From 5dd6a6d717874c5ba0af0b1ebda0a978e0f98f9a Mon Sep 17 00:00:00 2001 From: Kevin Sheehan <116211220+kbsheehan@users.noreply.github.com> Date: Mon, 18 Mar 2024 16:02:53 -0400 Subject: [PATCH 1/8] Update unifiedwritefilter-csp.md Added Windows 11 support in the note. --- windows/client-management/mdm/unifiedwritefilter-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index 1df0f1e524..d4bcc4bdc1 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -19,7 +19,7 @@ The table below shows the applicability of Windows: The UnifiedWriteFilter (UWF) configuration service provider enables the IT administrator to remotely manage the UWF to help protect physical storage media including any writable storage type. -> **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10 Enterprise and Windows 10 Education. +> **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10/11 Enterprise and Windows 10/11 Education. The following example shows the UWF configuration service provider in tree format. ``` From 35decd4fea0f8c8815eb91eff5b8d00aa7895279 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 22 Mar 2024 09:38:49 -0700 Subject: [PATCH 2/8] wordpad-dep-moreinfo-8840580 --- windows/whats-new/deprecated-features-resources.md | 12 +++++++++++- windows/whats-new/deprecated-features.md | 4 ++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/windows/whats-new/deprecated-features-resources.md b/windows/whats-new/deprecated-features-resources.md index 31d2f8b2ba..2bafb5aff4 100644 --- a/windows/whats-new/deprecated-features-resources.md +++ b/windows/whats-new/deprecated-features-resources.md @@ -1,7 +1,7 @@ --- title: Resources for deprecated features in the Windows client description: Resources and details for deprecated features in the Windows client. -ms.date: 10/09/2023 +ms.date: 03/25/2024 ms.service: windows-client ms.subservice: itpro-fundamentals ms.localizationpriority: medium @@ -21,6 +21,16 @@ appliesto: This article provides additional resources about [deprecated features for Windows client](deprecated-features.md) that may be needed by IT professionals. The following information is provided to help IT professionals plan for the removal of deprecated features: +## WordPad + +WordPad will be removed from all editions of Windows in an upcoming release. As a result, Windows will no longer have a built-in, default RTF reader. We recommend Microsoft Word for rich text documents like .doc and .rtf and Notepad for plain text documents like .txt. The following binaries will be removed as a result of WordPad removal: + +- wordpad.exe +- wordpadfilter.dll +- write.exe + +Avoid taking a direct dependency on these binaries and Wordpad in your product. Instead, for trying to open a text file, rely on Microsoft Word or Notepad. + ## VBScript VBScript will be available as a [feature on demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) before being retired in future Windows releases. Initially, the VBScript feature on demand will be preinstalled to allow for uninterrupted use while you prepare for the retirement of VBScript. diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 240545d36a..dc1d26cacc 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 03/14/2024 +ms.date: 03/25/2024 ms.service: windows-client ms.subservice: itpro-fundamentals ms.localizationpriority: medium @@ -62,7 +62,7 @@ The features in this article are no longer being actively developed, and might b | Remote Mailslots | Remote Mailslots are deprecated. The Remote Mailslot protocol is a dated, simple, unreliable, insecure IPC method first introduced in MS DOS. This protocol was first disabled by default in [Windows 11 Insider Preview Build ](https://blogs.windows.com/windows-insider/2023/03/08/announcing-windows-11-insider-preview-build-25314/). For more information on Remote Mailslots, see [About Mailslots](/windows/win32/ipc/about-mailslots) and [[MS-MAIL]: Remote Mailslot Protocol](/openspecs/windows_protocols/ms-mail/8ea19aa4-6e5a-4aed-b628-0b5cd75a1ab9).| November 2023 | | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | -| WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | +| WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt.

