9u8#i)z2!9mRO%`cgq10v7Ev_^3)>3w=Q0`oXH z7G`40razy1Vy(9;=jFu2L^tFfK&N>^6vWsb@MS3TSh{op;)BrAa#mvDxwplHeKgv% z2Z`~e?1nITaLb<1PM5)6TOXPY)Qv6qQ$c^D{gQb-WH6v@=eQBxaMATgr9#rSRJ{6Chzi^fbhC#VS^ES} z+|2a!lk%^VR7&Jke>?07)ianj7Pnz$s05x)HwK(XEurVOcMUk#hHjq}wfgZ9F#JJZ z;!|G2dV4#o9}D9KaZ9lHSp!3mV`OY8zdbNS422pa-@Y&f-vByuWP>tUMr2`e(aXPK zrO9hTP`$dv;EmhS?&yQm29aS~ILsZ8eI>q()n0u0o>!`@o!vY(y^&sj~@TxA~cA_;qo4c8rsNDwCh7;$5>bZ zzdkfE!lf761n2^q*(8}#N`?T?Qx{%X2cFPK;kJ_VoEhlpZA_j+C#^!D0kWL>kS~PP zz#wxb@WW0Yt3F62>FeW6Sk#vXR^k)pi*w&E#>SQxKo}EV%M-idxPw%4jbD%e#;A`g zGOBiiB#*TJRv9%%2GKtH*G%E99uPaw&vUDHr@QjHdU%oMfdh5stW5L{UFwm3e(2sVqg?mg6+wC)o9& zJ}_nonv5t?))3;w=o}v<%>2Sa1vY+O1`Qj)Y;%e(PQM>alS9^$dD(5xPj=qrYU zw0?+=r-NF*W9w>(#1lf}0+7@es)7oZc>3xZ>qPO)mzzbv z?5w-`AQ3o=pYBK}$jMQeM|6LDjP{Lln7Hh^I=OK(C4|rQcmcckp!dS&5Qs;i4I$_L zz^le@yIEC+Gn~aeJXIf7xj`kxjbg>S<;zipK~G?b0uy0fPc$UC%X>Dnc@HE^`Q5B_ z^QouI7f6}`YjMZLl1>QF6%a+mM;_~P6AB&k#~td^t`S^RB>Hf?hzv8*_IsD542S@L zML3XApvHp?zlCN{R$|_{DIb_%IY-5Q^(3iks6+HEYQ}C6%Pg&6zys)lWOdT5-KX}2 zd3>wowereJx8>5WXG&c5+0S0%4Z;W1nmnX$?DhIz$c<@S^?&5R%|@%rAsF}_+Ej|n z>(SB-QPHqp>Vx-?y|6#QR|Z$35mBH$IL6j_9r841j|;th$oV2OKQE8p*6U$oPI>u2 zJ)?Xgu}a7z>HtlL@ZY=`4IdkXTTYbyeuKDI6>@R#M zQb2&K?Hun=gA9~`IXI7OV^clq#RUBS-@vB@Mib~hEP4?8i;cAsh9qY`$O(LRL9M11 z@i!_z2=M``<7|f=3uFo)(xYz%V3E3@&cK!)*EQTcK~w<`3u&(;CBQz=R~Kqdm9!zaKH;6}wIB}Y~iFPxI$!o-%gP?Z*q%XiP; z2!}A5X%hh$$T71)hk3UWv@go6&WMVn(_vVtF)~zxWt3@OOIvL&7X$yV5T;{Fy92qMQzw1m3&9$=e;asDfW!UxJU~5yCfwUQ%mNbp zX2?xz5bkJ2tis+%**?(xzTgPwGYfgWzl8sZMbTO6(R|n7iWOyL({8ETNzkp1s`%;h zUvOJH06nhY*9zkP{#%QUBB>i+FP{l%afi*Jri0m?9|$n_U6%jzrrJQ9der&wPe%fW z4hI`HAnQ2&mTti&T86L%#UM1A`wW{NHE%6=H5ktgfVP2#W|?ox?I3hFFgegnZNmor z-zs6pKg%vrxHI(EgfD1X<2lo{x6?Jh`FEC@$|^mvH+bJd`!@c> z-vh%DZ{vSbUk`Mo4+55s1Xu*vP$;mA-c{z1D<71nHFqa8K}i8K4)Chy{BR}-Rdavr zNmbm?-{-Y@*zbD~RDG~7VA8ey(?5U4IaiGxhKPp~zSfYc>wy#HaK{dJB}s|qk%c`2 zmijY;Ffa?+znTB4aQIkCbDnPDlnLA0;R|ty#@J|n{o%fnL%vNGPlk@Xpgtfd1;3A9 zr2dVD?)Cpgjew9VLApC*QJze^r_!!2TVOys@-~7Qp5l3C$iE(=L!2&o-^8HXc4$Nf zoiNh)PQcJdr@aDW#f@?J9Hb+w!>3ahcH=1WTNC_SgD-eZ zpZyu}MB}XmY<}A(Z)k;3cGDUBwDa(#_Xz&8UE-^;91e54VJKgsMnrExG`0Y(GB(ZP zih|B`REKuH>L0^>zY1%G^9fb+eQU(xL569$O1yo*TEPJg)zzKiFFnH3HJX%avzpZd zGPI@W=-t6x`S>^49$A&zp-1+-2FZrE(#q#D18x*F46k1k_Y6>KcnbYYBe^K0yK9NK zV@eI@MgNqU)rdJ9iF}iyfH82%Cm)c)QkMjaF_4P9xprEUgx1wXH7>;@rxqLkMlPoZ z40_}_mt;#3+llHf+45VBlJo1-H;N`HWPH%xQ;S$7aUpuv!xgfyyOT$x`$lpYa4UPt z5oX)5T+`dFTyEteyWgBr2NAJ~9y46`yBzOO&8&mf=wNJI>hAPw^wRIjdFOPqhTUT3 z79)J&B3D4iKxpa7LQ}Q@^Z9LqZ^VY>`XZhgv==^Omf)nHKS@DXj|mm{bTO;+b`|b~ z@Jx1`rhdhipqo#QQh&5vFIz~$dq;lKtdHR2E`#HpbqC7Owo`PRh5oID$`QL18T_Q# zq8OGs>;LV=tJgRhKG6y9df+$TEwwWFFEiD7+UwZ-o(b%&ch-$Yt}aUvyzl$v+zZ7K zdb-U$r^^F2U+~O0F)jAPi_NdYg=m;10Vgb=btPvmD{R?r*PYs}f}zg6+r>4KTDK;w zP;?~dDbm?{yKP`?Z%{dX&{eLIV0Yy0Vm0|b)mZq`+_Ki;OXu$5JZnPiehc^ZQ7t9c zWRKgQ)F6o-OcWIUdmBzj6jwi(pWn*!=jwxjw^5M400uZ)O;NnH)pr>Q zAXO|*8k185;r*j28~-eERn^2A9cce*gm($>bZZ7Ma|;*5(%{5EyTV@SZ?v~Ghn??H z4L}5>)_bH~d5rsex73@>9GyA+Utgj8)#Ag}kWL?0O7kgA+Of>ibg;Cr2Rt3gh57$n z;J*$PAKD*r<~`4$UKf$@>A%|n(_H$`Q0o@;uKznCp(jU4dtVmq9VZr9r2o3g7{F_n z=B9#eC@a-3f-qFs*YitM@e<7rrLQu4dNIsjH^P0sZ6J4Vyl}>)9<8}ZTYxP@+GXG0 z>*_*K=GUuYs+WG7lUDb3YAN!|0SZ}_`uV*-zY|Dvrx|A8!oEIB2O6A&_kKr)&pI*X zt)`E$kcEZigjKdINU>$E^M%$ElgT8B8HIq^7uC3DG>x@2uDe_wxB!!M1b(?9FxGpV zMFET0^D$#W?Dn0TI!^OI{a|3oPX+(&e-s;51aZ49RT=KjiA+07LzdeZ?WD8H)La9CkUtYc7v^^VL)Z^7C(syJi9YOARw?!r#Ot zme*0WfW@-&8g_!}z2*X@{YL^C(kzxj&38-)GHVJto9tX2GQu<#f6@@s7bLclUF^qE z+jHxBMQhZHA<1`SE~zZ;cHgIrZX&U+80Ih0utQ0zX?>jAR_BRMG(6R|KXp7RX;3EH z2p=L^W6l2`1rE1th?pbsr;G~Q2pegC?+my6{n(>4%&lYe6c#^!QsAhWMq`(#7PdJ2fav2=Jhf7x z8dGQ}nLfXdMnG^V@K)eW8UxO0HuOJ~+1H-4M0h#eHA1y>q`ymAtXp?nC8228jCbP& z!L!o~Oq4phzWv?Qr{eGSU0l-~YFBkVp)-E&jhMOGMH&n5C!VMMy9yfe0-mi2AKkyt z0yYaXnHVG>HNTB>m&jF&nX=EWhF|v4t=@g<%|&`IsFCfszDFHIgq0S}&6%RWdeJ(D zSq1+IFW3_H@7cV1D2g~`ZW$!gJO226HZ(MGD6dz8B&W&6{tzhyB{9x)}Vw^bjmut40a}y~C1J&+UB+pPBC2mnq5s}nNVVTlgh`9w9I&a=+TPG|g zLd|$hscxNfFJZU4I{9{=lw7jQ%>J&qD{Sz6=XL^RTxgVU0=9o16zlpmU?JdziC|z7 z3KRN+wwoRJ>6QIWnO}vMR_G2NrHU*?%zIA+Y8Sj%OGUnHncx~ZC_2XHT=UNX(73vv zFzsJ1-|gf%$-@UXZ8TBMlr4Df$#eF5?{aIk{U51Mv(GQm$L+|9uri#a71~!F*yy)d zDoB0x4#7NgyQ>%ZIvh`BTq)Y%ZNKq;w@>$rrvOGSFeHXRn=m0OE1 zlI_W%z|*QnE*wOz@L#IwI55)yNw_qVCc@XRcW=EozmNOxNL>}bws|#CmL>T;FRyV{ zTbrw(c({}ahWDi$$xmUW`jo`qv85Y@{Ypgl-?F`_OjW=>-@N|F>x4#X;??(Ids?Sw zX09B{xY@{*e$a0}^BJL0J91=(j)Uv-xaS!^iVov1+)FP}(J5 zbJCFdrA+XcuREz_)9De84uPh5kqql;2dCm0UpIZ9nsXN;z zG)(;O!7`Ug^^XT;3K*pkPS)M59baOxi9IM~$JFxwnh8Fb6Fdbpx- z-oO&M<>E4ZsM&Gu|R8(M*m9^(himmnVB7d1T_geG!qhwjc}KH9pPE&YNevDNxqx9bu$H6e(|TeuXh{v z(o-p^QAig=ymM}xe7Z(GKZwqyVQZ|KT_YHZ62QghxrL(idX%q zR*G0PsIQDki+oJd|)=PO8wup09B~(=QzCl#87YFlIRG#hx9*o%A|vQ zWw_c<+Utd)~E!;kt(%fetzMenI}&VT1IS6?4tCkt4fV}SFa z7eo8M4qZ4Ya4kS)S+w9;pRw4rKfw{PX4rasD&+hd`dHR#?;r>dr|g)L9Jr6?Ka0fI zOlj25goP(WJPmQaHgU{qbbRZW?z;wuBdX)+S#6RoF{oMx|4$FKujexRug2{8q1x0c3>meb!e=8LyAMr zRZ*Wu*AXvEt{xyS=-rtrotgPo@DR5=`;bG*?OudVv3ItoBcJ}Dvrl5X$JDzSQ9>1l zL+;a$469#0d8>|S(kJf>CEIt#OgLWn4*aYU_A#Wv)guYBhIXCfrp^V38nO6wcge0( zUI~?|T`2|K7!LM{V>4}eR@1K(TO~i&%9;iJ8?p3u~JcprVynv!0Q5 z7grAkf3HaopY23{MozBiD|bfPF8yHrrQG|^{c}?3%f{)$#d>TCUOGxVxG>|tQVW!b07C0Q^F=R5bsE?QTrf2h!kox3=z^YzU3Ds8~ zPahwCV3y)MU+^=gPS*cjstkYWmu|t$w!HTqh`X1=;;wrtmZzKaem}|~Cy6R&m$eqO zcXH3Be%BOHyv2YqHpx1M--(7s6|2SZ>`)N*Ndazxc)%wn7oS9q35t0lKA+G)Ca6V7 zGce5NXzRN>c}Lr(#YvX!;&#)6vTA~y6CJ&;>PK^Pct5(!UQwVySl25al4lhr6g~VF zUmBJP&SS(%ZD=^{cxc|2*<;lbe0L&mJyaaOA0$C284Rc=@#{R2&r4^LDXpZJ>UH&K za6ciTHAZWc%udPuW^I?wWEJJotvKFc^?<12HZO6{?dyF+!Fgqs_{qpy=0WbB?k2hk zwF)9iDW%R0er+SdU183-g}klSj$&3R90MDNhYISnxF@~u*@mr7zsqoMAD*aBo=3MT z^{s0T+pAp<^fauh>54%#hkcfKM|F&H(vOb3#G|M9N|V609-wKLrcz5~KJ%c1Ki$~% zTqT?__~ThOuc1#iSJ+)7@0$CU?mk^r8s3X`Atg(q2C}{ClydrCMI}7AD*iE&K+zA~ zA&L7e*6if|_{Z#q+dcg#=NIvo9xf&~C)vv`qHm28!*a8Us*g-rIbMe555R=$97xdT ziM-YQJ#YMa;7mufK5H*sIvYpj{vvM+FYP)r{ck65B^9dD+ks{rvFYWN@0XLBls^XL z`zd2mv%GB<*W#iZWKx~Swx_csNtA{y z8-I$iaBe1P#HV~tZg?4=xLPxU|0u`hoxS$UCw(DzkBKrX6M&MeBl}Q{GBrP4REcLw zEbn8>yvC+0hSpBxSHGmh6K!6&%x}B;WkQO)QC%9=O4kv-d_tzo%`NDgxu8WqBhljG zc>49iiMYZYpJ;?Dd*{>G(l(#L;8&aFHXKo8B-NEog` zDa7K+P=hb|wk=?3n#K!_a)H#J{U4}cLK#jUPkYveuR}oG6n;#dcbaCx2XV+MT|Cypz+q&FY+ z=C2sN?KAZX|8}l0=(t@$+AyZeN~){uomOuD0j2!aU+vo()W}y>i0{GJ4~yYuy>(5h zDlD#;)6ZtEIOQT8cCYKY3(txU93fZrzW6!R$}s(6j5565yEAnm)4_lI&xyB-Zpw<~8-4xq$pQ@vwXFvjm=F?>j5^zDy^Q!RbH(~j1^R+je372!TCd>AQH zi5M)1`Ec2nbZ&A+z0buT?$hW8EGRh1^t9v=eU$`v$;1|`}uLJO?>P{c8`1?hwU-~D_>zRuCo^x*{9&PD@j%w=@ZQJ3NS@)KUI1% zt(~H{;uJX<|8LLLK^f!PeROLDkoQHs#`Jmi%vWXpC7D0enHjC>K6m+f@==ItEY_&% zhmvZ&YoS}pzYW$F!c**D#HRGdo{kiBZ!WaEOMPEVVei^Ji)L=rR`}Z6n29vL}A(5{J5U@42lE`A@n=mCg>KT^vZ&F3nxahHd(=hX7@LC42!3 zqjBLS`x&oa7pIL=4&_rbEOAHqX$5%BPH;9^Potz~e%f|9Y&Q?|PVcv|>U6;A2BZfw zq-ygS6nG%Ac;)t{kp+HYxO;AncF|EcGNScHClIroO_r1Qh^Y^)h&n}*rdm%5nJWQd~PX=(XzK)}Z9fX@osr3&p*3W9;{KbH8}dK8_ohH@xwjy^?P zmfB2A;ZO!E{75`7qx=-0*$vsa76ocGV zguMeZh+MeBw{l%}R-Ll~IR5O!F4l?3%#iEYj2d5z>b~{ks`pH|;0Z*2upX3tsn8H} z3*ya*OFpdTd;BWB>q`1FA7nBMS2gi>h-arKFW!;!u`02ieW&R<<2y#rC*Pm0#3Sc5 z`aWf(p(mx{Ph%*0`C0fv43BBA{+hwXXS)xYi3&M2c^HRSp=p}}EY3&KT*t;Nf6}J! zwnSg;L9q^)uNX_Mm zyyi7S-lmp?nx;<99!?;w?76N7Wd4=c(g;{rFC3cSq|$Jj=b`^O=hBhWj~-dwc@Umr zz!R>foTJ5XPRc^T=EC02fRE*8UEjCK;rH}}_&C>`Jfnd5htPrNDI<U2{W(MFQt`^KlBAh|gY_UrLl9Ol=uFIL3F8#-LukFX>PF7dKGd$}y}@ zpW^6koBbGsd7H7iLXpr_DDNJ6AB9{aT$Ij;4mW$^pHkSdzmwWnO!qp5>AmGplyP`j|s5W=W)|43Dr{^@2Pl{b2c= zaJxFrKV=V?exuN2ALm9>iOsf-<)4iqTgq-@1%c85_n#IF^6HYpbA@I@(qnr`{An#M z1C~=i>rJekoRlj36P*%DlPEEf8J$hKY^;<=in}%?TsB4ulnPwo0!B;&!CqQ!wB@wz zPV(a>G#DCI8h%)@CI4LF?;Y$6!s1ws)LZvANGn7-z0aqJy&DO#TY(8Bw|9&{j#l`pdb|0}plQycNG8ZDWhc=$csrA0sk%yq98M zpP6*}#wK~#IoU3MB>(&7ov@f_ebSw4Y||%bq?LnzT5@D;i6{l-tJ74ON$kZdc z^}E>5`%jc@*!Xc88panEGe7Gea;cmvT@0nGU5%=D^w5vukur8bejZzyv4_=^0 zysnCFbZ~RzoAv7ZxE|3pY#+8I9Cp8@c|z4oAth7yt8F#aTf*16SC3S=Xs#gQ9ay6< zj&J+)!&rebYq*A%Nfgr_F`gfc;Sb--8pLd_F;!x+Yl2jpo3%a8Yni{&`zFiWT-;cR zVL4BdpnlPWoWWLiHRG*kqc!rWlRJY%oGpx$@=M#^mCekV99t+zALDGAwAx?_RZroQ zOZA%a6S9ByY`N>PE&11O=$y;sr0zNH$1_4Pf;F0_ z7Ps&=rrx~$)SQ&l-sc4~QKt79nuCLg?Pm7O=01gwe^d)sRrpjoi4UmQdYmhs)?p8fIzNl>zKT~0OrphHXz`X&$OFBGqAC5j-`*KOb z6p~MmvO1n$b5C^z^|};iE8gjpYHgO!+;&^Z0B6#0tHjv#at*CeLJaweo4>&K&nu$j z-h1(gB-{r&6Z04C)~CDQhb0rzMk=xw$z|;=!kuIKVvP731J-0^8(gxp>3$jk^D@9I zR0EV@P*z$)I8H~d5xY44aljU5mr)l#OLOmrjKaC6o@6yIai6^rCVi--jP3PoE-PT~pJXX(#%g;o8z@Wt`dhm6|P1T@e0|Mwluq(i{0H zdMsG}PH0tAoMSQA(2*6>z`vDvok7W#>)>{DNJgu?uky(2HN+g|2kWt)^^I!P>jhr^ zgJr}Of!HqfwdT3m?9@3AudETGQzqNymZ*=A-($Q}mp;+9-oGz$ff=njHI~E7gGj7! ziRF}ukx8{(?(d49v_*y=LV6&xz~nBkcn##S+bZRJ{Ty&wob}UK8oh^}21x8XzQSEbs@RD&~GBFR%N&ahrSDI)W~lOBovK z{7)zcF2LP}lsLEL*+F#J$?~P2=AVuKmPRK}8o}rCcNSLN4_=e~mF}y=aORS~f~cWp z#g64uzKjLSKStjl1LaT~_}Z>H4I3NA{aFUFdc!Y@x&5hE4I1m`9_-vFrNmxHj^hBg zxE9chJNEv&Up>L(*<9(7vIS)whE;T9O&WeHUsC z8%jOBQ4BYo4+gd?t5Si9(&MmL(f1{R{JvYw1BbHfh-1HIY`WAkId8b$WXNw%iSgR( zUmLWayqxN8SmvPFqqUlq>bpIqT3mUh?gWN1i|5q$mvT*%V6v~{vSaW5+J3-iq7Lcp zd#}|DY1W|7X^+~(Z`7-f7)@68ga12vgslGdL2itiyb#qXX zJ(~SCoOI`H6bpB;RFq)qO0kRW)e-rtHip7q*O<0zr1Z5Agv|crMJ-hqz1eh0{_?TT zQZ-HL-?=lHo4k0;&9uMv~WjnwS@{EU$y zjHix={8pCyxlh}QalAZ~;~>w~e#QHAKNKA;W5XD4tsU-;o}3UeZoPd$;Z=k(_fzB7 z`B8UG(C4|Igh-sXy%(9Qm@|d0sCp=?W%y--)=N?O^bUrTywEzu~@;>`BpisfPQ7 zS&p$^N^w5bd)KUW1<@_1JB1XUSyrbEzDM@RO84D)YHg?Pl$tWY6_uWl@T)8wm%9{e zOMbZ5|8B+eT66(ZNbBmhaHcpw!Wsz)LCXD@ksG$N!#0+=sU-I)Ta%hk{+;^HIjJh4 z_6gf7VzbYX4b^1g@Q#oA)wUR$4cm$PZ0+yjzaV@iFVf;W(VCx~p46$TU7Fb^_~A^- z#FdUrc5?5qw$H%DgGMjhqK6&Wf8Vhw(ysext5ef;EGuV~!K7^e_sb`8g`<)_>Xlrz zY~C52zAa9bma zD^z+8j)#;m~;d%il?)u|^JFQOn?q>)VG zDKO3X-K58H)}(N&ymr=CN-`&=pg!>qwb=W9Vj2vp?aoM{q$7U7CcT9VYFRk0_ z6ZY3#%9~wp@DZBbDO4gaE6}S&d}%N%e2rIQRM#Z(|0FP-c&{M05g$`2s5dI-D@(~M z%gR+Zzt^?BXyhX4wPb|NTbr*!l`mu`7A7% z=hS#Ryy?obMvW=>O9vBHm}fH^_jgwAaUNC7qI~n%P_N)LeHzYVKcQZ@<`HVxRMNP$ z+nX@yV-yh_yc*I~Adg(Sn^V8emF{B~3QaE`acr%=4VK-iVHz}``&6h&lsdf~SwB$i zj)@<;QMa|imW_4G@~-x=TSf0Kb=DcJD5H*{QC}%+UEXp@*e23XtCZ639-1Bk12;s+ zJUNc(MLVPmecjUAdCc0tYce%TUK#c1aC2@O3{N%uq~w-=ZKr-Sa5rg5&KWDb@U(TO z7Ac`kj{Olp7g4TeyD%e?Y9J&v<$S{oJ5?K`bzbRMu(gSs*ldH)fI!rc$E{%OCeKWJ z>GiqI9A16tNWr0%zIZd%wQ>&`X7<*=pHdvHzrHa_h9yku9qPKKkf+&tbN;ChId(S5 z?AMlP2#Xq`B)zM+I#P9w0)li2O^~JpkY1!iC?ZlM1c4B$=s|iH5<0m%oLis!{kzZi@BW*a zJ$v?^-PW2tYrSi;<`cXzG{t*@>A7Wnkz|8aBsYCUie;HBO3|UDxXl4dP|UhGMnB#_ zaeu6Mc>&qxVrrROF`LtM#_E@Jt+U$*?xCOgn-}CX|e^S)v81g2ua^P z%TlxSKn_ffzpgyLM5of}-xyRin(Q)URDA|#hD}}KZ96nYnFbFz1TFSNJ{ z{^P_M!^-@qdWQ72&p?+=eId*q=Og?(q8y5w2`5B4Atj6w=1o%`cz#z#@4O*=*~8}K zzzUD&H_ee!6+?3VJC~OpZky2c`gg~?QCn|n(dy#LW;80%?ThQu z-Jfz)-Po|_1IsVC6a?dKEGyEWIOPhb!v!o>EqJ|jp({w(@5mX9)TQ7HBB*D&&u$-x zY9#*HL>x6UZAZ-^Bj7q7^kMG|((SKnl~m`4i#Z0etaQ>qV{D05m8|K4bEd~8|FEy> ze^Kd$Suw8LF^<0`%gCzsD7I_w$XV#IByacwTW#zwEsQ<$6G3sk-IJDqrLGc%JW{BR zaB6D~=e8$zxMG6O@7B6kU_z{vj$~_eX{34Q*0CR)KmOHves1lffThbj!c+Quv!AuG z+n-x={S~S{nQ}eLuIx-ZGY5$TB(Ynq5Se@kE;fh7fiw+jO(@v_c zB8+Rp9oh2C$=CjH9$*{s&lNK5J;KGjEw%a6$}qP>>bceUa!@}OXnLZ+> zy#VVqpM5z?98`fzQ%XWsf9QDYn48(YTFa_nR)|O**~DGmfPvEd=%LLJg4#(xB_awY6rWAt}9;2ZHU`+RnXAm+(E0vNy<(hv}^>c7?aZbbI^m0R6QY zyHSG&Ur564!MgB1Xgt(i#Unic9_V5AeZpJSpU21!pR)HF)?)1Oe4sUj39p~Gs}bMG zD`RKQnB=DfdEBUD&n*VpC?id9u0IY&056F0LlC7*SdN!6=okABwevFqN~5hZ)?Ukp z{;*hp_AU4KKBvoQtAMaZp7HlZ^c-e)fDw2@WXOXbO=EpVg`JY>?T%@#?I+0R1-xbl za~92NdGdMjd;3uSKt-&PFl4V&BqbH-JCu()^&T^`NrzVR)hymi{_fo zQrP;=q34|8oUkqtBNCb={r%G5mwaJqL_!f5gcB?q9%XDs&TddMj4j%9{B;w@-li>O zbR=xzca>$l?5G>8=;U716P|;Wt+?dSc-rcVc|M#!_EH@J9Z)+nR|@243^Pb*vv+xj7?C%WxHcsL-J!D?Kt zp0^MMwc$eOknn`KwC>vpRSzt+M+^9OKMQMm$<5y$m?SoRZ8Vxw9lv$r552IC{kEGK za18&Qp|Nky+w|_I+mznCw~$3|MNSbDuC#YFM^<2ZxOatsY^;hs`w}ckd6bZ?6bBgS zOLYIY;sVtY`*K$e7QCcK|00dH#b~wWaCWojeY@%^l!Ua<^9%tQ%xw5dZXVa?3(8Rf@ zs(=yM1V4h2WE9EMzs^kbMnHI;S7xieT$hEvQ?*R2o~MjTjMwT%c{EWCshGKB++yBb zzMbbu@Tz9M4Wx%g$EU^hSEI+_Nq%SFmTlDA#x*cEz~KhGCgz zWufCq+^;D{Unf|#jpc0r8@zV|c_o26rGN1%AT>pJde*XC$rKON)p5Mob%EdzuRTbV zPUXR_q~#t(!7EmlNaH*HXq||61_+1pTGY_X`)=?0ZzV7*ldzRLJ<7Yx5;>bUpKK}f zcXPjLV!G4x3F2pZrV-zl_}}Oi=7kCTG0EJW71;W zhZcDrq-5H{H7bdD%5hg9RQ}2NIt1!T{_JI^aff2&2Xu5xn1x&UKvln6bNAp`HAc-G z`)&F?Ituo&RO5=;Vm)#?buf3VUu)DCwl}wH88f#8G7caCGzMhspQaye61k9dX*~*AW}> zV>U$-s_UB0G5ww8*Kg4v9<7~SmK{Qs&=I8yw=#7Xu?8>+SP|awH+NZm>Sb*Y!?&Ex z5%ap%_(9!ZsnYDTRkpVc+4g;1p4BP09ayAilL+<))eAuF89Df3s54*cvzZqosY+C zGP8~uEX@*D9t*c+mZ*DHtZ>F5-pwx?(5=is-o;#&>7rTogn(?IY+#UcKb0&%r<|rgcuteh@Pn<^(nuR3Mlu>G6&F1;1_0n>jqa z{A#X%mz{t3qP7%*9H7;v9LQZVpWiE+wY*nh^T*r##faJ}t>`L^_(Q6*Ta3*&Z>2CW z)v@@t_z;%p`Bj5m7j^=(TMh&*g~}2~WF0ZP!|W@54Q)nhX#p|<;Yl_}dmC0_n60PN zzHX^OhZQ98;n^2l!xFql46LjPho0N>y3;Lwj{wjq%XO-O%nrb~o%j?)uJ@6(k_%}= zGbp>%^wlHenqlS%=hAv5)qhJzq}yBCf zQwvRs9Cqrz;^EJ^RFi@{OIS}?IFHW&N%|R@A9U4m2-eMN|2jInWbtVN_Ph?XdGffW zw;Ph{tDt!@9$MSXTPJmPlILzVv~ZiaVc0CkOkx@NIWhaO>6Hpz#wB>0E5a*9Cf0e#UcbTj(4X_s`P9Pwwt0L`ez z6xB!l(g-yHB>g1g>_Fn4v2}C92H{PPnas-8SPRE?TXwX`d2yoTHwIJ%TV~s-M`*b<$;)q>Ohxpdov^ee*aMv z{He6*TIW?;d_kZ8W{rR|0RuTs)D+nk{GZ>eR-)YJ%BUA0-8k-jAI1``yKTQ;$Md>? zMNU;|4mOGiaw*x_bA*j8L_=k_1!gDp?-@=ObJH2R%YCz_%=~PdhJLQ%0}~n*si+ny zKQk|>fc2T?9g%E+ywJF0)?|tci>$f7IKAEz-;=4g1Uod&W**R`U(Au`H>wnu^u7Ce z9@1hsVdkgNeF0zMpKE}_q}8HO?N8}S-N%T}(v~d*0>8%m_CESJCVG|wU*yjw#$E~b zfqx8;KSMqXsBx+r7L`dF;_d^{?U&+Rd}5t4!Q+>Zd&7yrUS){8ke5h_bBe58wDH-4 zY6fLqS_k2Gmfew$|7e9pSvG7lntkU0{UyJ ziaOMnS-q==J2Ptv{}`4wdLGi|_oo#kn9JF={h>xj2f<&s_dj&dp(X}POXIze>OJkiTY*UDLPH+1MRTbY%c!UP_U<)^MoO!_f6!@O-vk&8ZSa+EUO zE$%6j(w0}jIK+X5F3xfK*2|?UP$%VxQu4o>bOLH5WFhkqZw8nQK!bL@ZGo&qnS#>Bc~3! z_oC!dt)g}*W+KIO=%|QmX;rb6IHEx{v39u6#E6z<0Dh_+hA;*E`+rvm%*eZj%x(YJscgkUY^;w-rTjyiiu(#$Lzi0>=-^`p^L@ z`8O%Ctfb=$1^4C457#k6ZX|-0oxkjBc*cCV0`O#h8tnSLrRc4c+cE%A4977_0diN( zK4xZMXV4=3h086!pGYTfMBUrfBhb0aAsKsnWXpS83{6#_;&UEE!)i z4&hsOo%8s6Z~~wN8$Ld#e%J0#Cqn_$j|$KT^VM1W9w5CyXe5n$^{zeO4%PQ-a0I@}eFUb)`9szh|5*Kih;1dYXFvktemOZQFE6Z*jhsg(kH3tXNFXeg z)qjV;U?~%mlOP0;2!3O_)+r5?l{a%Z@<_i3g@Ox2p4LgjT1zk#(C>!;-oGZ86a)x& zi#)eC+DNS+#1G8Ww0L(W*a}&T(7DGndUAY7ei*Z~mxDkgd2ms<-_BR61Xv(|`WXgJ zHhBqX(#hein>PVm9Rf16w<}7}Y8ldRfp9L%Yin73@5q@b%ykf#$dE9=o6ckG)PMkP z*>}H%tVQ&T!`%%d04>^i24Dk{&SRIR4alA{6z&1K`*ybh$|Acv3#UxJ(!TR{h^+y% zA;3rK05#el=30pf!+XiY#{DmXse73AercWd1*0L@1ZsUdf= zH(OtFiW>-t;V13ABG;Krb+ZE2u{#?I`@Q;Hn&7w=jFfTy)7G|YcPXLP8kGy%XgzeD zvI%sTB^TFUI%#-{WTco%|JSTUvGnKS7+6l*`tbyuAzYDM>?VCGIi>+v2H~0!w4;9? zySXQ@krVfH07!)6kJI$v|GGx2vdTn5PCrSswN*s2kq`H}m`XStG{gxrCx;{uVYb~a z1HeB`tV~IgWx+i)q}aE!w^&*6!RXy=1}0&UA!Hn`_bZ09naM)J$S_kv zM4T~SN6l^Bu551^+Kd97bR;viZn}7Pw{3hvOdnZG4DrI;rd1KAO)p^Y>_H~l3TPt{ zx8g53s3RBKs3Yp%A~NEQ7p|PsePov^Au;Q@mR@eZGOK z%bGQ%198>pWgL_$PifE#>huwQQwreSxCO7AzHfuUVY%44(Z5T((+N{qSb5m3e82B?s{tR?4CNMX-qP8 zR)$(}sl5@0-z=aVzAQu=`ol~6Xpfq+iEE_N_rhIUM{~PWcK(=C(ZuHB38zx%WuRWG zeg92Nx#vxg9Wq$G&gJgxr^ZD09A0umJgZVrAB+$FBSj&}{VCNQTMMbfKj}~99U|i@ z3BM)jv}0D1Hn<@ZBX`y9Ms>dXgO7z?$Gv%B`;5s-+5}9Y(}cq<`bc~ zFdIc3`tkBlaubB8STAnVytty|e!cQh&J$xR#wvBXL%}dOc{$s&ST~x`S&5knt$%)5<2pbRFnpnUR^#eL_bK*vL@dK4`I8<$PgcJZu~xZacSqe qe9r!AXQOZ|J*5pynS6%^mPB==bDiB8CoD)l*HqPeP_Fzq^xpt^bIXzd literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-folder-ps.png b/windows/threat-protection/windows-defender-exploit-guard/images/cfa-allow-folder-ps.png new file mode 100644 index 0000000000000000000000000000000000000000..88cd35c6ce5c847d28cb77508e26c1943447b95b GIT binary patch literal 38259 zcmc$G2T)Y&mTs#Es34e-B%q+E2oeM&gD8k7L6jUtaujHCMgb)WA~_0@b7(S%D5&Jr zO-4Xs6C^g7x3=fpJ5zURW@_eDy?4udy4k(MA6EF*THo5Q738GJkJBDUp-|*9_wPPN zp^kW?P=~WfiQ$Nq*Uw=1IA(oc%@&0^`33p^q4#Vj>EIxVoy?*vbZ#nb&e34w2cxp}PjQ`Zgxkb|zMqs58edGQ;uX$Z<(4YbP5MBV#*M z4n>O~96kBxsEvUhaw?OZiG=}*mq2k0emRExqGV-g=b&d}fYP!)Ku$mL=jJB1`sR9Y zstu~_Q%MLMCPfab=-F7BSQ?=|(M|cmF_OQoN89KdpwBo|xE~8=x{4yI4^uCX~!wi6@S6^TRGro=$rm9JEW&>i1p|w>#UZ&LneYP@J6l zyDrB7szR0KG-i5oOZ_w{nOtLzR3`LMa0uyI}t#=d^lJ;fbL zoWe?F9zXKyiz3U`v$wSG`s`NLclVQAjFxOkDEQlVN~uC^Hx~NaNBrj7of7uUn|_qi z39sA_TW)7Pplunwv2+N=>VM~CQ-_%Ll0eSEkL76^QKy4<9`q4k&CTkm-@Ko0Kh?2| zlc!ue=1Fu1PG+jy6)2(UXS(ap!<{I7Qb0K2?W(@{SLa_e$DJckx6kehN8FfM-u7c6 zg_G}|Ny%M$Cv0poxqACoXQIZY@5tu!W6WfxS0x4M8JtR4pV5DrYrpt=``UqgHiM?< z$Rsiz&es<ditNRy?UC#fM2xn7el?5*CAeB-r25?vME&;k<%yI4swl% zYG1S1m+*6PawhqZP?(N=eib8NJ7sKTsjBU^{*+y{K>Yjn?_sIUkvH*Q&+GJv5Qb9v zi;ZN%hAhk4;sjC#t?IOH)~tmo=cww*o$#we2S>oEW}~%k+dq9MS_lz0)IO}Ot-Woo z9Jbt>Hxg5N_UyyT%F0^=kw|$PBg1&gMi& zFBY3tTPrH_Mm7F0%5%BY43}3hHCUk6a5eI|qy56b$KGred|IsKiqPJ$!)R}<+s+lu z3a(12^&dU7hnK3BYCDH|{BOV%jN0P3e13kEja;iIVa&+SZznsvR6|IxtX`ICO%Tz5 z`(9`t_cfU7$#nkdMRLn!!<>hDe~iL|RQ(|GrjD|aQF`s}-7tXm4+C`@6jR2ZQE_*-&W)u2DQ5Pp8=5v=TssLQ$$` z6r8nGrI$q}4CCGPm0%{y)2?xjd*HXsZR+#&;Tq*t86Lxyj>P>nR=3^drm$340e1D0 zZ{~`BmSl7^|I3#z%QvR{AI0)Lq7eS=IpRjp(yDb8n5kAum+K9r;c3ixo?LUVzf-xt zjbG1{cYDyKaG$P~lKL2<$8KRTgGd$(t^e@)^Q%H2z4pU)-H!~ZT?xYut%Tf*oC;6(~^TCaD`NTXDMpp%~t?%;4W*Hys?@hTowi~(1o_)Qyp{?WU zT0P>vW1)d-udtoYDlS&4+wRSGt;B3=;6Q*}E1$b>HS1u9Dr_y#vrD&W2R(k*ldP{a z-^AxtEq0mZ*BD}D9z1x%p;Ma!&m7LNDjUo_*v>yFLT^=Dk9qHJHi?-o4pkfqX|kSM z$7)#dR&6hi*6EZD*#sj-6hnELS#^1B4?AjAt!BDJ;9juDEllaoe)HqWV-0G?%Lg`+L&hg1Z z;ldP;c^^A=OufS9<4FeL3>6(W^c_D5W>2kh>-y>f`G*gCtlU@W_Lf6D=#_s~(n|67 zmW{e=FuJXUithBcXMri2Z@R$9nBUi@y4O0o8&p|YS%R3kN?+}AYYD_i8Meh`g4CF7 zugz}b>-Nnw$|O8;4aeHf=Vhyn&i5C;kBBhDeBRPf@$fkCZ>9={-82C!zP(`O!8ZGD zLT_@I9G7^%$1F939EH*k^5hq-Ch<)+Gq$5Et$!BC>A1aSQnNjmol+W|O$7rH+nbda zbXrLjQ2hZSh2EG~ix=~7?+dAp0y%C=6tlu`?}HfeR^12luY^nlQAZicu}Q=PgWjE^ zqss;lfj?ij`D%P(g4bf;7NX@Kc3m)9i)3aI5iQw>8=WpoHRnriNU8LE4LEN$P+~H* z5yW}MobhwCRr!uc+CkgZ5vld%Q}2=uIQjULWn^T+L`~kuf>EDpjWyaAr3dX)QdW-G+N~-nxdl#YIBw(9 z5sDdBv8~tc8^wtxh_?Xa(rN)upTpJdm(p+t;t~&br!Q}L6)5KErag)UKUevk?|w5Z;yPFc^{~UDKQ0OgsBLX+O>srcx1XX1>5SAb zM-XEtd&f-D$dPXy+|*k1PG(pqVU;}N#&s^!;hmuj^Dor*>?VJ_e{lak^?M7He!XBN z8-O&9ck3gKh3-kN^(h|NUIC28Kf+ZXMW4=&x~6pY%$XEGKLXF5{dy~DbNiR|{V>U} zU)0WCT(_=BP?l4H%g)ZumIcR85TYi7=aYKBJE~GFPTIJ7jD(mNu|%g21H|E+eR1!^ zOI_i{!*EWya^OHlGJHXKzJC1&&7l;1|5u+(&x9G;9nT-qV^4gS-v3<@Y5G*+#gWs z&rKwO{N&F)#Ec+5SQ?ibWMyS_k@F8F(OH)3RR4s)#ad~;TkDc=O6!6>zG`$Y4}l$1Q&U`{wPnG}0HC2;=O#st?W8DAk$2E!(%dgw7 zR99DTtfFRK!Rs8Thm|-kkH6qR(DKg!rrTaDEG!w|3&VOwMnu~_B70(;dx=zzlk5s2 zTDm2th**!|tq+EWhp%71&dn(Eb2zAH!5-OlOcT|Yrl#zSjQbZZToA?Q<>tO`80#o9 zXl5ZVm7;AHpg&pHOfP8nP1zS5@B8=fzc1MP4Mk2(8NzB`6BQlN6y@Pjf|bL#<>uss zvpiK+9{4fQUfeEfHaObT^8~Q4sje=Qv6`Tu;1gwKLpIqY=i`2g_9+~a?}z)`O--|M z=f|)HOpOA%T2_XJhJ6J0lVoIME>8FqzMPO&|B#TfR^0ILg3>g0f&w<7vq_ihObZ}~ z%Q8BfpU>~gIaCc-0$h0?7WN@4>w3-BRBWZ)Y?wezMTHtTr1vb7Q&U-KX;NW!0DlGI z(6djiFj1ggtUHZZGHOm>3bNeKx@WodHL%SEMfT@vY*Ry4ao18r<=j|7trz%$m??7n{eI{W$6 z35*F$#MH`4#l$3&WvhmgpQDI}o4cp0Yn(@Y^3x~J1jq4X$a1HpHBNu1N=cDyj$l8b z-U!wvyRvd%X+_HOZR+U3J^}OFfZQDUvJSD+P7ZQre}DfJeqcZyq-lFN;vz^GD9tuR zHW_{l&fl!uHU}A*bBMCCjS}6IM>iY!S*{to5k2cMNGhVcSOD8Q3clXW+tk6K?7@Qv zzicY(Hh=4B)Z9;uqhJVW+Nd2|P?nPNWtnXf+b?Xl0lDA)p;G&yzFtD+c)2UUY+71c z*TXf6mL59>aiaj`y0Ez#ZinY#PL{P>h6pSO;vf0lKP~BZa*JLP9K^E4NVQs6iNzqF zOjk@P-fpahg4f_dPTIrQPg}yTy?Omw@!`WjdM+-TZx;pVY3FY6_UK<%$iErLQ0Xg2 z38s!)vWLQBv%z!qf{=ZS6)8P6wSt;j^!WIA4;DK`2t5i=&D7FT8HNVpS8CMa|BWLLMm*aE*e$Z2LtNzc;N z9G!!0oDa5lB1Fs*lX_2GTH3E)T~$S8x~!C&oxPQw3q4$k*2}NT%6b68j^B> za>x-59cAS-cud_z1={Vymq1?z%d7}hu3)sl7Vcr5?Qi4ius?q$@tODibVxkr1rnw2 z2UZga-m0sG2jw9OVsPKolX=T(m%KR)dHDYUQDOywII!nKsJ`IG`aety5FDtKIe zh^ks{pflOITkqbzd#bLUm5`87z`#0gUxg^s=g*&$k_Cl?2F-cbv`3858|M#$YM6KY z{HgnC=jxH(K|qd|$Z#(stRSSG|OLPP`cCE@= z&uPFLT#|8~e6QmB)IPmCGcYjlEyexzZ{IpHmC{>qAXkR63aRD8maAS1_0;PILoU~3 z>L4J${3E|11gD3s;H>w?U60S$ggp#wouc3-!oM9`s~x$$`fa;rcr)61Q56E@>y|rr4-Mx`AnYuvQtMKa#MyI9;`~Smjq^ zIU(8$(MIe*l|w!asjaQ;dJ5y7agVwlxG`O6%4(@0$B7^qZ|xoQ@GbSGJFU~~92|1s z+#49iM~#oU?ycjPu`BvRR`%2J4#AtDN8o=Gr-fl@&9#htxGHr{vVN;2jJPmg#{m>z zGRZKTF{T&_i;vHppEnoT`t@$0#-%JPJNtcPWV(J+aL}ARJec#P3sL^5MmN1NGL-(% z3Bw@|s=T;3`U=fFz0tw-t#%LXu8!5^OPAT%AHhg4Mm?{ZjU~vQs*I6!aGw?s5YVH5 z%XVn8nm?||oEY}lZSr^-hr3OZ6X`JotK#C~bLY>e z16oN6A$Hp6H)@?GRR<4u4Ky2ki@xYv+1px*uo#pAMD=EO@7(cDaNjloO}&2eX1f(7 zC&Sgz?(PY~7P=8HK1>zx=1q8LX!4IA4@7q6i`}PRR1Jf%T6G$AeDYbPcICZied~_f zM8X}sf1**zru7l3w=|(qw!658%)WOCjO}{M+hRGB(Kc87##3oDn?aJ{m zTnmkgx;?*+fUV7P>EE;~;AHUQUjwpoa-M)ah3A$!EoqL4QrQ$Yl z{y%2zKq9u>zI@?n7fwk?V1SV{&)UW8=!H*$-$e{gctV2c_{6CeIDuK_Z+!CR&6^fw zE;EtZl^<*kw8Lx5O^o~+r>($a+16mUjZICv5=2~D6m@eMoM$dVO4Vdxpj34Fts+0- zTlWcdV)Jgb0G$v6ZCk@XWbFeMAR{7z$~L~C#_AjhC$l7Fb))%Exne~{g)@lDq@5sG zpi3skCG8(RTtYNS;wGkUZ^25I)^yzjfB`t!1lJWATW1g*NXzsL3}pHG60dfWgUYBE zJ%3$$u(y<*l=Nw-k`abfp~(ThO9KG8A?_RCs>xr!q9{DdoX1|BUt8;zkJalC>H+CI zs%ZrG-5+DzueX|cbpL)wp?=fad~y50Mg#RZ^xpP*is0KoE@#6RFA8bt=vw`TWF_16 zaxyb%UeL_V&8>Z74#_Ai?93?xRkSQK0Hj@7|iHLA`cxsIcA*-UIU)YbE zo4aM=R+xkbV)uJ{dS(EvmBsUedc*k?A#Y(#s3n7|dGU}#SGhH@OjE}F;t|t7*?&(|BMYg$gM%611NCA>N&VuYWv*JW)XnPO-rA01M?W*c z5}*Q$70JD^lu;28X`mMWJa)o+r~A+1P3 zeVAN|x*DMUF(2e+oW7T6i6AO3F>Iv;6GTkzEr*g#2UZjUO+;{#;D&o?UeZ z^N6t;T_o%^HcG_{Impq_(3qN=S7$9)jn)n?*>l=VPEG>;R)7;#SNZw)5OgvlOrQS! zrkL31l95)}mXoN%;!s9Ja&@(D}6;WyfF3 zj=ORJzL1^=%Yu{y7HZzH%3r^BO$G*lv8oFqOamgve!Uwt;xv7sHBro?I^fXVFOUl3 z1%JQH;cEgaWoltjT2tmiu!I0GNa;0XK`?>ek4$ns@BDBtOms_GBP^IvEDy>WY;a#z z`Gk_1I=k7&tEHvc(VZ6GHgTKF7`GjJTlFO6Gbv^%%lhH1Ggl1R&GhwC+WEJ!PAjXc zl9uw@se_T|*nO-;&S;;NnOcz3>gsB#e$z>`z5R7&<_2tx{;zFSaG(3DHP zx-aAkECx&MUl&>O#4T!#(Wi@}&FEQE4TK{ z@Z4jTO)g?NP0v%CMn>%>G>t7Ro|>6uw{xvKEFR5j7_$p0j;P;RUC>GgA-UN8U12(} zuJTq}^2mrb#7+H}3o}EcJvF=?70TM$c@T20Z*2JP?&#i^msf$bn_41lgP_Ysj*X3t zxdAC!&MA_)XL)%)mU>3BByZ4op``6h)_V8Ol0$~g(QSH1dAh|>dXFZqKBHdBwk={* zR3E9gzVS%46SA+b&#<--)HO8FO&1)Dp#mo8zFWSvAIdC^ME^Sc{K$`Fhjp6?Y$&xdr+K7qJLU}<-2)eWol^y$YVBqzU3+L*w4fd2MC<*CI0 zkXor}Z_3PK7H5AqDt<2KFh!+_uOHF05-L7_8{Vd4;xzu)A?y1Tj9pH$R zg&C8XRjlK2NL4XxKGzEbL%r1WJp`BLO$Mn17TRijAq2v4_P>8hBu*HRDiq^M22C}z*W2ca9$h|h!=5DK6>=1Ve=#+iORA|mIhvnW3x+3Dj+`= zv9q(Y?mp?A>ZazS<(tPa?)ZI;n|uKQ0dC%D>zCU5f(u8$tX%`~f!gAsvWW!}u}x${ zTBuIwyFuRCo#f;(!fmiPqZo#IzpMY?0zjs#MP$84X==%9t}hWVw}z8Sp5|<~pn{^J z9{xi$ScF7wk^yN+&^8N3K8u0Wwl=vz%&tX~&=*m-PISle++5#I_Nwl>e#sp*G1d@~ zjVLvHk3?qtQoSmnb*H$@dEIoin3WuTuKmZ4mBFXgkOYp8j~CrB7a;-2;MUd(IGN}9 z)|s{nt^rV!R+Om)`4A`@hVg*6OqczJS4HNq?rb zQgmWTC#jAfwlhY=1+z7>jOMH*shO~L>K{Qz9k)^#?Slm+eYH%(-Q*U|v>y#%S zwkSc^=`mDUdI8WP^<98WGkt~nNLeQ}Ip7CaCkUXAUbuakl~o!^d6o5zoR2}i+>-;7 zcar`#lgZUxfILy7Pe}AN<6g~OGN>tt;V}wsf7JpyxZWnTM5N`{3nj~z?E>{myUfw` zmo9OEc_H;JF}%&YBB~d5ChP>kXc*LPuHomrke=2p~b53;fd6lUk7k69lgz)~a>FL2c z@6a0iqWnhf3FMWvD=Rh{vg%0*NQw^3m?B6FyC@HfDH%&o1(i%A7q_~9Al6}tDk?Ms z+&NHwnL3PLW?_5MN33l+>(L;PW^X2s!sMwZh4LvtBocmetgFunR@`>P6`5xFDHPMu} z4~j%SJcIg^Xh_am-%5S;BMo3S(c@o^T@bMOGXMD+xz^e39c4#Q22*2W1v4|V4$J3_ zZZad1U(Unr!G3lvPc-ehcWY^C=71H?C@$vFJzpTcBQ}84sjAw$t-)N^rEqDtzBpbc zyg%0mMe%OzBkm_BGG6TZ4eqtMFa}K?DQ!7AAeS+D=fVzbI0ariO<{FMNK^{9s8C&X zjscQo*gYqx2?;v>PLfLyrYZS&U4bTdNlk;U;oSUC0cM7_ab=ayW8YPS-$oL!Pk+}^ z{yj0(6IuoBF`eqh7Frb3)FjVbI}ONflhr9c$}g7QayBIc0l8(D0G515#MevI0c*<| zhgeksC>_*;q9K?h(bCId=!GA6hu*?wisi|K!v@|%GV5_qo_}|`Dm?{nwr|wXj@CmLyhPf zF^!Sky+?L}@l#v6j5Et=w}N*Tts^{`Hohd!#Q%R*lBFjiphmSm`kN^PeGAm04DX+nCRT6nbn* zJZ&(&z<6z-xPkwL6Lm=HUy@toy5Mn>ug8!^|R;ZOu^t~f*GRc<$gjCONq@YwUm5S>Fs^^ z0@$vcNL>SN>h7Adi3<_FF7tbj_$$R|2~%oSqgy+1swCZr=w`Rx~nOk6Z2Bqb#~lrJ)iQ)^ZE4G#Ca zXfF9b;TlE>PE_ zegx%1B%-`3N%<$T{4YM^enN0)Df(9EEffu*CL|*nqW2A=K@}C14z%I(=XXoul2x1i zlPAIx6B+FiAciz}{`@Lra=?+DsAvO5$E!I0xCKZl{TzV&WFtg(08*nVo)gZW1Uz!~ zX+yWP;7i}*1EJOcq89oJB}q=wziplzSF?c;`d{^C;yeWG1nn?VPxzbq98oksny<0V{tV{(Y7Q^jg#ik&l9`dTtLI%9y zauvIW0sowE--|N9)=$8Vs4ZdLN)s5tYqQ5KI5WDK;a@m8RUkmNg2V_0K#170 z%r7rjh3KLq>uELw2VS1JvLl1xXkTgTVFnXQrm zHJ!TEHX#HbwikJ+M|?hITopjYzG7lhqPUU2Y`VXLQsbr-~&Vu^dfiQ=^#->3so$|m&-t!;pRn; zVtI_@`tXsd`}^*Lk%xVS7Rwu03+V1x;7I4BvY#fLjP?2I3&&Mfh(DoJgCTfZj3xr?$p$|> zy?2IH&Uk-!i+LdLRFU-d)j*K!EQlV{4Uo+28Ab`~K(!-2rEFsmi-v<-(0Kt@tdnX5 zao>Z3W^{4PJ^n#hjySJ01fIQSO(>|*f%qB{2b>!-XQXC06TJ8}v5QfV1cy*aLL&z1 z4ZZ#SCfO7o%}9tw^$;)$BydfuDB2(u?PUzE9f>{JnbgWcfo^wV8Dw=$sP0srO1`#* z5Eg=6NE(rA(`Z8gg$OF0L{G*vM8i8;SK=0^&Ys;YdEh6QUY$;-Lk;*K-me$3rVmfs zkzbIM7g-O7vTe)T9`Mgqq@!SA1RmDivb!09{-PiwX#LYuIal34!;kCdLnds1o5wJU z-(ujoXv8PZp}cnhucq8=Ai4yNVz9?`fC15<0dG!eLj%bWumBpr*G8KDjwATCKPnQW z6yRap(&D9Z{Hi2sT!$mLE~P8VW4CgB`p%v|pAA&Ep|YHuoKwB+0JmBfqkMI>9yj#o zacu^p6)=QAk|R@B$K?p07_Jw%Gc&w#At|2kCiOOg||9X46=Q zFf|UtR+qOUyd`SMlE29`g{7o|`^)^8*9qxjVrj3Ci%@~0e-X9+?dpHrC2%eyIh}Yv z^^MPgir;8u4&lJ=9#39CXHom3?%?+x$vrReQnua5Jv>oTmr3{Wg<>;C>7pIUqpnGH zwfbrM`dVR&dqe5#iB@hIjT7hBKVC>*@0d=FB6anT7cV@$OjU1vIQ|qV`AA6a zpPK|S5Cg0QWY5@Pn>iQSn z*uV0~{(t}daNhAeQ%p6mgeJ6zy5k*21V;XB5~rN;ss9c({`LErWv1KEbO3e*cp%MV z)>na?f-pGJ83pa`gDY(uT{_Wc& zgdqm}-x_x)3Co5-#(#e{abJc)WbG|5K#|1nYAb*2>YqKAQn~B%v#fTV9l4&4-}2UI zb6cCThDI#3C9ucJMFG@g_H1r12(1c?0^e2`GX<|0HN|XoXAB{50-WXo97Ea@b#l&|_j8V}*iMUTS z8FNnr(cE(NQwy}tGaVO2c7Hb@^=!8M>JL!F8MYs^fO=98QaO_0J~9r4P%E>euFGG~ zGpqd}4T_^c6OmPUAS;W8I2llfOc>B!);^!OX$<9`u+;O~juIv&CXk?e^DFI-)zf>k zX-kBkn+uPQ&V=gDs`e*%(n5c66PZ_6hnqL-6jY}J>`qZ0vMkd$=_d&kwuYF|1$&aX zbRgH9^kaT}FYo~z2NuW0=@+-@^*k`J(svl9p@z!~bQ3K(n9)P?Qxx7|2b@vy@fIh% zfDQ$T^yjG^$FczJLE>`&T0b1m8)yQHCniMr^-J)!Tw7f!IXMrZj=AC}?23VVPG;a9I4fT0IG3E*WSkFrjoBDy@vd7m_nKJaHGuor;4 zV!Sj`Bf3hhB@vXEA|0}=6@pF}85wyyDEH_Q@3j1*N92O}ogWKxa#}PStIoC0bQwS7 zugp^)U0sxlj)}>FQa#XHb{;}{{DitF-cH{I=KB|^j4*3yHmu{p{uYaVH5W5$eH-Dr z!TB2JA1_T%%E_jeYVKDCIWv0TgW)WTw+pfUr&Nb`ZFl;QJwZz-u0VEaAA z#vazGyAT$i%E<+@%tAMUvYT6tMI~^sp!^;a69WY*_*Y`kOf@JBi>;0^k3PvLYTi~1 zoia&-7M7M+U|+Rv0b@wg*B^#3Y}+m}#SN^i6*WVsV9(9YhBi$o0uRE}%&Zi6Z?-fb zkm=nf91e3m*Pv*7m7gDn{mKo6d#LkHaRd6tC>ZQoKD075<<^Oeh=|eR<5PAiulOiKno@>_G;O1SD+1eY)?Z{WwNE#AjEWcr^#0vD{WcGv z53aARMRf;FSczZ&>R^%vy1P@l)8)JG0XEb1elwGi>;<)j==0^8XMLw^Dh|svfBQx% zC~_JUo<^{!xELWX0;AG46}JQp8Q0m_OM`YRK@8Y6FfFb%XuL8q4d5-g=4WPJGp1f+ zkg#x4T1p@%C6Yt6;FGfb z_gW7u&Pz%Js2@+|3yWDcl~AOsg&m2UlEjef~vya&MWKpKB`*e9%E9-H)Z(CPymkVNGn z@k#C}{!O8M7(|pNsW&IcBal|VrVpmx>JjO2O#7JV{;`Ufl*qBZn*VBLrF=$R=YsgD_0}yMSd!QiLJ3Fzp>^8wq83X zHnw$7r`$R@_g*PbgMlG}*#gS5z_uY$9~vCAI8uh$AC~X@PJL=d`(HDH&A2{FuK!_nyd>UK?=A&gy55zDFds{Qx&4F z5ty1RuBfDx0@M#+9YbKgN!BsmO8u}gN-Qof85B~z%ragr7)(ZzPs#nR#vr<s*<)4h z=K+;KuCXD;0ag+qO0eBuL52iyM^=0GY`jq+bA(aDYF6 z5xM}1fw$OeQ_;}KhW=7W69DmF0z6sh4J5^ZV)6$X2hc9EKYX|oRsy_-3u5j=ORh~J zj5tW8T$X_gAV1~t@4|=z;1NOhRwRoFE>8<$Prh`J;Z*{pnZQTMhS}k?9Dr(cIqWNP zdn6=qAp(X5iwtPi139@3A$f3MV86`&0(*^8UwnSTAXyM9o@LqKk}!Z2ur-*iKO3XZ z{6V4ssBu=+%f2io(0>Qnkrg3`=idYKmPy7L+K!&6s#1S{_UB>V{>GFoQ1*suFpCTV z_n?Mxq^%69XEI397)f&eyEAVw(CGxXfWR;_Yhr3qal5YzPw8a zKfR-aa`w{Sj|f^j-rdy|4sHk?IVSU=x@<4;U8f`O#87;L+cPGrPPGH=SQ3As)?u%u+MtX6bqtg(^W7SQk zcb3_&(P9VrRqBd;^$E|P$obp70pww+G{;{5=wFL-A1P2Pe%y_2hO;{vpR&23D=eZ% z@(z07kJxAkEk;pR+NtkAl>O6O*{armqD!E8a~)@BIfT+Keu8=c=< ziZ^IbOkt$nXZn`3-L%s~=)2~YN@Qt|JC1}EGbmc&Jg#5c(_XD{7-nrTK!!gzP^RRe zR`e)rZC^amqSAI}bRgmYri2V&9eM0;tjwO#@Bwlgv!A)|Fh$g&v7srjD$%fuIR67e zy4YOg&He1!&EKQ1&Jm04Pxx(51{`Fimbgf^oj^t1o}m@=iWjxH??5GLQp@*wKqtby zo1NhHv`c}|a$qlD(X6IHdPdZxO4PCJ=FhdkRqU)5;n*tL2FrZ9k4+Xd@Xvbz3^Qam zhc4}X&83-g^IxLq!|8`-9yl~fmw13c87Z4qhIK9W-qhJuaocU8@M$w6_kw+B%6N(L zyq|Q>`ml>f(#_|xgKL`tVW|`x)%rU%d$V<1)6t=CX9x}rBQrQFl|Q;2=;X2Vs}rB+aQl}2^fZdoi6)stwVCN6CF%;lIuUCDY&zyG)i)y^o3$OW zkP!h`s#38%e)YY0``mrGszvsl>7-`&O+R-Y@$J?6Dz_N>hDYFM4wOC8wcr7lr#I?& zr=uO3xc5{B6F4_WQJiW-W;Dx(Wae=k2;HlQsZlBj=@_6W2`Z=UdZDUK@V zgL?1bs>#~?xrP%73Ky)FIjg?gdvK4G$kU97-5d8d?ooRXe#3+u{vKR= zS%G*G@t2fDDfd55QynD_AQAutMatX%(q;DF)tx4yQA5C7qs;BI&K1-zNb zZB^(l{jpGE$!1WMg2U1NWu#q2f1>L%bpJ@q{ZAkK&qN4CIC3Y?t4I>7%kTT2SikY) zKW%`)#1eCUhhDDo20x1CiRCDLKC@0tEcpk~BePX#s8TS$xI6d9n`ex_MEiEzVi|oMBR?CABkxw4T zo)9C9Qc3Ao7A_)GWxl|OO5}4pr@Hxhyf(B%?K?*HUsVEB3&HawM1?~`^A3z~YZMt| zpihG*LxMVJ_qZ;Tm7CiO@vnu}eW(YqlSM%1803w+DHuhCb1XL2)@Dj^+B}iGhhqxc zAb^3MkG8lvAl)jb!PJl_3-d`$Mjy#LUM)y0%?A7*)cpeHXE*T5@rBT zoC(1T_()BoM~_;2pR&MUC_j>V<2)f&Ow=udFbe3?z)04ERBj~HhtiFVjM#*PTvP`$ zv$J_3fv%CVM zoexv^FJJE3x^yX=7>7nX^WocrfT;1mIS>#amneFnfD9qXLyVDPSU?Xq)-Aca=Cwji z2Ot1e!f-Pt14fy5-PM_=G7!dtbglt70NnfJ3l?#^cTa$!N`@3wu}0ddl4=rDE^Ss; zR^VoSPv>pZy)lZz8P%SDjpf6O1coX zieT3;j74IJDc$RhdrnxtP6s=?C_OG%1<3aBrf<=`uqy}Dkp!uZfjg7dIQ;O_p3xOR zUd$ZKa7W5q@C5ZvB-Id0+IpVz;WB=+{^B@*c})Eiq*FgK(kQmcQQQp@Sqm@7{3sYt z_IXot=nrCDPRPp2`jrL)j(-A}TM3c|fX!L@35A)NCVfXn;NGaW|Jo$%7>Vq|Czc|o zRYRFBjKv^}j2Sks`xQa7C;VDr4EJSaE~T`qSFT7wTfYs|qc8gXvNoRC*-O3&gx|Hk zl)p8c#+wPb{oOyGn+N?>gw2dOp^$^6Gv=jLZ=T*b!J&z}fbz%iiTkHxo*qd% zboNpmBcE;`D$mS7!Z^S`>E6XB9XE0=ClTM}*!I7u7NBfdMD&Qg>+4Vki}*F~@yg?2 zaifgyY;6p=d7@ux8b;xYLxjJ@;R!B=bNVA&uI&UA>hs@5;(zeTNpwT4=5#tC%ide5i{tO*AfJDbIi7C*!1Jb;E6;8`?Vh-K%t;UWN!m#u2- zl?6|@-ps)m7#JW0nHV95yqb{w3DhU(8Ciqao!=x8R9qd>x~3ng4x!YKNO1aF^cUR& z;`B-5LGgwlB{aHpsx973VQY{IHilOI zLw@zh3Luqw2xz;1updE{uz2fI!gyD9j=I4f+M}(Z!g&y`7|?BTXOMSY z3uI-}=a{Wo~ zp3N(|X$6_@=NRI03XG0MAWbWvhF%@&M&!(E^n7!VptVMXzSBv5G($0Ee(bfE>0HHL z;bMFa5DK6%W+*EPLf#*3ZI)})Na$DoVqzZSl>GsX$3B9k6_r#YEDp!^y31=-+AY(j z#?p!A?!`A~9QrhV^Up}uU?hDo()aQ4!#@?tuq-Ut=Ui0nGWsyV@c8%z<;$9N?ll@m z+s4UcAYQhz@qCvGZ`uLIrtOs=lf??R!bRqi&vDa&9=!#ZWg}(~+3?eV{z4OYTg}Ec ztOg{3%s|FBmgAQE)@$!cNmUNtq`8k;pPGub!uVL&I_@ie;(q?^t>FcVPm}E$)Cf?X z9DB22iE<4H4159v4Ir}*eQp4OcU{zf6${N5E`4dXj+2Na9Mb|zw$>p@(T~sB89jaa zwB5=tnX=>rZ`Q`5-K&VSP}rJ`fGwDI#a*lJ_Q7aV%!gEx2tdFZe?Tx@t)oEd7`NxWv*nPfkPOGJmQd8|f+Wx9as2T`Qe z_}O>?g2!CP*m3lX^{Y#Qb_#dzzPxnl((}7_zrDRk<4YzPMkW(B=Iq7yrK6+yA-w1S z@&Hs%2(Dlj_^3w)l%c>rN#HsONdPlzoy(}CWJG^}eSm}%4>@nGarX>;f2tm^8hYH~ zD{T?@Fr_%)wy!;dKUn!#_yPJ!xRw4In+iV(c25mhxH-b_R_DJf8aO6z;ol7x!!D~t5+^w zP$mrNEc@EnIKXq_&+h{#i+vG%EFNX@j%o9E1BDrkcYAlWeI1&%knhf$V}668g z6uGB~L|A=gWM!3rqJvbzhOHaOfzzu5FIg~)qeaf?@Ta2i9=YQC8VXg=MVSk!W<0zG z$a#A<9Sx19b0HqP`m%`(|2!3WHP$|ayd!3#2#lJR$KE

    &AxN`lu&VC;C1-%+9^j+A82pG5)97HLxq11Oaa-^>2_voYoF1mi)5&{B1A=W9K1 z&b%+i@6z}t1JC5Th)B)l*gxy`d*V%ma33Zbq$r$AFT-3=%@l`b7|g_jhSz*`XR zNlVLyeMm_`-iRQw@{O6j|4(@4NdcGKden_yfyL^_gD7|Cy4l&4;3ogvFapOBg1l!C zR*3O0B=+)eMD|~N>QeHMrPRxVF>v8O0hfyV18S+zs)F}GJ=&4BIr;@Cu=bW}c-aRJ zx}a;ad*sh5a|jXDQx*fE7aF>sfTdg*{xiUfZ%?WNY zNhl6#|H&dH&60XwyecTD4sC{5j{|~-Y*>QR6wRZ!+npAqCWuL*ZUHtFe5rAVT;d}^ zBOu|8cpSL7=&&WJHE9CND(zwPGpoeN$Z2dEOwiA!j}8?g8OjgQn38Aj^qP0ipZm!W~3u^xiNz(m29v+vxsJb>AJ; zRQj%q1!NQibx=B}C;}=f9RvhMF!Z5H4TwlD0s$eApePnZ6e-d{dW}*gG!+!3g&L%z zfRs>_7D)))cRRmx)^FXj)>-%5zwVv2oM^JkxA)iH@;uMG8#GK711#%;Dn!ihdB8Ox zTw2->UYj-eWnSHZ2=r!Ys3ySccMkW-lQx_*P|5?8+IIOt z6F?p&%HMoxmFGTpQ~Ca*pdnRp@qz&lWPy0k1@YEor?*&;MVtS_>@+z`tfN`%v<