**[Update - March 2024]**: If you're a developer and need information about the affected binaries, see [Resources for deprecated features](deprecated-features-resources.md#wordpad). | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn, which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | | TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| | Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | From eed9febe43ca8a0d8a19b64d502a413e89d11e13 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 22 Mar 2024 10:19:20 -0700 Subject: [PATCH 3/8] wordpad-dep-moreinfo-8840580 --- windows/whats-new/deprecated-features-resources.md | 2 +- windows/whats-new/deprecated-features.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/deprecated-features-resources.md b/windows/whats-new/deprecated-features-resources.md index 2bafb5aff4..521dc1b1be 100644 --- a/windows/whats-new/deprecated-features-resources.md +++ b/windows/whats-new/deprecated-features-resources.md @@ -23,7 +23,7 @@ This article provides additional resources about [deprecated features for Window ## WordPad -WordPad will be removed from all editions of Windows in an upcoming release. As a result, Windows will no longer have a built-in, default RTF reader. We recommend Microsoft Word for rich text documents like .doc and .rtf and Notepad for plain text documents like .txt. The following binaries will be removed as a result of WordPad removal: +WordPad will be removed from all editions of Windows starting in Windows 11, version 24H2 and Windows Server 2025. As a result, Windows will no longer have a built-in, default RTF reader. We recommend Microsoft Word for rich text documents like .doc and .rtf and Notepad for plain text documents like .txt. The following binaries will be removed as a result of WordPad removal: - wordpad.exe - wordpadfilter.dll diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index dc1d26cacc..bdd77ff872 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -62,7 +62,7 @@ The features in this article are no longer being actively developed, and might b | Remote Mailslots | Remote Mailslots are deprecated. The Remote Mailslot protocol is a dated, simple, unreliable, insecure IPC method first introduced in MS DOS. This protocol was first disabled by default in [Windows 11 Insider Preview Build ](https://blogs.windows.com/windows-insider/2023/03/08/announcing-windows-11-insider-preview-build-25314/). For more information on Remote Mailslots, see [About Mailslots](/windows/win32/ipc/about-mailslots) and [[MS-MAIL]: Remote Mailslot Protocol](/openspecs/windows_protocols/ms-mail/8ea19aa4-6e5a-4aed-b628-0b5cd75a1ab9).| November 2023 | | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | -| WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt.

**[Update - March 2024]**: If you're a developer and need information about the affected binaries, see [Resources for deprecated features](deprecated-features-resources.md#wordpad). | September 1, 2023 | +| WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt.

**[Update - March 2024]**: WordPad will be removed from all editions of Windows starting in Windows 11, version 24H2 and Windows Server 2025. If you're a developer and need information about the affected binaries, see [Resources for deprecated features](deprecated-features-resources.md#wordpad). | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn, which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | | TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| | Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | From 8118e07c87f3e4d24c74a654d6b8b273cabc102c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 22 Mar 2024 10:29:44 -0700 Subject: [PATCH 4/8] wordpad-dep-moreinfo-8840580 --- windows/whats-new/deprecated-features.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index bdd77ff872..851c356c74 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -19,13 +19,13 @@ appliesto: # Deprecated features for Windows client -Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they've added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that have been removed, see [Windows features removed](removed-features.md). +Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that were removed, see [Windows features removed](removed-features.md). For more information about features in Windows 11, see [Feature deprecations and removals](https://www.microsoft.com/windows/windows-11-specifications#table3). To understand the distinction between *deprecation* and *removal*, see [Windows client features lifecycle](feature-lifecycle.md). -The features in this article are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. +The features in this article are no longer being actively developed, and might be removed in a future update. Some features were replaced with other features or functionality and some are now available from other sources. > [!TIP] > You can use RSS to be notified when this page is updated. For example, the following RSS link includes this article: @@ -63,12 +63,12 @@ The features in this article are no longer being actively developed, and might b | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt.

**[Update - March 2024]**: WordPad will be removed from all editions of Windows starting in Windows 11, version 24H2 and Windows Server 2025. If you're a developer and need information about the affected binaries, see [Resources for deprecated features](deprecated-features-resources.md#wordpad). | September 1, 2023 | -| AllJoyn | Microsoft's implementation of AllJoyn, which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | +| AllJoyn | Microsoft's implementation of AllJoyn, which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) is deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | | TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| | Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | | Microsoft Support Diagnostic Tool (MSDT) | [MSDT](/windows-server/administration/windows-commands/msdt) is deprecated and will be removed in a future release of Windows. MSDT is used to gather diagnostic data for analysis by support professionals. For more information, see [Resources for deprecated features](deprecated-features-resources.md) | January 2023 | | Universal Windows Platform (UWP) Applications for 32-bit Arm | This change is applicable only to devices with an Arm processor, for example Snapdragon processors from Qualcomm. If you have a PC built with a processor from Intel or AMD, this content isn't applicable. If you aren't sure which type of processor you have, check **Settings** > **System** > **About**.

Support for 32-bit Arm versions of applications will be removed in a future release of Windows 11. After this change, for the small number of applications affected, app features might be different and you might notice a difference in performance. For more technical details about this change, see [Update app architecture from Arm32 to Arm64](/windows/arm/arm32-to-arm64). | January 2023 | -| Update Compliance | [Update Compliance](/windows/deployment/update/update-compliance-monitor), a cloud-based service for the Windows client, is no longer being developed. This service has been replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | November 2022| +| Update Compliance | [Update Compliance](/windows/deployment/update/update-compliance-monitor), a cloud-based service for the Windows client, is no longer being developed. This service was replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | November 2022| | Windows Information Protection | [Windows Information Protection](/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip) will no longer be developed in future versions of Windows. For more information, see [Announcing sunset of Windows Information Protection (WIP)](https://go.microsoft.com/fwlink/?linkid=2202124).

For your data protection needs, Microsoft recommends that you use [Microsoft Purview Information Protection](/microsoft-365/compliance/information-protection) and [Microsoft Purview Data Loss Prevention](/microsoft-365/compliance/dlp-learn-about-dlp). | July 2022 | | BitLocker To Go Reader | **Note: BitLocker to Go as a feature is still supported.**
Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows client.
The following items might not be available in a future release of Windows client:
- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**
- Command line parameter: [`manage-bde -DiscoveryVolumeType`](/windows-server/administration/windows-commands/manage-bde-on) (-dv)
- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**
- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 | | Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | @@ -86,7 +86,7 @@ The features in this article are no longer being actively developed, and might b | Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which aren't as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 | | Print 3D app | 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| 1903 | |Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this reason, and because non-Microsoft partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 | -|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| 1809 | +|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We added a sync engine to the Outlook app that provides the same synchronization.| 1809 | |[Software Restriction Policies](/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| 1803 | |[Offline symbol packages](/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](/archive/blogs/windbg/update-on-microsofts-symbol-server). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| 1803 | |Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. For more information, see [Error opening Help in Windows-based programs: "Feature not included" or "Help not supported"](https://support.microsoft.com/topic/error-opening-help-in-windows-based-programs-feature-not-included-or-help-not-supported-3c841463-d67c-6062-0ee7-1a149da3973b).| 1803 | @@ -113,7 +113,7 @@ The features in this article are no longer being actively developed, and might b |TLS DHE_DSS ciphers DisabledByDefault| [TLS RC4 Ciphers](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server) will be disabled by default in this release. | 1703 | |TCPChimney | TCP Chimney Offload is no longer being developed. See [Performance Tuning Network Adapters](/windows-server/networking/technologies/network-subsystem/net-sub-performance-tuning-nics). | 1703 | |IPsec Task Offload| [IPsec Task Offload](/windows-hardware/drivers/network/task-offload) versions 1 and 2 are no longer being developed and shouldn't be used. | 1703 | -|`wusa.exe /uninstall /kb:####### /quiet`|The `wusa` tool usage to quietly uninstall an update has been deprecated. The uninstall command with `/quiet` switch fails with event ID 8 in the Setup event log. Uninstalling updates quietly could be a security risk because malicious software could quietly uninstall an update in the background without user intervention.|1507