    z<3cQ$T&KXH^WdZGSOdtOHGuziMWrUoEQElyNNY^EP(MWZCayB zIs9Ks@V~!WS28hG212x+BXirx6SoyU)=l5H|r2 z(|VYko0WBoT?IS`_R84J`vq~X|LNa&GC)Gc>!+`lrY2&PgGp-JZ>847N2;{Zzg-GA z`TYo{l?kjsaL}(r!vejK1|or-9!W6M0lJ&1oH*SF22cg$rwJ5T5*Bcv9N4pnwt5KG z2bl5wp{G%RO|2TL0*0e9*c!GPXOKp=u-;KS4PG*UQ_0B+zQb`=gm@4S0wd@Yq#Bas zygbPY(DwPcc&V5T%T#cVke|R)DJfEr2tk}6xIP$Xe8o9{B?Y@%8=!6LH_wcU2jJ;L zW3`o^KM&!+>tDx#7Y9~Ox0P32-%JIxsuv6vu-6vM)G%gj%7yOWh5pr*5FXi3Zbu8FHBJ6ncffmpSVC)c+<0J=oUmAux2N?K(eTk za}(Aow|>}F373HjsF$K>3P5x~8FxVdVcr7>Tw*99;;xh!X=-Y+l#dW_YZ7T5%h0yV zU}cn1Dc#u-VD115;&o_vGaTazmI`fXZ0m-Q7vfp`6d726@!kcky>8CcUu1E}ut8)N z)Y(d@3E;k|Z2r)w>W_n0_@xmI6g1@d55Gz2cLweq!u$a%8L{h+YJ}&(C;;MGOM5#; zNgu)}Z#|g31L?q&wZLbT%5GOFN zWh&B17{Nax+`0x}VU?=<8s9}<1EX_z@g4M*t9Kh%qE#Wa7T{omKYY+z3BOi|-f({| zXLiXaJQ;pOm3%EnfIz!cs9-RdfL9C4!%*{6>!sU$u*Ld21Eh2vd-%waBi^4XMzttJ zOFYvnTdSomu$@N4o4|(cZ5G12H{gIEKR*U=gb{L}Ydig~9d}Fqdv}NCII@?&V}Wnq zQE&ke;LTzk)wb%7>qXibGVVXXdt3`T`fH8ocZ$Qre{yJuTz6s(2wzV zk^6Jcz~BLg2!a^XE4R#)jvYS^EzM`4Bn`@;i>PfI_0}z~IzU1e86WUkcCeQ*bJ}j+ zQ&Sgax~l@7ZxZw|KsESuC+$tWi#}gFo%;Nv2)M8>X08Ji77#EV-e;!`Nub*($Lf9i z4Is=$Z1*U-Jf7U^(NT$Iu_QTy9919qUz>tG#3P+N>&gA4uTc&~*sY?Y`J+#&0Ju;i z0AVvv>IxFmBoYzR>B(4P8b3P8iQ@zkZUhJl40-hnHJSwLIIJMhiRIzFbcqR$r* z4=9|8mUOo%Q5xRQJHg6X{y~N7pEzp{Ix!1GV9<6j{vpONE87cWIKfuJ05&wwugzs1 zunJzV&We06MRh0jzAOWJ(^SIa4~eIaf^FamMhfjPH$SYMg`2h(AR`C`Df z!+zKD`SVfm;vC;zA$mP>A(Q9k3Xhd<^u-U=D8Km&Rs_o$e~;&jb#5MT4K+ULqB&mh zctY_&qUZ!K4{_%X?A-At0cbiRv%q|f78#Md`KTkAu8Md&ihgg@4+topI(AI`z<~o7 z!0Gw)luaZ2C@Ng!vv=JkzH81ijvotrm@n{`6$4a*Wx;n&Gm^J&{tt5|;bb;`c|(9= ziz2PNlaUdB6o06ue9!d6{yUK}n}?Y?-+VkdyOZhee(^iVronlG_5YhswYGDQSyWRg zQc_Yw`Jg7r#H8NGwJ^f;tIDnaEIXKY(O~q5HJ$_WQDk771@VJ{&Cx3fcAA-sC>;L2 z2b{~kQN2r2h6mV=BAg1an?N$BfAn_(m-9Vh#lcw!$ziAzv4u0TU?79#3o(@0x(6%Ap^FZiE4k8E`Ij{1BD(OZ$$ohChXH8-h@xvME}aRs+Rkpw;pl?k(7? zRpW1*yN)4JYT*CGiGV*t`FdZ7Tu7)F&$l<6O8pBiA^eMTci8ZQ1IOp>xm@mnVdK=uIPawHrNn#qH%HbMBLTBCeB$5w+BC$#& z#%YLagEUE0I6L3>DrEq;AWj^>DG9(JEc(nquF@Hl$7;(0Z_y!28F5dr>fCOn+!QKU zxr`}E{A=p#MJYeC`Nf9qEltuIBE}2RjrGZMhE5^-ePg<1S?DaC3QPvJT<@?ImGeBlg;TZ)kgEnPYHR&&Cj-y{|*)A zJ{HWZ=yizr%j!Et29D}HXwCeN=9BY5Fnwu-ytx@K0wz6;*g&t`c&tZ9X zUg;}B!9Q*bOoCpiMI^sM_x@lA1et=53L?l3d)|SdAtE9KdfYwt_8s9hIVfrUW?Zh< z`Vo@l+;{kNC&<7}RBj^TRFLEH9)%324VXE7gA)Ul$RV(GvJZkin2QMbMQ0(de@l#5 z5Mac2srXy1!@C#0T3w$>ZYe4@E&lsBkI%h##A#Mu%w9K|zldF*?*cHcC~6Lj_ut^{ja1{YR=$(+oO9EGR#q=8|4421}1Ad*jN zhxCLh5?vrV26l4o%*jghbs^aTIQXzj}gltZ+zziXF*I>wvx+=McAbGDwkSc zuWH-H_c0l)JULOqS1$jEme2X_!d(zaI}vVggVoUN4l&j(t28r5b7iy>>WBS{@9~l7 zyNX@yApcB+Kz;g41g18&`CSf%MOVXSYs1X;XN8_8#Ynt@Q#+59gkJ0kcS9}&N^hU>7Z1_4F_F%MIp}Mtyk8CZ{6yc2?U{tD$FQoueuHr6X0hib#AqD ztQPh^;M^V{IgJSJurCf6-RGZlz6^A$pb*20$hCIgft?O^A7F&eA5Ax7s)eox zSp2YH4e~3~Z98XY&Ywl|8wI}tRW!i_L%vLebFwz?sd^z2rA(ZsfDO6Bi{m-9vcos& zJIlK}4AF`egE4a51(C+5*FT-JZs7C5pK0vu!&5_)pV1m`tRj)1ORtWyhBKiv2-Rvo ziobbb3cfefQ03Rj2z{huMduYV)j3kDkRq0nPO@GJb z+B0ubsosbauk&Cu*OwDiJm$R)L60oB!%G~jata7L=X~#N2-crobXfKXL}CKz`#xrG z%1lhO5c<9bD`lDBc^82HX@teM*?ak==ik<79z~Z8;;u=ue zSly`X&u2cpjrvj#L=$7BQ?XNCMh#P~*^SxcgHvA7-O*txj6g0a${&vNBU!Qx`4~a+ zXhsN^)fj6#Z%_C%%qZuRq;p>qj~aqmn9|tiQ@9$Nc9C$Ikk&N@^Ya9UKl$FalCi2t z`A04m!mq8dLNs+h?un())oal`S$Z3brs>d!W^yK8Umh6GKKFCXwbt4 zPRL6(uA1q(U9Y)N%x$J>a??`nb`FoK>63L=|00>keHDyym&SSfyUacOjeH9p7pcBW z@qPYIeDe;6b)TPa({Vg~(!!}&`ckHL|4b^#>x$ITg?I6Y}byWjzcKSu@o9bi9N?mrhoZU^d7>role(N}bp0=^i zKTn)mF(|vYPO~qU(HI+z@$a!C|B*3KI8wqdoDaB(Mu;{ zK4PJk?64YbQBbb;+V*_`-Km|CxS=S^#PqfG+~ZIjXCl0z$*3uGej|0OV}D>kGdh3% zzM>dSs6IEl0gJY1<(OG2iClhh>if%Y*BGS3bG(NWPxmu@E@4<~cn{rbIO+iB%zud8q-xmK#S(bc&nQG)ZF$U9(onmjHX7>q%i z;qmEFve<=&2Fe1V{fT`6^U!{=g+B^QDcq^NoohvfiM-+0oTxoRW(|^S!x*Z8WwR_U zF|%&{!}_i5KQk?`MXzSr!cx;@nq^i3-N6SmcX(d1du380qeX$gcSt$x%tK*rO%)Yd zKrWcr0<0OH?xt`k&JK><}HB( zNG;7qJV;u7j#DL1{;gW7F&_5EGvZI7ErT)oI}VI*Oj_7scjJ!EDRB(F)i6JfqrIzg zC+fUh!Pw|P>At%Xhc`+}E23XmU`>d@dHVw;&k%j}WsP9YU_%5}HP?)7giiDqmN>Oes;NEzA(`E z#MNuWKG8?nYHk=qms7l6W_QowmS@7U+`^i%DaMPhQEdm)CG1a`^SW-~YIp3o^Dj>A zy|Zn)9D9;ca7FTPGMP%)7Da{oY*XG`z?bRt#BIjsDBEN`G^ovQUoxHjxTv~{#oN8B z_cpBJmY3@}!kinvh@G0|Vo&qnmTXfC%d z<8tG^Ab7C|=YP4=x8ZzHzUNGaJ@#yiGbeeK|Y;-|nqgJ(32p$oi z8G-c9z^C${sA9;JnF%ig)^N^Rqk2ZR5551k)QteHVtI)23 zg_5Z}tR!MfYs+)%z2l8{jFG__M1Y^^4wJ?|^z62O5v%{NKdrk)*+ad|Z7`-`j)*P+ z9%3vtg15$ZAmv@6|2&{n-#!S#mnnUrFV3?UG~fe2Hy?#GCy+L@V8=HDmqjpe@&J%F zF^VCya*oEd8P9$@>W?gJMfNu~pVK98lGa>X*zRjwsc*T>0q zPvnWbH^5eUg?fHc45Y|#9b75&po?FF=3}Lo7O}_wd^Wzc-58&?6|mYj zQqWD1OLkkz`E`A!cJJ85B7wO))bkSdTO--xL%vrDCY8EMRuTCU7+>m2kXw{=(R8f% zMQpuZ$B-X-wwS$nHA7^D*pZmPpV=hYVsfjpOF(j8#t#dk$TWXijpW${Dd(BmHr15) zAX~ADm1%|a%5uB09in&aSgV)n>CzAeU>Cf26{f3u@crX^Onwc3e$W*oxwSYGa+7aj z$Vb=jKMpE?6WvYRIbAHSiyjxeu)_D;yrrZL?ax46c$T6R=M9;UA}Uep>8Xd+9U0GtxI<8rQM1 zK}jPptXpfuhxSr1jL40YLgo5(9dumg^!=K+kqT8Ul1}$x#oX!)uDK$ipyndY>7>)# z_!U&+L@%XmXC1UzPsp}m)Wy#4h^b(4-1U1+rt8E;ErSAc(iMxZAtRal`li>IX|+xv zd^@|BvZ5u9%g}qa`y6@z$QmVB&sOr|u1KA_-8~vMG3bqF0>b#MZvC}0^Cgqnn1%dW z)5e3>Do84eXCw26D#m|GpYY08?d|;HD_-b)Rdc-x?b~tW$~JDR`(&MT>Eefu1CL&i zE4nJB?+4mAu}9Ffy*5~Hmq^ab&CrPbbvn~} zs9ATeu;xU5fp!Cqgn6=(mQ^-dO$rnIdXWLg<7v@FjS2K7>8#wu~J$Oo@PkRxy?ls1< z1D9_=8cFBFotkxDQ8^SD(y_Vr&U{RA>P38`lh`N2@`({H zfo)odS-c_UBqna7>paia6Hyd)e`_9nDf*<1M2Jte33cp5h|$@J%oSXJU)4l7%|Vg8 z;kK_6j6bzSsDo6B2Oety=+%!wWs8%qQs`_Z*P;$OPV0nMy3)d}OkX5r&Zcpl`srk4 z3XgP+SkUhz>i34nL#`Z6^1MQhu=u-W%}Am2j?GrOsUrVKwx^JJtgGh;G5ni!U2dVG z%Q{bCSOkkW&M|iXr@C)0itBR9{R$GMRr>NDToTnv~D z-K%PqK6zbC4qZZ>DXVxyqBfuxGkGkh-`IAH&+dJ`D@OH{#>4_8F@JT_)KWCR-+T6% znp*=RCT> zC|1Q>s1`>1$vTmKMN#9(ifkU-t?Uxj0NdQ!q6>Y0KaW)C7+zeutDFmTf>x}DVYGM%IL;g7z)cggvHP zxqpttx1YjQXn<@yQ|Hb3Ql?jo0w3~_%^Uc?(?)1U^Gn2EZcbqgei+Lg91QC+bMfp& zWu>_`v_8s-L@~znxA&(Qnc66AnqotWSMcp{)dw^c=`W;aB1=h)nVkQoHg^7P&tuZv zG?Ilwe~_iUD}F4_*SCTUxJDaDK^ZhMd3{Khoq?7as2 zr5WQ%n6}JXHnfoZK?$8+}gc2eC~qL`J<%H!9ZRUhc@A3Vowe?U=e!?UsVE zzD`^up>RF%bAsXu?F$QDa$q`^~SrKF)hsJS0() zhp3r^lPoR^zyG9={31n8Y+$HU2Tz$KPQOyQ-p4T;lU4etutILzvUrG=of;Xt`o@>! zte13yIiqmRCENFl^F3Sf;!d6DqPO4K)R`qe4#u`^zli&8*$)dl*3>z!F3oMsfR5UJ z?U!{djyOov-!&o;1qIo{U&*comoWGlN`4jESkuC^tUASvm}hd%AFfI^8t-zBko>#q zqjSNUxpyaJ%Zh94?;ljyAzhVHx0y^rD^V(` z{_WO{>e)S7HX2`46i!AK^9i~ZWO_a#rgJRw;dW4~I?z^+%SwE8^%e{HlnXACH|mOg zt2G0Lnrq>R)?t;fGqi*sJ$qJ)((38H3HUf({B~l8iI&*hoyloSJ|_bdUoAsSyIU(a z3tJMq(Ir-;oeXA|ben?uqy%+r;n76k>@f92Grp|0SgIp6K2X=l2c6KNZO7!XBM~VI zx!w?YPwmdQV{TU0obJySW+HA%*kdrQD3>-*#gps?{xDsiDX2HH$eN>qg>Q&koEmKJ{qYvc6QqgekQ&Gm(f+$MrJ52$F^!KE1tF>u7$~I*> zv{W@;fK>$<+-y^{@K=xJO}{Q+QnD_A-X(1&YD(_q<4$SO&+~aBVO<@rO&*h+wv2bL zB4NfHMmC=Cn+HafXp{f&Xje@yP2Kfp=5xhw2cATjpY2?mWiFWSDta6E8A_TppUHmtnJWxQdrx}t?Zv4HF!lZy+(z8#cCJZ?b%izlP^-}l*DtV zP24`7Iwq@k;I+$zYg&2f{qb|6s5INc(r10N>Y}d?*Qj|LHq%SNul0WUoL_u!V{Q4+ zlbttbTw~X1R}7>v;a#$$BtvtLA&ZP=LF&N=NkfP6zl{%@%$mCPYrj4OraYW;C;c@` zO#5+1pT21{HLK0Y6D!-YS>C9Xrx!yXs#Rf=GL|D&6c1sFX|25aN4UO>-AEkz$Kp{X zQs+;F7?q&Cuz4ltr;jfoYBtukU7PW;N%zR7<>@xGs1{2J5PWKE3SVRN z4t7?oFDtC{>}d$``hH&WJ}KH*rw$+9fimrX6K+DYv+cL|E}|-Rck5@lpN`W8zZd3y z+Tr!N)0ou*e}xnweY|X-BS3Jy)$ws~=dZ79w>y4J^XyN_V-5d9O2OFaaFasZoA5|k z*|59}@pi_5`Yaf%!P_R->Z;G0!Gg$Ijx}o!Z_cNN%bh^okMi$Yd7gD7f>%Gtr+Sw?D#nj2iSGrDZtk86Qz(j8;&~U;uyZ%v+ zAJ>e9jC({yn$xM}d9*OSxK*sPZMdWbSB|rApj%Ky4qGzv3J>!R63SOS6~Wdb9qIMp ze=FnWt)gYx)hnzln;(&NzQn#MI=SzL8@W?o?}d!CN3Tn4{Z-Z8k6c&$#T>0`w;Xhe z1g*=AvD$L8Cs52$QHJlji4WcOZ`cO7BsZ!iS?usT*K4XOfGyOn@-!+o&0tF>l6mPe zX7=p~vg%^lVlMkeu8dUm*4F77OP}?aO5DNB ze2m6S%eqOv`_+juDcP!&tq!MOZn;tZZ^G~4&`w*E{HcL3E*^F3)n#!=WQRf6CI?lw z)|y0-^{(Zp2WvHAx}uV1n;jk!P~vtL-#<7Cxg!y`}<3pcoap;#9L$@8%L`soVlzJ_Fbksi-@6V4~{2}e^{+4$&~)g zb4v2fNrFq(nM=M`k9tD_2#SP>@Sv!A=i3J@Z9+`%$~Mq^tjakAi|AXrJ%04pi~Ibx zUgYHelhFJdcrqzSnMAJ!hFNCiUo!*>ZlFW?XFKBXiiz$_%R1R4U4b9HA#r)=^~vM` z|A${Wm^f)|wj<93QL5d{vF@^6hmJ#vlc=By^M$vf3J-a1N{v$hg?q4z(@cEaak8<=eEk4P$XTMd}c*h0b zwO(m#=6Iv}{oTBj*&g5KPqU-7w|=QCQC^jo#~?5e9Y9?2 z0(Y_PQ`nBG-18-F=PzySP?;#1ZKjSikh{A>eAeu5=TKk8y-_u4T3Go;xxEH~8E0QW zTDOl@1$g!MH2rZWK85B~S6%-}ve(#gpEUK8ut!Us>AhJVz5Qolf2{iS9CnD6+&#p%l8 zw5^RnQblb&gu08@e+^28B=qIVD|;2AWj{>}O3$YyB96YsB4q2zrFGbNDpXS}8Ky__3TM>;P{Dc_0vu-AXq=N@OjN{M*iS{QjwfPnqr5=08d z@Wy0NdiG@vv540%UN!qr)+0=1@D=Gu8ZI%Hj0dH^=kiYWc$T&NsDM~-m4QoPaeQO? zHh7J+gwxue_oGbygq2zm>Cy>YrP;&^V=11V*Oz-x*{G_6SChi~P2ti;*c`otc`amC z#=1qY+-zx;JF_WsU+kN&SwUJ_3ZuKs3DLfoI4t}M zK@0pkuv_CTFp&L*JgR1&C@pq^AYML%NBccOKq`O2G~~mK?jnR&2!y#m3D)WQVHaY4 zZ54~J=AE+H+kZ}fiP|D?HG!~9e04*za35M*P~edf{s zSpTE<>w=1;V7#p_6180h{^<9$qWe8pp}d^Dp6_LlU)09sUs=Djmy~L%f&UM)f01{V zxXy87xZr&PA(A(I$MSQ z_*Qm!ZbOhch}^22@j>Fq4DDX`%Bc8z=vh`v!1aLW*GW{+HiNnbSl3yk{xjfc=PTO* zq9s7!=Q=L*wdmH=PIHXQEuRVWXsdo+_g<@ZJLiUFRlZCp&3ZZ5J1b^;M$P5A5{Kk` zmmbGSKhuFFmFSmy@(rSBre?QNOCGZ{oD=tGm!ncf8E?&IwW2(x~W9q`9U#+~-r z0QVA6HS*XfvM3Wl{jRkX{PQyKFUn{4aIB`jBW64%(f<%pSvpWub~g7?U9P;i9{5=K zJG9AaQ?3omGM5}MMvjhp^I^tdDeo6b_p{JAAwXq~OEJtozDiug7Ac`^OwU`0mdk91 zwgl}re5^nBKr2rSJiq?jBYCA-RV-X(EDX2nsv7jz1||K^tt?j>Rs>%Kr;+}iE#pV} zd$iI2xd=z6O5g`m@cZVVL&t6>|HqO%&cYGyW2-4U1B zg>K*cZDmkr?(B+8cA$md6CX~?oIX)k=3P8$aqg|HoSnUS%IEg3RTjui4LBLg)J>~J zn#a<_^?OXyou(FU@|Q3!YCLn=-Z|g}hU<;*{-%}3C*&&AD5*`?xxmuEZr;yeXzMKH zgjFlhg4ISo?yxRnnfASS?EQb38sfvMIi6uO9+zSZ4J8?Sa%bWldTT6aA~oxZ4QE%X=2t1A+44zP^Rfid0K3s$D+!1yqZyf!OJ? zbi?|>zwL&|$$LdH`Gw!_86YyCm%O10v9PTF{1+CfyT{65FZ5epvDSnRORxAF@EjZ$ ze}sZ=p9(-Jfz9)!b-FDf69_D`_m0>afkwh7 zSzy(ATWtY{p#YLbb6uJDMP@gxYS^l+h;_u%1%jS0?k5Ie(2mzkW zptsl1rdC#Nl4*d@Ldq&4dZmC%OT6Its63l7h$P*F%K=z@4d8PKV0Y{vdZKqi#xd?D zVA}K*Tgg?qruRJNk@5rdT?il+J%%s9Sxgy^AK5)s0u(J)4(YMCj^V=GO&^~K4B3Sn zBEP>efi7HsyNkmass{wE^_h>vkw64L8qrRj`EUg79`#!u zKzNtJw5_idutKzBkg=k13COarSizG>{O59Y;kQ_F=nZ@4Q^@W9>jb_d{Qt@KcAS)< zDncrDQGq}~AdA4p(E-v~^kAt4@&xMqun{A~rtOWi?ODtS=no?Nr{5ZC|9%L}Xnnw} zBSkodmXUJ5L4d{sJ>6k_5K({y5Fv&Yfk--$Qc|<}ZjaELGk8F7_CW#4wV5uB=+(*R z29;VXzu(!ZJ9bZzvQWHi93vHO@h1&Z;UdVOMOINYPvA=eov`W zKxGUC$}-R*=b+NHArvS_M%1X@?|UOi|7$?mPlQzrp-%jZ0PqdI{ss`iry?UjI$Rh& zh}FMF3UZDyi7tQmEkVVp!D!4 zGBQ>KO6wLNRBSNy5GCcR|2V$<*5z|R{)8QctS2{;g$Vl?fexwP_cops1z*h+MNG5^ zbRpnVJ-cBPb%EUU+#qLfW}g7(3LJsU@MPNIZeS zpqZF{yu2)N2O<5y??}NFkcJ(2-gI%LP3m6-!4cXoY8#KGavXC?czbh`+UDWmaOAXl z^r)uwe)Z0i_xko~JrI4MC4Bj>KO-(*H$LGb{J`bHmA6I%b1#CDxVnznIX?Px;L_fT zp^x70eF#!GN zFBy*KZ>eel7fq)O1SBuDS7)$H<1dnoAx`(qC*cfCo8R$!~z|+hbqE-=!iBN6H z-NOTO;7xr!A{H?T8ZH)AR;>Uuzo8K0Fabz)R5a`jXW_9tK!Irm`11?2HlSe2L}kF3 z+~=A@J#Z0rwi0whYP@Zb7!bKzVfY@34=yP#o&thqHHb{@53nLm%1-|{6#sI1(6l7 z=^vKIZI1@8v_oGgvcY!wB3~ovz~nX+@cB;i{9wh@4`3MZMEcRgwSiJ-+{VHl;=jZ2 zFt_6V_+XSj3_tWVI5r!jxJ{r+2{;O}#JVvJrQC({1o-&ry83LqwsuFB%E zOB^|*{;I3fZk_1F1_ncDMbLoIXDLeRR`C#Wqf5xh@HCWEpnA$xK_2KcdRw9S84US| z>n_WaW7{ac!%9lXBgsyT=NaFApHUzawUyg^US1&7II4mNud4SvXCPth1q_dSWhUAv zZB+4zY&IhnnJ|%xxO`UrX%tnMjYFdt3;bx?RLe*#$KM6a>v*#uE#e;PAcb1}b`I-j# z_@B@h5ia>LvYRI(_PJ?m=Zj%ntL+c)YS}L>9M`TADSw>#s#IMFBUb}e;8p9=~1#D%LwX@9qH1-k^ZgKC}oK|JZv z+rL=P3YOtv^*J;z3K#tqj8$KaU3^_msyK?ge0A>wey!@Qi{B+s5ITo>Jf44d+&6#o zbD44)_tK%$VsR1B`FoD-PBV_G8o6%i&5z6WbNcw{5*#VKweM<4BM+{dJqudKgu1N% KSBbjao&N=^YdB8; literal 0 HcmV?d00001 From b1414413068235df477e736eae9b70365008f42d Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 15:05:46 -0700 Subject: [PATCH 16/54] asr and wdsc --- .../attack-surface-reduction-exploit-guard.md | 13 +- .../customize-attack-surface-reduction.md | 60 ++++++-- ...tomize-controlled-folders-exploit-guard.md | 4 +- .../enable-attack-surface-reduction.md | 130 ++++++++---------- ...enable-controlled-folders-exploit-guard.md | 8 +- .../evaluate-attack-surface-reduction.md | 28 +++- .../images/security-center-custom-flyout.png | Bin 0 -> 80042 bytes .../images/security-center-custom-notif.png | Bin 0 -> 30783 bytes .../windows-defender-security-center.md | 46 +++++++ 9 files changed, 187 insertions(+), 102 deletions(-) create mode 100644 windows/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png create mode 100644 windows/threat-protection/windows-defender-security-center/images/security-center-custom-notif.png diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 9f43493f57..042de4137d 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -1,7 +1,7 @@ --- -title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system +title: Use Attack Surface Reduction rules to prevent malware infection +description: ASR rules can help prevent exploits from using apps and scripts to infect machines with malware +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,7 +14,7 @@ ms.author: iawilt --- -# Reduce the attack surface with Windows Defender Exploit Guard +# Reduce attack surfaces with Windows Defender Exploit Guard **Applies to:** @@ -28,11 +28,10 @@ ms.author: iawilt **Manageability available with** +- Windows Defender Security Center app - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md index 1cf8f4b7c2..ff43300ff8 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -1,7 +1,7 @@ --- -title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system +title: Configure how ASR works so you can finetune the protection in your network +description: You can individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from ASR +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, customize, configure, exclude search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,12 +14,9 @@ ms.author: iawilt --- -# Customize Attack Surface Reduction - - **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -28,21 +25,25 @@ ms.author: iawilt **Manageability available with** +- Windows Defender Security Center app - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. This topic describes how to customize Attack Surface Reduction by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer. +You can use Group Policy, PowerShell, and MDM CSPs to configure these settings. + ## Exclude files and folders -You can exclude files and folders from being evaluated by Attack Surface Reduction rules. You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the files should be excluded from individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). +You can exclude files and folders from being evaluated by Attack Surface Reduction rules. +You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the exclusions should only be applied to individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). + +### Use Group Policy to exclude files and folders 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -54,15 +55,46 @@ You can exclude files and folders from being evaluated by Attack Surface Reducti 6. Double-click the **Exclude files and paths from Attack Surface Reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. +### Use PowerShell to exclude files and folderss + +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: + + ```PowerShell + Add-MpPreference -AttackSurfaceReductionOnlyExclusions "" + ``` + +Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more folders to the list. + + +>[!IMPORTANT] +>Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + +### Use MDM CSPs to to exclude files and folders + +Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. + + ## Customize the notification -Customizing the Windows Defender Security Center is a simple task that provides users with a clear way to contact support. -Simply navigate in Group Policy to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Security Center\Enterprise Customization**. From there, you will be able to enable your custom notification, set your organization name and contact information. + +See the [Windows Defender Security Center](/windows-defender-security-center/windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. + + ## Related topics - [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) - [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) \ No newline at end of file +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) + + + + +### Attack Surface Reduction + +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions +- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules +-- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index e7a69616c2..42fccdb3c0 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -77,7 +77,7 @@ You can use the Windows Defender Security Center app or Group Policy to add and 4. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled Folder Access**. 6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder as Value? Or Value Name? @@ -145,7 +145,7 @@ When you add an app, you have to specify the app's location. Only the app in tha 4. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled Folder Access**. 6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app as Value? Or Value Name? what are the requirements? Have to be exe? Do you have to enter fully qualified path, or will it apply to any .exe with that name? diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index 68d4c7d692..842c5005a0 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -1,7 +1,7 @@ --- -title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system +title: Enable ASR rules individually to protect your organization +description: Enable ASR rules to protect your devices from attacks the use macros, scripts, and common injection techniques +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, enable, turn on search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -19,7 +19,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -30,20 +30,50 @@ ms.author: iawilt - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- Microsoft Intune -- Windows Defender Security Center app - +- Configuration service providers for mobile device management Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. -## Individually enable Attack Surface Reduction rules - -You can use Group Policy to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode. +You can use Group Policy, PowerShell, or MDM CSPs to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode. For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). +## Enable Attack Surface Reduction rules + +ASR rules are identified by their unique rule ID. + +Rule IDs willl be populated on machines that are enrolled in an E5 license. These machines will also properly report their Attack Surface Reduction rule history in the Windows Defender Security Center web console. + +You can also manually add the rules from the following table: + +Rule description | GUIDs +-|- +Block executable content from email client and webmail. | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 +Block Office applications from creating child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} +Block Office applications from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} +Block Office applications from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} +Impede JavaScript and VBScript to launch executables | {d3e037e1-3eb8-44c8-a917-57927947596d} +Block execution of potentially obfuscated scripts | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} + + + + +Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} + +>[!NOTE] +>I don't see this rule in the test tool + + +See the [Evaluate Attack Surface Reduction rules](evaluate-attack-surface-reduction.md) topic for details on each rule. + + >[!NOTE] + >Are we revealing the rule GUIDs? Will they appear on E5 machines? + + +### Use Group Policy to enable Attack Surface Reduction rules + + 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration**. @@ -53,7 +83,7 @@ For further details on how audit mode works, and when you might want to use it, 5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. 6. Double-click the **Configure Attack Surface Reduction rules** setting and set the option to **Enabled**. You can then set the individual state for each rule in the options section: - - Click **Show...** and enter the Rule ID in the **Value name** column and your desired state in the **Value** column as follows: + - Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows: - Block mode = 1 - Disabled = 0 - Audit mode = 2 @@ -61,69 +91,29 @@ For further details on how audit mode works, and when you might want to use it, ![](images/asr-rules-gp.png) ->[!NOTE] ->Rule IDs willl be populated on machines that are enrolled in an E5 license. These machines will also properly report their Attack Surface Reduction rule history in the Windows Defender Security Center web console. + + + ### Use PowerShell to enable Attack Surface Reduction rules + +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: + + ```PowerShell + Add-MpPreference -AttackSurfaceReductionRules_Ids + ``` >[!NOTE] ->The tool reveals the RuleIDs. How will the IDs be hidden/how will the experience differ without an E5? +>Not sure if this is right. What does AttackSurfaceReductionRules_Actions do? Do you need to add $TRUE/$FALSE or 1/0 at the end to enable it? Does the rule need to go in " or {}? Some examples would be handy here I think + +>[!IMPORTANT] +>Use `Add-MpPreference` to append or add rules. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + +### Use MDM CSPs to enable Attack Surface Reduction rules + +Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductionrules) configuration service provider (CSP) to individually enable and set the mode for each rule. - - - - -## Policy settings for Windows Defender EG - -The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. - - -### Attack Surface Reduction - -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules --- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 - - -#### Rule-GUIDs for ASR - -Rule description | GUIDs --|- -Office rules | -Block office application from injecting into other processes | {75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84} - | OMA URI : “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” - | Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 - | 1 = Block, 2 = Audit, 0 = Disabled. -Block office application/macros from creating executable content | {3b576869-a4ec-4529-8536-b80a7769e899} - | Replace the above GUID with the corresponding Rule GUID -Block office application from launching child processes | {d4f940ab-401b-4efc-aadc-ad5f3c50688a} - | Replace the above GUID with the corresponding Rule GUID -Block Win32 imports from Macro code in Office | {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} - | Replace the above GUID with the corresponding Rule GUID -Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} - | Replace the above GUID with the corresponding Rule GUID -Script rules | -Block obfuscated js/vbs/ps/macro code | {5beb7efe-fd9a-4556-801d-275e5ffc04cc} - | Replace the above GUID with the corresponding Rule GUID [Note: same rule as above, but also covers scripts hence written here] -Block js/vbs from executing payload downloaded from Internet. | {d3e037e1-3eb8-44c8-a917-57927947596d} - | Replace the above GUID with the corresponding Rule GUID -Email rule | -Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). | be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 - | Replace the above GUID with the corresponding Rule GUID [Currently working for Mail-client (Outlook). Personal Webmail (Outlook.com, Gmail, Yahoo) work in progress] - - - - - -### Manually enabling the Attack Surface Reduction rules - -You can also manually use GP or MDM-URIs to enable the ASR rules: - -From the rules tables above, choose the ASR rules that you want to enable and set the following policy. For each rule select the right GUID. - -After you’ve chosen your rules, use one of the tools above to simulate a rule to fire. -- “./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules” -- Value as String Data Type: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:2 ## Related topics diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md index 78ee516587..df9dfd2dd0 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -39,15 +39,11 @@ Controlled Folder Access helps you protect valuable data from malicious apps and This topic describes how to enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). -## Enable Controlled Folder Access - -You can enable Controlled Folder Access with either the Windows Defender Security Center app or Group Policy. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. +You can enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). -For further details on how audit mode works, and when you might want to use it, see the section [Use auditing mode to measure impact](#use-auditing-mode-to-measure-impact). - ### Use the Windows Defender Security app to enable Controlled Folder Access 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -68,7 +64,7 @@ For further details on how audit mode works, and when you might want to use it, 4. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled Folder Access**. 6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 1189ff3bee..ea07b44ca4 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: Use a demo tool to see how ASR could help protect your organization's devices +description: The custom demo tool lets you create sample malware infection scenarios so you can see how ASR would block and prevent attacks +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, evaluate, test, demo search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -13,8 +13,28 @@ author: iaanw ms.author: iawilt --- + # Evaluate Attack Surface Reduction rules +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + + + Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard [that helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines](attack-surface-reduction-exploit-guard.md). @@ -113,6 +133,8 @@ WebMail Script Archive | Script archive files (such as .????) | Web mail >[!NOTE] >What is a script archive file? +>[!NOTE] +>WebMail rules are currently being engineered and may not work as expected ### Rule: Block Office applications from creating child processes diff --git a/windows/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png b/windows/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png new file mode 100644 index 0000000000000000000000000000000000000000..ea5b039dd9271ac9c8277c94dab6a42ab64b047a GIT binary patch literal 80042 zcmbrm2Q=1w{6DP7N@z)ls8q;Gkr`1cNs^V!%w)@6S;=Tf5*bO7orG+%k|asWmSkj> zk@dVj-T&YJIp;a&8RtCbbf3E}m+Sg|KjZy=to`(SFuo!Gt%>4iWXFp%PAAVO(e%+WZ9TZ}@mQ4nzn7G> zo#dUJENmSp(z4zu<0S?syrgLAXyRaL=VWPXL$R5Tdlz1(C$Ar~wR3Z@G`Db~$Y6RW ziB}o_z3O0UMBcj7$?~cx#i2PSI{bu={N%i?nUjl=gDJ%&yH)b`_5VKH($U1)2ybm$i%>Y%FceDJs~11miWD|9;=u!Nio}&#M3E|Ge#(?bWNMHck|?@9vl5 zHEQxU4NE6$Q;KKfANNvF?4&rUD6iofH`e9msWP-eGub?LFs4E9h4OA?MP*|;o>w0< z#hwWke7&+i$ue8>bmoDSuOr4q7W?z>tEW8g{F?miQ(2^+-Q4mWX-2+GYFH5N7f-X`YtTt=!ZUQirHEk$->U4_jk=gW@J79ez(?gllR*m4f_@ z)=l~ia|ovk8~HqidXu9Eu9H`}|7=Ac2u-`*S3WmDG>x%WBtO;S?Q+*0^}M4Xfhk)I~c^c zgZ`0f@cg{1=VT?#&z^F*_X%>hc1T^@$;U_E(a}M>e!WNUl&Gkvu<6?^0=h40Wo2a# z$%YhXUMgm}@;O6ZQIQH4b?5eNU%Jh_6-`aQ;+yr09M)~-Rq?%bi%GY@=2G%eySC>S za=!hV{~mev`ER$_rl3PtJ{!)Bcd4amSaiKU)a^ccz(VYy)#^2+yLa#Q_V=&V($b2P z@nGpHcJVPxyeb+qSDdHEjJ1BL`hkzM${d91sX{Y>m(B@K-&X7A%daPyB{Cc3}8 zcIKCsk+GkjG+J61N+8oOyE1R`OoNZYS9$j)!F$EUQq&BrzU#LMR+#1W-I80WcpJr^ zq@KpSZCfz*UVl~K`Uf%|hifBtgf1`6nbh3edizw${B)zxorHv22|g>^k0)=mw6s)M z{}b;PcALIje_8ZFlbNEDQl(9S2^O7psk?L0gb-FTUljdB`Kqk$D{H!K+qSv7yBjw> zJmfl2I`<*R=olvc8c1!d2aYr1fBYDqUFDMXyoSeLI^Jf2y z41o;2qD{6XQ`BqMu1#zoz4PF~jdRJz>Ez>-ca!%Cu&lo?WDrrl@^^iAclU!sS6IB4 z|7gX@`RKdSJrFUWzV_>DpySYcqy9G`4~{tUmXwx?c>Q(SvUO`;l$L(wX`#}9{pX)1 z=HxIp%PtCZyAFiwZq-9!dy*BR$n)jbH9HP1qq*!Rv-FwT^yfdn=JU%g|33dNUWQ#X zh9On;QPrQ(_FTitwGvWN?IT~>tTsBixCAFB@46cqnbbP`;kEM>y%N`rCvI^Ds_-6b zeR}53-MiO6ebPWJJQmEDgxBY1zuAh|bV_i@d2?JV-f<#=qY@LB>$B?p@iB(rYJqYij{sl?N0N1Gn$r4 zpYxS<$66sFp(m-S1H}_%$MVdY(3%6+I{tW9iA^G6*LzeYL3YQluldzO2|f{%lXmrk z4rJBiJ&n;qb@g|4ZQQhJt&59`b;pZ!+l2I~D1QEN*DJJJ!%^3VaxwYmPfdZE z%b#JpD3xv|3zyH5h)vh)z@}L7UA(;1dsX9nRe1eVQ}lP6S^)C|4}30&@fMgj-w zZY5(A%r8!q+yDH)t$6(SW31p{Caxew9?QE&G{u&(Jb41?y%8VZC;Cb=gn#E0H$1YZoOJV&=sH@>%U!ms--!?-jH7 zKv8_{S5-K>c<=Y`0bjmoQ&Cg%NJ_HdotTSt>(D@k+xH)#dc3y9s%PJxwQZ@I+SOfz>0T^&BQ`29B8WqNA z^z#NA8=Kn=m(}>9s@`yNadFKrE}GOu?2x!N#%j}D5;ERZy#By5)Fl)#(tGLX_D8>u zi{l{s8vBPiw8r8?;+pRcN8)`}++JF=ti^=ANjip6?xi?!;sieJ7|)%ZQc~Wy2sg3HV0Y&r}5u)YS;v&*h4B>A>kt*f&)4D%b1(9YDPz&}w0{PhIuhFepO z4#(Q}zo8@Jz!pxuDTFFo$l!Q^O_$xulADBtMB;^X%`YWx2T3E$HL2@I?~(9cl8E=3 z)ge>C=D2El`67%A`nED~e5Ph77UZsd`)F5IR;pN!VZKV1XTSaYl(w0ocWGf}elXg= zZusLKDjFKf!p%o@Gc~mZSoDgoZNNg|xkGz6b^}YOl7x>e(>t?+VaIoA@NFe4I_9AH zW8B9e@65iaQ_`zTGY{l^WKpb1VaU{6kLyM6#2x{#Ql4Kz%MDEYW}Hjg^mEBJq{bLS z)|(Qozp0j=Wy_YMsjYODyRl7Ct0oI0?U?Q;YYb=f(qslr3*##`h}(9*@mZPS+P!zL z3Bb+#&*WQ^osP|IBZX~@RFssI8(CO*o%r3|-FbL;*2>GvQ;a)#ye=#}D!@`*Q=_Eq z{idOT4wb8=rG<2Meb>HqVpqRzLGuAhoA32!BI9oT^(7s8WHriPQi}yME9;Hx*VhIF z2Fho*o2;%ZlSU$X@Sq5~?v`!acJc9@Qf9I0P?iIGA)ix$^qD^>$b_====qhZ$r%W& zD^LjoJ6?OXPoeDgj*Q$y?aZG3dT0VYM}5%Q8IcT zcLcTb4L%t6O?%=*or9(O!eBJ|A*r;qYo^5jWxjCs7@sg$Z`=aPH-`ndJ9 zqE4;D_AD$as%&rHhILo1W#AQv25q=BKc!uK?Ess&P1v1XC#ve|hVG~q?ZqTNPezSN|aK|Axa)tOJFv9x}xhLL3#Z|anG zr7!IXtyvqQNdDBaV!$tpZhvE(`+*0|#z>4UNp0WGJIaP)Y}|L0vHy)kV{RuTFzwyD zH;MiH?oCPfcK1?FRI4gcLC^HZr&6wW*#uV_`W{bSQ)ge_*hp!@fFCM|?@cJfwgE~) zmFvl~R?*aC0WcC{3%AR7(UUzkfqh|?w;dOYJ%XLWQCEoxRZr7kO`T61pmZ_oxPR~7 zQQkXK>C8vw}zaIr8uDSR}5v{Hz z&%C+r5d*FwKwAEp(rv;@pTs{t`hWYEP1W!JPaZq@rkU+W!LwahNVMF}#{|~0nw-71 zv!2zz;qqFOPgW<%cd2iC!*i6EMP|Wor!Reh>pwcoeQ4LFWgkzaNG0+Pg^~UARR1yN z|G$3`IV$Bst|j2p31i>csXgSv(r!Jw^5Fk+Uw1z{-RQ+A+k=!@c?}t?{@v#3>1j3V z|L;zosGj70uCx1@dRp(;m|o_D^6tBA%Pjw{Jk8_dL+@OzZ2h0;RF|Fx{`)d%g+q)~ zXA@+@K?E<1N)afG0&(SU=l~*bt#TMFsa)C6rm9)-f@H1MpOypwb}!|3MPtIozon{VuB}9)C7p~VbX~LD zsC&0186tIQuE|o+6JQ zey%6z(|MBndq`hzudhE1Q$Jyu05<@hz#@vzlQjJjfwxIF2GF563Q`89+fwf10}#)% ze?MKtqhM1fCo#|ttAzd&in})fK5`s!ppv>a=Bt^Wsd17d^!n>UINRCsUH zytFpC0P-Fu?Y0S5bL`x?md%fBQ8KZ~YjBB1!mRN>Uup(w3lIVVdSZ`vo!|^OouYo( z)U*$j?D(luZ#PFJ;8)OBhytXm`*rj3b!@!dQK#&GeLVzTHkkW~{mC_}3yp6F9TXK6 zX-BD9wrx8mz+$re_s`_aOf?7t1qFT`EDvg#@ zelSdge8>yI`wf@RE~(L#Ma7MWq@K+*C^*0pYImLhNJ+^mfG$X5RTupfdCeQ*%%RC=;lJ#CAUlG1#Cs1Rn>SG>n_GhfuHpMrZ=*>`WE z`|U0Rbcb1bk(aloH_fAdQjurl*flBq6EEUN01@$DXVR{OiCE<8a@#sd?ig%3uLuxl zD7+Iq^?34Bh}G3Hu3YUf2&W*ze!5@lkDVJ;H!b*v*#s6zY9GaCP*4C6xR>hByM!M< zKl(=2ij4oag1SU`e?peYIAaM0Derzg5gP-T1(E2+lP9~wIF4)rdKG46xFtOJ{T%)e za$4J86M6@ z$KvA?I^CBRQ=dwEKWl-Es`%Ql+6xv>$1umU@h;gRZG zVWiSZ-6u)r-&0eSJwB`91l?+;Zyg^Wr=XCNlUrKsS*;~dcxlNqj9onIbBNa`Y+$fN zvU$NljX^7awr6v3aB%Q>Q9w+9?$;a4l)_xZ0rE~(-!M%*}XvT@`61KKYx)9JenZhh7^;-R~4EB!jGzg&mG zQ?4E!yU-6dg*>Smr^(f3z@HFBb(@Tvz^_ea{!L~cz5YR5od#{W!MF_98y9}xE?;y- zeFi9fKv8M0m+7x7y8*x6xtnSw?uux{i?OMB@gFpUCeAYvbuJ=NO>*9u_0KudU(5`( zE+%G~0$c)Nr)luT@tdefw7;h9o}Y31z)UN@ zrCN`q1!5DF)F-}K>I*qYoQ6<#A@sBa_LdBv`m}azEXQeS-B!)^IoFv za*K&!`inYq6?yLD^qQfNL-Y$gNsTI6R#pbq6^No_mwaLNXy*8adabol`#q$~rt9Cn zttxUHG8BzrW@Ebv!JNMCxgdrGpxVFE_ujoNdas@6IO-rBbAw?YxcDkSJuPE;=lBb^ zn3$LlY+m#(3W}1F5@t?LMkr>&wQpq%=U0dLXP^H_2GQpG@M3+S)}KYlleiEtlW4(9 zDCcYv5oB@0Xn;1&_eiHXAzgX5f{l&f`$tm2=$OK_;FLkYlhv)Qo7K}^ejbSD)KHz@ z{t^Yoyg6RU-CYu&puwjEb(VS4CiT?FF!mqPakNes0 zKYx_a5&OP>r>gxTW11kxBug~%2_#_r`)A9I(9r4=TwYYA`a&E` z6t!X7i3q<0X9?w{3JQG=iU;HZI}REH0|NpV0q@&5cME|V=j-NP{dSn3Mfi3Kd#Vel zpc5Lyuz|wt)q8i3r+711hltC#9#KWnE*y$Dz;umsq5he?dmzFpVjLhW9B0rom08eT z6~(WW14IgS<+tB~N03~^Z8|GPv&$ne-sC$}RaF7Kh^3JW>29pEXft+emhik*nnrzd za~)Khs=Kc<|{HLjtD)Q>(QTpJKm z3T3_q!s;y;jdWdYZ7CXj#DpQH&9NYc${QPZy)6x!Y!?s_*$7{u24Y^IQfv6}UDzLx z0L_}?!y!(#yL)En2?ndCR%1pcQ9$I=+vw#bRz2?AxkEgW*G|K0Lu=G6cRp6zr>3iW z6E+kbxKMD5#g^+T5W9-IBG9*pX@RK@>aZ4!zLugMaynYD&!0*5=;h11W&i%%1p%f{ zGOf)jLpPruntK(xYZ#cc$wYT40VZ|})20+IYj>`AkF+Gy$gVCqirIEAl~pF5N+CPn zdui%~z{OV#)c*3c77G-+4@=)l_AtmFcqPe!Ff@h`ctm0!~k-Ky%)zyv$S3dZJ}x;m3DIYtn2{nQMA zu81i+Q8L2_m32+8s>}_A+NK3irA3aHUWdAQk#G4-}G)%FD0up6{a}I-zSvUofq3 z?c~=h*+!j(_LFmS<*6n2n$BY+tEv=;M8~h0aa2{65f^{&REpZf!CGc6u3K;=`!SS? zo}MLkVg3Ea9Fk77@$vD4-X>#Ta*0~_cEbgAzNimY`P#3nx8FZ-k(Z&F@1hn1n;32K ziCaMl2|Y4@woa}#N&r`KNV_r<&l1Lq;LB%eZ4>{K1rVMN-@?hs$tve94Vr9meCB*u zmflu-j^G1q0m+4B}MAAW$RP!