Applies to Windows Server 2016 and Windows Server 2019.| +|`wusa.exe /uninstall /kb:####### /quiet`|The `wusa` tool usage to quietly uninstall an update is deprecated. The uninstall command with `/quiet` switch fails with event ID 8 in the Setup event log. Uninstalling updates quietly could be a security risk because malicious software could quietly uninstall an update in the background without user intervention.|1507
Applies to Windows Server 2016 and Windows Server 2019.| From 17a23a9ffada22435934a6db9e37fae434e01a48 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 26 Mar 2024 11:15:47 -0600 Subject: [PATCH 5/8] Freshness update --- ...tion-based-protection-of-code-integrity.md | 182 ++++++------------ ...ormation-virtualization-based-security.png | Bin 84515 -> 13287 bytes 2 files changed, 63 insertions(+), 119 deletions(-) diff --git a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md index 81b826505e..b1448ef801 100644 --- a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md @@ -2,7 +2,7 @@ title: Enable memory integrity description: This article explains the steps to opt in to using memory integrity on Windows devices. ms.topic: conceptual -ms.date: 03/16/2023 +ms.date: 03/26/2024 appliesto: - "✅ Windows 11" - "✅ Windows 10" @@ -16,14 +16,13 @@ appliesto: **Memory integrity** is a virtualization-based security (VBS) feature available in Windows. Memory integrity and VBS improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows kernel. VBS uses the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Memory integrity is a critical component that protects and hardens Windows by running kernel mode code integrity within the isolated virtual environment of VBS. Memory integrity also restricts kernel memory allocations that could be used to compromise the system. > [!NOTE] -> Memory integrity works better with Intel Kabylake and higher processors with *Mode-Based Execution Control*, and AMD Zen 2 and higher processors with *Guest Mode Execute Trap* capabilities. Older processors rely on an emulation of these features, called *Restricted User Mode*, and will have a bigger impact on performance. When nested virtualization is enabled, memory integrity works better when the VM is version >= 9.3. +> +> - Memory integrity is sometimes referred to as *hypervisor-protected code integrity (HVCI)* or *hypervisor enforced code integrity*, and was originally released as part of *Device Guard*. Device Guard is no longer used except to locate memory integrity and VBS settings in Group Policy or the Windows registry. +> - Memory integrity works better with Intel Kabylake and higher processors with *Mode-Based Execution Control*, and AMD Zen 2 and higher processors with *Guest Mode Execute Trap* capabilities. Older processors rely on an emulation of these features, called *Restricted User Mode*, and will have a bigger impact on performance. When nested virtualization is enabled, memory integrity works better when the VM is version >= 9.3. > [!WARNING] > Some applications and hardware device drivers may be incompatible with memory integrity. This incompatibility can cause devices or software to malfunction and in rare cases may result in a boot failure (blue screen). Such issues may occur after memory integrity has been turned on or during the enablement process itself. If compatibility issues occur, see [Troubleshooting](#troubleshooting) for remediation steps. -> [!NOTE] -> Memory integrity is sometimes referred to as *hypervisor-protected code integrity (HVCI)* or *hypervisor enforced code integrity*, and was originally released as part of *Device Guard*. Device Guard is no longer used except to locate memory integrity and VBS settings in Group Policy or the Windows registry. - ## Memory integrity features - Protects modification of the Control Flow Guard (CFG) bitmap for kernel mode drivers. @@ -47,21 +46,16 @@ Beginning with Windows 11 22H2, **Windows Security** shows a warning if memory i ### Enable memory integrity using Intune -Enabling in Intune requires using the Code Integrity node in the [VirtualizationBasedTechnology CSP](/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology). You can configure these settings by using the [settings catalog](/mem/intune/configuration/settings-catalog). +Use the **Virtualization Based Technology** > **Hypervisor Enforced Code Integrity** setting using the [settings catalog](/mem/intune/configuration/settings-catalog) to enable memory integrity. You can also use the HypervisorEnforcedCodeIntegrity node in the [VirtualizationBasedTechnology CSP](/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology). ### Enable memory integrity using Group Policy 1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one. - -2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. - -3. Double-click **Turn on Virtualization Based Security**. - -4. Select **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled without UEFI lock**. Only select **Enabled with UEFI lock** if you want to prevent memory integrity from being disabled remotely or by policy update. Once enabled with UEFI lock, you must have access to the UEFI BIOS menu to turn off Secure Boot if you want to turn off memory integrity. - +1. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. +1. Double-click **Turn on Virtualization Based Security**. +1. Select **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled without UEFI lock**. Only select **Enabled with UEFI lock** if you want to prevent memory integrity from being disabled remotely or by policy update. Once enabled with UEFI lock, you must have access to the UEFI BIOS menu to turn off Secure Boot if you want to turn off memory integrity. ![Enable memory integrity using Group Policy.](images/enable-hvci-gp.png) - -5. Select **Ok** to close the editor. +1. Select **Ok** to close the editor. To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated command prompt. @@ -69,8 +63,6 @@ To apply the new policy on a domain-joined computer, either restart or run `gpup Set the following registry keys to enable memory integrity. These keys provide exactly the same set of configuration options provided by Group Policy. - - > [!IMPORTANT] > > - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer's hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled. @@ -79,19 +71,13 @@ Set the following registry keys to enable memory integrity. These keys provide e > > - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. -#### For Windows 10 version 1607 and later and for Windows 11 version 21H2 - Recommended settings (to enable memory integrity without UEFI Lock): ```console reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f - reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f - reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f - reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f - reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f ``` @@ -155,52 +141,6 @@ reg delete HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Hyperviso reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "WasEnabledBy" /t REG_DWORD /d 2 /f ``` -#### For Windows 10 version 1511 and earlier - -Recommended