-MgQ3HZ{=r5i0{K-5oTA zXV3Qi9%)+-;m6`j4mWl+@i&Nx1LXFl*hR?f-2*@9*&2l!O2>~=XXzF3P;H#swJAhR zUH$sYmtx=m7ruNnic!VD&Ub$Y>uwehheFCypwJ^=pKBMI496j~`Fo@>!xpJOFP#3X@7* zU40VUdH_P;hhZm$P&N|==%vI-gHG%V73uNC0vp0DK!j1q2)_fCHt8;LBkw_p4uloZ zHM92IRy0Pj#oG=El<>}wO<;h4%q+nzGw-M~v2Y>Xz60tlY}zUpiKm6lgmFFsIt>ToF;bBV1L zkezKC=%%Hn=8MS|uFXNI>@#AANsN^SL3k(p9`K}ESPjJ0L*QViv~)>T$Pq?HM&&bS zYA)KA211KYM6Dx(Lp)&25OgA=o-!{8!WAfhQ-HTTFjG=eQWUP7cZPEcZpMQ+2DSeh zuq4(a4!apSrEegNVFV&TDw?)HE$;6&uAGbkLhrcAa-$^od*tV!1Wt= zPOSqb2=-YT;QIM7Wjz+)&Ct-mEY-3aJ1iRouMW6Vm{A(6emi@6dDJxo0&>ioIaMA> zZl$B6BS8R6Xkdsm`Uh+{^eV$JZhSb_pu&1ygXo3%d5ZZ}O>qqMv_zlgYJU%ELg{F*tkTMhCO!U#*KegDi%l*q^?5y0c!O2z@cEx z^gyIWu3x_%P{Pm02ZOd+=3pB_CjpMVqc_P)#l9e>4i?LGtPma;InaO`8XAbJz#^!3 zW7mlYLnsm!EstwtOmF!VEdmRO*!L^KJ0xa@0_>s>uxyedy0G4lhp__9bf#KW(>fH~ z=C=Mg?m4^r#kXG>FJIn^x_3`{<7&sRYp+};^nd*PSq~Yf5m}U&hRep({(gf$e!R%Z z5oTd#t`IaRd-u*PZ?g2`NA+5Jj&D$E9j{$8Lt8aNgvAK+`_87|U|z>N%tM~GK$u7^ zW}^eR;XMV`)z@51+&!sy)l?Jr()d5WzC{NH1mpmgh$gpaTfRPh`gBZ(wOQ=ptHu;x zaFg3jGCHR~eMhmZM&TYU!sFISJ|6xB%#qb3%$}nzLz90%BI~Q$)AmsvdwUUfscQn1 z71%8Avh+*evYNaz&b=o!@%y*aEGm31Dn$-fmR{4OQHezUdgw!#$FFoE6~3JaI&H{-TWtE!sO2VQsn_4Pu%|KcNm z{cLkMsb+xmV_0YJ@PSA%)v}tP)SFRgTUqg89IECp3^7e+Cg$(sj9^Hc1DTBVtgeV- z;$IIf{kkUA*w|P=hkk=cE z9E5UmQNkAQhrC@GkcjxzSrqB!=9Vi|Hh&!irH}KaZl=JVJ%NX=e!X|dwmS|6M@FX` zh^$$`HyvPZ)M35wagm6DFSuoGGNz#Q4gCWHIw(j0$)m0_8$%fimyh=LW1BniKuVA)=#BM~Mbtj1RP53#dzGcqz9 z-0Gu?D=Lo8g5T1a`maivgf%^qie6&~``-vV&Ki(XKwLZ;>(4A#JHUxO{5ZTzF>2op z?1#h9+G4je1UZ-n4@lgkEy83;e6PRb;0*9# zh(wWfZ-rk5wjdyY<-5AN-~&1@p6D$b=j-Y~Amcx9z?3C45VI3rR9u{gJA38+$LeY8 zFkgnydV2b|ZPAdY%r(=awr<}rM&3dd8+SYYu*pnQPw(9+d>8f<`7YSwDw&#j2FtAo2eDyZU@sVmBmiQtvCo#&qjk{hun;^inWjf88bIX=3IVfMbWTzk@ za%YX<#aGt*=RA{EIQ5tahGpk%Jw1H{C?(vbOcNJfJ?51Jw>Nfiud5roPJDFVJb zf%#M6jkN1Ve@4-&ePP=8;prK64x}|W>bhF_>TjKYC~8U%eNHn&+YbnvZuG+araGj_ z453OB*An4@z;!y<7HcUfTe1!0a6bc(l;$3_2|@~mJ5N-b9gz6^^&zLc)IC6g zS)|zm-qsN7RPb$avq5r8BA5i6bY@*86fzR+0>~iIGLjZ(GTZz%yu&(3HPv4ssiKa{ zCu|KRwIKku1ky5(CR+LNZDU_V5UDXClq@W4%V)-XZ2?580A5IP45Hh)fu6p)Z#KZO zq=AmKrMDE=8X!4?KYb+&qcYZCggvp;2#LmRK{9OY;s@cv_N_uon}kbDduhUDD5=J{ z60x071T=`Gg(TIL{D~uFCCE{=gSXYR8~AJh94B+8!pq$S!i|Db<=89}Y~ZuJ_2kKu zgJyx#CYF#1!T}Tvp-evzv)pu9RHw*^oq-zjta#!CiJw(nZ{Ul1Uc1n2KnX7&p)(?P z1M(kJQ3+Gyx>rgaCPHTUfuu7ZnRL$u2O|z09gsxWq3{u^ezqh}VdX}r8_a7;mzCjK z#jrlgR#!Zr_p4ZBmKB$MvJfNeieOX{B}1|E@33ZhExaK5ymdH0Bn)~8bVe)=$w#Ud zGDE>T2#qB0li18I-EOI!wy{lSSdmqTz=3=b>P-S<0D{rq?2ht9J%*7=(ia3|I1Q^4 zQe>5{yN}7V`512`@+FJ_AsgTBPOzEnY1mB>AT~4Hw>J=6Dyf9fA9VCBvIei>puDR* z6r&?_65u8mT{$VMcTQCf;g+YWk8Wae$lgTSu=Ms>)0v~mExnCG<=`XIL_^n&Ix;=4 zwo`kMnN979D^q0do>~=NIyF}r&u?; zy}GWB26-!9^!nL}9-()F_mp?z8;+r+&yIJkPwaQDnHM=f+MZ2A0TQMBz|Bi;Y3|zC z7r#rz*No7dS%nRKg|jkwIO?KC)z7DCkPr~+i$8WuZ+^QzyxQlJ53x2a#Mr+P;4t9<%_6EZR~xhNhE2hXHmFTVz<4N=H=;n_JG zL=V6ekqs_qE{WRFp9JXu*$U!sA-q)q=^#MF-erI?w!U5&F}5dql2)g9?htbxyNFy9 zM0UQ?=J`JdgEz1T{rqXM1W1I7C^k-jV7`|!>DY=)brD` zbEs1lwc+fIXL!!@MG@llKhdK{-8^QMREYFSCR7Mi}%GkK-DyN!dcGfm=G{!E|X6r!g} zKbhUW3n8*n_divHBZ0O8YS9mfj>o^`j%>Ic6%~j)N+Q-HNwuVl6EIxLnY47r{qzkEUKpUGkxtXN3B*TO-hZL2RmzK7H&9c4EwH@>s@{FxXgbpm zL@y9l0kQ~&iqutV}?)t=C|qOnb&YA4{T<=_WM z`?PmZpgQEnFWprG6rtekep~_<0RVzk+SM+_f6@)=Z*q$vsNX(8!GFS~D8#%R(?*ud z=H@2zlYMsAu4Oq%?~|j>f$o8{=Z=r9t;m(CC;#~de`KG^&cXzg061Fx;8azYdCO9X zu!8U};p-ebc1(B(crPR&LbYq>&cx#b$0h*F5W1i#nXFpRl#z#67Lk`XZ>G%a2m{L1 zl(-fn5`=A`rCW~H4gHxmvJhXSo$~kNWzkBwX3)tc;m@qh58UDle^eHWh6WgctgZ+; z5DdOkl;YkWl@Ub8z!D;i%qOZPk+|jLxUlVmNxGhii;;rKbT6B?=z9=lG^;6q^NNOs zVLxXjT>i$bTLY1bOwP$s)8_nvP5Gt3mWwD(D3-E0?+?eQpgt*BTU%dBU~^O4$DF}i z)@Vc4H8e|T)Vc5xUs|=%Bf3y(F2fJTj;(;^nvBo`WYLU|x}Ia@{!fo7C=eYSN?dYb z;d~PH^(D$fVqz~@;2Y5Qs`|Q>JO05PLng6b{_BjE z^;svewjfMNQ4!(Sji>Jm$U_=|FZ3w-WLeE&B-z5*4!QR(SNX_FOLL%yBQmw`z=1%B zlr0u-h)Z1XttIs=myy}R@=B!g?w?s(!EVpsXmH=EJ zrK{Z~KlyL|a_Vqqcc#*G`R3bUUhb_f0k1iT&duBNBQ5Pp2- z1Iy%h2}Up;#iK`$X7V4vIs(Ne*>I$}+uS8Uj&QKU)4O!1T!HWg*jc2dI zd#of#RUkC@Q~&OrqMe=ae=#*g2N25&0z65EDpoapaA_jy{(WP}N=R!0yJdb9&|WzR zEuO*`%>q#gtpz{oC7)4q@K*FcGHw?6Uuk|M!KxCzxQqrsfP1Fd_~@l321a;(E^)N4?_A1M;F7=+YB61-=j7-*GYldCbek^Y4FlJrS63vy zB4Kv@-wX2$T-StCN zE5%tP8xsz7JQ)O%M66PZwUMf(EOZ>WP!JeoaGV=7@vCiN8?1aB)_C4I;w-l$n~$gl z)S|o`&tuLX)mw%@A#s8V1!ofA`@-;prRzBmiw8NMVI3M784)GSdtq=J@g$Hk-OQ&3 zmR|?k@Be z2-YlbN&w6&*i=@RysiEk_O(Y3v|s1nzuyn$Hn1B?w*KJa ziR^Z*v_nrs+cw--Sn6+e!IGkIxzBm$RLX@i7e2Q0nwvd$XmwqwNG*T-!o1*H-`JRE zPqa?1w!kN6h#zgT+q^H;qc2$bXz|?Xg))JpF_d+HA+@OT#HNw9}`|ufFA-D1po1ag;-lwUPEih+DcuE&O#B2 zif`Z8@pVy}D@)Z+c*W@ra-+Lse_2+p6#JiWZs#oFk`*d;9u4~Poj>Sn!n-Ay!84F8*12XOU|WS zQk$nKgc$*SH0ql4GroVhN^)3>oP$8>eI8OCf&JElhITj&e_VGs_E*`J zgPKatjSO;X2?lmMd~Y){F)@)4#9OKO$zzO=2u7t7v+BDR-bA<5E!YhPr)q5T*}y0D z!~g9r1M^S2X@_nZwC3h6_0M{HdqXk~6K0>2pRdW@#lsWO;N3R7=GlQVP6j%isGI#)k1@6tu>bxvf^*TRL=VpFXow|H(RN9 zA<8R0;X_NV$q9gMt@JA6)voK$$A+5B4iYN{JJbYAk{Ee8<>rvx$vQ>Z*hnO*kD7+2 zQ{SZ9e*c|h%Da7=86SWczD7|>+GEE|{-rD?u%2T>?;nvfKIG&Z_#07}(Z31tTVGuJ zNyB+MJmJQ96jclhQs1=e=|QIE|NiAclmRue?NlUqi}TTon_UW+Wd++xse$hB2hDHO z^=BhanFnhFjJOXC-yNDLcz92$mKC8AY!Gaio5=8-*S2~7yl2Qs4xGK$rm8PD^52yh9qv? z)<%w6D!AA>&rF`{7WdR&SX`v^&9OdpVJ0_ApJBo9xn!p9rVvHeMm7!(fs6sI9XK`t zQ4}XF;IC(WmW+T&u00^UZ{M?zbo-lo2s>^Pu5UJP{}fZOmV%hE&#J0_ za{d_AMT8u2s-(n33KZ=_d_!R(1YH9g?c2XUsW&S=QKy<|d!0QIJ8%#H9;Bbu0m}-Z zOLqYwp&;VK-(dW*IZDBu$jI|4S&SD!w8^7vet*I`Y( zZ`iY{39=g?M(;hSx!r^e4{}-LxEQtp^2`}JdDJ+xx%EA@&xffe>iePDSF%_n~{;Vf!g4cgCPkc#-5H0&k}DDG9SA|d)+cs+}FjYRX;`&-NY z9ND!i`BcJ?Kk|xOaAGVcC&w!M>i4Ohb-oZ9=<2eN0QbWgCUT7B+_`f&Ez|bb3l|BH zi5caFuY8<=mw4rVUaL=Z2{^^ z8Y#qr&bg+T1RVm``c}CP%Q9oD($v`l@M=U|$KjwrpzB@x_YcQAzR(sR#Thlt{(JpK zNDrDtRmD9=E@o4B?j|4 zk>oHbsROW6jjW#_>H=eqf;c>Fx|=8M*M)noZzdKd<^l&7G}6WZx5~KX=v&_X;C71||ItF(w0-#56HZ}Znat1wSnH-b)^>yp^?b~sR zGR@)iNSAXU4q!pdLc`91LCDv(2Vx&??@ONf+06I;(z07IditMrPZ%XdwWwz`uimS#EnfMLjLx%*TZRIcrZzoDd_S6&z9O zLwEv)TGWcH+LTm%=5b>*OD4`ocZKF;(pVdX6 zgaA=a8FxcK0__|_znq?#uAwZoeTk6N&}xZptD~c{mD|wuHmHgOK9&s7flSM$= z7gG#kyXI7ix~onvR~fe2;@m_X%0o+r&OxHe4t|b@;YL!kaN|g{nn=jdfq+=Ic6(qn z5H3Kr@1Ct!XVzul|Zjz7ju-;azMqvNKd;$Fiann6veq1aiG zVs$a&lAim;i(eOizt+&rzjiL&;p%9`?x7WMBNQlg9Ix@3Z z-Sh5@_7?6789nVY^U@OLKcspV-p4g8dVYQ(I$k^>TcST<*|YU#m_P_o)i>lEvEdOTO1x4F~+*o^ZL^UFERx2l!SHb zS>oJZe>6YdQ)#!@pwOiUmqS;RPX)u^=)Hg(ZY{dOKa=z;3HIJg?G2y ze9X)kyf9l(-c;f?3rv z-nKGdC&%c%A0F_10UdG>&9y&dZ{a|M6bULVFE4-nI`1i~d+{QYq#Lv@Id5f>p7i~! z=lx90V1?8;STuXFp;9q^c{x=6@_hXKWLPaQ5+DexpYEPY2(mg;_ID(`X!gXaA$W&YP|bR_}B7uj3WnK>vp)|fdT zsGdE0>+`RwiMduxJF(GUT5QDe71>ek^rW54w8*Yhp#5zZF{YB6uVkA4W$Sa=%S*=Z z=+V6IzkmN$)7O8$LAcC-*#B#ckVq=^f(Q|A%)afx%iUDNUWcEVf zpvSDW_utlp7ha3ku-fV&EB_oGZYi4>iA#WYWmC3b1|y*G*Q;-;ZgOqB^qB3O!{ch@ z2~dkTvZa_CyQ2|F(dSjP^Q^d`s3C zAF}i(+b1P6bHn`Z%~Kk`XJih59~#Q2Sbrmb8>FeaCxeQ&McHXyI&5GMgG8)M(8P^XEN9bQc9nHs$zt; z4~#c5GNO&0%^2*DU%8F0?30znyf?l)C1qV?!yAm_O=O1(l@7v=BmCN}G>* z%#Puh?QJAu?wuAa`hM@~(x?762oCN;;*OXWkih~0K+bDxKifky_BB8B>sMVQ^GLA; zbf`?cqGocn`1Nbmi)Yoh9yQl>)!Q-Q^mzg?{^_~$)khd|JDh);!ZUY7@njGPg4i?n zqN2{}>#IV)I4eCxg;g?`mKy(8?~1qNT0aWG=up$f`}UZ|>2!nTn{}KXVaSYvmY&km z+6I^orb>y!Zx6`@1MSDp7L8(ebqgh!n*N%Y*o%U@P2bgz6nh+e3BgAZX%%VX!0Nul zw6qYop67IQPC~v13y>)2cIWT2o4+U5jc;z(bKC%|G;r4E?`Gi7UHtsyUNKW{ctX$1 zFJmw@;ytHN0$R91n{q=R$aitZX)-)kB&nn%uD160@d%EFX7Aa9na$H7LuBxD$by)! z5po^Nts{9>$cSceBCx{P*x5T?n69@eh)r1fzSrNF=R&~*2Fwc&1!=^SUK;Q)7yBYT z91RPs3Eegm+p`o@Rwj#!gs!nP=d&sfS5l5V=w|_Sq!QekJZ8W`%mLXfsI5xJj!^`X#*`fMvVrO3z8ZH%>UsB#3RX?7g3xz|p4h{21YH=YS}*kG zvgn4G^*S5O1hM5|5~Q}CG%?wQ#~uv6zsEm z0LNFbcuW*oJ(1X^PoF=df*eDWK{N}`kg~%;tC>;6p29{b_-sM5}7_` zo{4{H4jeo<^K$u~sm|yAK&Z75INMZK7XS9`DHM-8rZEU>JCeQ!OE%#*YBeR8>*r6-m+%Pu?L$%(D0M^mJ14&@rB*q}Y>=Timl8f&S(x z+haKqCC~`KgisT!xD6hM^C%*M(aOr|+4JXB15-FAT;WnSvtztyh%>9`$HViVZ=c^1 zh(s}z07V;{@x$4iXt5Sis-{QZ&QPkevUJqjE z*Tomf$^OWUsb9Ku=EMmaRC7I_gx$b|~NrcG{9zI18F)vH&* zOZ*VgWwh!@<&9~Imx;ymW3W@g!^6?}wMSXW&Ox&O9Rb9d`&L6{G*@3Ca~p-SYFzLQ zz?PU1SVzpXR3r|xx{$EifS7PZhcz!NL%%~2c^H#m^cA&7m!K^*neEy_Kb6e2d;?nL z2Aypjl^sc~eoxw`I&Fj`k9(iinf__AWOJ=ES|&SEZHwt`okdTDt$t7-kMbwk^TKu_ zhbskIKYu=MV35GFFJtztMxJo9lQiVg=Aq=26eW)kXrh2@M}=8;Gt(L#j?LeeQ#WvA zSgWXYm`XO+ZkfNcZp1klMURb5%;<-mgji)#w{38>pMG}T(2SSW6`4aeZ--{cGnUT0 zlz60yJ%Gmkdu}e_&c1VbDi_)_>IN26Mr$gHa2zvJ|4V99+vp$0*JlwE#3@|?mc~^5 ziHf18NlEgHcP{635LMeaw|8!_dAKg}FAbh#va?YX@Yi25^Vw)?PtVyaSJJNu=10U- z8cL*2jHSKLj?c@^zV+(W;Y_OY$N`}P9o=bHYafRklLz%hU0t!!s1}Re+}vw|tL?u| zQR|npdE505SuM4j%M|R5ph;L^6p2xRmgMf?kssfBcXyvdkzJ9V?tvBX3Ks7TtqQpOu9#~~^*XDn z=vBV|rh=p6K`$>a-Lr#*g%ZXlCe8C+X)NJ~*}}!d#RsNbal3d(-pD<<-Jd4(gjuok zl^O%YV^ntU*#ilvd0uMo$-A@hnmrdLPu4o)*u`wea6J2=AG4@L4-3U&R9s8DBWLB> zidm@3ue`t9O?gq~`DjY(FsvfTe8$48FXx_MX}dp9&=%JW&;KB=lLO6?(d7XK76?IF*I(~ zVRbn!i7DB%UoYSPu5o?-XHmM2X%;%Fc;H4Tk7-y0&g<1{{2=xTI+2WZlDpKY+c3E~C^GRMITl{kqzNJ$;ozD{<( z(7+$}4!CrL@R3tO$i$JzEAn-9s7xv`VrAmvUQFxpnJSlA()j z`akIU?s%@-_w9-#m1L6<2_co0WQS5_$Ouukk{vQaN>o-UGf`&9suUrcj0hQpWN%VL zJjYx2{r&!)=l6R4xL>#UeBR?4=QxhzJg;Orfsl|8_V7kd?~?PM+-b<)kuf$u_R3(m zRZjGoQ!wmF6TX+1oBMj9{ahjO-(cjqk*O)^ai^`Mo60%@WcL7ACj<5=f+t9N{`?M* zkXZ!5*2{$LiijvjOFKM1Ds;sI)%=$x4bPQK0;UU{@Ii21%>TJ2v zax}tbZj-OH(ZYwmZh{dRm(`C}n;EQYVjLl4qVhW)ss6ZvlDGQ6Cl&Ox6j$5$(Vq!lh)L?>1&tH7s zKeK~X)s239V+shw5$m{ zo_P;^ONivHXc^lODgb`kaJxO$KWDqo65k(hMSBkOVVz{Mm#}U|*ftVkp=_ z^+E5SZymb7{WcZpV*9Iiil(LVAs%`EnxSB*`H)ynRtLF73Uc7pB6 zt5*-rc98(I9axm*=0q z>{)bd-gbcZpO;urkWpy6_|E{7oyl9x3R{@LVE>_SfZB4eOh%JFb6Rc)j$oMBJK ze>w^}v7JI7r#z1i2aoqBlVvq%V4+Gs4mrt{_~)vG+EtmGzopj)d&YdvjXtJCbf{YX z^ZLtF(*YG|RgJS5vOBJ|{M6u8P*>j>ln8gN|H^K?SjkF+vNqOBn%&6AXjrnnFoBl> z5fc`n)df9G+Ba|Bpu+UAhatRWnTdT(MFN*HGV45)%>sZzMF#3vCQ5Az;`1N(PFo^P zz_g-PH@^uQGeVUMP+30wDM!@9^Ln}DVa%AMsy7uq(P%6@y$lGoKq z?^IqW8+Aq)2tZQ%>{&35=F>%2|?sILtLvr1My3bJq$kTs&c3}kp2c{b3O0Jm_areG{HD2*vOK^GBJvkh(u)aV2gcVoXe#i2X z)J@{%)dT&g!$k>G07|z}8+`MNoh1w{+6Z5VG6>m0YHDgJfKMQC$oKG$$W|aiE`u6o z1TZa>X^8uxqoaY}Dui>vq--QA^`2;u!!`iOM3RySn+^6bStW`n0z{HXydNhm#bK1Y zfX?qku?m(+5s*oO1VJK*-dy2apt2R%Pl z37!z4R3WncPQa{C;XQrxCK_c-07*1xH^-@+ICpM0;DjWEn8*pWkZ3{1!GzLOq+pSe z1Zu+wu|4u@HiZAEh!943k;JiMa3_|43IGQ+C>jCpgoGNp9tcFOzP-gTqoNm4EyTDy zD3w+YZysO3B0}cbi5-B~K)Ctn`*$-l{nZQXD(gm~ag*t;mDughnqvzd*hJWia9d|| zbQCXNKJehd1F*HBKp-Pfd)GROa^*-w)}XXSf)ii_1|4_p-hCRfHlPPTf4br}MC^d~ z_gw71#T)b>pi4zWL^L!tiAq86de9VMTOUP%C!AzO6;UukUu1j`X(1A@i0J5a z{U6wsZ?8@xboWIs7EI&E@dX0&7#p*}@P%^SZfqo01u;MAV9?>u_OetjN3t3y}(>TlvmTxFo-VBX7D>u zX(3Q2S`wjM3vWV z0KCx^hyq$AAUEJNR<)}9*Uh*6J5yOR>3C6~6WB+H$8a|U{kZULNcuHt!L1Sv7cS%= zV)0i?fsXc($)VKSNfihlsH-w<(=%0wo6Edm@qw!IV%>k^;S7-FVQ>0doJQ}XjmB3%Ro@H&YXFF`PCPt)2Fu`IB)<( zReojXSE(=ks|Dy&t|d*E^;5qAsL9@|92nr5LF{tbB!7T6Mk%u=AgS_JoY{yaO> zvxE1JO_@NW3q8yG{ukV0TiT1YzGOf;Hvldx<;jzc*&V?R7D>s;O2IkZ7+VO#28U(V zjuJ60#yO_C^yqsY`Vt5fK7Re`U8iEOz^EJ!exe^JHj#~?PmF~H_rk&g)(?j=wT_Ms z(I3ZN9Ok*pVdgf~_~fKHf*8YVlLbAl-Iw97fdPYDgrCTRMT0m8`bU0roh+T2Uz1&i$m10`nHld7MBCl+^`*#jjL7Yk)XRFpCbYRgPQ ziIok{0+v7Fb~;L3U@(1_yL$;D4FO5;!QFZ!8md+r5yC|K3^tDu4zNSO0|^`ru>9)G zEtx*RN*^D_#;PEkB)<9@JS2cTrR)wZa1HM6N3r8z7$f528=-G-$C`2n;RlSJfF?2j zt3Og?Omp<|Nw@l!*|)G@fe_5m(W6mNyhR9HP)gFw)8Gb^rKeW|+7Tf;h7JntQl#?O zsF)bR;vZ*X)p*oWB8V7+VP=^Y6gFBRlcp7dh@;%DbaAk;OprAkrJr)*$ zOM{-ON3{<^GN|^fb8e5VxJa;~5|9wWtgQYjIT6liB_U*Ccc=Aw=!Qqaib%>K~UC$Lo+uF{AyN2jK$rhk#3i`4BPc*;x= z_$pvN@FE(#Pur%P3JtN>F=uwK&e7~o*JvGIaFb+%amfEHpY$;h;2C&2iU4SbVX!hK zg8`Kz;e!3d7+}2M;b2HdfGpV**bEwRDJQ0+Y{~98jTRl;*WuSjCnptCT2WJV>xo_9}HS&3Z8>&y=q!%~6e#?4SdRWCF-Ia!m7 z*Uf+V(z}EmK1Kg0uv%OTFVnCio5B!K1*{huFP~<{Gr9MFzZA;4-oH@YHHHfYhX|2J_t9VpvOaL;PDlC z`-FX4SDTD7>~@bhY8yqRpVpQ-d)I$=ppCWGuV92ceIG}iqiwanNY5}XIJrFbjpS|H zk#0Z(azYxD(Z#aGwN@k3Ypkg49xutjwzk)bZ917#*>7H|yOd~aKJ!kll1cCWw6wj5 z%_SbWhkoQ1eJ1s*nPZ-9YwT`KpN?iMr_Jk5M|`wm$zLVOR{x^zvP5a<@9Pwzz?tZL zhe)LwZOJIgoKDd%&4&1>piK-xb7P$mgGuvya8D{vGhEjmqR`q^M4Sx32`yF8eB&{IwL8YF`Nf$EdNY}Qekwkp*IpF}%lavSk}H1-p~rz;K1&sc zHWXOSF?f0Lfc!Q1lO10^+CF?frzuM4{zW3c?#l>KxbX20!$ae`XN52Gm`g9@9I|fV zA`B&j7KE`=hU(8sWbX6DkR11U3+(PwuC71z@A^o$UBu#Gyj!JJmFz{&!+j)myNU%~ zW1_c&Jx(pfyoRzewoM_T6`DsBPH#W}f-J7J(FZn(I12$=91ZkUA;j4t*{v2jrc zHz|{Eg0>iSy>%c=_a8iHiHcT2G=vUVQ4m;!p!6wz;q!1X)qSqp$h*H@o0fvPO}ngn ztufu_Q`?N3bi>d3Pq(NPeUMz8`%_l==|^~KFe|q8+wDm!*JgLygTYls))7|sI|Hs z5>jnb0CpouzeC$J(YPd$7a%>d527wsSzWy&*Cr_`Nwhw}gKfb;r%XtrIhMChtpFd3 z);kl>B)icC!m>6F{H%HfD0ihz?p zH+mb{-hLJka=~FD{>!u6iMWx_wV-^)3AMOTHW2307{XLeW?}?s7b#--6bMX*kh2$hI?m%t~V!J-u zI#~{JvyIn4sSt7$g84-;U3gen+1?OIc{R00jks^8VcQYVr>3QS6xeT*7J>YT2&-@3 z25SaiENg4a4+{+cf>m@Bp#wkxAgnev>D)oY3n3c>(unW}UI4xjVLU=-;FsvZ)ZE#5 z8{xO7G=h#9H%U<0h#c`J09i<6z>@L?$wNdR&IP`*7Reuqf%g)ch^y%)X<1oScCTy& zwUooj$^1cSa@6OFHKLP%3fMdZ!w47}Hnp|3CbgXuStm+3m8oIs;LV{QOG{73@eKy! zw$FpAv$6!cy1F*NOaPQ>>Fy3r|=3<^93G;G9r2oIOPdKD2n zAfPS!ZJ(&6Q02&tM@4FsSrp25&(_u!y@SxmEkbrrDWRT1#)d*berOWfD~4do2qqDU zCp2h47O-)N%1iyoPBhFx|1%&-{>W-09z8k<9R|DCk6l13kjw#{L#Aiw+G&op-qqbr zh#C;3SemyHL1bA8`|;>PfCu$He>!{!+-j)laT7|lZ#pg>WGyxh>Acjw+G}#C845NC zgbUu6ANlIG7Xm>dU~X@(!Y7H09rz03V?<{}dX6eBI9yfL9mp;*$%GgRE}sz01SJyJ z5$!NMj#(u#U1XQ2Z|--NAf5{Ije-O))`VtraBvX7AQnjNW(LDjr~*C!`~cN^srOx6 zz2I9F8VA@iRLLNU4eGp6W9Sdz#+51zS+;mm-zDKSsG12LV2s5zYw_4hYufucsNDho~?p$&)wteVgH))5v`Z%313h@229tvS*hJe=y& zXccav8<;>nA{pd?we|Jo7jn>I#LCvTe9{$7!dQp~%adDL!66Z=15hC$@dE6FSRRB@ z^@SWX(FGWA|KUTL?PSqYtK;{t(ihPaPcu`A!7IP#auV7f41Lfzd@oPs}I; zJm^fD$@_+gD&BqF?oM$9z8fXCOk<`^r(ur)n?W%ZjkhqqHYp0pgXocgbFIbbS2c*rzn$YD72W%PY~* z%4J)qbp@|rdg z$_`BSt1qs*5gij!B$GqPnYX&QxDYpn0n`mXJPx4}02TC|h{ZxD4*LS)3C#%f7LaEU zCQaAa{aJfI4Ao1!FQ+i9$T$f#nq|EE%{Ol(0MlX~q3{A+jqY;9xHB4Emw64XEM zCJAiKss6yL=FgvNY_p4%0Qw-=G6R%IY*H2p=Rl;`yCHH23i=j#&W-~%g}5rRb~JAc zY#JU&3>M_XF99$f0^OiU%kq^(ko3M$gs^&%zmmU zYO@(clNLa>Hz6;9d7tuQap^?g%IkZlS$G8(=)-Ax8yk*M5U<; z8k2xSq^Ad=)FbXlKm9rlF}JJ0uyI#LTOBm-?s(DJ}kw4 zkXEex=jUv4F0MlvSiPXD^4;FSRzr9IMKn@tbcpm#5l z#Gqmy|M2*eFuTQd!3wkyKn7$C09#<(u{q$F2st~^>jU-yc*Y?{g-G+s-Z4hlUB^P$ zs(ol$YA=o^8jpT1m5ys2Z~<2UtsszJ=rY?3M$FC3pmdhoL$&AN!4Twz7$S7*C?8*l z|L({7d0da~IO2gjtj8j;Y>;x$@5NbuOwyj>Kr0^BE25nusvWVeQG%70k&y&|1W=xt ze*29F)dL@U(vY%3zWWf$CMfNook=VyS>uu$`?Y-g?%lz$jBF%v^XPh^1q%AeyV)I> zMwDi7VnT>bjopNT88pw?3#kJHuE>@F$D(q`=5QzhPs6G~wxxTTlbLZkEvxeO;RKS7 zacmR-sW?n*Z_xQ|1Os)PAdZ;NSr!;<1T}35CYxB01jYcY3yuZg1tH0S^+ii0rOa0^ zfG=OjvC6r0J<W!E8ZpT9t{?G7`i7$ry-X>hyxA;gfI3DP6bIqU9LnN#Eauk7c>S~+LqF9 z(~>Z`d52UdT@DEfdOztJ@%XVi&Ktql;RreTC!s?&(he#}IpW`^y8u8&a4&+f@PN(( zWK%2Lc>Q2YmF@s9)FF(3e2LztfQ>;Z+(k{X(Yb7U@#k@b>=aNj0c4vqWwfO)C`cbx z($J(uc8EcU-lNss?&9kD4GIobRphNiR0QnmX2&>a*X<}+`C^yy{JBaVkU?Vt<%Sd( zC`kc*B+hSCMNou1Eu%@IX4)` zIaZ-gg=km^oXbEAU4zVkOx5H**C%Q7;SWkIj8Tux=7Z{nhp@SrT`&|j^3yO#7mzOz z1K-)H44jXL=N9lzPwB_pdY@)>;1WPD5Wa>YfS`8DOdyx-MlcFk6z_+_Rcad>lV84! zMEOX+>svT^fZo=fm4wcag|fA!1#u{)S_(~eM?H2GcIiH0;Rv`f+sGa$zzDZ?{CK(Y zVLzZ$@L}*b?ua-<$|L~7g2wxRHxfDA0p|+oAX~^5B>m9w!X*M#KJ2~XcA#+UKL>|u@uI8%!H66k}W9MUAe+TMUL)>%bR`HIb-{G!d!zF zS0BWx&#KrY%3+8Bbzrs#UJ8*owgF)*U}8Z;r^3@>FGD*9o&YD1A<#6_=SCPwdpdXMos8)bs#R~!*Lp+Nj;)nGpquYD< zux1_`W$YCkt%pA%mVzNh(9<=Hm>5(Aq_GH8;j>TYeXXpnjzFT5sea~6IJXHvIpiQP z$l%BDLqBk5NS}fLMu#IVwY20x-c4Ygi%-9w0s#s~1X+v_l3_RkY_eyCg-nl|suA(Y zq6P<_#m#VQT#4vR2_6sg4RRTU)3&xL1|B-vrqg&s8yoqQRzj2xL3B(4F!q&KwZoD!sknCJdfHIkF*u@ z)#nc7YQIfQ%{txo>^Uz5p>3-YjcI_#gC(S&PPT|Y6|S&{3P=Feb~4fNN71V3RjldD zse)#*_1kq62X7y~Jm#)*I>`gaIcbiwBt|~h9A`|=xs%S{ZYE^ik=b~JaXYej;F^e- zFB^}EBe4RlA9o&^+Wb=fEK=a%d21KSw%IL_lQ{;NT?S=5w>gQ38wakUS;r&5+CDxd zLk4G$#ibs;KIX>r=KFCNRr;Sxp3&o9KwRHefYCANAMzFSrYpGll+O@wC&7?`&vhD7 zncQ-{%!KjB9RO@_{3q1Z?$HmYHeO43djxx9J6XZ+kn{zeVm8=k0dpOdbQd-qhIfC% z#Ss^iPvfu6+=Hq7{IaFfdA}f@hMM!NWM`m=ApDnt&R#-q~p{WZiPqI zQ6Mi9R)D%1)H`4X_5G)$FUJ^XrxX-CXm4+qdyJNBXdhdH&I%3&<6lOrbn@i(hLK|~ z`eC==M7_LG?sV+1{pg@n>pO)agYw#D6g6>ovGpjTZ>d;85=vzB{1 z$^2L5AFn+{oriLGqZKRh0(-=JspMz2Bksi6ZFz{%xs;i?3_%@+b6H37yTrWtVkSf! z8wfu}#=6aFpVFs4I>DW{2hurDhI3(vrFV;$AeI7g4>BZrLGyr1Vx;TQFyDC=H)EIX z(z(4PnbBj9c-XR6uO-BsE$~D?w^%?Uw$F%Qk2rA-Q4G7YDoImYN5=`!2y7vip`x?e zwohD*G&^+vc=oNJo)T#@;s(?RK7HWCABL(?UB)m2{U*}pvoxgs?gCj3IHyMBZ>)H2y_X;240k)AR>Vrr<<_e)xM^_FcVxUmw;Z}%d7qD=Tge@r%_z)*-66b%y^`k-sa7Qa?J>oi)o$ka0 z5uNff+K_H+^I2Q&9UU1l!69{K=H@%nYjvSA05eT!t5HA&E0||mPMq*c9B_wxWFL4@ zxKIKJDM1wlT&eYyD=9fS1i*lzt8$0{kZM7ttdnt({4x1gWZnP{iI(1|tBD+9J{!G-Si{mFoK{t2@LM7{b1b#5izlE&Jrm53gezY&G>pvg*Xe5 z27R9VDHmCeWb7f{1i@=L+8Uk0xjgPV+l|)eN{d6lZy4FoUPS2teUo@809`^qu<2EI zgX)nl6+l(tHi*KRE1;n9(k`KuAFMq>isiywf4h@?|=_J zd61wZ`y-+qC>rKwmga!Q$7S$B=zv`bz++@`@)<@Ibp{bJG4)WcrxfbJT>w5HDk33b z3xuqW8p=1+^dbkih_oH|e;~UD89Qe8A<{xE=dJsSbhGnR81k{^=dIq>eA;<41mpqkE$uXmRcpBgl zDnx3Ck`sRZ@`2gDSvR7EH#Ah};}5zQC1m~Jk%mw-@)WQMSYu2hQ6xB&@+KRd_o{xq z`z3|ditFPnNka1tSOBRBHyk-C%dO}Yf-B#nNe33!Fv>?M_bT1#gXF#=$bUV(u$N9c zQ6U;93WWkNKcG@+cur)-z}Y~MAw~lL2rLe91=0@a3J^H7>)io7HE4U7qjiOR6(AAd1_X$Kr$beU8mjX^!p*BM{m&&x|RvnuHgsU9#TM7B6G z^KsMF7LU#Ta=>WuXILERQg~OvFAzEqhZhsS77#E)4IHWr0dnHi2z@NUYdIXC--bhO zOwloiK#X80FdzVuhasgUYUH}R>#?AS(jchoam)Z3@8GirO<@T3D^sQZS-dh2NbX&^FinBRAqJ>i*%?-Am=70C2&j75_hk7l3-U6 z$l2FC9%{;41%4Ijm8T$5yWB=bK?9^BBxE=}BMZf%^H@|G=g)_<*|hy`M~H)H7>#tF zK=?mCCv<4^g2~&LzK2~?_y=2hdz(P8fp8><3jZu!DK$;n%c|21EJgon0o01P7mAS5 zJ~u9o1`{dC7SjIm05S_OoA4EwVi1Ig?^Sek9<*0YX&?69!0xk>LmwjEoM;J>@RGwi z$k1i@$sJRNU=S4x#QC_+5>2nY|7tGJ)4w;HJqisNQX?Q!7=sBAl5cxN>4dSw z#zrI-ExX&wNPBZPba3b$eyiQby{{`x>Lw^1co{Rma`*=Nc>>=sCqzTe&cxTzE1yWQ zAvi)L(qs3^Rl3+%9XEiQ!4nz*Gwe11>_9rut6ou)XuOUfAEOFSP2|i3?(D&E0s*F^ z4le}E7jyJpkELgzv1CWj2*70mpGC|9g&?3N4RZEmGqfi|}A?%<&Y^fELeFGcu#TEXhGa1BrSH$!oV1UvLk6ztx z4@4Y80#!L`pJ7&tPxm#EJJq8TdUyD}eCJFyt+x{s{ zGnh@Q!Sq_TG?oCzLfsH$@swi!kZzA4LL)Ja;sZql8tWAQyuQv3&9I@SUW!~hY>_Fe7 z!ugECFaEFG?cFH{`z{{+Bu!b+bTgf4MDf)*;pTKEGbNJd=z8`n!!3_vMvfl+bokQ; zRY~#c**-7Up6}OEn@$lo9CHq3e|}N({B@o4f_h%rtbF3)+Ok(uHw>SYYx+1btoPI5 zsaN~Tvi-*9S-XLgW!?CleLd@B4%@UlahP{BpLGc}aRQ~)6D}&+|KAVHEFjV3pdO=K zde=)-38X)HyMAyd)!pZEz6sXR1aO7|sc)h6pa@31JMPz z{16hN4MYq@&@coB33w?S2g>jU&=U_%wWFhtxeW2pJj$|&dSkTrSi++e;<%^{jDTQa zu#yoj0%^)a&7ji${Phz=t;8RYeYgpoE8G;cpt0De&PLU!s62CKlPs9>i>%5jt#=ys z@~eSqbvZE70E z*-k^rF?NZ_zZUg{oB)6vCYHXlH0esCX-I{{Cym+su(5x@U6^a1=%A=(K5a<_^; zJM5*SgA|z1p~ZUr?A+1$;P1AYqOzs@-D5llj?H3zv-|JOYnZ*Vpk%w#JAGxM zfr9v5pi=vYuL)cR#AJ7i_5b;p^ZlwXeK-mm+@9Wmo%Y`cc%ziPYkfIUHTVa$)adxF z&rqU%D6`!9mFQ1x`uB%tIoE>MzZ7U8XG6Mv*`{ezaMgArX`1bA`*3NYzuS1pmzbi{O@0#nVYqjp-p_YE12`| z=Hf2k@J;ypD(}n|8UId1x?J(!sZ^NXC;IPGlK%Tc(1rLhp})&VOV(q@HsU+^8Z9D! z-%DQk?)voq8=+hMef{kJPm@hyRYq zeF~w z_n7c68_|10qY+!>^js${C=nGZY8uw-ZywFoDiR_gs-~H^Mk1j^6+I&9gr+s@>^_F$ z>nCUD(^hxM$ZyovQLH9^{D@jKd|>O?)4ag-TZa!!3tV8lYe@Td&{;%*%N4lS={6ZJ=>QtWI8A9$^d~jfS{gxuESWLlx+4hHq zj>N%NL|LQDS08lgfX3XpczS)X1GP?Esi_00o1V@GV~u19d=j!wO6WyT;-ny=Q7Y=h zk#NC(G%t`%s;$qKNFte{1&S@W0M?@oMl8}TqNx(Gg1RS_I$S&!#uU$ zg-WYr)_#rk(NY*_u`bo%Uqic`*NDytdJV*xCDCOB=o3MeUi$Lp0lHz_K<9}${3;fS z=}alf&Ssoh0cf3hmTLVv6|>lEeaCl7DWIHSBhfb&&DMkde8H(nZ>~-^;uy;vvgk#* zh!a=U(5;vxczscEFdz5dRE7>T20l1gYLFoBp*_h(laZU0tf%1TC<}{-iMb)}@}r7b zL*j2Tg?*s++MWaO2O=~Lk!Q;h?W3EohDnzEo2s= zjg)`iJIN-0>MeSl4Wj`Kael@I!1@F=SNGYMxFMD5{jYkWe(2Q>tUjyV)-u+C3>79< zVp-R36R6Z?wO5jdi|f;}2NL*;lk4A+7vW^;)F(cW7;t8{P{Kc6@!fw+qxL7I(=`9s z^1%P@JMKS<>knnXNvC+M&3yfhsZy>x)2{~xR!^8OXPN$8kwquf!<6Vn1XfIgWk0_c zIiMk{NqdQ}Vw6uU=2I!L>k_R)WnY9%I0fiOO`EU&YP)n`M@}B+jUy)46HPkkglI(G z6yypQ*={PAsCM$OtxglnU0?X(tk%2jLdOznWA6$Yucn7*|6JU2Nl|T7E~TJ|vm(;V zTl#Y!=aKTp#nm*!Zl0*3?aTZ3zgmCJPvl~yEv&}ze-dLi_r5*s#XZ6|LQ$9|)|E2$ zS$p#~4Z48Du|wyA{7v*G4(^y6@w+f|*>V1sueD(ZPZZa!?E|gUn|A~syt@2Zla1?= zpS54I{8_)ozI$py-$IIY*N!azxx`COB_yE2@2LOsRP$)Wc*61YNm3RV;lQC&o60Vl zY!oc1t&*3?ex7z=_Uz7m&*U~}r&Mh=`nF^~Z6-KEt)6J4DAm08+(u81i0RXQMTKRR zE7KYKGq%r83LbpLu-WZT3}4nU{wRkOo`@;!9P98Ci(0y)N8H?9=%z2Z=4EnS=eOD= zc0gd8hz`fsI?WvT^q&v1lt6d?V0YpM@5ftBX|w~rvc|2vyuw!^ zbtFJx`H9U>k*;T5uSfDp+b0+1f0;iMSbfJ_(%n}go_@2yXZ}(RG>$|K2S1zYs7>eeLTp6jHW4^R=vD3J3xa|R*IJJml zgv%KgzD#P7Gv7q+yr>MEy4}+vvrrL7>L4$*K8Dhy}KwsF?M0|M&n|kTWnF`DP4vSmbXtC8@~T- zB)#DsKZVAqu$t8#Mj?T^qOg1RS!0KO2?{2kOOCV4{4PPAcr;x01(^?TOVQ1yK!r<@ zn}as-ZCTBrn$|wbf8-wjHO1)bO&_G+eJ$a$zdTK=^nKslsMyZnSK9MSYV5~O`!!2j??N8x>dv(*F<6v-znjhHutmj~B}P>(x6!s&+o5_{QTuFwoPW`!Ew6T}S?UeD zHHxR|dhEHB6lEX60+TQAQCu=0)L+=SQ2Lq))qOFuh zruJKS{EvwwfvyymbAc*V^jr1|Y?~YMVA%V1pZ!8qEsyz{d|=hy^6F1KmmJiF#lNnY3r1~~ zc*CsxS|+S;!BzFi#pt{Dti^7+2Ju`nVC24`8vIJ^b)mbl99Nl&$g#~+R86a|{7edb zhngR`c}w`bech(%LgCm&Yc~-ipRP5yy7Tns+>WN$1-qe3&c|!s)2Gb7^|h9iD5A4= zIKfb3^m$+WL&2t@o1L3i^!kQd*(HnSGlP2<)NMze1VxNg>O7#0+#(lX+jOd5*K3T- zboE7msR0*@(AA|HNjVzzX0GuBgYnhL*cFG9%)gora*u4C&o0opGZydmNYa`^L5r*R z^YLb#leb$jsF%8K@7OfnTjDn$dm_xOFh|Tb+iPGb#*>|wg2DB4pRXxXb&s&;r6#Ub z7kA1|rk5vqp4oqY(znyUHA;wYJk`H6b>n2L3UipUXAxOs<@|Y_GvBtdw~AGy%^z0| zE!_QOgW0pr#R2zGmnluT@^57!r(X{i%bzN)a+pl1yJFvzcp=N(R%ZE&OLoZl$8qob zvbLI(1+f~_uWEQ1F7J|$m9P=mqWbBAe%RBIbZ}#k#R(f|9&=C6Oj3Wec1l^#cSL`iPtz8>3ium>*ZHE8FugD>FrS! zq{xsr(KGDYdplm=Wq#9neXUC2`Z{+n^L;)B+Mb5L@~qFFJv1;cB)$AHTKRPSp`E{r zYfgPC%+;lSqg6glDZF-V=W1wA_6;kwr|HUpG*-Hbp;v-Q68L`9-5qF&-?7``BE~D8 zNj|7Zyw`O8qumBDhkI^ zC0yFuF$6_)#tir>eJ9Q`g@JM+fu)r+&LwWy^qIV(3h8bwc zJJ`1y_wqyucUAaiy>NUOvSahAME#Fi2LG|31iZYHeiE@eQ;56lufpuwyFXj7-6~P99&-ee_t- z1aHXqo$)>fl9q$*GD=T*ta4|r9hvXY7P5>8Zsy2p`k5x?{qexAOJSYXXQ$J4lN&mfOd--$hs*^IG$rVYH zurLq1*i&E0SbMKU$GMkUT$_4w%#@w<_p9LJt#q=cTBg_gw?cR7r^Dp#<&&GAVk3cjvdcnEdpk8wxjdDodCTa?mPz zYhxd2)27kh$zAMy)S#O7tsy^m3e_r?X5khtsG1-f>RyRZ;9RJ;Q*Ed}E*PTd$r&*JPIV$%#$QIt}z}YM+*I zZ0LK>p1#$6N3#wYo3`{vk+vd|Pe*?1*5sFNGU|VQi(cZ<*#XOM8hh_4GHi{ZkKBHm zTOp4_XM^Zx?SS^%%x`;4<&y(C71B@Fdyy^f2<+h6`j+YUJFc3!xUeVs+WY2?+Zlve z53epKG0={LPnrx39^F3H_x)Qd^~_Cy__aiq?ZG~R2Ty34)E&%i9gU-K$ZJum63-*Mml4Lwb6+h6I+F^MeKGCXk-#oa=G%kS?t^Q)Fpj3!4KQc zu?S6P=lt}snk(f~aN_Va+3|+LTJ5e8--HtrX^6%)C!t65D;m@rw#B+WP+Q=-6`b6_ z{?g6Hoe9H{PqJh{Pet*_MBlmA;m~~DNpv|i(OvS{o2PL-jlZt!Iwm`5!`gHL3XVP5 zOQPOBHVW9NkudJdVe{_Gz{PSqnXB~l9o_6Inw+9Xls<1#>`xbtu2?|wn6tgJ3C1;%n-$x_;y;L~Du#(`1X>*L z3a|~#OLJBUUSXWdplCbxtfltsx5JBB;zEzD{8XRls{N7LpxD~R(_MCDIoagK0YC2u zlNv5sk+K&f_b2<-vObuetX?!2uNb9>Ks-<#>P)+X{G8<5#8?@@mGi>03`^49!j>}K z+ekLxm1m~;o!tIBER5~^y4Bd<-aODm@r#e|9F>weWBLvxwmvknC#{07R<*(Yec|N>S+}O-nE*=}nA?nv~H?g#$Z1j0I zL*JJx>6{1kC@ftZ=d$bb##yNtORcpY{g_t~Fd3T@B0r~MqI{KYTbIUjX`o@!-x)MPmyC=`MOgQkBr61~L*pkEf z;LTwKNTc`dEc5t3xpbyK<6M%{jEB#fJGXs8)aQIR55=PgJ$2*?4z}d?h*p=? z>wZ6!-@0Z)*VK4-VB$FGqeS;(!aVo3rzpvpKPp)Eq7SK3k-+bHjxkW>$kov9Ezdq4Zl$DHxu&}BU}l=6*_Gb%s5LK9 zb#LRKUD`DtPWBHu3BMTSSTU7(_aY==m)U9SK+$WoliibNa zMXjIL5Zqxq^OKvQ{4IBEv$VaA+!6j?nWjrqYq_lj4?}m!>(Y5XaeK#Sx3f!s`=~S7 zuuG_MT!T@JSzOvhgNsjQ$~+h<2RZEAQ#K6Fu_&=8cVrF7HYRLZadJOOs`@7X?m%U| zefb)}!8pdcy2SiPEXsyFho~JC|zFR-MaIx!A zyIy4F%3VQ<`r|5(bW8ak4zswDKeTEzDSfdx?Ygt+ZhgPy3Gz++f4E=0L&{*w$6*#0 z`qXK9Gt&>L%EIhK(=2J>fZ>woPeoWROerxOiHmt(c-h7$nWj)R{dx&oH&&(#jP#Mt;Y~LF$_?Q(YGF4#}dteE%Y?d@Kud zl<01?r~hgJirJVXFK{tDc3ot@AIT*wchS~5F#Ff<+21OX$(4b2TkndA^UIc!&sFHI z^{GFWsz~-4m(BB^0-BZMBPL5y9Lt(TcS*3jvG3)dlfkF0^Bn`V_8wI;*L&#pQu{`y z0c}E;ZLZnFhiv+ka|Wz$j)xj)F}56z*OZF5w`l*3;!%%uNnnSruJ6`SYq9v<5e=%t zPitrg8Vr^Es*u37PgC}7dqk?i*dd(OF7zh-P^y1KP6|(0jP|dnlDaE%?PLrAbR5() z&Qpx{&knQw8l5sB+{vXT=e6zTa}Gjuac&SHzax7hiZ$#(AB`%CUPn zpy*{fwMy_O+Bi$4S3_0r=BQ@15@f%#webmE?vLFeXncM;JnZ*_gc$;bMmJzX@YJ9P^}dVL((^L*UaUjN*GLwt#gO7ezrC#Bu!Lkic;AqsD!R2t5 zxvuDwRFA@+&QFZAul&BWb(7Dj-`^`{ zmp7(uSd=33SxUX};H}r)+{wD@!Ea@JZv3G;RvKSnYDtkJK>oV){KgK7bom^EDze&FXsef2( zsr+i*8|v*R)!Ubb_3*IiRliP~e~Jp@?q5mVaP^>og{5LSJ9Y0@iO1$k{P#RVgm#pg z^)TrQzw4cJJ~_TA=#+P7h|2l3X|jjM$sN9>Rf{IeZVTI$ec0NK`?7&zbl`C2)%nGi zGatxe^A7&ZvKVdL*C*b*zcja$+}EYqp3Ri~@|mvru^OMb_m%2%?IR4n24zDcqYEkl|1r+@nOTr*V+xVkpYVh-J7emg-5XTSLHOh$VK+b^|d~HIdn6R zi+m-`CN6b;P01pxLyU5J@ON>#6C_SiUZyf@U5g&y-#ulsIxAKl<|7(q`r^HcyQ^K~`Di|#3=8??7bF@F5zvU}}I zNi>Cz4oQfb$i6~liPmZhr_rde=(6xRsv}Lu92@ssKVs(Cy(J)L&mqx$)TCc|MSW%5 zrE*z{#KmIH`9zl059IEaJpG|Vad+pLcYjLnh=l#1eS3iI)&Y+2^i5%VK8ig0JnhQ8 z(<@M1DqLn{t2^hHyQ0UIdzSUJ7FBUma)(6aJ#MsFGW-Fz1Z@KBbPvmO`}}!*L%&y> z)ydqZnLM|?U|IHx$+k8jrjJV(zOo*RxVGGTFL|sl`>D&RYZj~D9^V;p-ne1kS0V4b z5!X3>SA}RB+PiTN-lkEq`LIPWF7iv7H(l-xFCFg8S1%BCJ9jL@m49lfuz&TUmi(?fF;Gy8M) zyhwQSs8`@!M953Q4d+&Tl@;mI{q05%&C#?8Dh>x6?%eR9w=eMpXU%~t3<*Y2F6SpH6{HHDzP0Z^`xgamRA=@W%nH^&f1uuWpl0SU{TzYxSO-T zOm`--T1mwJUMP9(Gg?l%T_$ylNB%96*Mp`yf!yj+PqZvnZlqF3N=p*xhhL(`Amw~b z^)tyuhy7Wl4k{hbtQP&-1bSv2CZ3%j`_k}Mw@7C%xxlwq>}ubW*oXb4`V%-TXla*b zymKiVnFM%uIt=u59rgbhTk7vGJIct(9B{$c!g4A8V5f1^&eGBzC%56C4tJZ8xqwAP03^Vj@%^NsmvV0AJ&%Vj9>*1w@6e^Ni}6&3%DljMdeeo#pCXtW|7jcQ{CTtv>eFg1266= zz8Rt!eta-3EK1Ttlb@Q}`H;ZSb0;F*)yo;5@mK2>*)7%bn~Ev7dXo;1*-baI%3gQp zL1Dcu(!m$5>@U&x+!Fj!V8a*vt1qngp3MF*^|b0){3Cx_RVBOJ#`%i|)iz|oSXljk zTP>puRf&V9Uu)-ay&b3Y{p~eXRct}Jh5`MYOQ{N)E6FX=a@&c#d!Zj%#lVOi;UmRTt0C+l#B zQnb?0#*jird!?r9&p78VcE!y)mRFZTJhk2gOxzIo+WV8k$M~l>M>#_jTOR$kI~$I7 z?HrnN@(D?5T$T?^zA)59F)H9#M7ud_G)^VOdG}5)z4zgnZTHXKd_C>YDc##Ym^I(> zdNIGoYEnKP|i9&CLoaVGUgq~D)}p}y3F zn2m9QW-1-Kcz#{4+}|dqKV0e1$y>T*ch7Z2j~3s199SnxuHE`a4qvI~3^IDV*1>10 zZsxw~D0cr+73&WZ=CZD%zM4wpU*ancc-if#jo16-#i0x$0qDRCJR z%L`A_+-AubI^GpLzD7?sKb@Vy_^Zn}Uf)1TUva}F=HY^3KPShV{-bN>=Ytb{%{4|3 zY*bBI-P3$LrA;pX(<>$Z z>y`PFj}n`>@7}{G(8q9!wJGFc!$QoUyYtB%4jA`{Y?_*VDbc*0CW`*0x^BKxS3I8p z-7nugvs>PK%?ipdIIXe0t3DH$=xx|UIrVVEVX3j&pY9{)?(IvjuM%A4QjNgOZDyAL z-;3++wDJi9 z&%s-(*Y0>M%M;Wh7w$Hld;H3M|35u%^*!699`GIc`S1^2?S;ozTKWnK7mY_eRyoXn zm^U=0_vo)Ty{Y8?O6SSv^!1Tfc9!#>78N+eJ^qpXKK-De#t908v^GHzO#}Ul-!E^j z{IYqlgp)b<(xTwfv7C^K?>xf$w46;@<@Oayyy{VW{zKlcG^{F<_#Nte_7v{y;!=j5d7&$RK$9r856#C)Z^sSAz&v z1@3nmn5xM<+u7CqZp19*3P!MO)#`<;03iPPJ;-|c$pz|P0;WlJ4CZ6;_X%$)Ebng704n`;>EGYntmy@3QCWh7zd_+@4WU@5MB>>A`0Jl$EAH z#y$2Wr4UmfT7)1UZX*6k(;)xFhAumT00PDS0IX>c-DAj`&=nO|e}%`y!Qb=P+y4M| zxsLj0;rhfEFT|Oe1Cnw<-D{MaH^mlAHJpLSlB-zB>{iGJzR8=1C)i%g3QCYu+TT#g z>0ovI`mX|iLNLK@N!<5A$tY}=J}>;foBVBTSA4Q=lzK~i2C#x<)%me(Wlk(GD2Ql= zLc+*P_wtl4eM2y%&wgw-ZiRFr`r#@_Uf&_Ws+Gnog^=>_vJNKt?z8fLpFV^SI5ut~X505Ls z@~MS%k|Pu(Jxt5{u@A5SVJBh*sjFyruLojh8kUyaglz)7GMV-&J4r0-Cc*WOaM0km zD2|0btz5fTvFE$;Lcnx+|2z%LW?>+1f?2cVpP=l|;ambGkqBc=ZWWh=HpyQAm>SMn z&3K@azg0wqj?t|$AYXmL){IQNKHn^53bzYYL`;8YHv1Gwb8t=rm zuT<`#4bfwCfy7p8)+s3%bXP&$8w_b|wYxw`p!1X;R5!rN!J)&4h4jkFLf2hj-wD7C zJFh$4Amb6V$f2AtMC@Sj4GMy2G(GKn7Jgij%zz-|cP{(~wUI7X?6%UNeYT+eu<+yyrh)$a% zHgG}Vq>9IvM`+{3(Slgr$lv%&yfL8Zs*VLTFk^?mIAq&Ee;xP0sho$SMU^is3k-XYfEZh$#%yZgM!F{ih8PLqb=C zYK*dh0ddo6&381%;t$A15Vj!)?)}}JLCJPFgPu!MN8qB@P%__p6v7x}Ym|IBkSQeE zpyF@|BJ!x%ks!OISU4m5aM0@@TE}qHfs${xbG=B8%QEiAjMwVC*P~>OGSB5Vuq9jL zhRy6xkb1$V8NkC=uy(nE9b@bZfGdmeDy|&?_50@18`nY4>a8)VYjHWq4hN6wyW8H5 z&%Ly+-3nf%GFF4h))`pu_`~A3wvhXK4<(KFq1?)RmsM!=f&zKMEVS_$RQ0ywTv4gS zmM(iLFq>XlgEc@{61}|GBSXRAwdBO%F?m?#>Mt#*d+N%~ZHJsB6_0ir=*SlMp5RU$ zMjVQ;>J)+fKm23-2dn{z-iFmZx%bdj82g+ni0z&PNR7fiIaf#96bn0$MFnZA?X`mu z;{KV#Rxr!~o0hnp!9`~K&0QywFRd=mw>>+`j1No>CzRGxbmQb%{L1mNevo&9)Swl1 zkFlNO50zr_9RchqWRI)i`yYzKTU4MHoFn8TwIjEwRrVjk)>_ zuYl``{S2rfAIqS{E(W1v6B0NUAD2A6&Y!}HAYPIa+w^hrH^>&I+wcP;JU@KB(;(u3 z+NcYw0?3N+L!lAhUDCJ=G@A*TR1h0`kj~+7>tBNn!JzbX+25b6v|?o+V_gMudUc>d zBTjciI04IR;`Sd?jorz{#3r#~3Lv`fgMXMnlv4;3hd{9wsGaeBW4N|88OSizv+DgT6}cY23d zZFTijgQ8GKMd5ytRZ2WSXa~4_u}f($GRGE{0=yv`VW&HZ&L9>bL4T~WcSi+9 z?t-!(tz}IpH!{mDhvx-;Fs$7RV+Io&+s@}Z5#mQ7jZ*zmnCRI&6f@U>h!pV~BPxct zbr8jilXe*qhq{8KHc3u74vmu9!u7o z$6?2^%*zY6`)2)cA|gSz=i*OtuAuT20a*{mo3LYTMxsKV*HBmQf8A-8gl$s@oni0v z4Mdv0b>)lUDiWo1=n0cmQ3QFSWazCfm_0Y%nQPm^v+}pIEIcyOKT(J*gc2V?*YOUK zE0Ati!2RY&KElP2UtMy6hvdUgIlsTRkNcXj9Z4LQL9QRlZIWNdBTdYc1f->*o#ba1 z1q0eB$cGTQrUU0cy(P|u2b~7>)_Xs+Nw8yudg*JkEtG4qrG559hV4lvkk!E_?;MwF zuVPTpgW!m(3{;>}(*xo3o2%6@ao6S~5)9NOAfs6+e)s#KXLhU*-nduYmb%5Ywd4m^ zOL7;|R}6MxOIQ9n5L2y0q07#`|012iM;LHM1@I$DBbV-sO>*x~~y29sB z$e?$S_p8~@(r{T=SQyIaIfl7os8ANB>&37t2*PF6bKOeuGp_?%%CI4KzVOP=jVe(# zNu4GT6(b247JWNm-GEvPIor2y(gAm*dvEQJf z#2fZp{@cFc3PjH6RHiAR-9mB$u@VIr8j8%-ji1x7(@7pe1F`C$fcmP#4KeLDK4?rK z+Ed`GCF`xYzq7x37E?Vh{o9@)E~sR8TAU@A3g5`p?8|+2n!@!J7xS_0a|B7R@Okxd zH|i}M?28Oc{-drkR%vX465sNLgRp;tsO?#{`l!>$-~pV?abAeUpKN?;x+WLB1&UMD zdsrZ9#KtKW)^p-FTi_`@x$?yhyNRx+Q&2VG2a=E&_UMt@J9cXW10pPmRUQ&l;Rm8t zf9j#)3l0R60n~2;4N`s9h*u=d%!!^mX?UK-|J%01vyRArMLm>j*I>zx*v=3|1>$&u zy>waFoaAut(rUBDxcLnqhB(%}JuEN)T!*OG_#rT*3Cw6`OD|4c=ZBAm@ zsSTdxSgl5JpU$YhCWredUFq{goC6d)7UC?|c|>9EEl!L7k!<(Alv8hic2<;Er$_2F zELq`B_MQK*zbA8kES4H8Y$Op7E}KFkB68`9H5c<|uz)Z< zS-B-5A_C<0ov7@IiMxS;-u7o5%8s-90%BLc?Kkgxz4f$$Nn=#y71dQQ*8;p*_KK8| zmBitIi&*R0N%n!!^H0=JfT_ z9)-9v5C>AYL&#kD0V)4soEIX;m?LJ6w~T@?g4_BoUM9y>6ly-On;)RWah8e&u;${F-+du^M!ZW>QQEw~yTE-4-$pZWgl)Z}oac{t7!eBp>; zsA%LSyfP|XL%}1>7xS?QNQdWj8$}yl8qKv7?G6cF+|5Yn)=!}c?1yjGE4ve!eh0U2 zY~MJN=xr{veGp59f{1>26(+nGx*cP*o+!zAMMXtBD7PBS{Cy?7sjSa@4_9#S$33tQ zMxP5YD@bGB$}U@Bg>jx;6q4?z`3gyG%7B&Ww9vNrXtlK6%2901VaYlvnGW#91=izRF&63|yiAC>yzMJ)JcY zEYO6Vr#tTzcDxg(m2v&{77`X8@Byo_7JU${HWoW`Se2pc)HE7IWzup3-nMvH<4*)p zx(IC#%v%4NbFF>vSK7*e66UOy%LS&0h_0uP7_=K_1a8k_N7EPmd}b_gBGb|`JXUMWIxak~x{eQUt?|yA+k?5p--*fTmk9o4%ls$Ky`B}RC4-b`lh$KI*T>p_9@^H^Jj~1^M zXH|uwV?ytUfiF1{;|Y@2PpPHb2qV)TXP@fd0gxokoq**Pc2=G3zCV z$Ff>>RaCXZNy8X_gX~VWL-~3w{<`%qS!7&=h_v7qxmkJyFdOWlW3zG}EsJ=3$6mD) zVp?se7B-gkaUSaUc8;|~Cn?)5N(~1yJ^j7UiAr&NJb3wix>l_jxxM`FY3Evg(y_mu zPDg;^uU6)(P9F)Sg^nX9y2*V+>l)4*qYzgk8=*+@lkc|aLf{=Gs})3)FUQKS!oYkA z&DJHfUWqVa>dG6&DN05o2ph`QqN|QX1{*S{R^xLMeQ`ij2!a)R?fWhqlVch0pW|h7 zOhV9hy{k(fmmz+|=;-@VlHA)l0br{D%l>bmRYPpKVbgAf!aU~!6vv{--aSe{c&guh zFF&lHfgfyx1e;^l0rgJVsdw9Q%)YLprtKH=TG&L4ilM#=QcWVU@RiULBJcR^8-^k$fT~O8f}18wKqRr)!D4G}X(ETmVy6#nNX zj<#oDei2QIcGkpELqo$%!=r7IUsk<-H_FNfPJ1p*lt>jtpLP};;@QBhcu@HbKbPwE z@<1ME8Z%>6*}u6P1B^4W@=Wd}uHEhSapP{!EUp^vwa!9PN^dp{=+xZ!d3K`5-P7yc zj)r8S>3{$lNC~yrN|IaxRZ*hl6fa)^w=Oq{hgelA{F0SUF`@1+`vR1on3=#>@6NHoxzC?Z}cStjkgAJGY;H}cj zr)@<))Sk_P@Do|}-p0V-4cSp7o0RzYn<$m;qk3GAh*EB0(UEx)`jZe+gD4SX^N8`m zaU-K65JW{4O41Cf8)9QlS~iHcK#}Gv{C=&P;|~+u3@K&?<-i_MDuROUlyU7xfiQxA zj=0`ja{VenTS>i_k`cnVR!HETbg{3t`J&iL>3QhQt zC>zP{czAdP9D#idGi;zQT)Z@056uMZ@YS8Z+HIVWF2s>hArW5+ z0DQ!OXb3VdiZtGp0~RO*pl$&q91>RquER1cv;hA!IC@rMEBXzj7ybY!)xt6(lsiZn z^#RQ>BvJ8Mba3L)7(9ak4oVg$ylbEeJ7Qtp4ji0lA)-)#R!lIOU^qp7f&vhp!jr^< zkHjt45}{>$iI9bYI;J%KED|_@F^KmrY|8gKbO@6q+cbJY@(hu;B%0rN^t;m)RO-APCVvu=5em&7qWGV{FD$#?H z^h)^odiWim^7v4`G}XAuffp}5a!TtKJMb#-pM=QkcKy7VQ@X%XSM4D8kU1K_o4WKlahBqK56lM6K=N%6usL}p zh-sNMtHrJtjm)TWI@Odj;&OzB8|sDRjq0S#ur2od{SxIE*;Vf*8_P7K9~;@wW%`31 z%3jRf>)?-N+F9j!B5VGFya2pA;1XtfsX;*?t2%z+uj91?28M=#SkZ-~*zLBlrT5Tl z6M}4K6@&|_@Wqk*x|?W==ouLB%R|?Jz)3j(S@lkx+Cx+{Tab&KR+ijz&Ni^NhF?%a2lB044SRT%R9_iPJuFN1L+5Wv5+?X?vK<1&R3Bbv@gRV8_`us&bQ&ZvR zZw5EQ<(r3i61L=?)78`0Cx&=c5GPeVdGfLC`Sbd*{;2FSiCWG(^Z+WCFTcjHq7X~f zuP`SW1dzsvoXH4md{q!$Z4a(vJsw@T9|YdRAr-J4j%!S4J+?tch5>atBc3!gfCDkz zXhBq*S{RKB0tys}K?~8g)H5;?B!?R3e+vQIoc_+*wE%x6b1^6Zh@wr0H!2GkhBCrB zF*5v!!|y6?Z&HP1J+SzoZ|xb8#;@%k;GHD`g&Kr+7z4smVtTqJ909!OBLsDs@I(@y zKi5HLYQx?Ki-x^!lNLFb#|_B?2Z+0e9ENPqxjj=rUIU=%N))qOFkm1Po}fzyg~^YE z(3OgY#vS7_&l2(@A)=j)lJN`xm%+4@*sYMhgM6D3@c<i#Y5UyZCm>r3r zj^{^7_znsn#Ax^(W=X1MX0cEW&&AxNV%V7&NHEa(S0Q=}KQH-hf~%;atsO$pxp#Q1 zRp_T6((X;(L25?EHhARH!#@+z?xfLv_@fE@EF-!TpXCL*5Z1DA|pZ*daf&>j4(<0Nh% z5vwl&{bPdm(ja1J3i)B=P2j)(eFfwVK<7OYA{&p$5gh5sKyu7ggR{2f5a>8Abl(3PTP zpX+d-yFdO{U|(9XOz$=#2A)DRVHJ6fy!I4&xe#$&CU4l2nH*kJ{7%#cW{4omy-A zy`}Igfc6^@HDH5hU^hp?0s)MX=OM%lMQLH<7Ze)dki@#bwb@#n1(Hk0HGe_X8Y};5 z1_q2Mxp+~&B0^j&o>FU!Q_zLvrV@=>Fw5a=vl5gO{7@~!v)kQNft*2<}@Nkpkeg4I+mSE>wX9z`4dJ<<=79{t#J7rf15K)x`wv$w4O{0Nl-hd#XHa zL0k-uGll9dAG+Vi(3~O@LZky)_Jg6&TQF@YtUv6B0*lmafCF6 zyoYO)3%^H5ZK1&@lM5J1;-Hgn{`>)}{4Pe9!llJ)m{mQ7?F5EtRrasRsK5!|Kk5gJ zKR?&DEPC;id`SwePoX=Vul0hlS2!qVQXuaUP#gy)Bwm@nj)^Jomc z1RGs2iei)-; zOJnj3%xapLyY_%@;AOT0B%h%}c)+pdKGaZ)p^N zZ_IT!XVS}wbFd#mMUm!x;Xw3*8<~ah6ru943BKP`1K^?=zLDjk5hM)D8gD~u9n zYBb_@*@!4Dz!6~3xU;CDZE%TSUFdp<)&+1U#%-|S{&O7zs$HIc8W?wHDWqDjdGUJ7 zXxS~oAz@*C$=j$^mBOJXTTNBr`$s|o0?@4p z1jOir_<5qn2FhwcDGE(GoDLKZCyvWO!s;#tM?!0>J5_hoGyMG@Q&z~?#n#lQOR{c; zmJ9qmVU%^ZZA{;{3DX7eXzma7qu#*TLqJCHl!D5Pfs#aAOzJVXBnA}_)I>RsXG4U& zA3p3*dK7NQp}J?iM-2*cA`FY50!Q=~6+A1bn?fl62u(QxEc|=mRPu^uDQr}ECcqfZ zb2=$x)Q#qgjK-Xybg~u43~?SqH@x#p(?c3~_AnUCu|@d)aMmTrdTe@cHVQC!?9`(@ z+;QlNaP$2=Zur285%Jxy`$HQ;MvO8tQ79pX|LVrdYMegZqssfLY)cepw!6js$^kA2 z>vuVp#So4UCcKX`Gc%dW<6%q!AcCk@qQ^#igh9flboCo-A59@)j$b07w-qDn+j;&T z*AZ2)dQXdTL=|C<&>4_WxD*u3HJp28UO#9WO~PTdwzi(ER#*u$U;W#O#`uJuUV@4e zSQRn!g;_PA1KKrdaX;9o28mjob!Kqvmb~JxD}U%Y8WsTz5_+Lb4{@jOcY1i$KgK2 z0B({YF^7hdEo0VWwAYZhB?c|f%f-}Uhm32g^If9di=i>HOpE<%)64A!kb4F0Upe79 ze@L|GhXjr};xjr(!#gVv_6OtIApYgJO`YkzF@GB6sv=CJ@#cWuAx^v}jEil$vWF4q zpgc)bB4NfTffkt9Pe23+&>E3$&+p25dOU(k-+c!caB)Dq#B>Sgme?Vo+>3|VFUA!< zAd5W2mrEcrLKgy+14{8EOXJ;c+p(h-9n}u0i|okRhQ9p3qLHuPw>~?H07aM@fG~-i zGWj6HIS9zt=QmEg0Jdhow+CTV=u1yVO|w6{B4N=2IZ^lkpGd3~QyX_^wUtCX=Kov# z`f=Xe72DRgQj(ImWyDRlY_VqoDHKncbne7gh~MTep9XFQj^2HkxOQfz;8?+i@W$wq zV3{+{oIBly)kPf~7do>H01oP}2u>|{0P$C~n$fQ5+DW$_x8KlX5K5Ie?RfrV009_? zOws{E#BEiL4h>ZVnj+TROng(otAVO28lw~_GU2YlFJ`PWn-ddl$hs0Q7DBSY)WZ&p z6NFwg|5~*TBUg$FKTWZlCNNw%;m z0ar1AQp)a}0e%YBi6%TD5cOba42N1Jah4&dc4HXL24@&Z<{iBHiya0`s`%ruxy70C zf$%gBkI%)P!d)gGQTV|T0ZfPlJRsb@T_z>?z>wi2X7{5_apYYPMgvYP}~V zb5jzLTI4ih5rjI4VaJZN54#>iVU+aZ=#bv?N1EcZ5VP>!lIyv|#Yj_=lx5}XIrTjj zTwGkFJ^qNJ{UP^>kR9>1pM~qqByMi-B5s)l0-s&kw{0U#LST~2w$TZ@a*sgqYdiBD z7$yKjRs;`?Q2Ef5z!D`GNf5@(&))3A*XV-Sfzij~$B&8dG2Ej(0j=fLNG)pHzBZA) z$b9s!Z*#NdlSfk(vayA-Bj&$Sr`zD)fG*uB*kGaW@b8?3tImgRL|Wa58`WEIKW=WW zi&7hs-m9(V$7sC&dD38ZBUTf0PLlN$<*S08i~LS+KA$&y7(K!35FNE%D}-G-9CLbS zRIp#C+(c;}hSxjS-Uthem^iS-+1{+;D4l-zo*G+8R@6dDH2llVl5(fm*x1nR)a96n zT`%cn8ZG#=OtF1cc*p1aqR}F!Mq?xL_lq47=*u7J+%vilSs#MRlSO^YccJ&ao6%!v z$p!bx3RoGTMIw}})0Tho@=EHQ-0XsfW);ilcY8MFH*}f(xHjw%zBqcNNK8mW=$^la zM}b&Yq_#kWL}d5Hc`9!QREXJ~*AK4_+w&laZg?72t#cNPPoRp?s6WGCAUw45f@kB% z{ArFO3ty}ou2@+mIX7gz_L+9cU)aB<&a}+9ecNYOQg8jtinLi(fM)II!FiO0XL`L> zZ@|bbbx3AKl+kcjW~Tw;Xu-(3YdY*Tc31{54m{8Y|u?= z@%Sn4+^;e|>?ot_5*7U*IzNIc(Xr^~_;VwsQg|Ug@ExBnHOYcwZv0RSt$(HFh2ass zI_4s}&zTF_7fzXHH;p=2dfva~TG}vmN-RJ2XrB$8tz;C_SH4A*X@|{j%oz|;CUX7Q zm)9AseL*p~3;Xj*^RkOZ91GPHACEV5?(a*Pb9^@EJpScVgO`F~24hhVE>Ymt(3#6+ zMUJ<2)2t}|(+^&|20W!H$Dgaf%VC;a3yRTUv?oNuzpRfgeMyL*wunCy!^Ri@qRzl% z9=K#Tk}g475kjg8%ox`il-@-)hI-t>iL2}W>}EN9clN@Hgi*mk7+)cP?}fxZ|Bf6e zcBY_2s9QcSqOueo8sX6gFFTU{ih6nz*S0jR0Z$Au16t+B)<&&tn_UXN*yyEs;erUD z3eu?p*M$XR!Cc3wF~lG=4M>zQ(P#h`OBzXn!vnar1lEk(L3&yumIwRJlP|6B9RK|j zn2sPq3Ym6d1c}xPetl6}ZSoOc@OApo`=A7aImyYAYx{viV1SCrwlO#lpf_-X3}_)< z17^)TRJ&l76P6WfMi7w}V9o~n8n7-IxGBM(S$H3nyIVmRRT*LpG2a6-`P-M*d-A)T zgI?Z1n@;G)NRP0n;{Z#T;{I=d-(XjU!u;mX3sfV-x}8)ogg}WAk&3l7A4+@7G+qKU zKvhYoa|Y#;=W4)SQ^%1-@E!(AL|S8@$s9K^O*Wp&4Z3%aSeCNOUAvE4K6vRM5hV2b z(wMK*s5kF&O=C5*ra-E!@l|$jQ+DXloY$hK|F|5!%d;w9cRHO;wE=ZWw`-fWu<4sn z_<*70Cb@Ue?GOg4X4l5}!3~5v3vr?axaosGfsqBFH4|rR1a)-eWO<;m5yrGD^O;a{ALBK50Nf zgNdT#3>2@4FgE1G;j`NOo+fcV>%d$;sFQ@=w!}8fA8;B z*a9>H%K_44Y|}i{T}n9M_c-DBIf4=J=<0IW>iV}?`MsK;48vbkiKZM(!__R8y0oK1 zUn=@KxKG1L7IrqGsrl)NiPLRK8+{rG2*k(tie^g_x)_YYZLd9g?bye06MXF!a3`zo zuWts)ve$idXMC-b@$Z4u^mO31Q!uX~<4<&rsG>2WgW&QbS@)ODw9-BwCg$^NibW4a zFflR${GMkDYYloY{=Zy+tN8OzWG-(64cXN63D2YNbJy?{-(SgC`cva6=j;m&PS&cb zDrl4H#L1KRM(jIHvIwgJH;t&vr1kxF=(F9IF;`5zfG8`rvBQHA_3JiU z&1kr2gz{t3rL7hn z21x!~0swk9CEO^6_ z3pS!69QK&R1>WqCbt#15F~U8$jgKB>x6T3{@4r$6(5@g}EX%xqnz^8IARdNZs$J;I zWiEgBZL!r)oEWmI>3lZb*8Igkso+=~$d4F}dL0({gAi$PAbMd`VO0aW3V8OTRAIMY zo{V=d-1zxCUrN-mg@smGmUx(N!2EES_qeCpV=V!=TA)mPTjh|lx@XAw6e2Ay;}rB| zNp-akklQnlDB&NkpQ~}hPt+ayv4jl^T=c~8Fptjgt7u^qXw&am?Bn6#As{QLIJhd9 z9h0FWv5bWRGDc9v7N~6lF;&K*1Af2piF75n@b#Dn(@Cm+LzhD=QlUx#cNf~TJ*&WoFwQ&wcq_Xz@JpigFSH$0 zt6f`+xhXN)yV1YmTQl-vq+UL53o<-fgFls=D})J*j&X~^61{C5aS2fcI13>DEQm}n zBl%~twQJ!M=IE%9fsF0xvaT4IyxJ(5JzeHa?}L1C9A=})yC4P0z~svI^%o{PKA@q9 zC&Rc|pcEpAdrue!m}Q{1X#4ajRevzlCGT*=!{(n?P8b=be2jQNRSDM|pks`y*3weZ zOJOj~X}`zF_+WLb{^1vJ+`fsn=$M{fIqVzUu}cH8Sn_d;BK!o+3x?p3k?}cjY8K!m z$ef$-*lcimDQG$6pTHjA63G6o08IcN9YiZYc<_X>i+v>$Gw`1+h&Pya)L_$uku#Ry z4d5z~1qLtxN%5dW1N3=e+es~7pSR?8clI6j{K7~&6NcKPOHes1y)YydD z<*BR}9wKXq-+B(Wn>bh?X(S2M80jsDDJuV-JM%throE2mEutlf!6%E|_5z31-0S*y zWW;R8$;vj_Z6#U|kcVj{ur9+4gD(|E2|p#AI~GR9Z7!I(c)cCjuW+l}B1pc@Zk;4+ zNUP2P)%1~pIKK`?1<^d=(PIwsznv>ixW~vo&l-(4Wj%Uj)1Shb)Fls4zj+8x2bm9o z)gIq!8N#!?CP1;r0YZ<15V9O;xEAI;aJL|wLQ(+j03VSoI&iN3S?^f3d;qzNa7Iv^ zwPE}~hzdHfvc#>TlGJQqpa-G$#4W?Ubp}-d+aZeJ`T{Z_Oh4?sj4CvGB_kV5Bp5O+ zu=>*D8b34DauEG}ynTGmJi}=pYlukQ`Wq*@g0dXV){dU(GI1<>^fqPVS_P4;>Y+3B z%xsGtE=PJ(=G+d56@2uF-o3Qy0oob!eYuE*!oB$>S?b}lSzD#*3p(@8e^x?;O0roHBrvzxt2u?03jX_E{p(|H~DR0V<1(h-AgZQYxuVCSH{c!Dm zT&Or|15H~sFjtTuUxt4>i3l=W7D7xl(0F@}E|&(uG?ZN}oDT$PZ-IJ$)A9Z6bXZFR zhc+Jh?UiF+EK1aAl(FzEXu|TCPxaRU%%H3h?NH2sKSD}e;BT(Kx=(8GS{;aP8FN+W zGIiX&dv#MPYx!B!Uet8#e@?I38)BcRytp%RFifG1FLefB?1G6v7RC+Gz(b30fn4QPDrUnjEpeFMfwq1kO1cb z-`-eXnF5jl@J9sU=O4XpfUf!m#4SSWB>Nm>E$WPtp`PA?Qwu}%;#cd=7Ai7U6$3oo(1Or6|0W5%X z5JC#LL1Z5TELuRzh%2DwK6U7P?h2?CUJO8|)vzyyGNDiA@aw?9y7^m}gnqq}Go((l zdFT5(JH$SmNb>Vi@});L4PRj|1IB;}R`->YM?nX{5b8Nr&48=n@z^i0(i%q|b`8yt5F81x0(S z3sRv(Ly}*+Mc7#!SQOt6J}gZazJLFIqUW*n_KlcXZ|A-Q+6#*Lzt`oey)==faWjAC z+wbwU0L;yP@KXQ!U+t?*WT^6k3oNJy)82i8@^QL%Hp+Re$l@+u(DNQF^Cq)J40Sv* z@_?8U>N*z3INunpp29rZ+(PZb`SVM?Cvwo?frkp#Ecjg2U(1J`cU|^FKmD>{*cqer z2csr4ml5bNSm$qe=%KaHHxc#C1gCRRm60-<4Cel=xH$FqA&67E->&YoJ1L?CBVvTj|`up|GEHTRGJnUjen&6#^=FiOe*yY)SwWBvT6H z2yxG)KTKmbD{P_WD}4ypzV*Y$T^e4WX-QQ55G|Emwa*Ss;Ob@0a8wtoY~S=Me>47@ zRuTFGPRV^x^(4%15=;=rS|}~ie%ggqaYk({as2Y?4jv?SE+6SeF5ghZh&;*-I-&!25?W9CUTPna~drg*<{fOC#!tuP81{h^FhHv{Z&(2Yl->=jBa261kGh+WJE=+YJNihA`JlK^>|5@knDhPN}lD2;42|m(Flr4d5ntpx8el+LPN=E@!Eu#PqEW&V`Do?%5n{j!x`s!2mgcg^4i*)$ts|%`|-UIf$u#b-5^>Dr% zrjAGQ-2qt+Ye$Ost8pIF8&Cyc=JXQp3_$!|))1UQApCdk-W3oP)nTBH*PxMgpXLL7 z7yG~1w!8!CJ}9;Qpy~n0Crka(230xSTsxt(v#>v{v$&7I%9(Wr@PGmbAVgT#u*e!63 z$+u4Dk5^AM@yldHx5lmP2eY0EjJCZ6LW)fnuVO0)R=W7a)fg%QWsh!EL&|)%|NFK) zMsNnO6Ltw%5{{AtEJwcvLt+dtn+P0^*I(m?4jYiZ=_V0ltVI(5orRWMagdA11Q*GX zEOu)afuTkQa@aDNm`A#X(GGgeK+L069Y$vs4tg#fL^Vqm@zDU`#DaApi=GYFbNCUG zqFKqc7T8f>%NOh_Trx&rQeaiD$9#j_DSTL%{#oW24Me-gX1d9Qb1rO z{+>Wh5SJ9h6)6p2_@WEF+5L_aND4_zxBiYO%$9_yim-G0DNxet$8a z7*vweo1T7r>w^7j6L^-Qu?1G(g6SigIuOkSV1U9%h)CT>jc^rAFaVzLU}&NdjwM9jaAlq6 zB_&vVM+He*O$4$KErb>xzz>t2kr3r1JTn4;6sVh7b2nHm8vcSIKW>A;qd8;7xbXl zV&#dzNdU9R9!rQ?(j$@ACRseD2eQL{Ou2n3yu633*TB{s$QvF2zCn?{>CW8H!MIia zmaN`lyhY5WtRy0&TnU+Ar^r^7%s~LCv#P}eIi&Yy?uK-ZuVI{PU z;W!~d?*54-It)>4N$L7*f4bU>9nL%kH&It2k5bp%cxD4E@SB}=MM${U zG+GI=Q|@Q7SztoLNj9$G^@=Nwc{=8S*zCB8C_rZC7G^J4a3C6`H9hvQ;zWdn+BT3tFaY$4ZEycC?-+>1%kjn*Yv7I z%?UqHyYuItV$B;fT0|SXJzV?~CMM~&U7`XsN)hy3#oCZqL4-iTOZI}9D&Rw$0{9R} zweCqHW8)g+KR}0gRtURV2o@x-p%ehcp`@w=V>)_7X&xZ&xXpyJ20Ra#7>Z9|MYD1t zA67-D4^of@0xR6+Ieci-NjAl)#@CIijBw!4wT<|}do(b3H_ZWL{JhB{fKs<%pBR+T z*=uryQ8(85ta!3w6D|az41${87dTfFYeO_+;4cIo>nLzJhfnxe%8>(RwD4;u6n_xA z+?MA$(T4^khK$3Z2M37Y;lNi=uLAluT&r)5!kj9Z15BgL2=it-|66!IIG?DVjM!I- zT*oTFk$-&Xswfs7u|skRy$_+r5aKafH89l!sqH|F^FY?e>=F1h01&IuOOa_f$)sReC?&Os!<;eGFyo~z`bB(A z#C{Q%Q1zA+PTfP%(*$h02W|@-Ht}`N033(=q`IzdwS_pqw}PSYqX46Jpz5fwmLLKQ z*qaPu56c?$oRODuz51&j)nSvn1dt@# zYk*Hs)rI{xUM3F&$&O?Lz}<#B4k39x=&-Hf;5}RXCot+*l)xyKusbVWVebRn?LfN* zxaplf4Sv}LZpylv6@T(k;v5uc@B3XJ+d46w}oj5LZ<24=*a z;9xw7-D@vEVI`bzm&@s-7Eq6Lm6g|F$Ou-h?FW91zu8CqXHN7x7vMV+;rWa6AD()W z<}h+8AWNrR-V?FMNG~>ebjG(eohude>FG_1jFhN&tv}ZBAQk@i%T|xK7C-dgFVC=4 z*2AP2!LJAALME@@Jt5Z`zv{%c8Ss+VNOWG~teIebZKy1;u4(5SGoDpqV(Z!%9h}AF zG;(8XGPv;Y?pzo?|o5vQ?Qlr7{I;=M6a8|Zr`|L;%g&j?fjYMKm48Ji%- zu=9uPh&b2xSu3+$@#)E+_V~luw`*ub!XApPelU5(O0W1-Z>IfP&_kLMYVNo3ZKf~o z{i?Szp=B*?tdwibyx=4oL+wkETRQB{6Jp+R(Xm9=mnrGj_`U2OR;_3LzRXs-nd9!o z`-(->Iaocyk4Cx8oywwBs;fFvHG7z?DI;wTr;t!O@=S-o??F!6&7)6e-A zKQrSjSeoA&?Bsn@T=F>aJC`Hp9;;r8GF>-Q`gnSR(n)JT(~V*Y_|Q7);e2B z@pBnLNsNd2wA<<)M}E=>>BybQjN@M~_s3_gl22@!n!wfk!7ZDZE?z#a&&b2){W;#! z`Rb;gt-+MfHuZ(6oo<^e$;%J>A+&D!cnBAze}>OeQuD3)odS&sqj|D>(&%=UhQ5t& zw>V&D{HjU&)yew)D+047n-3jbSM2gu`K_3GNQcvPF}4;4lO@Z!p3Ld5@%H5C03GtB zM*_wm3-J`AVxl?oHP)s{I($nn+vdm}&dokPTKm@T zUb|Gb|MLBUibo-=r9xZ8JvH`U70b4|u0au#r*X7!<>|e=13RfcpS|*s8bZEujW>PG zG72xGEgekN;rw@lHX=wNu|VPpZoX(MEo|Dee`_d>TeP9fax-sBO|Xx;_&07A0s5`o zolWn3=a(~Oe|^2%d%&kuz*{?`{h0oary(cn&9iN9^=7WqNNf@Drhl`}XW*x{7TXX7 zWrY|+_}gvtul71D{Jg3DMKDSci$nZA;qe6rliL-=h254nZK2Ec)48zOcK=$+H|w?< z4XZT2&#XGr7S^p+{gLtVlhjQNRxMM1nJ>yz?MR#77;ndEu71fucaO$_oquUWs44GV zbk%DSYT;Hp`mL+J2N=tNbhTs1&Z<Z?g*ITKLn9+ZQVHcOSQT~|3x0~q zB}_V<{$Z4}S`s%yQ>WE`h-{vmP0?Zc>8v-pA*s`@dF|*E%iiAcfnkx&=M@GVwwAu? z->~sY%*@QFZcK4ewW@&?OAK|Qh>1)!+b0+KX1>fDpBb~L?Mt=_j#tQ*RMqZ@W;vs(y_CSFsY{BOEduU?Rru8A(gB$mI{0``57(o! zKHL4qiNJ0k-xDkybq9VIU5ic%RGiDFu)Xl;1~LJ$F)C+$Y`=E zotNHb;g-CkNaLun$F58b)kD}dO=7t8DBR`1$h*G+pF*!xUdjO6C{UA^-p^~7gpZR2UZ>om(-Xyk&{>_4j z6E}2zP_P0;tFo2ET-Jm`P`DY}^-1wJ58DZdHXOKRSea@i|I1jfK9p9W(>1uicO@*o zlm7S7?l-R<-oD;VtF^yXp}pp<);8PynKDBIy#{mV#Wq|rFxs>$OgrapZ?n-zS3KoU zt65pecXZb_KYuS?*_U~y_X=|^_2+`pqm-TVuY9OSE;voq#i~)KM2|hR?QgN9YqmRR zzU|D9aQlZl=jbh8OusuT*xo4qO>#+~@4dm!2H#3^yY?d={K>MbNRr^m7Xi#ZZXG$8OBnL1HH z0%4GBQUm2DtPhkKgaClrumBPd=>sO=o9lBIX<-e8^V1h2rbP`+KP^4Uf_LlNJ$I&!rqRPVICW~V_z8SlU^Vz-~3 zW+UqpOP(x~zbR2duun2ic5^DKqz`2YJ^SuVb8~-W^LI(gbv|lFkMa(P^laPw(VeO` zOy<{5w%Q4QnLo?)hY*>U%7e-zd4pN+cKYsEHQT@8z)nZAHb1uvI`hfFwJ{Vtv#f#k zN?I%NcaOGe6-%aXW{}yulKuIJ>af3J`+oz8S6u9L>%=dA*C#X?4$nW9$y$#qh_nHQ zF>pcW2DAv&Vk~Jc^MAPj`#hK2$TlgOXwdViqbNl)G=dHZrT$h|iIV)WdowbSpnTn1 z!S&rA-T0@&H$O?+toJkQ+XH((`cPx9x+77__YB+aoAB>5(S2f2eV5nFUe+@Fr%7o1 zn*&;Gxex!S$86P4=&UHO<3a|b(@?Yju6+K`=;(V6L)pXS-ho_l;lUOkU;cf=9IdBZ zWGm-if9u<;(6)}6u|O_d^hci>G<^>%&#Nd$Y)QO%laEGfQ~xm)B@wqJpV7QRT*r42 zyj>pdyi@{r1b)UQ56fQ@k^IBYVchk0bC0kV8_VZc14p;zDr9cFwOfJCp5tE)_h3`# z?eaqt#SyEEWvf;gVG=9~OMl=Dh4S42)SS>cj*-goFUk>2;{3;h4ski9i>l~k#u{Cb za?U%Ta^^oSr%*j>84@a9wfTgh!EbwWp}Z^h@Kr->np@WhIBUUnWmrz)gv_--6i^mGpV)f)i^7zv=GSPR;IQxr6Gy>bplT zd?~p1P;xJpx)!!|^<-RZUs%@bk=o-!Pg%R@9xJ;g|6+UEiOcS>#qLeg6ORw@)wx@p z*?u$%6wVay;*?66Tghh(qO053f`Zd>{tQkWs=3Z8+wiQKPul*)iAFvq*^qIE^G9=B zld2Q5L?7f0w#RT(9e+e!;(Eqs!(}?pc$;RO;;-8)6*ABDTszbkcXILKyehU-4?WGu z2+GSl00pFCqvqdgw3S?8>MuaCA-aRWc;17bJ9#4xWMF5IbzDB`9T_ORxWL+eNNVzL zN?UQqh|||#&B9GatEj>Z>%1BLWr!hLNt^Tnu_oryx<_yHF$BwrYvrv0iUF59#&)jj}l;OP3)o zomrQ7i1USq|51l8Dc}4jC^(bpLYnn23@otL->mAA-OUro@cO_{>9|M}xhu&xG>?^b zetb`}`N7DVQSOaS;>O7ur^XL7-ry1=lDh00d+oVC2{Hu@xN~5vl~hu)GiyI~!U*JY zCg)9G-9W&zPqDuXrl&;jKEL|s`^W9c?T4Jio1gadxGZhGo9OuCRli+#?^{uO|J(80 z#R3y{-4rXs33T$}H6sou_6Xg-a;`zra&u*Bdl99va_^?eC2_Z)u8m1ok0(s{A5L9+ zeqCbYuSAj0gTJH$vyU+R?wYGiFmL;`DE)VPH$}db_(#Q7!#^?~1We9;N?FcsS>N5F z5^&3=N%7bSahG;eUhv?k6lalj6UTH-@t}vP&~`dE&zz@YoKkNVyQ5y%x=b7!i~Vaq z^DL-D_2J^(jGhbIk6t&o5_&WKgq25N`%;O&4x?rHImfuE?ouw{B3;hkrWbxN{(j!O zq&71n89H|QP2xxIIIF%8y7?vCF*%>BKi ztvKFv*PR-EM1NDuiFuGKG#FoSz|{|j_EzjlN>*Z*_2c``BArhA<+B9hko%7NfBo5& z@6-P0ka)7*J2W6!O9{CfkMKxZe z$+Gc#xB&exk3{dj;`_tQ_09)3zB;~r`Q{1#BLzz}e2fg2kL|m)QHW~NzUav1kMS~R z)kpM-9sao^>oHNT`F#E%1`qp)FbNnSz(ihLVC$QAV)qANkG%qR$fnj~$;W7V!9zNl z#?rz@NL_~d(ZHI{&GS@uKLwuO`*zFQob4^WP02o~R=$hxA6uS^&8WQ|mHO<_%om{`l56X}H*Tg+lGY!Jk3YnDsXb0+SK*q6 z&;E31JfKY#cel%^FW#(bYM#4qJmLjo(|MsY>&$Zt|8zg)tIxYG{7HXkp80oDQT#&w z`YYak8k-qP_mzZaFBe3ci!@DtwhGr*q2)LgGg@9Y(h_^twWPsjTf{*DkNLEV9eI)B zv{j#zte!~oXkHiX_hL#(3t{`vH{`?of4VyBu&AQ0?Gu8CNJt}PA>ATK35ZAvDBTSb z5)#Ug(kX(pgeW1>(l|6oj&yg6v=S12>-c=nb-nNFR@idQ+mfxGod8u7H(9BE0luo*`IH%ShI3@E-O>xILzx@%l#kOLy)LSYeF(G;7 zZaA*h3vVwniquj1rTNecH7?lo+G#h}p9(!c`bB{QN68Ri+OAy^xqRW(Go}2DCcf<( zkw<9bfWL0!FfT}dR1XCK1i~psSfBwH$Poh25zs;vp+uAZXD|nm;nD~@G8e9Ix)x+M zNxF0QIAX%+Z{3m04Pzhv$-Xlp6g@$0waRHtFIVzXizdTdzb7gJ^OnSY=P(&3hbWws zk22lsL+oz`3B3Urz=Iu=zhx~WLi^(PjylPwK5uMmA!2j5-g#_zTc?Mov$9NZG! zQAmz7xQX6La9A$n;I%1k{?L4F@TM}pRx-W8)@x^?O}&_f1-X`vnq-XRct=KDM~H6t zme`PT?*PjBd4yyU2Ts_nVT!}f^cor+TRw-^&40Mlha)f}E6)XdV!I+@`0zCnQKuLK zv6@f5ObvfMul5|ItB{Hs<+s+O_JiY6A*wDs=MGiq zZ_7=)>qIz`2iCV*FL%?BWpPm#3#{yYJrbX+zR|@ONlcC}irPvNtk+4qxyibzo4h2M z{=>w$-&jjxcHv-iep+j{n}&R$x`%rvJ^ewM&$8NyOX8Z9;o)wzcybzzD)>{;^iKBfpJ!Xf*@%14I=5nU)#+om&IpMe)H}o{o_6zf+~BppxEU1`d%nPLG!R=InAY{TJ$$2 z?w{?&*g}R^jem1T%V|*x@AC$K3Tb5PQIojK*O+?-_4u-I2HNxix%<^i)q=N(BY9oS zQ$4A3bf(ni(b2=shbF`;5&JLJ(hMe#ougpQsmm8}(hkTh7xK<{@v9sM^USIG^z+l~ zh!Fo_I|cXcfk4_elH4}FMxnU`9*ebf-ouV0jSutqO!SmX<@=ZaR$jvlJyzF8J;8~) zwq@&}muT|TETA*Dajl0B&0pXjxE`L0M!z%rVJ{)X*YRopvdaji)2ZV_!)qZv-uP#J zS^*cX1_=MME>Kg5QTQ10AnX1$G9cDM-viR`t<4!^p|iyNz4Y@}h4yn&iJ>*~qZG5u2hOm$z;3trkWm1mZC9O-dLxX@m(+A*7=59z>Q^j!IK&-#B9O)q5s;q_xFl)_3=?n?ET9X(lc5OZ4S7E>0`WRh!KtQ&iot z+fI+9TZsVEcLSo_N3=u*C9KOh+a{Cug7vq=q?!rR?ajdS>p^fX-Wuv&wM@cC~AddwNp-SZ*NIP?f5yxXxA8yMlxJ3 z1#B98V|E28?Y56R!rciCm#`FLIQ-USWCiu_y*XfBz@w=MOb<+ZpM5ubG^X#1MKfhj z1zBO+RMHT=NUl5Cxw#SvzwA4>d9Xf%V@`e`b`1sCF=Tx{)m9N;h`lgvSe5`lK z%0D;q?unGeAhRCPw<>IH!u)frvfV6ok|sd{-@hmClpKuaH!vCW+=E%CB zS(abZgS?$+CRloohAys2h@!A)?Hk@`JP!HGFzgpR%$968P3S&7IkhddM?2|t`X7X` zWV|)529T0k;wld;0_92!A}{L#KB5KJzg2}uXLc`OT{>OxE?pZsCs}#Qg&NhzHFMdp437DlHgiV@ zYf)Ku;hh|W>%{pdT{lhTz0uUa!Tq;Zu&YqIf#ItQDTaXowjKEnUAA=3tA4oa-GzNk z!=9i(O4ej4vob8E!vgstWjEUn9u+L^lW4l=n*}^e({4;W6MCi2k`o!S8yiS#IQ^rf zv}b|3t5k``oV=29#*3u~z8w9~~ zcj7l$h)dTt8N3}Zcw!Zw8p0>^dub^bqVq4F%m*??(Jb;7+*Huxp54Y4%I-f|Jt7kA zmv~gzxwle|$4#GrOx=SgR@(o6x zsm+~wMVC~eYYLCw%Gc1ut#dwQ-dc0!UB~;wkeAOoEe7=svjxzbo!HyWoYC*p#YekONnUzVflb$inG&9EB@eEJu{G^U52dM}_XR`ZmsO zA*|V%tnq?o_+y;Y%ex&z8;2G1dbc#cPhyr^3%D;0QE^O&bAy+U2*pgAp_KCAY`|4D z%XHO7lC-Yv2}%({>=Q@Jn=*fN>V`M@veT6Z2?cZwv2uu`ofl37%hFbtYhu+=Cm}Rf zY83Saa#Aj~w~FMkN%szMj{bZTMyF&K@wzvl@yAbcbqa;;>R?e-?o_w?5#dov+gSto zN3cv+ZBH94diC5SC)aoMh%l)3?K`!5y6`~c_)d1cvc@1Y+3l+BkaLoTub1;5J>Q8H z_*DJk!Oc73Da&K7vicvZUpj{g$hB6vsKtv?SsX3((|05`x@T+gf2!}fl=EbFBd1>< zHN)+!>$28zj){S33n=r-A76S_Iath}bHMv?@< zyl?%h?6+t0U!3jbIc)whzQlFPr66%%i8pS3gv0ryex?6pIjfvVCCQqhcYV*_F|m^8 zH76cj7eTP>*XfA(%>8MWUR4uG1#b@rqYX5*5cSbnnT-7El z2?tG>3flb{{-)zbI&Rr`7!e)erSXvzwTS6ud6APFscV_eOL6Mn4`EC#thb zr=0s<@g(YK#WIP-zFRm+oq)zH3~K1-AtZpd_bzo z9YkM7DZ)UUH*QJuYq8Fe+oYTLmBh2?7w+RDp56Rb{?WkQy7WxuVXbYQ`s(WEQpKL0wHbGWZ%6VLe>ixz zhIY@xGTU;m-ts!`<@t;6wH5r;Cmj7Vw`8U4*M9Xg^zyo!k!jEY0~;$>0O@?j03C6h z``|C``=c_w7lmII_iQkI&X%xvraln7YK-uly=nmacgX-o}#zne;()6AG*_B%+vlOoH#-^VH zz*a?MB~=DwIn+idz7p+-F7Db0Xg5SQmmsj|M1%{_b9X?9Z;$I{juY>|v+egX82dt2 z9al2T~cwhhwwk4P$aN}|0Y5MD7b@Ia%`1ifpB zMghW%6)0_dfFd}+>l4)T0!)6Mt>3U@)2v9S`V;CP^gKR9mdH-#_on3MRko+-b0vc>F^JU?6iJ@)dQM9T4`?acA- z(du#)-gdVY{DIP!I`enYm+$Ad_NnZb6@JJX?6d z2$Xdb=uw5P#Sdaes^s{DLwvY*zW-d^*}+wI?PmU7{8B4akJ@sT>5lcM677+-y#eYn z8rBCxx^u+^nFKh>R=u}OIi8y0XX6a0eh9~&!ei=s^5g-L;N0f*nCXlbK}tw#!p2bL zX&C9bP;2o6ucw2c_IiEED&>sN)4)muib=G^N5E`&vkz>b;s= zCtT%8b>aAH-{GmtCVcfy9qZ@~%hSNqz5wjv6LilY8_rSf7tVffG}$27a4+UJ zPR*`Fd}eM4oiK}bkf~NLkEHG205HH~Y#Z?%IOd!fkdVp<6~*tEmT+IfeHkVZq(0bo z>6+#t>S+3)n8T=vj}jvMHB*nj0cNUX8t43eYMmJVb14fcH7)sucwccI#l|Y- zmQ|a0ldPc{?0L*b2bcDCRiX`O(~UTLRkv~JIJh=-(#*_#!nG=2*zw@&d)!auh*m5W zUvTM3br|r| z42Y`sdBm$6eDgD_(_4K~wWSO?7iYXjLW?qMX^IPO&4y)>*Nv;0jbTae`>r=-wAvZlg*q2~D6 zIXk*ASB9I!OvXDC;eVWZb6NlX)(`rT+Yzl&l$|$hx-UXj2+Dtp(X zor|E(Wv*5Op;=4IZQuiiwR!^pM8|P^p?e)v*V4^Z$p`d`6&zee_2*o zmj{Q2oB-QotV0DD<3#{7P-LW>&MJb zQ;Ikwr!W7ARX@b*A;X=0m1RmX>H9wCXewXi!9iJ~>Wb>GX4z}eMQn~sC2aF#uR>jk z;UC4NLl%1DR=SS^E*VH%n7BU23U8)K6dW5}Dl_+t3CLQd7C5v`X|EwpZ)1;*_nv$G zvqmL-h=K7j9mCx{iK5Nz(X<^ASC1R|;`Tw+62oZO!XA%^pMa_affNI#wM@4YBfZ-Dmmtq6Q-~2 zrzz*Nn}jmN*Y{RjWhFe7-Yn~0sifG>>rRDU}wewg@~W6HR^P))8~TAz7_erf4Z~N77#GYY9#7z+Ur30f&aY6oX!e z(D@^}g4=LSUWd_i(=%o++GLYNo3get@R-wRnmIuRe%Srb=SdAy^8#5#pA_2Wth&h` zJI8Nd^fJ!KO@{(_#3?vd%BFwIYNfuoUZhyo;C5s(Z zuzj*UW^0OnNLPO#@|Bq=mFQ!WnI8+~1)uXqGA%z0#y&URn4D`JSsI~57h&NP0IGr1 zx2U-~T3)Vi;i&|_L}QOYej;Q6JKQ%HlP<}|`HxrmEwJhvnO%W(kixW<|0Wg|^#%F+ zQct`Zp0v=*YH`DT68MxJ*(d6*Y73#w6DaRIRV8e4HzXI>-p}Q7NHM8b!c~uI`rT|* z+|=HlaJVHdi}Np{q4BjY5ZU-LVEyzdT{_K;*d|yk9BE_PAB<4$!el?mR?mB$^Qx(I%ZiXeSAH`ELse1> zs8N6*QDP_b(e^<4SsX~yN+7`O6<#0$4j1TLJ-5Z8|NbfZi-2_z6cb9KUh4`}_>v2y zNi8D>H!*1>9U)Sanv-Yx_|2*jdF8pGS58nSL5bvrOiO+ZhEcK)aonHd zD?IeNh5!ADi7AcaZZScSEj+8T++4ibIWB1-nPKDz;Ixe@rAH zK<&BBQg67(SK4L?IRf+toxUIZUpfQcEEf~Te$HRxKKDfK5*>%Kq0Pl$-F!0^k7Sb} zD#gm$)Z6?)HXK2kI-E19%Q9SQmz`q&qWF8>De`lkRr=}kv31;8agFW5W9@1Xx~-+0 zH_NjghFb1Z;ikE=63E3ZueY;irv7!|m~_L^rVN9O)g9H}3EwbMAAHdVj9Tf=6R-j&z0^WO|fptPSpx16kO ztM}f~{?f6;^#>6dnVEjznDTFL1@&EE(?=HreLFch84EFK-N}w6-@dbl z!)V``=4Y45=YnZHFN#j^Nur0LaJMkzja(vSI|gphzw$5A8PS;k9K+}4cC1AIb2|`( zYcg{*VH@HSYtjvC*UeBrw}s`~XLDbsm|kGi(U?_i&(2j$*2X{Ct|kid_epx4;r@$q z;t7$0ZbV+02%1fLkRO(`#7P>H{#k+w!ZLeEI1U8M(oD^;JY`G%#HqqSWpQ8fB7?O$ z*{jSUDyzyCnnd0_N1_M6%7o4C$9>9`>Q;}qVl9x_yZr5C@Kp^eJyAtgTorn{kJZDb zPtDGajQmtOPxLTZ-$fb^SDgh-68V-2G9Dl70t=xyG_0+E`=+c{U}zqN-bC`MbjSElRDBZsj`t?5xAEv&l>JN?)kQt0-QTNaQi*&lu0)zhs!v z|4xP(Ln?mZqOUo>{M~n!Q#G!ib<01ca{bifOYK_Pzld{{9_Nd4hzS0RJKZ>&N7WPo zE~9Y;-_uwYp3YY^J*Tj4HQ=$Vg6)b6&l<+$)SlI5x3&0PKo+m(`te+_3(ocIrl_RJ z?F4Sa$z|sWouR=tqG7jqq^4N?QXwpW(1NwJ6-$z!GFMTy z$*=o4U&HEDkIZ=!pK|=JfGRW9-PA|F+O5FcZwF zT#s5X)|pd!kKW}!pG8*gB&*`tVnPE_y5%X<(8mY zcAw$PJ6RBuum1S)J})m6cDc|_MI(VaY zQO~OkqxfR(t5`C`u7_6qr6A&Dn#FX=3hJn(Fpk1mE6HP8Xk9`wX)U#!F%J@jgOBX0<^jtcp&hkLYsy& zSiLzyScCMbfz*sjMe_8y&OI?_F{g(G5Z9822G%lKPjNluc3!8p_w|V*h=> z`msT6wx*+!kpTKU=a6(E;*5znhyt<%RG`nXfCok3@2kWjQ=)AS_I!x033LkdUxNSr zF3(tX!Y(L(qoUObm4=Q*zYaY>P6d8d8~DiLHUvwam>?cyaq5UV8HE1`nVmmrF=gh2 z1;AGGHS2|D0E#}pA@x75)AF(tbo@Bw+&iel3?kA zhTik}Gyih6^Y$;hXr-EY4*^LYVLx#)dtNdlCnp&C2f3>kFC&gfVBN+_L6{2oHfWf} zpQs?QtcS6RjQ3v^gbH$5YGRn?J+U;OvlnUJe{8s`W^oYHSD;%dawlAWrve_HB$__| z`Gge2Zk1O`?Nf@tf>Z4D*8pM*2lpuUvwrm(cuJfQOYZOA9beb5!vzUBxYF(v(rUVd zsn#dP>`gm+D&)z$-K5y?r9Vg1{fE;C7!iMOW#*ZT%J+D^MDH=HS2+e?Tzw z{x#N*tZx&rVqdk*_wKTO!xG134>h}m;As6?d=(+vpnDVI$eGPOH( zV(PYBy|%zM7!-*;;HB6D?jFjVR9UL58PmpU+Y^j*RLCtp^lVvhLTq*bwS=_L2>-~< zg5$+0+`KC)+SND>P))FZpzgDd18z{P!pDa>1JES(z8o=hx>wa9%l>vABHIO+so0Ai zA;_!>`#l6T(_AdB9mn=dgtbU_%F&Mwsb%s0+w|fVaYJqlHFC zh|Pd&cR9Kp?2;}{O-+F=vVU??DN~i1Dje}0LAU|xVE}v>7#zGWk!}S-Z7f6p@r1n< z5O_@j7_nyPCqgJifS&hmHgOBD)D(a4Z<^n-q`{XW-GJLzzUM_AX zMxN~xc&-+Kas2^}P6H;&HdtsOTe(sY7$AcsPW`#N`(8{mDgX#aDZm^{L5zf3@iy=nE4!PH-w@@mT7=EDfVR;IoJoV6#`~z z^p$6IF&<(npf+S+V1SQm)&J3e);Pon+4|YD99X}A^?|shSYpz8s+<Ui@$pm$gcE#LkRB|A!UIlFFi?@X31o}P%F55KkwV=C2HAN&qF055++rAx zEurB%>B_c|3&Mz*sTeqPqkuVLG5*B{dD?kUa~BaVIKXpaRdSFe4eWBb5I4d*Q_sl} zHcOY$8UMz{2C{u3@!o!gSVAEmxZ+Ud2baGT76`;)1)1s)EH|76qMKV=UCpSiO#zkP zHgJ-6z@{yQ1T~9`3?q=}mci-^xNZ4N)rJatpiF*4M1ycP2n`X+0&FD8TOt&;G;N0I z4DEA&){ErWS`o`>#FQ5C!EmkxItfdX5%3&wvN{!P9oW;Oy%{fe8PP? z4g0&FeW~R5fM~_`v)CulZ;^BQTt`-OHc}2(wq51 zB}FgjdqG`EIRgIeTpcRn)3p(Ye&tUU;v_yFmNxI81S0=&jp@Vp|f z9bLmnP?5Q;HFNCp6Af93{3WjM-x_P6h0Ukhvj1fT?1aClG=w_sqWK(GS~gXi0h zwTabcC;DqK-%{AGUjI)RyhEbFN`X8t=||mGh`IO+@Xv;4UWug{iE>ng=gt9wrX3uQ zy8#P}0VIMF5#AU^X*@H!r>6s<0pE z>uUt~x-2Kv^@J`bfY9~>JO&8M)ew>$Hc_MR@h5Q>c@OKF=}>|6eBRdRm<~=2Y5I>w zEnYt-br1A~$O%C7n3fwzhD~UZ?^*o9Medi06Gv1;IiL7w_a^!;}aL;o0{fZ-1 za2wW>Y_REuImV?=mf8uHkl3!Jv*l-**22n|nguPCkL8BwaXxf`k*<19La5mGW|O=V7@=bjA;FU};0Nc;$`*rxjSi3B$`ps3ne6*I^yV@W*tR(*T4P z@qB<_8!T)Q-b|F(?n8(pK|q%YOASim(T&R{P;7_k6#pXytPyMp@5TT>AM@~o{yx4j zJQc`F4Dbnl^KY+ldz+sS+TkTgQpO@e0q9I&fOE{wW`Sx^SG#jHec`%kGD|z7r=7^U z7AF-O1)*>h+-sK?B^~JW{7;{Rj}~JO*gM4l(DHSh#NQXB{Xolw#4B6?Xsn$w9lEwe%^787v1w_HrX@7cLeI&w{B6mZ6$yE? z<6Gr#y}SSD5lPz0+j`?tgaW%edH(!lRl?n6@qS2 zD0jnh0oljrBKc#~8F*5@7CNauXGajv?H--Xl+Pa+zyAMQScVVfEU_I}MMk~LztNsK z|7jS2ZEqajH@9YF0TQ;3BQ(1h$}^opG574;SHFy_FOcoHH2saJ%wnSA8)%P5KRB4O zu(~3W#j39LoVbc_v#_hy8$4kCEAj8{MStnH#zQmB*2qr>vOSwuR&Ur(ZTx$FW!C)) U4WF+97W|QyRk>d%ZS4R504i1^d;kCd literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-security-center/images/security-center-custom-notif.png b/windows/threat-protection/windows-defender-security-center/images/security-center-custom-notif.png new file mode 100644 index 0000000000000000000000000000000000000000..363648cbc0ccec362158539ef8918591739a9a78 GIT binary patch literal 30783 zcmcG$c{G>r`ah~kqEJLiBtuf>5}8WoLWWF<%tK}p5*0$ooFQE?vwoy|Jq|Ouj52QLiv^W&$g&jlt=Kx-OdV1GQ0c9s16Do9E|(3|35#H z(RRLg+u6d-kt8*x>^sn>ragTG~5X+S!uO>|tTW&&i3OU$V1zbF?(Ka3)Eo zsymOLQvT3P0zC;KyXdkF^XPZ7prhNj@JL@x#w{|M&0Tb~H96S=jO(|KDG`WM^YzYU@n0 zSogFHKO-f6O~caJ+LYw&zvdGpB*#b;q%Uf?zM6=+<9zMf;<98`S#)%?@?mx#N>!`3 z#}6ebTzmKWq5mMCcd$ciQo`K9T5V6`a#e=AmoCz(YFv0AANJH|r@Zg{1$Qa^-?ihD zOS{Ko-QEb3|M^_Ekv<&$>F$)sXzbm8rE3$pOA?R${ryP{!@|Of ze8PP5f`WqT*n|Gxe?-~i(8aY4;TYw0Pf6RtBZXZXw>0qWtaAnpGW(k!Tp%gy4QU^* z9CIF+Tai~%sx%R3$}*5Vf9GFNn^onc%i!D!+0LPRq$bM!OKVhPEIb?b+|MRb0=eai0B4C(opC#mWwIfh?IH8b@T{3wrJO>6tmW9txHx5d*u*KTp9 zOmW4tjM-P}fnw6?weQhkE8JHNYAW@!qBCz4hlhttZEbE8%~TyxP*gn5#r!E(HQ0XF6#A^N6+)w{5q4Y z^iozyX`j}O+Xt1Dltvc@KIrj0+IK`2H_<>nyPJ}+?@v<#XVmP+KS__<$Jx2K9e5t0$G$0!hH9p}6Z}sYMINf9(mvD`sK)(xNEj5a zMkyw_y6t#C!W6O_OC$B>^VHIg*J`O(Q#D-0m>e3K?aFs<-}Xu0u6XrfZPZ`#o!gf^ zBvd6D|9PY`jTQDeo;|#e+*j&Vf(F;j+Q#I+L1*GuKR)c@S@6?Pu|Hbgo~pssWY;{? zvZnUtD%qTGp7I+FuF4`c5v%;eeqYLIRKzYiI_6L}nqN23`qpDVEN6y znQCV9?hg)Eo(uRIS3gnJ(fJm0=XZc+T2g-gwY>3^Sjqccld^BF`ez@|YhS5b#c}c3 zdKOAacW5-w z!M#)TWw-KmvAQ@wxH~Z>D)$m5EJmAEQbtB_O^y6s(j5|URDqSplPA>--nLmCXJy4^ z$}1?qLGbw;5*YYpbgt>wug6`J9AaXO-sShzQojz)`1jsEA7c?$Z}w%_5jP$1Fe9aul$3puUdQC3%R@G5vOdQmG71VBGZNfYv zFY8rtbrpVa;X-#x!>IAnzn+QTB}bCf6iiImSXfxhgZATUI<2b)XQ&Sz^i@uwVUkue z_*z{Z@$4Dd1#Rs^O-)VO8JeXlBS&WX)w!auW9QxP6_45#c3Ilk9Mtu|nVnwoK(&y% zbV-Ie?suVpK-n&O6DqQu+ecr;Dn9&vlW%=!Ca^r)xO%zYk6B(t<%GC+OnCT#=H}*_ zA3x0MU!1l6l^2kcBTyB@a0y@7AhC8@L_~y^mezj$kE&*du1tI84SW|nKY!T#yt9zq z@48?4x4wP*#=^@RG8*R<+ms-eivsfa@nd28K9W1V_s%he$dS=t0hLn*w>HYQ8 zCakMMm_sU!Sa254-uh`j-FMM_aU!6}!enE0VWOuvy4}Dl2G<_zF{_|^{d(6zaJ`xF z=lk0{rptHZ4npJNRBUZ|RK#X>l6r3|?)lN2botwlA0ts(`u)XIrL3Z&FHy&ui=50Q zR{yX*IVvja=_zqaE7PR<$x-XypPn;`yZ1StUl}*pQq!(|VRj^>)xA6}gw^R6^9 z#J^0;&FB86WzDY7HK=Q7NbBn}ozhJIe3OrwY^UqUbMv?9=_V5$*>$f(A|5{6PEJlP z?6J(Zn~G^@y8p|km64ayva+*ly<4%kb4n&Ld3?LUy@i7bvcbox$)=m+n2E~1{Q*gu zR@TVcRM`m$iCEsU_3+tQMca5{PNtQ=m+AVLcP3aUl zvUhfN($dk*emfD@SbWFMTBu8gAy+^^GMb_}@%H(ncNZu6S4QI`2cO|=j5+7rTXPX( zYGA0oe*L<``55|2+tYi#-JH}*Ydf%ifB7?hF(Cc)8#%K{OHAt!&riviO$^TVr~LQgsf5X?Z50hN6o~fjK%lfO*JxE z*vo;9Kqa|Oo!ePg_gv5oTYAR5L~Q0OjgOxn&HnulaDX_1-@fHUZK%u>6%%{)^{aGd z*`_;D!59Da1Zt)oyoXLQ)>|gY?77T>t4ud2i^UG&Pn5uyaQMCFut@DEe>+tY!5Ti)= zN%iDuudOAoZjZToqD~z@{!H`^Pn_4LNLJ}8S0Fv_NM`ZB0j$7imt7h9_kLWse%1*= z!H9PKyZf+yC>WQYp1zo&nd>sCTW2QNlA>bXRbVqTJWOl|+mZ!M&2;VZ`g6T?f7{Yl zTH-dPQ3jT0Yk511oKBGYJ|q_4_;J()X=&-{fk0jX+>FcA@A@AxqQsr!<4y<(J=MuI zYiew~|IOt1$&&$9RkFX`$GM3jpsRbh@VEP^UAuNwaw<^Yimh>*o32D0bn;H;?>? zseNR+zgAZ6KXRnDBiookz=RCD0k!_uuV32PM!Sd|37jAXNQT<*l-JP>oe7EGnMoY)Yb2e zeP|gQ`gz?hNh?b~{YLRqUkdtx8P{c;><&EE!fr>3IFH$YMoK{efe(`fU8q+k*nZ#<3BS7a~mWsrD`}fh%fnn zJU~P9oX>Fk$&)A9I5=kUw4DZn&mF*8evdlUS#tMW$=xNo!A7%Oevf7Qk-F!X6cqMg z7rpuL;hDcbS?Tfs1xh~7F)0e%&d*l)vvq8e_2H)udnyliOLFJkU5 zAVB{Tb>apOJje`*#z1}NdOaf0Nr>xt-+QoY7ae)!ZuT{O2=3rj(J< zabS^PS?{h%+Z0PWdU{k^e6xwE={DlAqV+boZd&EP7;8zHn{QEZn&{x)oZ8x?dRhNS zHlh3`-!uwxOa3h_T%>8+DdiU1yFxeWJldH7$zPbK=iYfH83$$E{i>P-Y@I?dx|+O!N}9MY4LWR^2y zgHczQ3%l-Jd_Wq0%ynfrn&FHEHL9ms-823(XV31Dv@Gl8J>&L`lqo%!lxF>9-bX6` zXoFcbG7i@_r>A;JbvD>Q~n=UPu3fDJN zg^uif6zBE}4mu9&C_d1fTeM>* z%|yw8ZjRJa<(Ts`?PZ$>Gc;?l$1hu2p2YeAO3aO=#0j9hzIgfaTYbIwsMPNwpSRBc zijFgSdr>SdlP!`L9isRRkmEyfpc$|d==F%*Czj+;COIx6}!F_8_WfbVcH3JMvRRGZaCr_K47(-Dnh&K?^J?U7HP3b@Uh zBwu+hrK-B0*vHE=gLu$yG}DUaeu(;Znm4|_`1R}8tJ>P~Iy%oe&v9`nMm~S`Y&p=! zM=>crK7RXs6s?3dD+gglHg@)=RP__@-n|ocn@#*M+IP25H-jXINnF?Ux!#?g+s@-Z z_r*2%bxoRmk31Q6wp4N9CV}G-t$V{60JNG0h{t~tf_C3uBW!eTww8GMR zYX``7qK${z)C)v2(oa03KYaN6Nc~HlQV)?d&5YH;^6g_|W8HVBN;)Q8Q0#Xp9ZmX} zC{uh>Qgh5VDi0vD8o%9{ZM@sk($WK^6O67IRPWJVh6?kzd$PcJd-m)xQoNg)(`WFj ztyAg+d+>4~Z)x8fKc?+{VRB4w^7DxY9&Ox-8(-T~d?zJ8KMG4mVN;xw6aMNI zBgd6zpEs6zRlv#=l$AL+I7pYHh2FJ{HCpA5(w+um1;mU-i+z8ye0zLCLTY+C8#g!6 z^YuMuWPn0H09SP_r08djetxh6EtB7INFE#U5||&WY|t?_HXp1@q#`>vH#bSQ`*;S5 zsen~0r}O!kXAbfk91CG=8Vx_a&_zX@M#zrb%hE3)Sd45!7|tYrg7*8H+Z-Gm_8#K9 z4@xp)c)LiiwY`1EG>(0)O_vb9i1j>rT08GS4II+{8S`Xd{CPmD-UY%;fo5a zJ1YQgF9TJ$m*{uE{=U?je zl0+RsJ??it&;R@iaG9S>Al*!dafn0D?RIDjBKS@f$&E8{o~tKOTLBpY0k#MnMRbyK z@7)9#QBY6-Wr30r6%|!MwQ5~)DXlF$F0SF>E(%uwQw1d@_OoXX0?pyB>&COncziNi zL&Do-QJ6vU2eZ63PT`?}Uj;*~c>*wYwIjCIbIrzm>0doc%5x!`!vs{cIHRVn?hRGM zD&KM7>z>1h5Bv1F2r~{8UO0Ba*qHT%@~h9|3&gp$x^-*DRV*MXdu8OD7I*nY=GQ2H&{cR68E#$u3ej4|2b7O%JkyJix1E}o&(o0 zh4>L%1qXmGu<~J(MdGJVj2W7z)>}%z!TDJzte*ECkdc=DDxvT26vXN&$BK1k>iKbuLE zx^N}+$2Y~U>x{nZ>bK`}pSQ>?S=1eAhzqG59vBRfOioP=n4Y#*jnho49GuC!o=zdu zE`K<_^+(@Z+0+{;g>!m;oIeWw4gbZ>eUr2|uy*)3JG-yf`XDp-T|`6#0m$);MGXxN zJyyq3DnzTs7sw@DElFAO4ZfdX>b6T+O43*wV_7QS>1VNfNp5<#I+x1o^3E-8nTMOL zb5ug6F~76SkI;E5O=l=(K>HqZ+^CCcegpyNiO31V8 zKi9SPj9oZ(Y*V!NR+87PGlxm{9=ZT->RGmBbnaR!Kpfx8de;(tTJlPUQ7neTldegL zagj3G+|D3KGNW@hB4-J(fL{`e4OEMTpj&ozY+ajKdm1mi*n-5u;3}gk+p8guiiigC!yEwrmDCkbV1}cXp5)X+=1gdOw zZ6&DnxAm2|)U>pO($dl%k+PjYC%PFUXq$$BZjn(@(6-#mhwEd-U!oAJ-ngM;W5aEg zzxwHWL|B+e#1^^IuQBHX^z_xhL*+j+uDcC|$=RQek-VJXaz4iSU-$E9efI!DuzCNU z58@h{7{GB0s*XWYJ+2$gox8BRVs^MzL0i4d0>0@dc=$`2SEzGc*H1CtU7|vZS|J0jUsD20)DiGhN^=fZ~5B4UIp4a%8rQIs5qd_%H5m zpPXBH56G5NbV+tZt1pMX8N{Qp@hTw7{f5zmckdqa-1x}nwdp~q=co}V$9`WfLfIpv z0tpGImlx4}&^7P?cihLi6I5|=vP;g%N$|^~eF>;aXz!3OuX05N9Xa;|;1oqrGc778 zXz%y$-+@xmslp;730&v!T>4J6E7+&Q$lNJ;Y1d90#$Yx52P<)D&RfXiSvk+$nO?E^g+u8q$1SaGcQ@61~tV92M$EgP~iEWj%-#EC`&vcVzXp6Ha6xR-`O)Z%Xc%IKretELh_$4`!uI) zEp)wj4*Zse<4PY$lqqoiz|x~fq?@zRWz&#KL1c;spNJA$UHS;gzp^b)eYfF*GlftX z|F)*4UoU)u158*AFeDlzx5S8(4ShOFQRctk#TdHjUPj?iug$r*#N_1dDReB?b#-|r zSiaZPyo#v(#c`BuC-i*);YS@E+F+xf!Q(|hf+4e;)`YS^ASXx%E`h+D5K6AR5)Mnt zDt+31x!=b(yER;sZI#4&=1Y#|1_PBLT=4zv!Q~g;&Sp}D+m<#r)9%KOo zGLLn8bkUo1rm$=yxV2S-jz`a5HlaT$THmPSy`i2%TNI%5w9Yu4UmvDw(7HUc1-uy7KgFw9LJA8 zBv28)MPg%K9rjFBj%n>zKN)PW0VkbX&Hu5Z%Hw4M(d7up^YkelK=&8m$14y9MDP4d zyd2E~*u5Jk1%h5>h~%cfViF-w&A4)Ma*`-pK1HEQN=;R8<&^*DI#?BaDM>Bcaad8v z=GRUFEJkoB89}q1A8)5B?ArGkVmBe};rJ1&V%d_spN`H&Q%mC8qhiQ60Q1{FYZ=_D ze5;ypi0|fwVyB~&yRoBg;&4Fdf0+{JdAPVo8Nx0o(`o%r&j2QyGp?T__Kf%vBM_!E z6vV5X*a+C0eRC@SPXqxY>h+0O*N33vkN*6z03C&7)ZbU`jo-TYAMM{1D<5=-{~qBx+TCia;Q|?O z)SF5IYIP&D2^0zR9+-E5l@c)3%5Rb=bF)2q^r*SDm2Dy&g8Y9SzlZJP!`N(~QPPaL zU6YVq3v(_SUR?648<=&GfkB%3aAlo zlA5|lIRAb}nij7En%O4lj8$s_ZU*9alS6hI!J5jF}(%Q18?%-@%sk`vhwge0YinT#3150 z)bLRbj9bwSl2yOBU^X3I?cmQ;^vuC3S;TYDg(z%|m;L-|kc_8qj zw}(G_Chy@P27}-jA+6b3!EZIxb@0x|eLy_xiEo)gi&VhyzBb^W&vQD;SVL(r+2Wkv(HcU8h9|aKqI>gkDf;&IwQ28(;9u& z8+A%mO|62^?I1{?KLFqnq(G|5p1f%m+f3A};ab#cil6!h|>k4gRZDK6(9FZEe3t zkG7|rnQf`3hu3*}NC}21+Bo4M!0hSFv!ub9WU~K$_Uft^t_w^}0L&2t)IUKkBJmiIBG}k{3+@4rAIGCbKrDWb0(9o^KGX;f zr;)mTxLR-G;~x^W`rSLO@3pm^?+tfAEe4q-PSY#p6TBt!2a=MKJ}v&bCDkR-C63dg zcPQFM+w~arF&36>ft3}&hswA;sGR^5jklu*cU_F$EOpCwX{akChst z=yzBPVNb&IzX_#gqPL7Wuu=*N5kw)v_=6wUbO%zfb;tV$S!J7t)7lgP!LaSl2nng_ z>D9rr?7$OUSXeMGA$(RLI(W# zQ?tJk_4i@zuvNPXHfNsPW~y$+Vth3B+*FaZx6Z>ol;c0goKdGW zxY}eE+M~9sm@xM_vD$nlFgF%~&|?-wHBvRqCoi46)H?=tfO8B+ff^`?6ba4%WY{w8 z*F`v+~DNl zv5k%%k=ld2#fB#lA3<3Xai9Mq(>ty{((BZDs~HKMh;Luvbub87A2Q3;k!H2+Ese>z zUif(E(kO%kBj7GVcLo|dn%1_;e7Bs}6ml4f%7Y!dn;RRCZP)LMtZGk?qp~esF)Og` z`3{qg|Il8fa9}Tgf$a9JwssJkcK-{f(H}7@DEpsR7sjzUV59*bHjG~yLrw7azX`}V z@hg8^t83e43P=zb3?D>cgmf${E%ytOmFPFX<*8|Cs2*R~?3!U;XaI()sjD-=Eq&dy<&8W}uk#FGzOtV=qcQQx^J7(8Yb#{6L@d+5InWTaJ+w9`H924x{I|y1vzUow z$%ZH4^`mSe5r9MTPvNg|Ur_0id&z)Al9y=A50~w~5L9p}?qY8ZZ|+b$T#VZ@u9?hdI8~rxgHV|0M0W=R$-_7dkBOm_ zB#DT>iz^-|iqL3;Ih;223Z#BP&w&|_SQV;pKRObkEZ76k7f`_r$ReSeAs+D!DW=NL zb#--#uV0g7XkOOSV?@U$)Nq21JbQKs4+T0uN`(V-;m4El(8*McjT1V&`B+#U0P_SY z?L<@od*ka(KK~naSw$m<_p8Oce0eG_iAYkxq3CO^y?*uTXNbHFB5%8X{gPKuFoYg3 zkkkV_W@>6m08@k~kb;2uwPK%<(@EJ%xWKWK93JG1P35gfO)%umZ9Q`}Xa_HX{^B65>F=zUWQdjlH7lR99ih>guWs2eUBy z>7>THmb;gT3iKw^_4Mf=e8b{ICuk zz$E?OPh}0E7t5x!sH&@9f*yjZO&~yK$tU$@tU$B?uLlkvRs;gYastc8sV2x8=63oA z2b+EiXGb7wc5V(aviXTl8ZbT3ujP#?uMqvL6u8pZF+??$eZqLsI^saMjXj=aw@a4| z9(!1Hw4ZWH0*XY%*Q>g^inwR2(O~jR+vEKFs%&%2DC5X4)$u%{Jo+8$jkD$aw>6+L zkRDV<*k$4nOlDA&ewX6s!VdBB4qSWuz?1`17hZ`t9TIgpT^+)l0$m6|82i-z(d(y< zZwOmIH1q=C8$3Jg%f^zscS=|Po`Q^`rSHZLF$-%?NEKx zdFpozkQNjV9cTc=Vw&adXJGg?<+XJe5g=mc*%k@{UuTCs=$agPd@A$iSaT8<2SyTN zXhiPFVX$gXzZaa%|9X<3e$fyJ1nm1Rpeuvb5~>0eCE^FRAICT#=bYr`P6EJ02(3_X zWhc%e)Tsf<7-cy;i{Rj3=dtEp(Y5UVh)fpJ4@lY+!Eqb=nQ^48tqoon)(JH+At&cR zut)fcwLjRi zpwOit5LH!GM0Uk!eIltY-uSnehmE$2a6v;P@EJZIpZsIgocK=L{~Uv@TQRjysHgs!eG!ooKp0pZsPT#X_EB$v=cM3)Fp z?B41;3(gb7sW_a{H$`%?vcy9@O-C_Rwk6?Ge8XZM*yQ!ck1ycNk~#V2vDOBk`(1;! zuT$nJj(Qg#e?0roJbduSF`q+@idGTnOn_9Z;emjphif%xk-nc$2w%5Ztsn&=;x^0X z=H^B+|Fn>4=JO3DkLIm?U z8EICyh_F)k?AtetE&o4Z6$pZeexP-;cz`_U8cwC%0qsJ5SweRf-3+MAOtDs#*k-xTE^JUoultNQLj}lADB{KUoR~u zM}y;#u9J%lCy`1+-Nn{-n{SeXwK$Bv%mFqX8A(gjMih8#4|6CpMDz|?rhFviB0cnE zUj=K3b=F-4O3x}0yI4j^Bsu`tDmZMe+ngDW3V@ok{& z#?WF=Vs=E=`c@jfK>V~NDi`s`&OO?XzoVU&!*pRZ}%kg>KteemGH3XXIQ zE+PpASqD!ajTm?mpKiD#Py6&<1_2*Pz;FLKd=8br*kv+4J$)}C zt;mQWiUQA|HC6qA`tv!sPK0zJA;APM7fcM9S$rOfiKT^w@OY~x=+GQdq-(x?dxMOX z#RXF`1O4-LdQ_4_OQCR7j=YIXt zg(GucU9=13DHrJ_94lN1+Bf8Cv@1i1JSZD)u5$W6c~XUF9Xe0{7r)A0lx-{n7L!Pb zp>-K!zcPxsh9XNDc6&Pdw6mfPEi%ChSFU_TfZSm~y45Pb#<>IWjf#p2A4`?*`keI@ z;1FZ2sWjm2SfHjimv#rqCUo#*CMU}V?X%o3MomUdPwyw2z;f=KR$@(5bC05Nl6s0V zy5u7&W*)s0U%q@9gE|d)V;4bF)6-AmvrTBKW%_asBEj@z=-l1az+)Rn>F6Hy*rsG> ztA3gYXOPylhzPyHuC@Z=mUvRU#9D!~?dQ+OQLd>+!9CD95S_6rS)hY#Iq+aN(@l^B zY}!EIm$);2|AXYd+S2E5jH84TZ46WpC(LIn8@>~;B&r|0dKDmLP}@nmgS4IH7j zV_U$Bk40)GJT~?RXoIvQ!(LKD3FOWR-5YR<&@kbo6gzr-KXoxl%`jV=lb81dpccFw zc=JlYA!yrhPX(R-T!q((1OcQq;<)A z>_qgFgRugdY1a}X_wC$n4L$~eLC|9{$vFqE)BKJLfHuhU?E%?G0SUZI#WdP1cSDzr zs(?Ap=Cq1hN zCHgAx6>-N#+f*Q)I(b@gxqM7}Y7!mcC{T^Cke=S@ohkDyAn4$AFn~_b)v^`4B7lH$ zkAq9Dr24{rb;I+OvUxE*vcr%wu0-?Pzye`C^5>+VLtzuYyEp`dmGIvz0ze^JzUmbE>)5VR`F2ub=HZ$sP54j|i@0%IgB%Pl zXufn0GaR5n2*#XefZi>Ir|AAldJZj@C%d>zg!_&?SV+O#6_Hc*m* zrUPWo-G^&{T1((tXjwmh{`5*4lh+kJX6=M)#YPQ#`V^B1ualB?-8cO5sHvkv9$N+_ z1Vu;Pz@P!@pFC7AXvp9;jjgR;Q3bJQp+ZBHAj~QtAy{z~ESxqsk?6b#5P?iLLJy72 z&BrAq@b`>TXz%Z5m8GVmnB16Tt*3}!aaB@$)9plGjJsB{vVuIlS6<0|1sKx_|y zQPl4n@$zLY)W|(lR3}75*FMq3ps}GJpyN{?ITF}uEt}RRK=6BJ8(Z5EWG`SpqJjp) z44+yOMA9~!FRgtX_>di*kba4~!}_uVumRSLfZ@<*p`c-B`1tHZVMEZ2(AKcg5G50- zj>vo9(`I#$gP5s7c&;W^{4NP_qVa#@bpDmCP!2Kl(2?oIzU}Vvv>_z6srW^|S9`x-vc4-SaGi98Mhenh8&W!m4Ss;Mc9$UcLF#|P>m7~5C|CAzw@1JM~A z-242Y-o`gsXn%A*i6#rshI=Lkc+jSa#Gq}@c?dg%$;1gz3Ge8S^LdH&=}X!2XsneN zp5|qShEiwm(nOiXo+J2uR8%Ee3IW#6b=&VC1|AT!M6f*TQ%^bnIr^a)l(dCTu21Ezb~v2R4Vg*@(b5 z;e=w#)d1!Y>0{&(Ko2f0tH8}hx?t>A{wX3;4(j|LUk9T^;n-2YMG8=IIU)kE*Bzal zpvn?S9%7D1^xp?>K+}PN0azQKU?UQPOtw8A`Axsm!gjz;M!fBUkA9pIC*U9Q=O{vY z_ZHfS{5jm9?ja&&*Z=4Ukvan|6f*}mz%b16_1VjmOjM-a7w6~b4Lr(w?)27!4+2E8 z;4X$Tbv z*O6;Zg=0t9Y6yj^X=$CXZVi9rF;ugk$i>4Z^$!SuYVZK!Kk$ySjLa^@q}d<`qzHgy zupyXs}f@!L=qV0yJ&lBg5W^oj-ASpc8(%$p_IxNkJjt&^mfJp)DY^ zxR>-&@ml0gbrcX-9LG+d-is+FY|@pL6^w@%Wo!F1_8>lv1C)U18gS{YTc;{3EAi;j zDxmC}f`A$I*F&Hd+?JG*f;#^gG#k1Az!*t?@@)*|WRpb4#qq{V+>>C27IAR`-mM%qqqgi2e&519-cF zY72)Ek2s+82lQ6k!oZAC1U4_q%0A*N+8M&2Q(S7ld8(j+{E0h-{+WnbSCZoc)XMu9 zPugui7XLAkEW58ak&O3(^lycNx)xT-2QIvkwDlbMqx1e!mi>xW>h?Fx2j~4Sy}qH5 z=)9$yq1i#7MCGFqop+xu{f**eq$h=~p9$~2f}Y*I#`g2i=O08`{~T>j_GZ1{&C16v zc>hbkFsoYquw#JC6<;ZqRlW0ahj%pFh3~mQUJ?4xm2GOzx3BCn`xQ-hHe6s!+$Dd~ z2)Um?A;ktk;qSbz9x*l-*XB3H#HG%Bh*J)+xR%xyf3*3dAMLi2`P{||C=#c1L?%J z+aipM11t+;zOi$c$BRSFm!~qzo=uie4`sW%*>{rW?xbPNA>aD-_iv%>>{wK2cVePm z3%!