settings (to enable memory integrity, without UEFI Lock): - -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f - -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f - -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f - -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f -``` - -If you want to customize the preceding recommended settings, use the following settings. - -**To enable VBS (it is always locked to UEFI)** - -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f -``` - -**To enable VBS and require Secure boot only (value 1)** - -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f -``` - -**To enable VBS with Secure Boot and DMA (value 3)** - -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 3 /f -``` - -**To enable memory integrity (with the default, UEFI lock)** - -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f -``` - -**To enable memory integrity without UEFI lock** - -```console -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f -``` - ### Enable memory integrity using Windows Defender Application Control (WDAC) You can use WDAC policy to turn on memory integrity using any of the following techniques: @@ -214,10 +154,12 @@ You can use WDAC policy to turn on memory integrity using any of the following t ### Validate enabled VBS and memory integrity features -Windows 10, Windows 11, and Windows Server 2016 and higher have a WMI class for VBS-related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: +#### Use Win32_DeviceGuard WMI class + +Windows 10, Windows 11, and Windows Server 2016 and higher have a WMI class for VBS-related properties and features: **Win32_DeviceGuard**. This class can be queried from an elevated Windows PowerShell session by using the following command: ```powershell -Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard +Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard ``` > [!NOTE] @@ -225,83 +167,85 @@ Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windo The output of this command provides details of the available hardware-based security features and those features that are currently enabled. -#### AvailableSecurityProperties +##### AvailableSecurityProperties This field helps to enumerate and report state on the relevant security properties for VBS and memory integrity. -Value | Description --|- -**0.** | If present, no relevant properties exist on the device. -**1.** | If present, hypervisor support is available. -**2.** | If present, Secure Boot is available. -**3.** | If present, DMA protection is available. -**4.** | If present, Secure Memory Overwrite is available. -**5.** | If present, NX protections are available. -**6.** | If present, SMM mitigations are available. -**7.** | If present, MBEC/GMET is available. -**8.** | If present, APIC virtualization is available. +| Value | Description | +|-------|---------------------------------------------------------| +| **0** | If present, no relevant properties exist on the device. | +| **1** | If present, hypervisor support is available. | +| **2** | If present, Secure Boot is available. | +| **3** | If present, DMA protection is available. | +| **4** | If present, Secure Memory Overwrite is available. | +| **5** | If present, NX protections are available. | +| **6** | If present, SMM mitigations are available. | +| **7** | If present, MBEC/GMET is available. | +| **8** | If present, APIC virtualization is available. | -#### InstanceIdentifier +##### InstanceIdentifier A string that is unique to a particular device and set by WMI. -#### RequiredSecurityProperties +##### RequiredSecurityProperties This field describes the required security properties to enable VBS. -Value | Description --|- -**0.** | Nothing is required. -**1.** | If present, hypervisor support is needed. -**2.** | If present, Secure Boot is needed. -**3.** | If present, DMA protection is needed. -**4.