*60hfS4Ri0Pmeowc%@+2FiY5Xgy2=k&$SsGi3b>bhVkX4N3O=7$6RkqPqX+702 zY~3KG?CI=gud_QB>;)kugoM6URUJSn1tGa0TGrdU9dSG`vZZb(Dr{PuE@Zk;5u~)^ zRPM5swZp4Nse(Xo?D%o1p;yAaj@~FB&#rKM($AW{Q+fy#+33vShMJHKCk$B;l%0ru z>gaUxC_MFnThN@SKvZbt^$X^rwvw>Fh;TJ>VVJ-}jri9~o`Z&h?h0KMe+d7F=xb;d zsLlCvcca(8gC{j)6#o7Wn^^j4Z5ARJn9P-4wva=EL?ac|uVfr#VWr5c>5BMdl<1K{K$VYNULY z=9-(6`ock_@+sa4Z@fZ46Klt_taG_@AE-%}%~_XBCsY);b%Rj0`k<0frz#B&4kD)@ zI!bvK?fB!zkGW=IFpiR=FwKPYkLy@cw6w&tj~~zDnoNRM4~&9Zp%g+q{x5_&^+!W&H9g5fd0 zl@+Gto9;JL_FCoZT6n7^zRHUT^pQ;fWeQ-pVqcZpClQqyb-YWDN2{3Z>&@UBe~X>& z9ZD>XsEEDB74_#xYFVQ3f#!P(y0`7)s70P zTHNIgwl)^_I|!@L<1xj^t5bi{WKXUEmp2v`lynqjUSgX4|ZWQOl06=YRO1?c;NKy9IPP zquhFMS7bs-d`>GA1g4m;l4MIAcG(-}-;E0B6n+ zzA^uFkL@|A$wYPz5v*63PX&Idq{u^QXE}qDiM@)6L2@8dbRN(YOw9{`+z<>ETkY8%n0!|U^#F356*<$rK(zvJR*XB#F2n_wEcm)=sSLK_WfGy=wanL*643|VyC?JfyK~gp*}tnsTx*U zT4%jX{^h?Tv)Ey^>-Q8RWvbS~@8YT7OQlOaQ=WkcW5H7&1ll6RxhGF32}pbNPB)QF zy~#(6&7wg{k$00Kf`!4&b|w@)zUJxj(-2@shkXOd#{@D0Mz$whitAR8 zumJNnS@_#V5P{{s9mHrKI5qSYq^<>BCbVPkE$RT7A;@3^%mfJo!o(pFN486wWz9Z~ z7yPK0l@VnHo5pq|Zj+c66|(K-oYTSN!X(^)nhECz7w$tsCHMfG1>)@hxH?D!XgS`b z`-~tiBQSB9Tj7%)Zd?YTH0XQ+%)2~Z%qX>1-6hn`%a@IzV!EbHj!N{;B_0e&y#F%<&5I)k+1`Z`B3;EU@3Sr zLJ-n*MDzxxnWDLQN_sP^emJyZO!~oGy8=|p$owXTNyO0yz!S6+%wK zDMrEx@aV_n?vHYhu@#W&@Cs3QNkoz^Gn40MmO%sJa_|5rTUtTme0!%x5gsuiMr((L z-dlGHJWnx!xg<9IdB-bZhlj*iH8lF0e1|$x_*GU+S zxNN7o({PFZN|yAktgKLuSV{=xfEkHLWCGQ5w(xlV2x?wA-e}T+_nSP9Z)|M50HK=5IRc45ClthWVh>m2 zH;^UA7o)GEEIqoCzuKyy`!c9x*M;f^_wY4F2N($khP=vz6iP;{QSO^s~ zcXaq8LizdrTy(Fpx)A`sf2*5+CfYyV!fB%fDD;f|` zU=(i|k?;cFC3p$W4iQ=E`FPFjX~d z67=~#B2tOL6B84WynYzl!)VbnOe2FRYG?cmJ#A4D%(pJHKd5)=1V8_NB*{>BPtd<3 zY-mi+LXV3yO~lR~-fk=>w;Rw)`IgM0V3;8{{2aIl#AEy5FbIbZ<&pa6QSM!DaW(;a zmpw{r1!8w~ef73^N{l0ji;D|Zli^XK27LD?7g+~Xl#nx7AijAT<{ zg3RIA4P@XC9~L>?=DZVCCtXih1Xhr@G~C~|1G^$9ondTl#RBto6}}W#V#S`rgx=PO z7nXeK|7;@g?aHJ07fNi)p1ncyw^+EFy`Dx#JN@ex!CMPzF%j{72bI_bRn@S%B0Y6= zR(caC+7QFp1O?Scy7t8;2aH)y5A2zrT;^p8Z5TA-NN&WyU0tmB^^t+IFYB=fzxD3i z`e~I9J)fs%ay4fKWArEg_}sWk%ZZOM!9+k#O#dX^7`Hbw2<0gyIn1erzOaFwM|eIM zzk{ZCKeV!Vjd8cXb z;tiogdkMkx+BNp6m#3QA7bwc<_14s$WmnJ};XBIKdZvhX0)R?|ygG`xTg8jqi$p6V z+)+p|a2W(3IU?7a=oeT$_$DKR+vI`Zxz^gyrkk z+CE*|s=g!LCIW;j1*iz9sz@q#Sv+ym>ThyvBgYF9K_j^Sk-4S4!Q5PR<8I zfx~gPl+}+L88^y#kAWZDl8Y5_dW5vAU#mLedRw6eS<{D62v9`$fdq8^T_)4UOKirK z^aJ|3>(EP)t2`MgeHX96=;`S}uXdx%Hh?9AQ4?G^fCiueT8oE7-01+0zf4GQz(A;m zI7)EcfB=bub1K4h9{s1#I5F2ipy##iHUd@OjFuN zipTUN(^h*jUne+j%y;=-N@@89Ig@B^u%iBJRRUAL&dsHHSziU$25GZsiYt%fiGe(f z@z(+wVyJd6nu7_BDY_Tx8v@K<&2r%k5$PJ3cF8Fzet;7ZadFJYA^`p!h|!zi0-*)L7WyByXVG{JYEb~p*?-+dvv1(_ z@xfc%s&gS{0XktxnM3jiffJH32Mi72wK(QD^38d3Zt)~Y@MGW})&t%N0Z9*K82IW$ zy(F6Mm6-EUD3WPEU%tZRC)Nk|fDLLgW7tGz=txw4SS#t;*-}5x1;IcDmLRSf%m^kA zUKB=(JO4Vq0MYgfN(7vcaNc-Cb%_^m03@tbohxNgQt5BE$?Y_G=%t#vX0>s2T}PD` ztoV?S^|SQ&-yI#Ul?+4{HaA!Og*XO3SW3d-q5I>_Lg*~BcjB3nI2nl-2|=;%x36&_ z?{|lkPK1jvm&+FCOX$M?bwo|G1E*bfF%xD9c8OlodWxeBu!!!Ja!mg^5QB1e?}`%s z2s$3RJfJ#mp9N+*&=~Q8F6>qmbrW#&KMU>!cD+wD(}n|1#P%VZ1~Cmbwb$|&=8giJ zBlxW$aKRJ|Ts-w4|7l%u_7?vFO=$<(7Ndm6vt1N)e0WqumKePZ(XsB^?KhAJMY>=$ zPxA0y((~ufyN+iRK0|gBQ2%}2wj;r^L>9`A*|P?{oIvl0yddLEL$I0+1dv=6g21C`&0kXzI@ND>0 zE)aPI4D{f2LvDXlQ{YFkW7v0b(FNlo592vOQ63SmCIQyQR)7u!Qz{!N1BL;cY;7ov z$B0+6VQQQWy&rFd0F0r|k=F$)#WfMBW{5R-)4=v%S*Olgj*fMf^$MsYcsybYt?Ce; z@r1d@^-#v$3@px+9MmP&mf%mPD*PA7``fpEh)%tCoiQS&W?*Mv>!%bHJOxN{`qRil zyjSK<+1d>N#MI2pr%T&Dg9*rEjY0L)L_i(Q03TpTL1{N=PeMNJd`ve;O}A5nII%+W z^YeO|ma@aY{uD;(_#{6?6cWAfzP^E)s#m>HHb5K9g`trVMRnq}Uhm#1Dm&Dh2||d* zog@Cs>5wF*p{~-WG zg1A~v49wPWiBcGRIagEPQ>CP&Tz-ITF?-JryznJ4RM=}%41b@1cY=ahhqF2A7{Sso zBFz4^D(1xtt~8rsJ)R$Nk|8Z)dv!FtRW=gv*MLP>a0@6S2PS`qPVoKFWnsAq-SHO$arZ!jhd;P z%E7)>kFSD_nla;K)v@JD4!WJ*)n~h_j(Sq=XW-O-fBd`3yv+2JOfTt@p+P(66P9>> znbz0B(TC`pw&F{SVx;RDGZP<>hU89f?iVt5VD_)6p5~``l1OX(--JT5EpO(HJRMi| zU0J*QJ*k&+g_E@l5xmyYIIocz?8%$BMu-(eAccq?;#}t9Jv0~UWs~FM9Zgp=ls-yg z!f#fS}p1;@cPV(I6M)gEMeGq~hCQ`e-aB#1?_SoK$e=3mBbm)Mx zhj?{a(?6N`j4<0xYFjOY)t~DB9bfgmuH~w61Np z+XZ4V?!*!BcWg|x#rd6w;r#evzlX80OmGjMov}Os@Ia(IP{I*Yu5df)naDQG`l4X78VV|S&_L;^a zJs#o}B*5q^-&8!MAVjp@_fDznuco!xE0Ik0fq3Z{QV#@=iuTnGyjKx&qG0!EOlk93 z->rfyoBnpj(lUJd=K2a7CS7ymHi94_qP>G~LzW-{NoW=(#}r^tnHHUr-ow40zg@8 zmdDOfkZEAexlI1@g}B$%yD3CWb^>pP_5Y0b^4{-qU6udDhnV9TZ~e7tCigsv-Anf` zzW#B1O^uq2Dgt_1r=3q#v;@m0T-imf*UPueIPmPamCAg=A@iA>{k;3at|_l`JHGHA z*HkUq5BiFibb(ZbrHWzx91#R0`6y9<081t(C!0C$wcohofQhc!bPGW80q8i9E7U~$ zf;mjQSq$}w5M=O@Ct!GtM;QX&<-Ah6d^s@PlNk4W&eLX=OANFsDX)P_5^wUr-Gqt= z!{x)v1CAk9fp=9Ah5_KV$nC$8r|m@{{$cdB1_4nBLS?j7#Cu4QWG!1C=7kYUyypyV zFPJ+KjfDn7EL1#ax7%n8w4zyvsn;|!OYssR;;khFJVH?fRwOp>^LR(l6AewxMavWP zf+Q^IK38cKCbLWgs5hpA?L54JQ;-J{hV}+@mhE9#k2yC4IxOdSPo4~0VA=&1fsi(n z+tB|1)7qJb^_;$Y9HSB0qK(jkWT}v!NcvI=MI>a2k_t&>t!P0aLZwO8iDYeLQnc3; z*_AR));6s|r6RPP*E93`oj=cYopYV}Yv!7(`hGv3=eeKzes2#wuSm^7pHWfau;bI4 zhjgCbe+yNT?k*rou+{7`cK|JiPn#OkqcqjzUur4Hz?xSu9Mg57Q_Cd*fK#1QM2rr? z482dd5d7OmR8%0%jWa>y`4?B% znVRnQ_lt#ok!>>v*b`({7-{v2J^iU1B2V??*(c7oM7j&4F$hN)(%DNKtstM)8c_#U zYo*{alpniPM8#oh-1E>O+dfW6PFZ0`c<{!T6NM0{N zz9DJ7sXsy$;Z*mS-h{FvVq1V42bfs8Ua^zC6pqe1jx?YNln^3Wg9uF2xbmahLrkwP^S)xTf#~j455U~DFi_2li zWt*NE_p?MtrmGxFumrux)yh2bpHNXZp+Xi80kQs&u>h29+p**GbvK_N8h27D?*efl zs+FEF$je|Dn&yXmKI|4ffNq>eTz%B%LP_klz|l9KI;Gm*)B1Pz7fN<9_@f8dO=l>i zy39bc&CCwXYZW<{;JT|;t>W7aAuk5ksCI<8Mi$Sq;JF=Q0Y>j0z$WZF8Ua;Z-GOLA z!Bd3yLJX%F86p`1EMweHBj5aiiZJm0zBwz{qJ!uoguCESR7hBu|5K-T{E)y&c+EUk zA?#Rv!#ZP}Q{J!h`J2Ont8Zq{lc2(Xk@t!A!f}5V zI{_Z*4%=4jARZ@!;PXHKlslHXLe(XMQx~n)PeN44(2;~3#`sv*Z|%OIW8l;mcnxrS z@6ZGIb)=13bt!+n5c~qZlE@JU&jdIm9;Q$#_a3VM3k0zC>a;l?9(v3&YTM<>^tJu* zsz|H{v32;3@71Fo^|@H$T+p!LYIMe%$h)_hX+c1Tk3B5C%gx+e#`J>at9|Xh656(j zF(-b{a{`>>;fzk3^-WdHKse&lyqX+*(&0GxjGzMviHVP!q&=pEYW0zhQ<0f<@i0z- z3GlKc?FsV0>e4(h#*wfoFboPP3~u;s8(z`&?f*isf-2s}Ri%`J`J{1$sm%J#TD;te z@n?RIyq}YUdV<&}Vdx>@Xld>~Y^odF-0F306N~CD#>9*rvG&ZBMFYkuF@l^tc~ZnQ zB3$wE1&nicJ~pU9Op@r7h47lF*%|dd@(9hC6&Ynjv;;)NM5akGq97*RQyj4xz?Q%t z9TsQXM>jv2hxxxnZ5dvZ=n?i{)KF#RT}y1&$4P4{^pdhaue0og)TsOYV!x;v%IrIS z8#63_46>rfl^ z7JJ*1bBsPfo1nbDk`@7-Goop3=aes1*trW8wR?4*O1_1qrnO0>X@Og{ z18o-Q106dnBJ5UAsqC@m(fnY}0(v*C&$fSUp1nn<{xr}r`Ok@q#uS-57{nFrCP^FYx2@%dpJVQsshGp1VWQ}X0ex|u z0Tc@(4rrD`V|mWa0VY_kC{mzQ`;Hzx+TTrTkGt%^S0}E_Pt$3i%H^3s%ZQp3A1V?&TIhjzj&xI4HsVzh;F0UT$t za393_Ao3Rw5OvjD*Bp!vj8a%4>3)TW{OX#YZWcT#l#cD&?sfaX^N35@X4-sHsA;C_x=GKbQWFR9+gbAISICb+;Ha9e^;7x_A=pW5L zq^`!mR+;#GU~d83X-6<#W`ibxd)Q;Yqs!=)ZW&b`IpqM10>ZgI%9FS{Oe$B@CRX)5Z!#2t;tW;M>ykAv0uax{Qb~WCW~xVh706dxW3Zoi#NJ<1 zOD=+aqe`WlxW`Fw@sBOZHfsIC8ZzY#ZzCWT3J5{&;7UR3{Dj9Q>gb^9I}^N1O#-S} zOvQw@d9AkW^`4~kpX^YzitQoNh$yaGc?cno)afo+*VNz>V3kzQn+03fts5oOd!l-Z zTx!Y^LX;*+NQ%{{pz79ajPc$x2 z%@#}}j}5FSx6~!!Jb*JzJ^=x_oN}!3@fB_OEK51jf5A$FIo@HVE?s&L)eccFI~7`-122%veS2;Pkm)ygp$`VZ{EDX>jloY$kTPy zx|5JFX+s_}diYF*sD>+d%0i4D6E6)|`&IGcd&DsCYI?NAkSr*rQ{QTDHJLV~@1SPY zS5oQPYk)^Gl#t(x%m7f?19vtr-^N(!POo0pBXkI4d5ir)3R}%drnNYBHf(Bf%g9)`ZGY=>L%CLUdE?jk|^ImEEIhe}+zr7t8cA z^>%j4c(}~lbcN8(^Eo$QPzwwS3JXVmtjtQDc6aYq!s)P*lW@dXJm*TckESPHWxHLR(MO*Ls9%W~nyk5EAx*hO!PwVw%5&d;lmduE; z>DT_(8`<1-J%eIiF7!{IvNth6MK>+FJv<>X?|E!SZqEn3UVFUR+yfVvfE>{R8%{UM zemyXE-KwVQ&GM-QjgtE2bRE5vhE3KR*SXKM&0nYfuDH5ST5Vmck59+!P4#6y{X1UI zSsuNlw&cyEQ_WBJLc=iv&{)1}*$Jd`uXfx1?#^!xF`Oe-pj<>HCl5OP^ir>x;VZi> znKN6}KC5@gsSA%Tx7&|bihgKnQt32XzJRSbM)t72?P4gCgLaG6uJf}4vaT4dpk*4l z*D@dh9k5yV3%xc_0m7wC|MLT5qL=V;)RmUZiTMvm@&EG+Vq^Mma=+yg{y-ybOp^YN z_5%&w5`8mmmmah}=xrEts(syNEE&JtTwr05Q56>BJr#-V+w^#=##L>*lvVa+{q{#um1z2^pcT36TDo$<4#a27C~5f}4!cGdzG zB=6|jhRAKr#MW9|Sb zy;&QlG>v~ZEL&Sm7}huMYayR{1is8`Ij243zY(4P?Zc9c!aYw8-RqC07xGIRJ<-ix z3-*-cVD+P`yl-VGM~}Ktt}?~Q)6E3kgvI5iOEuICf5bs$?%sv-Lv5_boBPc&IFr@2 z8{hcEi4$Xs9n@2{aM}R_!r$d!AOs<-q#rMm|9tiHXr5m1{ed^2<&ufC z9Rir+Or!j}R)1+?jxakf8+SafExoAD5sFgSqG^QNd^@c>TuK%hy<(J|eAE|H zr5qfOxL5&D#16^l%}jX{@a~{`@9Js7BlfrM90Xd`;W(K)juJ-Csi)<9v^x}hZalAz zZ9T>r%qKi)ZTeyDcqMJCQ^1F9E9ptAtrCn?3x*+j|2rj)eI#=GqclnF2-&64YLorT zAn#vqoLXr#hjUKoO9(Psi@fRq(U|K10QlytDR7_N1W^MX(3@R#^ziW5T9z&4rMrK@ zkHx#1kL1*~YysU6Gx^m}sBk$)C-;`n|i}F(FlR_p|S;9q_qYk;8~%}6+o1U zWzDBgmnfpFdZY!&OA3DWiI=Hzr=th=OtOi69Q&34Nv9juawfT3__egFC{TKkLKx}K z11A5KGz88u6mJ}f{1v2VwVys^Jn_aR!FjFD+zkA_bEiIJB>9l=xqI`fQTVgNMW{k` z_2XR^($mjk{ji^Sl5Z`p*ZC@pm%?I>(EuoF&uYhw@ScAR?qCKnf%2MI3;*Y)|n?N`t8p4v7^s_Vw{4BI|=WWEEL;O~V(1JP1@61>Dy zbE4bxu3K4B&f2B*4aJf~z>mnG#wkz9ur&&7V7J~X@^0|(^pJzbo7hsT55Mxe?}g6rMf zBCMvhZhI76=*;gaTj2M7piWvtH__mNV_@>xk4EZW55Gt39`8u2^ewNhX z%#OOujv%gKX>jZO;wBct-GK|{gqgM)vO@Va;$e$Mk35ZR0=)B3qt?EEZ(p3|)z*Aj z;`laYyQrDo^}9;mg)J~F6Sb6)gd#v&%|>&1lN4I-Q@;ySP$P}$Dc+?pKK1i!H5P(E zm@2U@dPrKkmVC?gScbVr#2PYat5wC#DZ7+uoFg~SAi;V?chYmjt3#;I=Aj#fmzv<) z=E<_z;NsGDY^87An#9-4CX<8$rNaIxiwB6-11}U*KMbw~3MKqnu)Q#mF9^=0Byw}W zKM|N{i*TFm2jGV;<1`Z=kt2=+DB{zO#Lth5(1pWF72|z=vSfD>7 zN$!p1ChT?MBh>4PZuF})R%`Y6@FEKo0d(^nW0$y*gaE$?ekvFt`#g=XH?v=yMaa5J zf7-N%94U;~Vk-!pEkg!ikZ?C)?jJ=n1Ad1H+>7)O!I+EtMv&=o_+V%ixvuo+R>C8R zC>k7=u?c?>n=k-?nJQmXTPqH5g4ceS5B1NxLv1+!^&Y3NwT~v=f6#alWd!qnf}x(T zD6Og(wK!uLCjn!wpy~=%!Kj)WJ|i=S<3;LFN&WrWZDzV$7ZpBOeg>tE)O$rCf~ej0 z50cR4tgYP*bFerfNgfJg#5`BzAQIyMjfEV{$w_39;FQn&UU(zAz4-6^g2N9TdU;L0 z8U>V@5vzICj zi0hqw^sOSLgCP)@EQdr&?rIPM2YS{(pEV`TMk`_p?c-lIz!z6k%-N%ywoKh-yKnOa z74hkWWJ56gX!>$dx_ywjYmQO^0c z6SL=AP+1OCseJUq0}M=uPOH?9Yi@)S63CXg6Jvk-@6(_QcjnPGd|R;oJe>-xJ0m3H z5?vtqEws#2h8#7N+Db!iHy(K&XBkr_fSj26tMei+U%&ow;u_6K%RsU2zY7gIf`}RR zT1erDAAbltana)-a8qkT8RtCX_6<$D9HZ#|Rj?3HBIx2o5X=H=YeiChgK`GMooZ$o z=lqe$9X)3ZeNOqc7x_8x6Ccm zp4XS!gOEzZo&aYgK^%~ASBlYu>(^Q)TJ38%;`<@)zLKs}?|BQIFrX}?NNfq#8WTkp*+2e8mG2z;G5z5DRxL zcDc!Ae@%w};S&aUCI!B)5Wk6Q*`Or;@py=v$b^Z3atPYQBuk$M5VTNEiUmkqylbLx zZF1&|-X7(c=>64Z>SjrsT;l_AzZLB(yH=da@OQ`X0An%W+$$ISs00eR%av=_%8}g( z;%(Ak8Vn)cDxPL>p?Uc8|JD#^nYHSwa0nn^jB3bw40~ zz^z}0#Cummb!o}ZGIB|8%ty6-Ow)uzqg3$y%Jg$6iwe{0RTiN}?TqY(TpKSZF z_}g!BeHFiiHoKH;5r9c0FKE07(z9AHo%rQ%HbHI_EDq*j_$QAt^p-1$0j42wjSvvBs6IKUZW+g;x z9vBgou-9DW>MV_{tCE}-gL>~b-0FH|mPT2NT&HEM`JA6*Pfsyr7ub@q3C zweWtd-{$n0i;6aVN-B&>a8+1*+NslIXzEItCE5RH4C8-BjB1i)53X=+nbgf!vf8gp zy2btN7Z*#nHjeg9(4YQl<5Y`3f*15WS6CansZ(0xoTg^iK0DKIf7SQ#ouofBC2!aH zJzWe^3Fx`1zv=U&b2#vRlD_werq!eqGL5 z$aHV;l7II8S&yN5rPdvp?K_jFpVRb|mz Windows Defender Security Center > Enterprise Customization**. + +6. Open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. + +7. Open the **Specify contact company name** setting and set it to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. + +8. To ensure the custom notification appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: + 1. Specify contact email address of Email ID + 2. Specify contact phone number or Skype ID + 3. Specify contact website + +9. Click **OK** after configuring each setting to save your changes. + + +### Use PowerShell to customize the notification + + + +>[!NOTE] +>Are there any PS cmdlets for customizing? What about CSPs for MDM? + + >[!NOTE] From 0a4a65fadc121cab59e73e297864026493a1fed0 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 15:09:48 -0700 Subject: [PATCH 17/54] asr drafted --- .../attack-surface-reduction-exploit-guard.md | 3 +-- .../controlled-folders-exploit-guard.md | 2 +- .../customize-attack-surface-reduction.md | 11 +---------- 3 files changed, 3 insertions(+), 13 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 042de4137d..f3b27e6b2f 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -28,13 +28,12 @@ ms.author: iawilt **Manageability available with** -- Windows Defender Security Center app - Group Policy - PowerShell - Configuration service providers for mobile device management -Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. +Attack Surface Reduction is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. The feature is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as: diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index ea1bc34493..94fa39f532 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -35,7 +35,7 @@ ms.author: iawilt - Configuration service providers for mobile device management -Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. +Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). All apps (any executable file, including .exe, .scr, .dll files and others) are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md index ff43300ff8..c803200e8d 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -79,8 +79,7 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusio ## Customize the notification -See the [Windows Defender Security Center](/windows-defender-security-center/windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. - +See the [Windows Defender Security Center](/windows-defender-security-center/windows-defender-security-center#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. @@ -90,11 +89,3 @@ See the [Windows Defender Security Center](/windows-defender-security-center/win - [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) - - - -### Attack Surface Reduction - -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions -- ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules --- Value as String Data Type : {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}:1 \ No newline at end of file From 16b320ef2fec7b62476deec8a06310451ffc8d77 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 16:27:27 -0700 Subject: [PATCH 18/54] intro topics for main, evaluate, audit, asr, cfa drafted --- .../audit-windows-defender-exploit-guard.md | 60 ++++++++----------- .../customize-attack-surface-reduction.md | 6 +- .../enable-attack-surface-reduction.md | 22 +++++-- ...enable-controlled-folders-exploit-guard.md | 8 ++- .../evaluate-attack-surface-reduction.md | 2 +- ...evaluate-windows-defender-exploit-guard.md | 32 ++++++---- .../network-protection-exploit-guard.md | 52 +--------------- .../windows-defender-exploit-guard.md | 16 ++--- 8 files changed, 87 insertions(+), 111 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md index 04a89fd2a7..36feda4bb8 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: Test how the features will work in your organization +description: Auditing mode lets you use the event log to see how Windows Defender Exploit Guard would protect your devices if it were enabled +keywords: exploit guard, audit, auditing, mode, enabled, disabled, test, demo, evaluate, lab search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,44 +14,34 @@ ms.author: iawilt --- -# Use audit mode to evaluate Windows Defender Exploit Guard features +# Use auditing mode to evaluate Windows Defender Exploit Guard features You can enable each of the features of Windows Defender Explot Guard in auditing mode. This lets you see a record of what *would* have happened if you had enabled the feature. You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period. -This topic lists the auditing functionality available for each feature, the management tools (Group Policy, Intune, MDM CSPs, System Center Configuration Manager, or PowerShell) that can be used to configure and deploy the setting to multiple machines in your network(s), and links to configuring each feature or setting. +While the features will not block or prevent apps, scripts, or files from being modified, the Windows Event Log will record events as if the features were fully enabled. This means you can enable auditing mode and then review the event log to see what impact the feature would have had were it enabled. + +This topic links to enabling the auditing functionality for each feature. It also You can use Group Policy, PowerShell, and configuration servicer providers (CSPs) to enable auditing mode. + + +Auditing options | How to enable auditing mode | How to view events +- | - | - +Auditing applies to all events | [Enable Controlled Folder Access](enable-controlled-folders-exploit-guard.md#enable-and-audit-controlled-folder-access) | [Controlled Folder Access events](controlled-folders-exploit-guard.md#review-controlled-folder-access-events-in-windows-event-viewer) +Auditing applies to individual rules | [Enable Attack Surface Reduction rules](enable-attack-surface-reduction.md#enable-and-audit-attack-surface-reduction-rules) | [Attack Surface Reduction events](attack-surface-reduction-exploit-guard.md#review-attack-surface-reduction-events-in-windows-event-viewer) +Auditing applies to all events | [Enable Network Protection](enable-network-protection.md#enable-and-audit-network-protection) | [Network Protection events](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) +Auditing applies to individual mitigations | [Enable Exploit Protection](enable-exploit-protection.md#enable-and-audit-exploit-protection) | [Exploit Protection events](exploit-protection-exploit-guard.md#review-exploit-protection-events-in-windows-event-viewer) + + +## Related topics + +Topic | Description +---|--- +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) +- [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) - - -## Audit/block modes - -Controlled Folder Access has mitigations that can be individually enabled in audit or blocking mode. - -Component |Description |Rule/mitigation description | --|-|-|- -Controlled Folder Access |Automatically blocks access to content to protected folders. - This can be enabled in audit/block mode |Protected folders |Folders that are shielded by this component. -| | | Allowed apps |Apps that are allowed to write into protected folders - - - - -### Audit/block modes - -Each of these components can individually be enabled in audit or blocking mode. - -Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. - -Component |Description |Rule/mitigation description | --|-|-|- -Attack Surface Reduction (ASR) | Provides rules that allow you to prevent macro, script and email threats. - Each rule can be enabled in audit/block mode - Supports file/folder exclusions applied to all rules |Rules to prevent macro threats |Block office application from creating executable content -| | | | Block obfuscated js/vbs/ps/macro code -| | | | Block office application from launching child processes -| | | | Block office application from injecting into other processes -| | | | Block Win32 imports from macro code in Office -| | | Rules to prevent script threats |Block js/vbs from executing payload downloaded from Internet -| | | | Block obfuscated js/vbs/ps/macro code -| | | Rules to prevent email threats |Block execution of executable content (exe, dll, ps, js, vbs, etc) dropped from email (webmail/mail-client). \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md index c803200e8d..6ecd896317 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -13,6 +13,7 @@ author: iaanw ms.author: iawilt --- +# Customize Attack Surface Reduction **Applies to:** @@ -70,7 +71,7 @@ Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add >[!IMPORTANT] >Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. -### Use MDM CSPs to to exclude files and folders +### Use MDM CSPs to exclude files and folders Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. @@ -78,8 +79,7 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusio ## Customize the notification - -See the [Windows Defender Security Center](/windows-defender-security-center/windows-defender-security-center#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. +See the [Windows Defender Security Center](../windows-defender-security-center/windows-defender-security-center#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index 842c5005a0..71f847c5ea 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -35,13 +35,15 @@ ms.author: iawilt Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. + + +## Enable and audit Attack Surface Reduction rules + You can use Group Policy, PowerShell, or MDM CSPs to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode. For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). -## Enable Attack Surface Reduction rules - -ASR rules are identified by their unique rule ID. +Attack Surface Reduction rules are identified by their unique rule ID. Rule IDs willl be populated on machines that are enrolled in an E5 license. These machines will also properly report their Attack Surface Reduction rule history in the Windows Defender Security Center web console. @@ -107,7 +109,19 @@ See the [Evaluate Attack Surface Reduction rules](evaluate-attack-surface-reduct >Not sure if this is right. What does AttackSurfaceReductionRules_Actions do? Do you need to add $TRUE/$FALSE or 1/0 at the end to enable it? Does the rule need to go in " or {}? Some examples would be handy here I think >[!IMPORTANT] ->Use `Add-MpPreference` to append or add rules. Using the `Set-MpPreference` cmdlet will overwrite the existing list. +>Use `Add-MpPreference` to append or add rules. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + +You can enable the feauting in auditing mode using the following cmdlet: + +```PowerShell +Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode +``` + +Use `Disabled` insead of AuditMode to turn the feature off. + +>[!NOTE] +>We need to walk through this so I understand how it works + ### Use MDM CSPs to enable Attack Surface Reduction rules diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md index df9dfd2dd0..c062b2db26 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -39,6 +39,9 @@ Controlled Folder Access helps you protect valuable data from malicious apps and This topic describes how to enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). + +## Enable and audit Controlled Folder Access + You can enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). @@ -83,9 +86,12 @@ For further details on how audit mode works, and when you might want to use it, 2. Enter the following cmdlet: ```PowerShell - Set-MpPreference -EnableControlledFolderAccess 1 + Set-MpPreference -EnableControlledFolderAccess Enabled ``` +You can enable the feauting in auditing mode by specifying `AuditMode` instead of `Enabled`. + +Use `Disabled` to turn the feature off. ### Use MDM CSPs to enable Controlled Folder Access diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index ea07b44ca4..6ee8fcbc6c 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -245,7 +245,7 @@ This enables all Attack Surface Reduction rules in audit mode. >[!TIP] >If you want to fully audit how Attack Surface Reduction will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). -You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). +You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Attack Surface Reduction topic](attack-surface-reduction-exploit-guard.md). diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md index c2fdb2c0a5..4f2500cca8 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: Evaluate the impact of each of the four features in Windows Defender Exploit Guard +description: Use our evaluation guides to quickly enable and configure features, and test them against common attack scenarios +keywords: evaluate, guides, evaluation, exploit guard, controlled folder access, attack surface reduction, exploit protection, network protection, test, demo search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -28,13 +28,25 @@ ms.author: iawilt Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. -You can use Windows Defender EG to: +Windows Defender Exploit Guard is comprised of four features. We've developed evaluation guides for each of the features so you can easily and quickly see how they work and determine if they are suitable for your organization. -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) - -There are a few ways you can get started evaluating Windows Defender EG to see how it works and how it could help protect your network. This topic brings together the evaluation topics for each of the four features in Windows Defender EG. +Before you begin, you should read the main [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) topic to get an understanding of each of the features and what their prerequisutes are. +- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) +- [Evaluate Controlled Folder Access](evaluate-controlled-folder-access.md) +- [Evaluate Exploit Protection](evaluate-exploit-protection.md) +- [Evaluate Network Protection](evaluate-network-protection.md) + +You might also be interested in enabling the features in auditing mode - which allows you to see how the features work in the real world without impacting your organization or employee's work habits: + +- [Use auditing mode to evaluate Windows Defender Exploit Guard features](audit-windows-defender-exploit-guard.md) + +## Related topics + +Topic | Description +---|--- +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) +- [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md index 670f31b22a..cec397807f 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md @@ -37,56 +37,10 @@ ms.author: iawilt - Windows Defender Security Center app -Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. - -You can use Windows Defender EG to: - -- Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) -- Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) - -Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) - -You can also [enable audit mode](audit-mode-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. - -Windows Defender EG is a component of the new Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. Other components of Windows Defender Advanced Threat Protection include: - - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) -- [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) - - [Windows Defender SmartScreen] - - [Windows Defender Device Guard] - - [Windows Defender Application Control] - - Each of the features in Windows Defender EG have slightly different requirements: - - Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license - -|-|-|- - Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console - Attack Surface Reduction | 16232 | Must be enabled | Required - Network Protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console - Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console - -> [!NOTE] -> Each feature's requirements are further described in the individual topics in this library. - - The way in which the features can be managed, configured, and reported on also varies: - - Feature | Configuration available with | Reporting available with - -|-|- - Exploit Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs - Attack Surface Reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Network Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - Controlled Folder Access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | x - ## In this library - -Topic | Description ----|--- -[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. -[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. -[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. -[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. + + +Set-MpPreference -EnableNetworkProtection [Disabled|Enabled|AuditMode] \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 43d3e1ae33..2970b32a36 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -1,6 +1,6 @@ --- title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. +description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection, including helping to prevent ransomware encryption and exploit attacks keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -20,7 +20,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16242 and later +- Windows 10 Insider Preview **Audience** @@ -31,21 +31,21 @@ Windows Defender Exploit Guard is a new collection of tools and features that he You can use Windows Defender EG to: - Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit.guard.md) +- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit-guard.md) - Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) - Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) -You can also [enable audit mode](audit-mode-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. +You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. Windows Defender EG can be managed and reported on in the Windows Defender Security Center as part of the Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies, which also includes: - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) -- [Windows Defender SmartScreen] +- [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md) - [Windows Defender Device Guard] -- [Windows Defender Application Control] +- [Windows Defender Application Guard](../windows-defender-application-guard/wd-app-guard-overview.md) Each of the features in Windows Defender EG have slightly different requirements: @@ -53,7 +53,7 @@ Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus -|-|-|- Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console Attack Surface Reduction | 16232 | Must be enabled | Required -Network Protection | not released | Must be enabled | Required for reporting in the Windows Defender ATP console +Network Protection | Not released | Must be enabled | Required for reporting in the Windows Defender ATP console Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console > [!NOTE] @@ -74,7 +74,7 @@ Controlled Folder Access | System Center Configuration Manager, Group Policy, Mi Topic | Description ---|--- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. -[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit.guard.m) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. +[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. [Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. From f594ecf3f54f9f9d56259198b144c1ae6eb97324 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 18:58:51 -0700 Subject: [PATCH 19/54] netprot drafted --- .../audit-windows-defender-exploit-guard.md | 8 + .../customize-attack-surface-reduction.md | 2 +- .../enable-attack-surface-reduction.md | 2 +- .../enable-network-protection.md | 97 ++++++++++ .../evaluate-network-protection.md | 168 ++++++++---------- .../images/np-notif.png | Bin 0 -> 15215 bytes .../network-protection-exploit-guard.md | 64 +++++-- .../scripts/np-events.xml | 21 +++ .../windows-defender-exploit-guard.md | 10 +- 9 files changed, 258 insertions(+), 114 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/images/np-notif.png create mode 100644 windows/threat-protection/windows-defender-exploit-guard/scripts/np-events.xml diff --git a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md index 36feda4bb8..a8fd18defd 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md @@ -45,3 +45,11 @@ Topic | Description + +## Enabling Windows Defender EG rules in audit mode +Use the script Enable-ExploitGuardAuditMode.ps1 to turn on the ASR rules and Controlled Folder Access into audit mode via Local GP on a device. This allows one to observe how the rules would perform across various machines in your system, and determine which can be turned on in Block mode and if any exclusions need to be applied. +**Note:** Rename Enable-ExploitGuardAuditMode.rename to Enable-ExploitGuardAuditMode.ps1 +Run the following in an elevated powershell prompt: +- Set-ExecutionPolicy Bypass -Force +- .\Enable-ExploitGuardAuditMode.ps1 +Successful output should indicate ASR and Controlled Folder Access were turned on in audit mode \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md index 6ecd896317..57aa7dde33 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -87,5 +87,5 @@ See the [Windows Defender Security Center](../windows-defender-security-center/w - [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) - [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index 71f847c5ea..b65fdd426a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -134,4 +134,4 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https - [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) - [Customize Attack Surface Reduction](customize-attack-surface-reduction.md) -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md new file mode 100644 index 0000000000..dbe561aedf --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md @@ -0,0 +1,97 @@ +--- +title: Turn Network Protection on +description: Enable Network Protection with Group Policy, PowerShell, or MDM CSPs +keywords: ANetwork Protection, exploits, malicious website, ip, domain, domains, enable, turn on +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + +# Enable Network Protection + + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + +Network Protection is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. + + +## Enable and audit Network Protection + +You can enable Network Protection in either block or auditing mode (non-blocking, Windows Defender Advanced Threat Protection events only) with Group Policy, PowerShell, or MDM settings with CSP. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + +>[!NOTE] +>What does it mean by non blocking ATP events only? + +### Use Group Policy to enable Network Protection + + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Network Protection**. + +6. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Block** - Users will not be able to access malicious IP addresses and domains + - **Disable (Default)** - The Network Protection feature will not work. Users will not be blocked from accessing malicious domains + - **Audit Mode** - If a user visits a malicious IP address or domain, an event will be recorded in the Windows event log but the user will not be blocked from visiting the address. + + +>[!IMPORTANT] +>To fully enable the Network Protection feature, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu. + + + ### Use PowerShell to enable Network Protection + +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: + + ``` + Set-MpPreference -EnableNetworkProtection Enabled + ``` + +You can enable the feauting in auditing mode using the following cmdlet: + + ``` + Set-MpPreference -EnableNetworkProtection AuditMode + ``` + +Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off. + + + +### Use MDM CSPs to enable Network Protection + + +Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure Network Protection. + + +## Related topics + +- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) +- [Evaluate Network Protection](evaluate-network-protection.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md index 428d11bd27..6b4bbfdb3b 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: Conduct a demo to see how Network Protection works +description: Quickly see how Network Protection works by performing common scenarios that it protects against +keywords: Network Protection, exploits, malicious website, ip, domain, domains, evaluate, test, demo search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -13,116 +13,98 @@ author: iaanw ms.author: iawilt --- - -## Policy settings for Windows Defender EG -The MDM policy settings for Windows Defender EG are listed in this section, along with example settings. -### Network Filter - -In Windows 10, Version 1709, you can enable Windows Defender EG Network Protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. - -You can enable Network Protection in either block or audit mode (non-blocking, ATP events only) with Group Policy, WMI/PowerShell, or MDM settings with CSP. - - -#### Group Policy - -The Network Protection feature can be configured with the following Group Policy details: -- Location: \Microsoft\Windows Defender Exploit Guard -- Name: Prevent users and apps from accessing dangerous websites -- Values: **Enabled**: Specify the mode in the **Options** section: - **Block**: Users and applications will not be able to access dangerous domains - **Audit**: Users and applications can connect to dangerous domains, however if this feature would have blocked access if it were set to block, then a record of the event will be in the event logs - -The settings in the XML file will be applied to the endpoint - -**Disabled**: Users and applications will not be blocked from connecting to dangerous domains. - -**Not configured**: Same as **Disabled**. - -To enable Network Protection in block mode, select the **Enabled** value and specify **Enabled** in the drop-down sub-option menu. - - -#### Windows Management Instrumentation/PowerShell - -Use the following cmdlet to configure Network Protection: -``` -Set-MpPreference -EnableNetworkProtection [Disabled|Enabled|AuditMode] -``` - -To enable Network Protection in Block mode, use: -``` -Set-MpPreference -EnableNetworkProtection Enabled -``` - - -#### Mobile device management/Configuration service provider - -Use this CSP to configure Network Protection: -- Policy area: Defender -- Name: Defender\EnableNetworkProtection -- Supported Values: --- 0: Disabled --- 1: Enabled (Block Mode) --- 2: Audit Mode - -To enable Network Protection in block mode, set **Defender\EnableNetworkProtection** to integer 1. +# Evaluate Network Protection -## Network Protection +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators +**Manageability available with** -Component | Configuration available with | Event ID | Corresponds to… --|-|-|- -Network Filter | GP, MDM | Provider: Windows Defender | -| | | Event when settings are changed | -| | | Event when NW filter fires in Audit-mode | -| | | Event when NW filter fires in Block-mode | +- Group Policy +- PowerShell +- Configuration service providers for mobile device management +Network Protection is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. -### Audit/block modes -Each of these components can individually be enabled in audit or blocking mode. +This topic helps you evaluate Network Protection by enabling the feature and guiding you to a testing site. -Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode. +>[!NOTE] +>The site will replicate the behavior that would happen if a user visted a malicious site or domain. The sites in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious. +## Enable Network Protection +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: -Component |Description |Rule/mitigation description | --|-|-|- -Network Filter |Blocks outbound connection from any app to low rep IP/domain - This can be enabled in audit/block mode |Enable/disable/audit |Puts the feature in enable/disable or audit mode. + ```PowerShell + Set-MpPreference -EnableNetworkProtection Enabled + ``` + +You can also carry out the processes described in this topic in audit or disabled mode to see how the feature will work. Use the same PowerShell cmdlet as above, but replace `Enabled` with either `AuditMode` or `Disabled`. + +### Visit a (fake) malicious domain -### Visit a malicious domain in block mode using Internet Explorer or Google Chrome -1. Enable Network Protection in block mode. 1. Open Internet Explorer, Google Chrome, or any other browser of your choice. -1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) -You will get a 403 Forbidden response in the browser, and you will see an Action Center message saying that Windows Defender EG blocked a connection to a malicious site. +1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net). + +You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked. + +![](images/np-notif.png) -### Visit a malicious domain in audit mode using Internet Explorer or Google Chrome -1. Enable Network Protection in audit mode. -1. Open Internet Explorer, Google Chrome, or any other browser of your choice. -1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) -You will be able to navigate successfully to the site. However, you can see an audit event in Windows Defender ATP or in the Windows Event Log (under Windows Defender > Operational). + + ## Review Network Protection events in Windows Event Viewer + +You can also review the Windows event log to see the events there were created when performing the demo: + +1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +2. On the left panel, under **Actions**, click **Import custom view...** + +3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [download the XML directly](scripts/np-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Network Protection: + +Event ID | Description +-|- +5007 | Event when settings are changed +1125 | Event when rule fires in Audit-mode +1126 | Event when rule fires in Block-mode -### Visit a malicious domain in Microsoft Edge -1. Enable Network Protection in bmode. -1. Ensure that SmartScreen is enabled. (Start -> Windows Defender Security Center -> App & browser -> SmartScreen in Microsoft Edge -> Block or Warn) -1. Open Microsoft Edge. -1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net) -You will see a SmartScreen malware/phishing warning. This is the 1st class experience for Microsoft Edge. +## Use auditing mode to measure impact + +You can also enable the Network Protection feature in auditing mode. This lets you see a record of what IPs and domains would have been blocked if the feature were enabled. + +You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the feature will block connections during normal use. + +To enable audit mode, use the following PowerShell cmdlet: + +```PowerShell +Set-MpPreference -EnableNetworkProtection AuditMode +``` -## Enabling Windows Defender EG rules in audit mode -Use the script Enable-ExploitGuardAuditMode.ps1 to turn on the ASR rules and Controlled Folder Access into audit mode via Local GP on a device. This allows one to observe how the rules would perform across various machines in your system, and determine which can be turned on in Block mode and if any exclusions need to be applied. -**Note:** Rename Enable-ExploitGuardAuditMode.rename to Enable-ExploitGuardAuditMode.ps1 -Run the following in an elevated powershell prompt: -- Set-ExecutionPolicy Bypass -Force -- .\Enable-ExploitGuardAuditMode.ps1 -Successful output should indicate ASR and Controlled Folder Access were turned on in audit mode +>[!TIP] +>If you want to fully audit how Network Protection will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). +You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Network Protection topic](network-protection-exploit-guard.md). -## Monitoring with Windows Defender Advanced Threat Protection -Windows Defender EG events can be found in event logs, or if the enterprise uses Windows Defender ATP, the Windows Defender Security Center - \ No newline at end of file + + + ## Related topics + +- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Use audit mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/images/np-notif.png b/windows/threat-protection/windows-defender-exploit-guard/images/np-notif.png new file mode 100644 index 0000000000000000000000000000000000000000..69eb1bbeee41365c03b01a1bee5b24f25a038a12 GIT binary patch literal 15215 zcmdtJbySsY)Fyra38e+;Mg$}Uq(fSelx`4Fx}>B-1w;uc=@yjkE&-7SK^ke1F6o+m z-uL^h->jMWX04gOzBTW96?x8co^!|E*LCgd-X~N|MIQGC#SH`kfvfOP<}m_+iitp= z;9_CGm82ivTHwcZ$A@|^5D2_>jhMS#L{uea+#&OeuAbzLM~ zT`V1(5ub~CAHpRZ7q}#2@xt8M%F)Hj!5%?$ot_b{-#}iMc5r;@Z1vpI1yO+CD-2ih z{<-RGVTQbw&c({k0&)Kc|2n*K9r=oe!!s9mGiM8gk>eHecI|GFty>ZQO4Fh?b zrj?7W1tM?j2Qvaehft7_)bvQ+obmJ4{Fx$g89yuU-jj``a7Rvx=g~LIUM%aDw|%!a z7Jiskr3BnzF<>(94wg&mW**J1OXN>dX3ZjDF5Xy{bXcFd`w0)`09AHx(Pj^lkuwhNypog^&;I;DZL|u+0#*` z0#?GIk+wPiPuZiR+8&}by6kc37L)?^uR0ec?d&-2-n~2LT&t$8?$ovZ$59ae4bLud zm~D!5eP2lx(HZnJUnjx|S7E%#M?_deq||Z#YiQApp^p$J8b1si8qpEDWlt3b%ecJf zu@U|p22}`zi||ZN{+}(e4R(#PNgukjh32N|C z$1JRp%=72WqBQu3?-_oDEd%Yha$(h;KY!k?*->iV85tSr56jc`q|~%OS%|(^yOIhI z)7sh^fq;2Setz}p)wKi_r&`0j!ot{|!_6sX4OY(hN24P5@842ZR(5WZx3S6pVLWN> zTx*D2UWDnv+Rrk(cXEuPG^*o6I72G8Zrv&?XyH?=In`q)d8rgICHqCXV)15=tbT5J zIT1-1I!y$oT$cLh>MCD-xcASWKappa*49!mhQWLAmfF;D{2`ge?AQZI1bpq7EsZ2-D$D%4P5T zu8#cVRaEd0bNgvmqHdd$5Yj<@mn(j9_V%3CHZ~S#KSxH=b8|5bs%%^9x0@)dwsv=S zYhZ3AHe;NIeisMd`}#WST-O69bqplJIs$Pi`R5io!eC8Mxm}F;ZO8q8{W9M8)hJ?1 zok=|wPAwAo;X`15zY3L*^R+P(Ke3|P-xMRGqYD9;G!GONZ@@=7ZB5rkc4`u{EebfwQ`%%n`e{X+ZT~CjE|LCn{1GixMbs~=(rjT^HX`}0_ ztE=W^eo^`aDK6I5cOf{RD$;)l!oLyXTx4{R*yw1tidum=PeNo`8a}K=TpWomgv906O#Kk->qPnU#gWe%mX?+e zl$CKgjT^``;~!kVejQdY*1~SKiMqD7R=3g9b^NqYuN*@-1&@h|iKj-yc?k=mYiFko z-~8tnE&6qW%^LgW3pdCf(}7g6vc`(7<||)Bh=&qvw6vd}#8$(;%1J`o`~zQKalo1w zO)YcttaGo~CLiagftC#S3Lj|1J>+<5VL^ZYzSbw=_FK^$iS4UDvg5-@a|y8BYCBSvfX9iQV;`=1Oa8Yvj76NFmG&jjV2u zM0yd@5aDlAREyCv80)Q}K?FG%e0b=FkPhf{tevsX5&K$MT;&TP^k;Q7Dgb52Dwt!9 zMiH4|^1PpU>FH6n8;?@=5{~h%g_9|_CzE7a3OYX^`kilbao6{9KMmh2sr2?^Y$RrE z)hyy2UtBt!l-gTbwm@ix1=ISHVUw^U7x(7Pn^If(>FEeDF)?Qz1_Uw>VCWzD?ex{; zg@5teO}@Ik^j$8Wsdw*De+O8^Cm@j3+-%bSlB}@hy5A!Gv{NWwZ;q{bW)E%dR?8T(i&OcYiv>kg7+_cou!@A!kVPI}ran#FM|i_+DEtxo)nRpW z;Wf*)`J*$ZVPyf|qYQpJ;#7URx+=1u3i?CAWF#Cc@Gcz~%D%1d{n{kx{)PTsGZZ=-4^C z7+iIMR8by3!OP@L5pbY^wB0?Na)|ijftX8po+>FRiK1O(7z%OGQUJ?*MW%EbQzu&dxlCTQgx?zPn-L_3m606ckG@ ziB^P1EEQ~Q*lu8BmpaUf!wv(a(sOa)+gB%9T}vbuT=BnS=;*i>Dk#b7< zU|CpMB^4B|_os@5!E-egu3sCapL9wQcD;cweoR+aR~MO-6qcAsVdy^N%CmFYrRp09 z5x=yu(o=7MDz^8X5y@KK-lE+-JyF0fMMXtcwW@biGXWqqP*FzLW-QDZUKp}!nf-AAy8HHA7%WhPsnc#T*v)DH_0EKYq z+FUYPT|vXi?<8~a)yR;LH^Hqagvxol$*NK^jBORDgoK2wWK;x%gi(R;!hgkI24ku` z53DPys=hAne!r@$s#0;Olq<~4MCFXf2IgO^OY=E9Y+c-yG3=aoY+2kzN{M*ew0P+R zndph)(|aTXiAQ zWn)O}1#KClsjeOX&?Qfqoa_`hBGV=ecu&6}blzb02$_ExEo~Na>=o1b- z{Z@ghtN>L9{<*K;NDC5yK9c8@P;~)w9AT7_Au|rp7Kl3(>lq<8LK{Ri_r>7^#xHuR%OjQ-% z`NfMM=Z&14oE^``@j6#Fgz0j3Y?*XHUfzS3FNJ*1re-r?ok5qqe*M~6VyfCf9uf=# z1ET~etD>^f3;5vX4~-+6l_w?ceSbW z-YX)rtr^n6gCiratcE{jAV+4H0dHSkUas-jWk8M?(7iWJf>y+BBXT|D5a=bbz=0)S zr&tb#06AD<{qydG_RE(qJyvt#pPKHEn@4n=+D=vB?yn5UgU$sWy4GlnpEX3bdmQqK z;?ph5?mf>&!gz_D7PN;73az7s2FpKB;y4US+_#OPs1)lixoBxY+_(W{Kd6R3tRBiea?*py_u(SrCftMg3P9+IcO5=NMHc={<|6CB3EzWM~ zz*F7WIQ++t$F*FA7Cmtpz?woN5LoBu-kO@4a}blS`| z>>~g^nyKZbEC|cPjS0qeG{pV;_iK)Rd7&WWvIvn7$IgC@J0@@yaz#o?YJ8C~(Hh8K zLmN=EeYyPk00uWP0amU`%2xnKP?4DhUVr}#<(*B{yE}|qfR5s(c;9VAgxHxF@FjV% z(vOZf|1HoQS{LECu(&uhJe=h+npsZTN&ZNzZOE;C=(jNFnYqTJUmD^sgi{cR=&svi zt7~g-1#p!M97cYfogOJJAM#p!GeTm(jEt&&;8Fa$iu8%&8XZ2U5FLR8+9^ zAQu4*Z+^yoHWnaI_8anv$Y_?z9X10MW;RyqIFIU|@i!1DBS3g$e*i z?Ug(+dGrXoKScx+S%j^I^j!VPia@SQFB-uM29-2%vAS-XZd7r*V#npv3*Tv%Vdd`U z&&tUWP;th%GN4n~j1|ekz5r3PGHbuBf}-z+^`p(aE+FAMR|d%%45!5Mc$SKHIXGnH z<%5$y9{%#$Hgj}T6JId}QQ+}A;dzP2?vnz;+MBRBZ+eyke_Fo=m4olQ6Lhao)xdxf zB>I0aFB*b`L;sagy;}x^CGvB%wMmew((A~c3bb&&rC7^U>Nr@Uw ze%Dhepz3M+Y9)mbSGSFEdS+c?s8zbBLo{+#%q~t3#!Jl5AiIL05`oP~FDtu=Oi922 zD1l!8{p)gmF?%J3RMLEWd~?X!1fmvDGko@9%N<$$$oZVh=um_MR>ww12Z?zdB8wgn z^0JWlKZb`bnyx_Ud+fAgIzi2bWZjAVB!0WMfSfh!_7$797Xa`zE1xKVeFBa9Y{c$?3sdcXFA-*M z`Y4xiRV!LA+Aw-6+qp~PJ#{Wvy_#}NZ9$uxpr`TTrkt;$Btg1 z_S5IjgU^4B+wx~a5z9d|>lfUHQawfe_obHBt-EY&gruYbU$(Q3@r=IsJ?Hbrfq3`4 zI2bc4)ivd#h^1}q?NxGdaZ!4hl9-fa@tkrs*e6pcr9WMOMsC5a-hAttEkEUl=xB9t zhJLKQw-VC%QdPzOQR&XdzGusZpK@|g$UIep4`*fd^%K1f1*TlAP4xpl-Oe4po;DB+ zdvlTi@NH;lsHD>-6P+-%`DS)oUQX`K-pj|2Z=U-$**zUpJnJu{D}3LQ~ONT6cH8%yczM5%(n*SmNB-zJR6|1I=Q%W z;w{O={iUer8}M0VN(yd@3Ud#Ebk`G+&0ASB_VR!u$tt6m-8>qNN5;moAWIq>8y~8w2CL*opZzQ|Z8@33r%P@*~g0$Dz zbB9Bdlc{tIwU52UEk=+@jF7st#Lo>9Aj4TCAx20` z)%Hf?F8*ClAN$S~YTKxlsKcu;m6GLlPnE1bA;N%ws^pjZzfq9v9OLa%;f75-J|9|j z{U^C~4_-1G-RRNTh1rqo@s3#zZ$Idpft9wQEcvMDXhsctz&T({ogX*>6=x)_gq`fd z7cF%*uM^kR^z>Mpdq8PNJsXWzbs=*NIZ1hVd4si@239D?_+AgMY6{P_1>-Yva^kh91wY{?E3up6uWhKU zB^OWQ%A<DS4lFtmPf zSI2kqggmoOA<$ZWKUafZ?=z36EtTrx=w*VtpX#0U-l>E&auI5>;VL2x! zCqdtHkMEw?8EagD;7||?rl^pYfH))n6M6`Em&#ray8~t`k8HaTR80`_4VF5x@w`KX zR>5l0=r`htoS2@MPncFu1^wo2mzq||RgSj|PGMFw6_#6SHD^K%Tw7a9@3#{bt^*V9 zHZyZiy8N|Quo|5om>$Kj?S-^9|! z27n8ReK&85q^SIH5hf-kmZ4Gz?UtT2&q6&K-bK_tHO-HbpT+;%%$l7De&-VHK!%mQDW;_Xj z_F8{Wyt&D6{%mf(*H^g>$;_RgRAwZV!sV13#{UN_xSk zXP!}I^aQYEpuHr{ZF_;=j2oGC8_ibVF=^@F{xWJX6Vvt8*lB^M^kJ)xRrrc*^3 z8NPWEc8W_`Y>2M^ld269(ckc4etudyI+*c2ISrc36aZh%vl8Kz z6ttjeJR4~MX1iC2?pt#kxBs*-ol`e48PGYtDGLWA4DUfioL~qIy$qSRmwd-=8N7sM zLY%E^U@1YWqY%KAdcDE=N8INAiByxeu83xl&-Dnh(OX>1KRAinOLM@2+PIB2j2E?b z{Xvts@Qxz4W1b!kB|aYBS5xkmW#@UwAm{p)ssnH(*4L#C4U>6L>AG=UUG2&z=JrpX zP`HJU#s#dfO}js+FZ^k(^(!W?FpDfB^dD(~PeC(g&t}Y!O+9o&DXhc!Cr6W4KqrC9 zTrKYXS0+YAg$>KRnquv~(mBoym9*)XQ`pnuj+(Lt@tJi6HD8^v9S@7f~-M0o=D2c$$hUL1;VH2%Cm@SXOnlz|tWwm1JArf`i>$Tzouc+5o9@h!FhuX$-gXN8F=0_NW6EHa5Tq zLcma|QKI9&$>^hvxw-PAGhop5B?y3FTw5!Yhc<%Y`$Pm3Lj4TQuHm|iaE>^P-8Z7G z^7@X|bFM?SH4Ge|;#t73U)xB~9iN#2ZeLPct*`HTER{LBW{e}V zJ)rC9*DAZIrP;o|J}{0-^b6_7swZrLV!H7!LA@=Bth`PUaqqs`+S-x>ndqNEYZlZ> zP@%f}Mc*_p3${t)F_OX|RiPfW&t1W+U z!HVO4i*K`^Zt)LS;S?T6B9OB~Gc(j~NdW-?Ar|4;9Qd^21xoffOd=u%;h7% zUTWD69$WADyE-ggL`h1Tn{3mR`SLGR`NV+(E72)Iht&H+N@?QM7(w)w;{uMxfo_6h zEBjsZgTRhp_NUJq+v!Udk4fhaziwER%FoSZw)UB^7x?n!%hFE+kPmC?>rgSF()~4} zMwXHe>{$#51O+Fu7eMsbyGea{Q#wa66CBL4pqu-57+gyL#t3^T6%5{9h4W>ogRpS% zk8`_ie!G(vAfJZ}o)_j(kny_%2M_PfG{g>DYo6ozu@m_chSaBQ&Q(O`!3_pYu`PaTYo@K%(lH$#@MRB|R$ef_}|P|buQo}1Z{^wU_9HT+#jEwEqeJy2~oh1AEIIy&-(4(vaHTyk>IF@nrA z1E}u_(tT);_;~oXZT$cP7gyesL1!`Aijh%%hvL}vR@8*k{S89?N+0isv=(uUc2GuHhnEpH{ zoD@)S@(D0-zlRP2W?CGkkbe4UXQyO1^U#>2+tF^(UH`Lx0xs~E5#`>62p5`HAf|+d zjqCkDl#4`^TK2SfLc(^7puT#@8tEt#i7Xn1i5Je8>|Ni*ToRu9O2A<-UBtaf{)~RR zxy?){olB-Rom14Z2wK$6-X2I@h+w&=1~am2q;oe$=MRRQQyhZaU(wNTB{yiH%?=n=Um@;77)DhPTu~Xbg$O$EK8-kAkhx zp||BRw;&z-K!@x9<1ah*=$Q)H|5lC~Zohq9UGD>-wl%R>iE3$U-;Ll2|NHe0MJm+) zRKhL~#V>f0TXOkO&G*#`K3{I%C59FmMml3B(P;tx#~V_WyE3A)4@Ll5SX=!)B-(Vv z-gQ}5hOe>(Gus5`ip{#!i#>htU@-#xH1%sBMK-(yLW(qzMg2{k+mrFT*Nihj#GN=( zZtj(p@qqKB7Y;@xG#Ge#);a&wF){*^oUwQswHT*^=;|5}x8ZVVhPHaJ8dvn^qM|n{ zxnY9YcSi|Pi+d|7dSrYmU9r4{GxE&c+^VMKP30+ysM|Q)YYjh&`*^BRBDcTEM|J8R zCf<=v524rFy(KUOaLvK{;Gs2oIa<_p`bmTO!Wny=$0U<4i0{S{*35!SW;Rh~ zfp}xwV_Q8XjUf;)t2#IQf`09mhkb)_vF({-+sS0U&o1?zhbRPY_n|ol6O-)AAuZEJ z)T_qVXLyzoj|`0S_!~YT&GttkPl4D=o_5_lF{e3ZWc8i)^7K@Lvk1N=4r42}Hwo|M z7+r)@_WI92{zHv|ke2=d2`@=qiA>FcN{2=4+rr%sKfnLiq3NQ1x~p%riCiv?Z`GUzN=LpR%Thr7S+?6qQL&g@QXfg#dq(QCKinPsh#17vt`AIQ$*}6gw{CUt zna~03fS^<#3#+7=tja4WkO3+Ov;`-Hl&8?Nd?JR9vE-s7Ke96A1Wpmv!L7MpNQbIl z2!_l_)uW*V>#63tI{i^0Z8#?%&Q+y7A~u{80tu{*x(mu8Ck1knaa5t+FnPeSxVGu$ zu048USw%6eJro*XUTnt<^!IBUPqF=SN{f#tEn}~q!fl?7_@{o~+uK7rq-=HB*|(`A ze5pXLVFaN-vSNQxor|bE{P|TMjCEkBC%%)`m8fdPWwP?>YHEn$v3$epNTS_7>e;-u zc?hMzbq~~amTumpK160ULvBqbKW zu+e(s7%)h!0f(qA!bT%(_ckBOri0h$;_eBtFdQqs~!AUi1rR8vJmVM~|GQ&UsZufknecw2n{GW1l;16cR2#kZr{B3dvFh^mNhu48EMLHE#_r86D(p$(R>vMRe>lRqhW<^5 z2jIgD=V&w!j1O}NK*Sqi6EKb5y~BC>^y!1*v52)`QR4CmQPwwtjLU9Z?m2>w>7KrGC1acnJhR5$@_01g}9dWFAgn)I41NmhM*ucq4QGtr^Zt?91 zT8Z$brKj0BIrB?h(Fi(uLR67X2&fL1*yUZ1!J#3PunvacZRt>#9H@O+BSw+VHV=7fYD%|M;;pYg`SBuzR@|Em8DrF)`7}?S$|ms-V%(iS6rloH_^-5s zznzJhr)vrQ>SydNDwGXYdiowVKc8GgeItj)Wmv=g?4WKMc=!g$6gp;R`IAy2B1FJo zTU^Uvqyr!p&NT?Zzn)?+3dg^H)WIy%HZCUZ=;-LK0vRmm@<&bSz{cJlH1%7-_Nno4 ztVUxlW_r{#m4~)=cCTAa)trl-Oz8H14<8L*Aghpp#*R|Dwa**_(79yFonBda|F`hl z(DV!-X1&gqep%5K(}FcZ&OW+Bwr*mn%`xlB?!&jPBcKm5^YU0MpR$eA>VajGT*9(e zp!^yRCS_-4WnkAOJ2UO7)!JF;xJQaS8-0I>@jl@La=MXGT1p5?p-aQsPgJ(4s-i-( zwy_xe0H|bFO?|{^7Zw&`G7e5pJ)uZrt^SOAr2QGP2!27IaZLw;M6aLWJYwAY2?u1q zzTDd4?``$`>DQ!hQ$YRUX0TviO04Ma%h zbT^Bz&Uc~aQM}begSqknBs8I(z5DeT(-!_K!FQqor>N4 z{c>=!M1>Ch1d_#$_Y;)HtL&1_>%m@tZV~PLTdb_C&LX>40a+Lf{vgmyO&`ca-#{9C zKUQ4?J^$wIO(0up9N@DMV8G$lHV&`KKr_Xc^3wgMb?*k&%gKL{8n>))vWl;5{Q+R`xTpve3Zib54PHwV+0HXLo>hB{v0I zJK@=&bNvjQ)&xLd3uXi$Qs+AKQ+(_Fr?Hr4C^o%oW$rRAv6_oz^bm^29#V? zU%IhXvEiUwva;P}SH6p5X6rddeqa9S=q7pwJz^evpL3lKdaw1WoQb%&Um5GAe*751 z7>t*hS3=--yhyvel8_)Uw{CMu+EnFuR6s&UZO(LS**yWyGDf7jWp1KeJE-k$rdQoaZdN#&}s`zVzGSa#8 zlYPQ!pHoaqwW}=J1$PJ97Hlp)jGWu3K1U*2HIDOvIP8eIkk#-*r;rM$06 z4vqKM7L%YihJbMB718H_7Wzv^ZQ@(=CNy5edIEhNuxO5BMvv4F+7~6)m6Q0D!)7HKcI7u=>y&dF0f zyTiGBgsO-i2qFXTy-9O;esL28VrNN1b#XaG1O;)(oc6Y+@S-a>GS-z*r6vLmf#>G7 zaQWdUV^L2;+H4?~&uZGv#lazAyb}|0b}k9SZX05*q@tqX zE$w9<%`E#FhJEeHGb(5?G24{RuRlBbm~!ZTuQFxuxHUD2UBXmGg56ldpB#7nD_k zRLAxQ&8Uc`<}EJ|dvj{Ucke?F?1mep(gy+5+m7$#O$i=NL`bN=c8K#qJDZwZGDJfN zIxkVPclS_M3oFaUYv>06qbn;e;Jp(1hI4XsHSw1!)qBm#f@jJ-|LPVfRu(Q3FNHuf zJJWPr3^^h?!!H?2YE^cAgsNgf!~`1-Hqq{^-q46Zq@ByARj_h`?{|!*k}8Tkf!?dc zpEoq272ol6nroRlK3*78TFi;h&D{GTn46N_oTX1nQaT`W?vkSiJmf4ZVO z!Mub~MM}s+HRzW(J(Iv?F!tJP-l<(plLkYw`|3!a?_%%P`M}lrK;F?m8Rn7ktS+L` zF(80D5n;w~tGEuIgQFM~0i9G`gh9<`_2XMS>Eo}lFU2>GGAb)?ZEkK#_FVD_hDhMz zWmX?isibYSO8h#(|6aE%*KlZZb^lA9qZ9+7vT*#A(RIX5P;M#?B^lOKb#n+r0{!{i zXJ#(5zD%O%o6^e3-fIdX$n`?Bd^y{a-8VsdZD3zZ4lB)RC06V*zomkOgYz~lOkG1G z=wN-!d|=CDzQ^SBCc@Oz6ak%`tp$2rHCuJ-a$2O}RN#TYS0$c}T>S~&qZjnOl8t#? zi@W{!;r-rFtH#YK6RO?3R*zmW0-gN%RHt+!`%-W67YfY zsUWipaIg?2L8*O_pXy;~j2rAJ_5!GFv3d5ma_?w0n)dq`D}MDmB$v^Tz1NhR6E_*3 zByeH!J6+02dN(mLLi~3EI%~1P9Dx6+M8`v+lZ3Sg69dEXj~X)xXM<1s+46UYQDFdA z^{d4d=D$U+*wp75usH0}cLxP}9G6nu-yFEK18?jc+`qy$F=)itrt-loEN*-YG`eTV zbmz_j;Pc`tt?dIy_Fu;b#^)ykw2SzD=UI=xT^vn0PHkeN&^;js$lTfM5!uBLyCMWI z`|dg`bgJ^5=df{C?z<0$`0IO`4|pgtP;17F?Y?C;h@Q{m`$b0M52T0$3tXNFbbF>< zo!jY_n2O`kY~b9@DlWzsnBgOBEhk2{6NKEk<&^tX=2tBD5b7}YWV5`NyfnL2gx1ka znAbKNjdrcTKs~vSkNAeyB5tyTAI-05W~asXY2vBJ{T*RWfYuX3vmY7}Ff7wCw&s}i z>Bc9od5W_O8>xHZ4VL)>EU@6se-BPF;|Q(O^pUs0*K%~L&e__859d#R#20#O{(Sc5 z>h$sFmX^88GrQw0_a?vsr-f@xR~OruvAen0eqZk^C@>bG!O0Te=MWKmDc8%WIAym< z6+iYLSXuXuej5Z|sG#raFNu(H;gQdAnAmqX9BxPG%4v_j?@l7Eulv=RER@!NfTbh% z_yY~^v;Gzl`Poo?x!XwgN5jN3{IES1-(-vYqK#BIS;LMLBacJx*Q2rG&gZ$xZ3DhE z$-j0@{w_L5oK-Xal0ce$6z(enX`RCoLUcoOmmj6u3DEw6#O0y{_xhwwP~7UL)t!}yOVI@%UZnbPs)mTa z+8fXMUT4J#0>Zz33yz7HX)w9@b(S)^A1W!eM@b`_t3uTq`^mA=%E(lq=o1&Xcp;f~ zWpm&jCG5p7eswanb5QJO^pfQR5}n#=o0laK|{`+874e>|HXi4X1RG*7;VrwbRb z?X?j5KO}s07bz5w!8y6@V{#qXjquS$R*u-W$<<*of*U9YWal@W(w&@bySGKgy@6ba1WgCh zZ?~JRkG|*lTM&MW-w>^)eGLzTf|8QV=zBentBWl{s*~@o4JUVg519Cap|ZSxp5sox z|Be0WuaD^KWy^cyn8+sXvhtP1mVj#c28Ulr>A%>2xuhYjv+Cz#`LnfOW!j{Sg3Hz} zj}-~iqpcYri7Qgqq~?pMX33(7cSe02S)SL2|JB|LP#T5EvGDF=oX@76 zW5#iC#jL&wWm$AS%JDm8?oEt+7alHfkDHsotr4cOl-T!2%pI>j(Lk=E_@~Jk1%>aa z#y=HleEoV+J>F{*z3~42AZT4W9)2y+>NkWx!i7n%ZO1zI?& z`6Q`XvY)icAM|Qu_LzC1J;mkuP?}RwF+OYweB)|UJ?EysY7kmKve-zxCVqLm_{gpE j+BQ_y|ATGaafN@k2?edwE!GykSBg-ORgo!@G7bE1Dl@_< literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md index cec397807f..b6475785db 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md @@ -1,7 +1,7 @@ --- -title: Use Windows Defender Exploit Guard to protect your corporate network -description: Windows Defender Exploit Guard consists of features that can protect your network from malware and threat infection. It replaces EMET. -keywords: emet, exploit guard, Controlled Folder Access, Network Protection, Exploit Protection, Attack Surface Reduction, hips, host intrusion prevention system +title: Use Network Protection to prevent connections to suspicious domains +description: Protect your network by preventing users from accessing known malicious and suspicious network addresses +keywords: Network Protection, exploits, malicious website, ip, domain, domains search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -15,12 +15,11 @@ ms.author: iawilt -# Windows Defender Exploit Guard - +# Protect your network with Windows Defender Exploit Guard **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -31,16 +30,53 @@ ms.author: iawilt - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management + + +Network Protection is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. + +You can enable Network Protection in either block or auditing mode (non-blocking, Windows Defender Advanced Threat Protection events only) with Group Policy, PowerShell, or MDM settings with CSP. + + + +## Requirements + +The following requirements must be met before Network Protection will work: + +Windows 10 version | Windows Defender Antivirus +- | - +Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled + + +## Review Network Protection events in Windows Event Viewer + + +You can review the Windows event log to see events there are created when Network Protection blocked access to a malicious IP or domain: + +1. Download the [Exploit Guard Evaluation Package](#) and extract the file *np-events.xml* to an easily accessible location on the machine. + +1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +2. On the left panel, under **Actions**, click **Import custom view...** + +3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [download the XML directly](scripts/np-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Network Protection: + + Event ID | Description +-|- +5007 | Event when settings are changed +1125 | Event when Network Protection fires in Audit-mode +1126 | Event when Network Protection fires in Block-mode + ## In this section - - - -Set-MpPreference -EnableNetworkProtection [Disabled|Enabled|AuditMode] \ No newline at end of file +Topic | Description +---|--- +[Evaluate Network Protection](evaluate-network-protection.md) | Undertake a number of scenarios that demonstrate how the feature works, and what events would typically be created. +[Enable Network Protection](enable-network-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage the Network Protection feature in your network. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/scripts/np-events.xml b/windows/threat-protection/windows-defender-exploit-guard/scripts/np-events.xml new file mode 100644 index 0000000000..7077dde1b9 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/scripts/np-events.xml @@ -0,0 +1,21 @@ + + + + + Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC + 1125,1126,5007 + 0 + False + + + + Network Protection view + + + + + + + + + \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 2970b32a36..921ddc67b0 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -49,12 +49,12 @@ Windows Defender EG can be managed and reported on in the Windows Defender Secur Each of the features in Windows Defender EG have slightly different requirements: -Feature | Minimum Windows 10 Insider Preview build | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license +Feature | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license -|-|-|- -Exploit Protection | 16232 | No requirement | Required for reporting in the Windows Defender ATP console -Attack Surface Reduction | 16232 | Must be enabled | Required -Network Protection | Not released | Must be enabled | Required for reporting in the Windows Defender ATP console -Controlled Folder Access | 16232 | Must be enabled | Required for reporting in the Windows Defender ATP console +Exploit Protection | No requirement | Required for reporting in the Windows Defender ATP console +Attack Surface Reduction | Must be enabled | Required +Network Protection | Must be enabled | Required for reporting in the Windows Defender ATP console +Controlled Folder Access | Must be enabled | Required for reporting in the Windows Defender ATP console > [!NOTE] > Each feature's requirements are further described in the individual topics in this library. From 396ae19f2eccf1adc8f6ce885143bc618549f83e Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 18:59:56 -0700 Subject: [PATCH 20/54] asr changes --- .../enable-attack-surface-reduction.md | 4 +--- .../evaluate-attack-surface-reduction.md | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index b65fdd426a..85b0b1b8fc 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -108,8 +108,6 @@ See the [Evaluate Attack Surface Reduction rules](evaluate-attack-surface-reduct >[!NOTE] >Not sure if this is right. What does AttackSurfaceReductionRules_Actions do? Do you need to add $TRUE/$FALSE or 1/0 at the end to enable it? Does the rule need to go in " or {}? Some examples would be handy here I think ->[!IMPORTANT] ->Use `Add-MpPreference` to append or add rules. Using the `Set-MpPreference` cmdlet will overwrite the existing list. You can enable the feauting in auditing mode using the following cmdlet: @@ -117,7 +115,7 @@ You can enable the feauting in auditing mode using the following cmdlet: Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode ``` -Use `Disabled` insead of AuditMode to turn the feature off. +Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off. >[!NOTE] >We need to walk through this so I understand how it works diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 6ee8fcbc6c..9aa2358b1c 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -222,7 +222,7 @@ You can also review the Windows event log to see the events there were created w 5. This will create a custom view that filters to only show the following events related to Attack Surface Reduction: - Event ID | Description +Event ID | Description -|- 5007 | Event when settings are changed 1122 | Event when rule fires in Audit-mode From e3dd577f2effe7a428457c6c1673523ef21f5e17 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Tue, 15 Aug 2017 19:06:04 -0700 Subject: [PATCH 21/54] update toc with wdeg --- windows/threat-protection/TOC.