** | If present, Secure Memory Overwrite is needed. -**5.** | If present, NX protections are needed. -**6.** | If present, SMM mitigations are needed. -**7.** | If present, MBEC/GMET is needed. +| Value | Description | +|-------|------------------------------------------------| +| **0** | Nothing is required. | +| **1** | If present, hypervisor support is needed. | +| **2** | If present, Secure Boot is needed. | +| **3** | If present, DMA protection is needed. | +| **4** | If present, Secure Memory Overwrite is needed. | +| **5** | If present, NX protections are needed. | +| **6** | If present, SMM mitigations are needed. | +| **7** | If present, MBEC/GMET is needed. | -#### SecurityServicesConfigured +##### SecurityServicesConfigured This field indicates whether Credential Guard or memory integrity has been configured. -Value | Description --|- -**0.** | No services are configured. -**1.** | If present, Credential Guard is configured. -**2.** | If present, memory integrity is configured. -**3.** | If present, System Guard Secure Launch is configured. -**4.** | If present, SMM Firmware Measurement is configured. +| Value | Description | +|-------|-------------------------------------------------------| +| **0** | No services are configured. | +| **1** | If present, Credential Guard is configured. | +| **2** | If present, memory integrity is configured. | +| **3** | If present, System Guard Secure Launch is configured. | +| **4** | If present, SMM Firmware Measurement is configured. | -#### SecurityServicesRunning +##### SecurityServicesRunning This field indicates whether Credential Guard or memory integrity is running. -Value | Description --|- -**0.** | No services running. -**1.** | If present, Credential Guard is running. -**2.** | If present, memory integrity is running. -**3.** | If present, System Guard Secure Launch is running. -**4.** | If present, SMM Firmware Measurement is running. +| Value | Description | +|-------|----------------------------------------------------| +| **0** | No services running. | +| **1** | If present, Credential Guard is running. | +| **2** | If present, memory integrity is running. | +| **3** | If present, System Guard Secure Launch is running. | +| **4** | If present, SMM Firmware Measurement is running. | -#### Version +##### Version This field lists the version of this WMI class. The only valid value now is **1.0**. -#### VirtualizationBasedSecurityStatus +##### VirtualizationBasedSecurityStatus This field indicates whether VBS is enabled and running. -Value | Description --|- -**0.** | VBS isn't enabled. -**1.** | VBS is enabled but not running. -**2.** | VBS is enabled and running. +| Value | Description | +|-------|---------------------------------| +| **0** | VBS isn't enabled. | +| **1** | VBS is enabled but not running. | +| **2** | VBS is enabled and running. | -#### PSComputerName +##### PSComputerName This field lists the computer name. All valid values for computer name. +#### Use msinfo32.exe + Another method to determine the available and enabled VBS features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the VBS features are displayed at the bottom of the **System Summary** section. :::image type="content" alt-text="Virtualization-based security features in the System Summary of System Information." source="images/system-information-virtualization-based-security.png" lightbox="images/system-information-virtualization-based-security.png"::: diff --git a/windows/security/hardware-security/images/system-information-virtualization-based-security.png b/windows/security/hardware-security/images/system-information-virtualization-based-security.png index d865fc1715b52c313ceaca02f74380a3ed2bcad4..8884277fc487e3f9227c634695c7003164cf2a2a 100644 GIT binary patch literal 13287 zcmch72~?8nzb-bH+id4fD@!X)Q*+AFoJ%WbDa{EJbDNn1&YGZr?Xt;%497I76irPr z=K-)ZHN~VfB}E|zB*h^?L_qXn|8xJtx#yg9*130G))GG6#q#@o@ArQ1^ZcIYd34#) zN@~}^T>t<;%EtPF69BN~ocK6%$2RdhjUoyWe@H|+Sy=!odJj#Dzijb8?