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md index f482e0b44e..8fd4ead61d 100644 --- a/windows/threat-protection/TOC.md +++ b/windows/threat-protection/TOC.md @@ -143,6 +143,35 @@ #### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) #### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) + + +## [Windows Defender Exploit Guard](windows-defender-exploit-guard\windows-defender-exploit-guard.md) +### [Evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +#### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +### [Protect devices from exploits with Windows Defender Exploit Guard](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +#### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) +#### [Evaluate Exploit Protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +#### [Enable Exploit Protection](windows-defender-exploit-guard\enable-exploit-protection.md) +#### [Configure Exploit Protection](windows-defender-exploit-guard\configure-exploit-protection.md) +##### [Configure system-wide settings for Exploit Protection](windows-defender-exploit-guard\configure-system-exploit-protection.md) +##### [Individually configure apps for Exploit Protection](windows-defender-exploit-guard\configure-app-exploit-protection.md) +### [Reduce attack surfaces with Windows Defender Exploit Guard](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +#### [Evaluate Attack Surface Reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +#### [Enable Attack Surface Reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +#### [Customize Attack Surface Reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +### [Protect your network with Windows Defender Exploit Guard](windows-defender-exploit-guard\network-protection-exploit-guard.md) +#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +### [Protect important folders with controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) +#### [Evaluate Controlled Folder Access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +#### [Customize Controlled Folder Access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) +#### [Enable Controlled Folder Access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) + + + + + + ## [Windows Defender SmartScreen](windows-defender-smartscreen\windows-defender-smartscreen-overview.md) ### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen\windows-defender-smartscreen-available-settings.md) ### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen\windows-defender-smartscreen-set-individual-device.md) From 6c02a0f46aea3d74e927ba9073d6bb4440e096eb Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 16 Aug 2017 02:11:52 +0000 Subject: [PATCH 22/54] Updated windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 921ddc67b0..3263a0c3d3 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -59,15 +59,6 @@ Controlled Folder Access | Must be enabled | Required for reporting in the Windo > [!NOTE] > Each feature's requirements are further described in the individual topics in this library. -The way in which the features can be managed, configured, and reported on also varies: - - Feature | Configuration available with | Reporting available with --|-|- -Exploit Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, PowerShell, Windows Defender Security Center | Windows Event logs -Attack Surface Reduction | Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | -Network Protection | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | -Controlled Folder Access | System Center Configuration Manager, Group Policy, Microsoft Intune, Mobile device management policies, Windows Defender Security Center | - ## In this library From 48ff508ae904947dd5455322c0483ada9a5fed52 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 16 Aug 2017 11:26:51 -0700 Subject: [PATCH 23/54] ep changes --- windows/threat-protection/TOC.md | 2 +- .../attack-surface-reduction-exploit-guard.md | 8 +- .../audit-windows-defender-exploit-guard.md | 8 +- .../configure-app-exploit-protection.md | 53 ++++ .../configure-system-exploit-protection.md | 100 +++++++ .../controlled-folders-exploit-guard.md | 9 +- .../customize-exploit-protection.md | 91 ++++++ .../emet-exploit-protection-exploit-guard.md | 256 ++++++++++++++++ .../enable-exploit-protection.md | 105 +++++++ .../exploit-protection-exploit-guard.md | 282 +++++------------- ...port-export-exploit-protection-emet-xml.md | 46 +++ .../network-protection-exploit-guard.md | 9 +- .../scripts/ep-events.xml | 21 ++ .../windows-defender-exploit-guard.md | 17 +- 14 files changed, 783 insertions(+), 224 deletions(-) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/configure-app-exploit-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/configure-system-exploit-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md create mode 100644 windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md index 8fd4ead61d..74c6e5b0d6 100644 --- a/windows/threat-protection/TOC.md +++ b/windows/threat-protection/TOC.md @@ -152,7 +152,7 @@ #### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) #### [Evaluate Exploit Protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) #### [Enable Exploit Protection](windows-defender-exploit-guard\enable-exploit-protection.md) -#### [Configure Exploit Protection](windows-defender-exploit-guard\configure-exploit-protection.md) +#### [Customize Exploit Protection](windows-defender-exploit-guard\customize-exploit-protection.md) ##### [Configure system-wide settings for Exploit Protection](windows-defender-exploit-guard\configure-system-exploit-protection.md) ##### [Individually configure apps for Exploit Protection](windows-defender-exploit-guard\configure-app-exploit-protection.md) ### [Reduce attack surfaces with Windows Defender Exploit Guard](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index f3b27e6b2f..25f91f1191 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -33,7 +33,11 @@ ms.author: iawilt - Configuration service providers for mobile device management -Attack Surface Reduction is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. +Attack Surface Reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. + +It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). + +Attack Surface Reduction works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). The feature is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as: @@ -45,6 +49,8 @@ When a rule is triggered, a notification will be displayed from the Action Cente You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Attack Surface Reduction would impact your organization if it were enabled. + + ## Requirements The following requirements must be met before Attack Surface Reduction will work: diff --git a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md index a8fd18defd..d3ce46793b 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md @@ -23,7 +23,13 @@ You might want to do this when testing how the feature will work in your organiz While the features will not block or prevent apps, scripts, or files from being modified, the Windows Event Log will record events as if the features were fully enabled. This means you can enable auditing mode and then review the event log to see what impact the feature would have had were it enabled. -This topic links to enabling the auditing functionality for each feature. It also You can use Group Policy, PowerShell, and configuration servicer providers (CSPs) to enable auditing mode. +You can use Windows Defender Advanced Threat Protection to get greater granularity into each event, especially for investigating Attack Surface Reduction rules. Using the Windows Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). + +This topic links to topics that describe how to enable the auditing functionality for each feature and how to view events in the Windows Event Viewer. + +You can use Group Policy, PowerShell, and configuration servicer providers (CSPs) to enable auditing mode. + + Auditing options | How to enable auditing mode | How to view events diff --git a/windows/threat-protection/windows-defender-exploit-guard/configure-app-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/configure-app-exploit-protection.md new file mode 100644 index 0000000000..95abdbbd6f --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/configure-app-exploit-protection.md @@ -0,0 +1,53 @@ +--- +title: Configure how ASR works so you can finetune the protection in your network +description: You can individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from ASR +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, customize, configure, exclude +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + +# Customize Attack Surface Reduction + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + + +## App-specific mitigations + + What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? + + 1. Configure + 2. Export + 3. Import + + + + + +## Related topics + +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) +- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) + diff --git a/windows/threat-protection/windows-defender-exploit-guard/configure-system-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/configure-system-exploit-protection.md new file mode 100644 index 0000000000..6df66b8dab --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/configure-system-exploit-protection.md @@ -0,0 +1,100 @@ +--- +title: Configure how ASR works so you can finetune the protection in your network +description: You can individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from ASR +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, customize, configure, exclude +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + +# Customize Attack Surface Reduction + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + +## System-level mitigations + +What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? + +System-level mitigations are applied to... + +You can set each of the following system-level mitigations to on, off, or the default value: + +Mitigation | Default value +Control flow guard | On +Data execution prevention | On +Force randomization for images (Mandatory ASLR) | Off +Randomize memory allocations (Bottom-up ASLR) | On +Validate exception chains (SEHOP) | On +Validate heap integrity | Off + +Generally, the default values should be used to... + + + +### Control flow guard + + + +### Data execution prevention + + + +### Force randomization for images (Mandatory ASLR) + + + +### Randomize memory allocations (Bottom-up ASLR) + + + +### Validate exception chains (SEHOP) + + + +### Validate heap integrity + + +### Configure system-level mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. + + +## Related topics + +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) +- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) + diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index 94fa39f532..1c9e0ee9e5 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -35,7 +35,11 @@ ms.author: iawilt - Configuration service providers for mobile device management -Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). +Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. + +It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). + +Controlled Folder Access works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). All apps (any executable file, including .exe, .scr, .dll files and others) are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder. @@ -47,11 +51,14 @@ The protected folders include common system folders, and you can [add additional As with other features of Windows Defender Exploit Guard, you can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Controlled Folder Access would impact your organization if it were enabled. + + ## Requirements The following requirements must be met before Controlled Folder Access will work: Windows 10 version | Windows Defender Antivirus +-|- Insider Preview build 16232 or later (dated July 1, 2017 or later) | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md new file mode 100644 index 0000000000..57aa7dde33 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -0,0 +1,91 @@ +--- +title: Configure how ASR works so you can finetune the protection in your network +description: You can individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from ASR +keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, customize, configure, exclude +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + +# Customize Attack Surface Reduction + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + +Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. + +This topic describes how to customize Attack Surface Reduction by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer. + +You can use Group Policy, PowerShell, and MDM CSPs to configure these settings. + +## Exclude files and folders + +You can exclude files and folders from being evaluated by Attack Surface Reduction rules. + +You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the exclusions should only be applied to individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). + +### Use Group Policy to exclude files and folders + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. + +6. Double-click the **Exclude files and paths from Attack Surface Reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. + +### Use PowerShell to exclude files and folderss + +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: + + ```PowerShell + Add-MpPreference -AttackSurfaceReductionOnlyExclusions "" + ``` + +Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more folders to the list. + + +>[!IMPORTANT] +>Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + +### Use MDM CSPs to exclude files and folders + +Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. + + + +## Customize the notification + +See the [Windows Defender Security Center](../windows-defender-security-center/windows-defender-security-center#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. + + + +## Related topics + +- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) +- [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) +- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) + diff --git a/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md new file mode 100644 index 0000000000..9dbb92d72d --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md @@ -0,0 +1,256 @@ +--- +title: +keywords: +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + + +# Protect devices from exploits with Windows Defender Exploit Guard + + +**Applies to:** + +- Windows 10 Insider Preview, build 16232 and later + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center app + + +Exploit Protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. + + It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. + + You configure these settings using the Windows Defender Security Center on an individual machine, and then export the configuration as an XML file that you can deploy to other machines. You can use Group Policy to distribute the XML file to multiple devices at once. + +## Requirements + +The following requirements must be met before Exploit Protection will work: + +Windows 10 version | Windows Defender Advanced Threat Protection +Insider Preview build 16232 or later (dated July 1, 2017 or later) | For full reporting you need a license for [Windows Defender ATP](../windows-defender-atp/windows-defender-advanced-threat-protection.md) + + + ## System-level mitigations + +What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? + +System-level mitigations are applied to... + +You can set each of the following system-level mitigations to on, off, or the default value: + +Mitigation | Default value +Control flow guard | On +Data execution prevention | On +Force randomization for images (Mandatory ASLR) | Off +Randomize memory allocations (Bottom-up ASLR) | On +Validate exception chains (SEHOP) | On +Validate heap integrity | Off + +Generally, the default values should be used to... + + + +### Control flow guard + + + +### Data execution prevention + + + +### Force randomization for images (Mandatory ASLR) + + + +### Randomize memory allocations (Bottom-up ASLR) + + + +### Validate exception chains (SEHOP) + + + +### Validate heap integrity + + + + + + 1. Configure + 2. Export + 3. Import + +### Configure system-level mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. + + ### Export system-level mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can import the XML file to other machines in your organization. You can do this individually for each machine by using the Windows Defender Security Center, or you can deploy a Group Policy setting for multiple devices. + + ### Import system-level mitigations + + **Use the Windows Defender Security app to import system-level mitigations:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +**Use Group Policy to import and deploy system-level mitigations:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + + + ## App-specific mitigations + + What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? + + 1. Configure + 2. Export + 3. Import + +### Configure app-specific mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. + + ### Export app-specific mitigations + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +You can import the XML file to other machines in your organization. You can do this individually for each machine by using the Windows Defender Security Center, or you can deploy a Group Policy setting for multiple devices. + + ### Import app-specific mitigations + + **Use the Windows Defender Security app to import app-specific mitigations:** + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Under the **Controlled folder access** section, click **Protected folders** + +4. Click **Add a protected folder** and follow the prompts to add apps. + + ![](images/cfa-prot-folders.png) + +**Use Group Policy to import and deploy app-specific mitigations:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + + + +## Review event logs for Exploit Protection + +How do you see these event logs? Are they under specific codes/areas? + +Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md new file mode 100644 index 0000000000..c062b2db26 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md @@ -0,0 +1,105 @@ +--- +title: Turn on the protected folders feature in Windows 10 +keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, enable, turn on, use +description: Learn how to protect your important files by enabling Controlled Folder Access +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + + +# Enable Controlled Folder Access + + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + +Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). + +This topic describes how to enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). + + +## Enable and audit Controlled Folder Access + +You can enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. + +For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). + + +### Use the Windows Defender Security app to enable Controlled Folder Access + +1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) + +3. Set the switch for the feature to **On** + + ![](images/cfa-on.png) + +### Use Group Policy to enable Controlled Folder Access + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled Folder Access**. + +6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. + - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + + + ![](images/cfa-gp-enable.png) + +>[!IMPORTANT] +>To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. + +### Use PowerShell to enable Controlled Folder Access + +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +2. Enter the following cmdlet: + + ```PowerShell + Set-MpPreference -EnableControlledFolderAccess Enabled + ``` + +You can enable the feauting in auditing mode by specifying `AuditMode` instead of `Enabled`. + +Use `Disabled` to turn the feature off. + +### Use MDM CSPs to enable Controlled Folder Access + +Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders. + + +## Related topics + +- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) +- [Customize Controlled Folder Access](customize-controlled-folders-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md index 9dbb92d72d..aee8fe555a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md @@ -19,7 +19,7 @@ ms.author: iawilt **Applies to:** -- Windows 10 Insider Preview, build 16232 and later +- Windows 10 Insider Preview **Audience** @@ -28,229 +28,87 @@ ms.author: iawilt **Manageability available with** +- Windows Defender Security Center app - Group Policy - PowerShell -- Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune -- Windows Defender Security Center app +- Configuration service providers for mobile device management -Exploit Protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. +Exploit Protection automatically applies a number of exploit mitigation techniques on both [the operating system processes](configure-system-exploit-protection.md) and on [individual apps](configure-app-exploit-protection.md). - It is part of Windows Defender Exploit Guard, which is itself a component in the new Windows Defender Advanced Threat Protection offering of security and threat prevention products. +It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). - You configure these settings using the Windows Defender Security Center on an individual machine, and then export the configuration as an XML file that you can deploy to other machines. You can use Group Policy to distribute the XML file to multiple devices at once. +Exploit Protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). + + You configure these settings using the Windows Defender Security Center app on an individual machine, and then [export the configuration as an XML file that you can deploy to other machines](import-export-exploit-protection-emet-xml.md). You can use Group Policy to distribute the XML file to multiple devices at once. + + Exploit Protection consists of a number of mitigations that are designed to protect against typical malware infection behavior - especially for malware that attempts to exploit software vulnerabilities to spread and infect machines. + + Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection. + + You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Attack Surface Reduction would impact your organization if it were enabled. + + ## Requirements The following requirements must be met before Exploit Protection will work: Windows 10 version | Windows Defender Advanced Threat Protection +-|- Insider Preview build 16232 or later (dated July 1, 2017 or later) | For full reporting you need a license for [Windows Defender ATP](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - ## System-level mitigations - -What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? - -System-level mitigations are applied to... - -You can set each of the following system-level mitigations to on, off, or the default value: - -Mitigation | Default value -Control flow guard | On -Data execution prevention | On -Force randomization for images (Mandatory ASLR) | Off -Randomize memory allocations (Bottom-up ASLR) | On -Validate exception chains (SEHOP) | On -Validate heap integrity | Off - -Generally, the default values should be used to... - - - -### Control flow guard - - - -### Data execution prevention - - - -### Force randomization for images (Mandatory ASLR) - - - -### Randomize memory allocations (Bottom-up ASLR) - - - -### Validate exception chains (SEHOP) - - - -### Validate heap integrity - - - - - - 1. Configure - 2. Export - 3. Import - -### Configure system-level mitigations - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - -You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. - - ### Export system-level mitigations - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - -You can import the XML file to other machines in your organization. You can do this individually for each machine by using the Windows Defender Security Center, or you can deploy a Group Policy setting for multiple devices. - - ### Import system-level mitigations - - **Use the Windows Defender Security app to import system-level mitigations:** - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - -**Use Group Policy to import and deploy system-level mitigations:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. - - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. - - - ![](images/cfa-gp-enable.png) - ->[!IMPORTANT] ->To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. - - - ## App-specific mitigations - - What is the scope for these? Any app? Only Windows/system services? Signed apps? Known bad apps? - - 1. Configure - 2. Export - 3. Import - -### Configure app-specific mitigations - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - -You can now export these settings as an XML file. This allows you to copy the configuration from one machine onto other machines. - - ### Export app-specific mitigations - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - -You can import the XML file to other machines in your organization. You can do this individually for each machine by using the Windows Defender Security Center, or you can deploy a Group Policy setting for multiple devices. - - ### Import app-specific mitigations - - **Use the Windows Defender Security app to import app-specific mitigations:** - -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Under the **Controlled folder access** section, click **Protected folders** - -4. Click **Add a protected folder** and follow the prompts to add apps. - - ![](images/cfa-prot-folders.png) - -**Use Group Policy to import and deploy app-specific mitigations:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exploit Guard**. - -6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The controlled folder access feature will not work. All apps can make changes to files in protected folders. - - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. - - - ![](images/cfa-gp-enable.png) - ->[!IMPORTANT] ->To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. - - - -## Review event logs for Exploit Protection - -How do you see these event logs? Are they under specific codes/areas? - -Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. \ No newline at end of file + ## Review Exploit Protection events in Windows Event Viewer + +You can review the Windows event log to see events there are created when Exploit Protection blocks (or audits) an app: + +1. Download the [Exploit Guard Evaluation Package](#) and extract the file *ep-events.xml* to an easily accessible location on the machine. + +2. Type **Event viewer** in the Start menu to open the Windows Event Viewer. + +3. On the left panel, under **Actions**, click **Import custom view...** + +4. Navigate to where you extracted *ep-events.xml* and select it. Alternatively, [download the XML directly](scripts/ep-events.xml). + +4. Click **OK**. + +5. This will create a custom view that filters to only show the following events related to Controlled Folder Access: + +Provider/source | Event ID | Description +-|:-:|- +Security-Mitigations | 1 | ACG audit +Security-Mitigations | 2 | ACG enforce +Security-Mitigations | 3 | Do not allow child processes audit +Security-Mitigations | 4 | Do not allow child processes block +Security-Mitigations | 5 | Block low integrity images audit +Security-Mitigations | 6 | Block low integrity images block +Security-Mitigations | 7 | Block remote images audit +Security-Mitigations | 8 | Block remote images block +Security-Mitigations | 9 | Disable win32k system calls audit +Security-Mitigations | 10 | Disable win32k system calls block +Security-Mitigations | 11 | Code integrity guard audit +Security-Mitigations | 12 | Code integrity guard block +Security-Mitigations | 13 | EAF audit +Security-Mitigations | 14 | EAF enforce +Security-Mitigations | 15 | EAF+ audit +Security-Mitigations | 16 | EAF+ enforce +Security-Mitigations | 17 | IAF audit +Security-Mitigations | 18 | IAF enforce +Security-Mitigations | 19 | ROP StackPivot audit +Security-Mitigations | 20 | ROP StackPivot enforce +Security-Mitigations | 21 | ROP CallerCheck audit +Security-Mitigations | 22 | ROP CallerCheck enforce +Security-Mitigations | 23 | ROP SimExec audit +Security-Mitigations | 24 | ROP SimExec enforce +WER-Diagnostics | 5 | CFG Block +Provider: Win32K | 260 | Untrusted Font + + + ## In this section + +Topic | Description +---|--- +[Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) | Many of the features in the EMET are now included in Exploit Protection. This topic identifies those features and explains how the features have changed or evolved. +[Evaluate Exploit Protection](evaluate-exploit-protection.md) | Undertake a demo scenario to see how Exploit Protection mitigations can protect your network from malicious and suspicious behavior. +[Enable Exploit Protection](enable-exploit-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage Exploit Protection in your network. See how to configure mitigations for the operating system and for individual apps, and how to export, import, and deploy the settings across your organization. You can also convert an existing EMET configuration profile and import it into Exploit Protection. diff --git a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md new file mode 100644 index 0000000000..4aac198c95 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md @@ -0,0 +1,46 @@ +--- +title: Turn on the protected folders feature in Windows 10 +keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, enable, turn on, use +description: Learn how to protect your important files by enabling Controlled Folder Access +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +ms.author: iawilt +--- + + + +# Import, export, and deploy Exploit Protection configurations + + +**Applies to:** + +- Windows 10 Insider Preview + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- Group Policy +- PowerShell +- Configuration service providers for mobile device management + + + + + + +## Related topics + +- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) +- [Customize Controlled Folder Access](customize-controlled-folders-exploit-guard.md) +- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md index b6475785db..f7255b5a9b 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md @@ -33,11 +33,18 @@ ms.author: iawilt - Configuration service providers for mobile device management -Network Protection is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +Network Protection helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. + +It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). + +Network Protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). You can enable Network Protection in either block or auditing mode (non-blocking, Windows Defender Advanced Threat Protection events only) with Group Policy, PowerShell, or MDM settings with CSP. +You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Network Protection would impact your organization if it were enabled. + + ## Requirements diff --git a/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml b/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml new file mode 100644 index 0000000000..7077dde1b9 --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml @@ -0,0 +1,21 @@ + + + + + Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC + 1125,1126,5007 + 0 + False + + + + Network Protection view + + + + + + + + + \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 3263a0c3d3..3eb82f73cb 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -35,21 +35,24 @@ You can use Windows Defender EG to: - Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) - Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) -Evaluate Windows Defender EG with our evaluation and set-up guide, which provides a pre-built PowerShell script and testing tool so you can see the new features in action: +Evaluate each feature of Windows Defender EG with the guides at the following link, which provide pre-built PowerShell scripts and testing tools so you can see the features in action: - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) -You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for Windows Defender EG, which provides with reporting and event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. + +You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for Windows Defender EG, which provides you with basic event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. Windows Defender EG can be managed and reported on in the Windows Defender Security Center as part of the Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies, which also includes: - [The Windows Defender ATP console](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) - [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -- [Windows Defender Device Guard] +- Windows Defender Device Guard - [Windows Defender Application Guard](../windows-defender-application-guard/wd-app-guard-overview.md) +You can use the Windows Defender ATP console to obtain detailed reporting into events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). + Each of the features in Windows Defender EG have slightly different requirements: -Feature | Windows Defender Antivirus | Windows Defender Advanced Threat Protection license +Feature | [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10) | [Windows Defender Advanced Threat Protection license](../windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection) -|-|-|- Exploit Protection | No requirement | Required for reporting in the Windows Defender ATP console Attack Surface Reduction | Must be enabled | Required @@ -65,8 +68,8 @@ Controlled Folder Access | Must be enabled | Required for reporting in the Windo Topic | Description ---|--- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard) | Exploit Protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. -[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as macro, script, PowerShell, USB, and Flash security policies and configuration. -[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors, and set up reporting for suspicious activity. -[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (such as ransomware malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. +[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as Office-based malicious macro code and PowerShell, VBScript, and JavaScript scripts. +[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors. +[Protect important folders with Controlled Folder Access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (including ransomware encryption malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. From 70a30ac75714a558e11526a48457a96fd4e2ff31 Mon Sep 17 00:00:00 2001 From: Misha Kutsovsky Date: Thu, 17 Aug 2017 06:24:52 +0000 Subject: [PATCH 24/54] Updated network-protection-exploit-guard.md with general description details --- .../network-protection-exploit-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md index f7255b5a9b..c3559b3cdf 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md @@ -33,9 +33,9 @@ ms.author: iawilt - Configuration service providers for mobile device management -Network Protection helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +Network Protection help prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. By bringing smartscreen intel down onto the client, Network Protection block all outboud HTTP/S Traffic to low reputation sources based on Domain/Hostname -It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). +As a part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md), Network Protection reduces the attak surface of your devices from internet based threats. Network Protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). From d81a813ccbe92005991d94fcb72da8ecd82fce9e Mon Sep 17 00:00:00 2001 From: Misha Kutsovsky Date: Thu, 17 Aug 2017 06:28:43 +0000 Subject: [PATCH 25/54] Updated enable-network-protection.md small updates to Note (removed some text) --- .../enable-network-protection.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md index dbe561aedf..47c9a89313 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md @@ -38,12 +38,10 @@ Network Protection is a feature that is part of [Windows Defender Exploit Guard] ## Enable and audit Network Protection -You can enable Network Protection in either block or auditing mode (non-blocking, Windows Defender Advanced Threat Protection events only) with Group Policy, PowerShell, or MDM settings with CSP. +You can enable Network Protection in either audit or block mode with Group Policy, PowerShell, or MDM settings with CSP. For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). ->[!NOTE] ->What does it mean by non blocking ATP events only? ### Use Group Policy to enable Network Protection From 81b59c5d23017697cc70830a6189eb94e79ab1c6 Mon Sep 17 00:00:00 2001 From: Misha Kutsovsky Date: Thu, 17 Aug 2017 06:32:16 +0000 Subject: [PATCH 26/54] Updated evaluate-network-protection.md Added Phishing example as suggestion for Network Protection --- .../evaluate-network-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md index 6b4bbfdb3b..1832fefeeb 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md @@ -56,7 +56,7 @@ You can also carry out the processes described in this topic in audit or disable 1. Open Internet Explorer, Google Chrome, or any other browser of your choice. 1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net). - +> should we add https://smartscreentestratings2.net/index.html as the test site for this example. Display a sample phishing site, and then show what happens when you go to it with Network Protection enabled You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked. ![](images/np-notif.png) From 03589ee1685da4546b4c55551a9b477f0c00bc22 Mon Sep 17 00:00:00 2001 From: Misha Kutsovsky Date: Thu, 17 Aug 2017 06:52:33 +0000 Subject: [PATCH 27/54] Updated windows-defender-exploit-guard.md Added WD-EG descriptions, added a note --- .../windows-defender-exploit-guard.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 3eb82f73cb..7b87e5427a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -26,14 +26,15 @@ ms.author: iawilt - Enterprise security administrators -Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. +Windows Defender Exploit Guard is a new set of host intrusion prevention capabilities for Windows 10, allowing enterprise administrators to manage the attack surface of the OS & applications. By resticting the various vectors through which malware can cause harm to your devices, Windows Defender offers a defense in depth solution to keeping the enteprise safe. With a rich collection of tools and features based off the Intelligent Security Graph, Exploit Guard provides an easy to use experience that offers the best balance of security & productivity for an enterprise. -You can use Windows Defender EG to: +You can use Windows Defender Exploit Guard (WDEG) to configure and manage any of the following functionalities: - Apply exploit mitigation techniques to apps your organization uses, both individually and to all apps, with [Exploit Protection](exploit-protection-exploit-guard.md) -- Reduce the attack surface that exploits can leverage, by utlizing rules that go beyond standard host-intrusion prevention systems (HIPS) with [Attack Surface Reduction rules](attack-surface-reduction-exploit-guard.md) -- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity outside of the browser with [Network Protection](network-protection-exploit-guard.md) +- Reduce the attack surface of your applications with intelligent rule that stop vectors of office, script & mail based malware [Attack Surface Reduction rules](attack-surface-reduction-exploit-guard.md) +- Extend the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity on the device wwith [Network Protection](network-protection-exploit-guard.md) - Protect files in key system folders from changes made by malicious and suspicious apps with [Controlled Folder Access](controlled-folders-exploit-guard.md) +> How do we make the naming more clear here: could we go name first? Evaluate each feature of Windows Defender EG with the guides at the following link, which provide pre-built PowerShell scripts and testing tools so you can see the features in action: - [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) From 9d1d638b6a8a77b8e91831ef8d438768f6abe3d4 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Sun, 20 Aug 2017 17:56:07 -0700 Subject: [PATCH 28/54] exprot --- .../customize-exploit-protection.md | 9 ++- .../emet-exploit-protection-exploit-guard.md | 11 ++- .../enable-exploit-protection.md | 80 ++++++------------- .../enable-network-protection.md | 10 ++- .../evaluate-exploit-protection.md | 9 ++- .../exploit-protection-exploit-guard.md | 14 ++++ ...port-export-exploit-protection-emet-xml.md | 8 +- 7 files changed, 72 insertions(+), 69 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md index 57aa7dde33..17f8c23087 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -85,7 +85,8 @@ See the [Windows Defender Security Center](../windows-defender-security-center/w ## Related topics -- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) -- [Enable Attack Surface Reduction](enable-attack-surface-reduction.md) -- [Evaluate Attack Surface Reduction](evaluate-attack-surface-reduction.md) - +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) +- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) +- [Evaluate Exploit Protection](evaluate-exploit-protection.md) +- [Enable Exploit Protection](enable-exploit-protection.md) +- [Import, export, and deploy Exploit Protection configurations](import-export-exploit-protection-emet-xml.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md index 9dbb92d72d..9af571fe10 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md @@ -253,4 +253,13 @@ You can import the XML file to other machines in your organization. You can do t How do you see these event logs? Are they under specific codes/areas? -Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. \ No newline at end of file +Also - is there any SCCM, Intune, or MDM functionality here? Can't see anything in the SCCM console. + + + + +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) +- [Evaluate Exploit Protection](evaluate-exploit-protection.md) +- [Enable Exploit Protection](enable-exploit-protection.md) +- [Configure and audit Exploit Protection mitigations](customize-exploit-protection.md) +- [Import, export, and deploy Exploit Protection configurations](import-export-exploit-protection-emet-xml.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md index c062b2db26..6281a70c77 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md @@ -1,7 +1,7 @@ --- -title: Turn on the protected folders feature in Windows 10 -keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, enable, turn on, use -description: Learn how to protect your important files by enabling Controlled Folder Access +title: +keywords: +description: search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -35,71 +35,39 @@ ms.author: iawilt - Configuration service providers for mobile device management -Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). +Exploit Protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level. -This topic describes how to enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). +Many of the features that are part of the Enhance Mitigation Experience Toolkit (EMET) are included in Exploit Protection. See the [Comparison between EMET and Exploit Protection](emet-exploit-protection-exploit-guard.md). + +It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). -## Enable and audit Controlled Folder Access -You can enable Controlled Folder Access with the Windows Defender Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. +## Enable and audit Exploit Protection -For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). +You enable and configure each Exploit Protection mitigation separately. Some mitigations apply to the entire operating system, while others can be targeted towards specific apps. +The mitigations available in Exploit Protection are enabled or configured to their default values automatically in Windows 10. However, you can customize the configuration to suit your organization and then deploy that configuration across your network. -### Use the Windows Defender Security app to enable Controlled Folder Access +You can also set mitigations to audit mode. Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine. -1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. +For background information on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: +You can also convert an existing EMET configuration file (in XML format) and import it into Exploit Protection. This is useful if you have been using EMET and have a customized series of policies and mitigations that you want to keep using. - ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](../windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png) - -3. Set the switch for the feature to **On** +See the following topics for instructions on configuring Exploit Protection mitigations and importing, exporting, and converting configurations: - ![](images/cfa-on.png) - -### Use Group Policy to enable Controlled Folder Access - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled Folder Access**. - -6. Double-click the **Configure controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The Controlled Folder Access feature will not work. All apps can make changes to files in protected folders. - - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. - - - ![](images/cfa-gp-enable.png) - ->[!IMPORTANT] ->To fully enable the Controlled Folder Access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. - -### Use PowerShell to enable Controlled Folder Access - -1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** -2. Enter the following cmdlet: - - ```PowerShell - Set-MpPreference -EnableControlledFolderAccess Enabled - ``` - -You can enable the feauting in auditing mode by specifying `AuditMode` instead of `Enabled`. - -Use `Disabled` to turn the feature off. - -### Use MDM CSPs to enable Controlled Folder Access - -Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders. +1. [Configure the mitigations you want to enable or audit](customize-exploit-protection.md) +2. [Export the configuration to an XML file that you can use to deploy the configuration to multiple machines](import-export-exploit-protection-emet-xml). ## Related topics -- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) -- [Customize Controlled Folder Access](customize-controlled-folders-exploit-guard.md) -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) +- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) +- [Evaluate Exploit Protection](evaluate-exploit-protection.md) +- [Configure and audit Exploit Protection mitigations](customize-exploit-protection.md) +- [Import, export, and deploy Exploit Protection configurations](import-export-exploit-protection-emet-xml.md) + + + diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md index 47c9a89313..fc4ef85457 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md @@ -35,15 +35,17 @@ ms.author: iawilt Network Protection is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +This topic describes how to enable Network Protection with Group Policy, PowerShell cmdlets, and configuration service providers (CSPs) for mobile device management (MDM). + ## Enable and audit Network Protection You can enable Network Protection in either audit or block mode with Group Policy, PowerShell, or MDM settings with CSP. -For further details on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). +For background information on how audit mode works, and when you might want to use it, see the [auditing Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md). -### Use Group Policy to enable Network Protection +### Use Group Policy to enable or audit Network Protection 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -64,7 +66,7 @@ For further details on how audit mode works, and when you might want to use it, >To fully enable the Network Protection feature, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu. - ### Use PowerShell to enable Network Protection + ### Use PowerShell to enable or audit Network Protection 1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** 2. Enter the following cmdlet: @@ -83,7 +85,7 @@ Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off. -### Use MDM CSPs to enable Network Protection +### Use MDM CSPs to enable or audit Network Protection Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure Network Protection. diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md index 8f57ca59bb..db654e9f29 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md @@ -193,4 +193,11 @@ b. IE should open as expected ### Managing Exploit Protection through Group Policy 1. Launch Group Policy Management Console (gpmc.msc) and from within and existing or new GPO navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection** and open the policy named *Use a common set of exploit protection settings*. 2. Enable the setting as seen below and point to an accessible location for the client machines to the recently created XML. -3. Apply the new GP to targeted machines by direction OU membership, Security Group or WMI filter. \ No newline at end of file +3. Apply the new GP to targeted machines by direction OU membership, Security Group or WMI filter. + + +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) +- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) +- [Enable Exploit Protection](enable-exploit-protection.md) +- [Configure and audit Exploit Protection mitigations](customize-exploit-protection.md) +- [Import, export, and deploy Exploit Protection configurations](import-export-exploit-protection-emet-xml.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md index aee8fe555a..e900fe8bec 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md @@ -50,6 +50,20 @@ Exploit Protection works best with [Windows Defender Advanced Threat Protection] + + ############### + What is Exploit Protection?[edit | edit source] +The Exploit Protection feature set, a subset of the all-up Windows Defender Exploit Guard effort, enables pro users and IT admins/SecOps personnel to view, audit, and configure system and application security mitigations—in turn allowing them to raise the cost of exploitation and reduce attack surface in their environments. +Exploit Protection is rapidly shaping up to be the new and improved in-box EMET replacement for Windows 10. This has been well-received by our customers, who were formerly concerned about EMET’s upcoming EOL and the disparity between EMET and Windows 10, but are now happy to see that their feedback has been internalized and is being acted upon. +Exploit Protection is comprised mainly of 3 pillars: +Security mitigations built-in to the OS, now also including legacy app protection for apps that are not yet re-compiled to take advantage of CFG +Improved manageability experience, including support for SCCM, Intune, and Group Policy management +Reporting and auditing capabilities, including a better-together story with Windows Defender ATP +####################### + + + + ## Requirements The following requirements must be met before Exploit Protection will work: diff --git a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md index 4aac198c95..68a672efa7 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md +++ b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md @@ -41,6 +41,8 @@ ms.author: iawilt ## Related topics -- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) -- [Customize Controlled Folder Access](customize-controlled-folders-exploit-guard.md) -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) +- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) +- [Evaluate Exploit Protection](evaluate-exploit-protection.md) +- [Enable Exploit Protection](enable-exploit-protection.md) +- [Configure and audit Exploit Protection mitigations](customize-exploit-protection.md) From 279a10a397172b7321328dfe2d37fc15ea845070 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Sun, 20 Aug 2017 19:11:18 -0700 Subject: [PATCH 29/54] exp prot inc mit dets --- .../customize-exploit-protection.md | 67 ++++++------------- .../exploit-protection-exploit-guard.md | 23 ++----- .../scripts/ep-events.xml | 48 +++++++++++-- 3 files changed, 66 insertions(+), 72 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md index 17f8c23087..75e3768ee9 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -1,7 +1,7 @@ --- -title: Configure how ASR works so you can finetune the protection in your network -description: You can individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from ASR -keywords: Attack Surface Reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, customize, configure, exclude +title: +keywords: +description: search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -32,54 +32,27 @@ ms.author: iawilt - Configuration service providers for mobile device management -Attack Surface Reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. - -This topic describes how to customize Attack Surface Reduction by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer. - -You can use Group Policy, PowerShell, and MDM CSPs to configure these settings. - -## Exclude files and folders - -You can exclude files and folders from being evaluated by Attack Surface Reduction rules. - -You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the exclusions should only be applied to individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode). - -### Use Group Policy to exclude files and folders - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction**. - -6. Double-click the **Exclude files and paths from Attack Surface Reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. - -### Use PowerShell to exclude files and folderss - -1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** -2. Enter the following cmdlet: - - ```PowerShell - Add-MpPreference -AttackSurfaceReductionOnlyExclusions "" - ``` - -Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more folders to the list. +> [!div class="checklist"] +> * Log in to Azure +> * Create a resource group +> * Prepare the configuration +> * Create a virtual machine +> * Configure the firewall +> * Snapshot the virtual machine +> * Run management tasks ->[!IMPORTANT] ->Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. - -### Use MDM CSPs to exclude files and folders - -Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. +head | text +-|- +text | > [!div class="checklist"] > * Log in to Azure - -## Customize the notification - -See the [Windows Defender Security Center](../windows-defender-security-center/windows-defender-security-center#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. +> * Create a resource group +> * Prepare the configuration +> * Create a virtual machine +> * Configure the firewall +> * Snapshot the virtual machine +> * Run management tasks diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md index e900fe8bec..988cc27d0f 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md @@ -40,30 +40,17 @@ It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md Exploit Protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection). - You configure these settings using the Windows Defender Security Center app on an individual machine, and then [export the configuration as an XML file that you can deploy to other machines](import-export-exploit-protection-emet-xml.md). You can use Group Policy to distribute the XML file to multiple devices at once. + You [configure these settings using the Windows Defender Security Center app or PowerShell](customize-exploit-protection.md) on an individual machine, and then [export the configuration as an XML file that you can deploy to other machines](import-export-exploit-protection-emet-xml.md). You can use Group Policy to distribute the XML file to multiple devices at once. - Exploit Protection consists of a number of mitigations that are designed to protect against typical malware infection behavior - especially for malware that attempts to exploit software vulnerabilities to spread and infect machines. + You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Exploit Protection would impact your organization if it were enabled. Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection. - You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Attack Surface Reduction would impact your organization if it were enabled. + >[!IMPORTANT] + >If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit Protection in Windows 10. - - ############### - What is Exploit Protection?[edit | edit source] -The Exploit Protection feature set, a subset of the all-up Windows Defender Exploit Guard effort, enables pro users and IT admins/SecOps personnel to view, audit, and configure system and application security mitigations—in turn allowing them to raise the cost of exploitation and reduce attack surface in their environments. -Exploit Protection is rapidly shaping up to be the new and improved in-box EMET replacement for Windows 10. This has been well-received by our customers, who were formerly concerned about EMET’s upcoming EOL and the disparity between EMET and Windows 10, but are now happy to see that their feedback has been internalized and is being acted upon. -Exploit Protection is comprised mainly of 3 pillars: -Security mitigations built-in to the OS, now also including legacy app protection for apps that are not yet re-compiled to take advantage of CFG -Improved manageability experience, including support for SCCM, Intune, and Group Policy management -Reporting and auditing capabilities, including a better-together story with Windows Defender ATP -####################### - - - - ## Requirements The following requirements must be met before Exploit Protection will work: @@ -116,7 +103,7 @@ Security-Mitigations | 22 | ROP CallerCheck enforce Security-Mitigations | 23 | ROP SimExec audit Security-Mitigations | 24 | ROP SimExec enforce WER-Diagnostics | 5 | CFG Block -Provider: Win32K | 260 | Untrusted Font +Win32K | 260 | Untrusted Font ## In this section diff --git a/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml b/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml index 7077dde1b9..24e207a21d 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml +++ b/windows/threat-protection/windows-defender-exploit-guard/scripts/ep-events.xml @@ -2,20 +2,54 @@ - Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC - 1125,1126,5007 + Microsoft-Windows-Security-Mitigations/KernelMode,Microsoft-Windows-Win32k/Concurrency,Microsoft-Windows-Win32k/Contention,Microsoft-Windows-Win32k/Messages,Microsoft-Windows-Win32k/Operational,Microsoft-Windows-Win32k/Power,Microsoft-Windows-Win32k/Render,Microsoft-Windows-Win32k/Tracing,Microsoft-Windows-Win32k/UIPI,System,Microsoft-Windows-Security-Mitigations/UserMode + 1-24, 5, 260 + Microsoft-Windows-Security-Mitigations,Microsoft-Windows-WER-Diag,Microsoft-Windows-Win32k,Win32k 0 - False + True - Network Protection view + Exploit protection view - - - + + + + + + + + + + + + + + + 255 + 70 + 305 + 215 + 215 + 215 + 50 + 110 + 80 + 170 + 70 + 70 + 90 + 70 + 80 + 70 + 100 + 85 + 140 + 140 + + \ No newline at end of file From e0dafddad508915ef6804ca95e2c770f189b566c Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 21 Aug 2017 02:17:33 +0000 Subject: [PATCH 30/54] Updated customize-exploit-protection.md --- .../customize-exploit-protection.md | 22 ++++++++----------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md index 75e3768ee9..0e94ece453 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -32,6 +32,12 @@ ms.author: iawilt - Configuration service providers for mobile device management + + + + + + + +
    HeadHead2
    Item > [!div class="checklist"] > * Log in to Azure > * Create a resource group @@ -40,19 +46,9 @@ ms.author: iawilt > * Configure the firewall > * Snapshot the virtual machine > * Run management tasks - - -head | text --|- -text | > [!div class="checklist"] > * Log in to Azure - - -> * Create a resource group -> * Prepare the configuration -> * Create a virtual machine -> * Configure the firewall -> * Snapshot the virtual machine -> * Run management tasks +
    From f9729d73fdff528deae43928e7602a0602e275b6 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 21 Aug 2017 02:19:05 +0000 Subject: [PATCH 31/54] Updated customize-exploit-protection.md --- .../customize-exploit-protection.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md index 0e94ece453..b771752f78 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -37,16 +37,7 @@ ms.author: iawilt HeadHead2 Item - -> [!div class="checklist"] -> * Log in to Azure -> * Create a resource group -> * Prepare the configuration -> * Create a virtual machine -> * Configure the firewall -> * Snapshot the virtual machine -> * Run management tasks - +