{FRfc#D!; z_1P-^zBA0)BN71E-L~;3(HZ*s1^}QJZ*$@N)mZS{D6)cs&-fOuI{NkNc~^AuouNy2 zUWrtl3-s)Eu2vjx_;Ee+iIn}d!?rcMrMoQqG9g1`-sTnf$whQb|6mAG4Pbk>c&*2;jB=MKenO9;h_xkpDg`N| zuEP6IVTQJOE!-ZmJp5RT(mxhv>XqpLcqixEvmF3f=&uE^sTia;c>fA(TF`91UKf0} z4z@yLA6?6k+;lP_>gl7!McA5$z61bxTKm$Wr_#PU0Kf_u9-44f)~HlcNmlZR_*Xs> zTL9o28tRK2FD(?PZ?$5YNPI*;beEgkI>{& znbo$E0Dw+~Ff`%g-Fe8B^Y+p`^$^Yz4WwN`!}ZIs6LnPfJGc=ppzSW7eJ-TihW$_( zakAM!+o!JW)#JdsHS5c=J%1Pk6!g}A=)frR4Q6sQ%`~4HiRS1y_Mv) zpGh(wR`>v^e{!K1Eu5ABvC?H;ze9SH0V_P6#lagh{u@ zc(w!_3xrZlf{ni9X8mmaP=jMhJ$dSi0Gpm6&^4-^z-Nfd)(2YWL#LPy_f<)__a8sx zaisy@oXn=~w={kcY3QKtr%WET6^buPAf=h`F;{V2ghDp0O{1oc)^VQ%@kG9BZO_7g zKaLmep`X-AlCW_v&vVLowQ-LbkiE|b*QEAnLvHTMGEfVdR<#kIxE4zvmp^Eua9>Jt zPK^;T>e-R5wJNn|;hU_m#J4rhBvG2B2&lvk9=p3bGbRYqou+@U4B*CuX3K>R+sgW8 z&MBLT?`QVgtxp(Z`f*1FrRy@<6Mi0vzZ}4LiR9Nlo?O3Nm44;7vUC}R`K*;ineIjQ zGv#RYuf|=JILm^*sodkM>uU_}ZvL6!H%O^=A{4#)_%WK2I%H?j`@8tT=nULngG|ePtwLOipv7_Nb0;@?Qg%o830H= z;0chReP6zP4ghG;;(J~mqHmP|0Dg3C+OeFnQyXxEDAgKx766C^NFMp7iJ;2^5MCV9 zb8z=n@dQi%Dc&bGUh$@~=YAc$qxk+$hp4wCCL>G_@22$o4aFZ+W5$}Ue^~I$ht)riJE%f zsL&E`6qCBwE{$|;oTO^6OjJp#G+s1(n2Sz+QEtpz7H3>9$?Ciq5qpZZ6rTHl>>BEcP>+`P~|8uRsK!tJiaqE-y#g<;u&6MAiV*p=; zOXsTNTe4kNS9U5@9nS7qJ{8-EI{X10QMBMw>9WX(OwP$*tFPUAKWOu`^laC4;s+PV zHJ1C+PO?I886;oX$LRS;&G=f)yai?bti!Qj;ojWzqj%~QxpmVIJ{Mz&IcCn=t!ecW zCkj*Bb4xXyzrlIS8K0~|<%p^f8TrEnI=?Tf{DFzh1NrqvjrPaeMORH+E%#QRdxRO! z{=O8>6-X@i^mdVK`;a{E?&Y3q@~ z`rg6wq1yCnM5cOaj6T&oY!+B-p#U`>K%q)FO92Yo0E*a1i5m(hW-WW0AlsX}uSZbF zAi%pLHdrYcDSwNoqz3D4A{zce(_t0!m>0y9guQOHx?S}jK41#@^)nv5#wF-R{;=S| zoD*`ZXS%NGG4DywVbpXCO&Z!@t08(ZZ!}~W>r1*ebF+^|anoM_!5PgEsuBZ4`b3{p zginPBW(2Uzn1sxX;_wMok&`;P%v(cyL9l&U-L#V-@W74EE!es0yW0Ed;M`l$@tO;W z?*s4Cb!}K*cPR#2US~}}dGKCsrHm;}1}k!Cq1biB8Z$6HT-VKW8UbY=O7d$CKg^8& zOl6xcFuyE^#?8icyG6&~E&?#G<0O=S0|X{CN+sV>aA)7qpi_ni1EE=cvHTs{a3IYT zeTZ)+l}GYd00!}g;Ax+5e~{-Xos((onlGpBjpFL<0`Or&scvV^Lh0}N z^fY4CSZ$@N*?5}oX-NY}KtWSDDobetk!&XtNihrIpnj~(6W5$Ht+I@c`>5r0C8z}E zT(8%e7?p{~3@_=l+t2^d!DTNGbW}U7UZso9g=Vowj^S_H&sU>_c|Uu-A9*&%1VZZt zU6Qzx_5mSf;bmy3v;an(M4vo$y22M7BaCYvMGU@eSqE+T>9K)s3Fz`|yx&gJu0IW- zhal>KY76*79`79#GWb6ALjs9IrguJO5HEUXT@h<$fjO z2Si?FHO#Q+rCCI8Np6g~Ll!MQ@gAzCt;|`or$eS{fffPh@b~tkGL?coV9i&h&GGAJ zr;TP{1Ko!V^;;d2qoC}?zF~OX8xZ(UDV)CIx5JUWxtOSsIB#_y@D*)p2!+AhjN7eG z9&9U=Qap^d6AJK5GdGR4Q`6`mt5%Tc^f2m7Z9`Ksh*rB0Nv9fsW}_>g)-;i$sD1JN zRiT9)y1qE*M&{IF&m#dsl7lQ$`{HXlr%=;mI{-P~RYJH!u>J2WZ7 z@`rLY69<+DhRvU~{A8cNronmX(%)som~LOdh+a$jjJ;EErt$}z?h%`>v6LWD1A+8O%F!oE2e z7z7gmgg1MkjdJY|5>!XB9%s9K&@_Ow5)^AXmX}s0qkpz$&CToYC_bD?)$(*zmulvj zF|*Q6O*8P9CAT2VYg@Mq-s~}e6jz4dh*QVOcIHj!EzqV0>JRA;BdAEw!9kwExsGn_ zdWm<;gPs77ZSUgu^xd_DzR2EwBSU}WWYOF-dW}1cP5#rpF;6EJ2ep!ea{E_7kU^iOC#QQzoT$Z_2A2b*`I)zx14l=*o~xplI<7i}Q1i0D zU%XjHU){Xs)F@*wBV+}PHN zrWfg`%8WA#36Atu_vr5G*xhB7MQH-7w)EhSmEVnjIv-N0n zQnSUHx=EL+L!6yK6h;Po;MpU$k7YEVo;JQk46tnc)Y$-$#oDw@WRenBeYBH(`bz$K zslwps+PfOPN8V=30SZu40ofM^2bg{NzG=r#SOi*~7Kyo^J8F8?5m4!0uFKi#JJU{N z+))wy2GDO8vls^i`z2TdE~W71L3keEI+NA{h%nT>iF!o_T=zVgaJ_ztB0~?KV7`ZK z>D&o0doPp|Q<+$U|9e97cP2zgkv;dnTeVNcX%VRu4sey|mqQM|Tfu9deYyKMd6sAO z1IAtU(x8D+=Sg7H7d_Eq$hPH47s?BTta>eU_?909xHiIYX=;m;r}td{j3!sKZ{ha^ zb4M@9BU#Rj@7EkDmXs^h(wCkw-!zQZMcZMD(YK)Z)QF1Z=V&DuYv3{OoDk7VnK*5& zFwTS&FbI$*QKf6r3d}jvu;2s~m&p1X>jC~N>j@0!B0Sx^=q9uKH{Dnd5a5_hnAuEC z`AR;>7=*8b%+ZWMsHy6jp=SLXhu{s#nyH=DsTWh+LOtsV0}BW0@RtfShkwo>K5_{X zPB~Ams_NvFA8hh_K&ax-kuP{x9%OE3oscR1MP^Xm-$9`S(BgcsclMs5X+$qGh5C&} z^Gz=j{^Cl|gU@*5v=|9YPaZDHuHhW5^T&=-$((6FWv$sD9-UT z@m0H>1~VzQYA(vtkSC3hTQ8{xZkHhd4Q}uex@BT=epA10?56Q=;Gk#Gr>>sx7bqwc zU5)3D?2c8#g`r&*lcJv%syjwVXp5U#(N0eVbNRe~<5A!tJC?YUMfEGU)@i@BIk5MZ z@JeVdVh0>FlRK>!oiO?QT7#37|B(#Nx$#bqWspy&=%xOK3x$q1pQwR* zuxq=-Z8^-I__4l5v40M)$PUYJ6^sostERnrPMy;Xu-hD>i;3&4bv?Lnws?*s&_52T z7S#!oeNTgm%7uA6kZXQN3TDZ!!~};Z$9Ge9S0bmOT9nT)Q3%qzs%r61b>Gp!X!L?F zCAbMrcE?$-dJYkwkD}sk+1s&e@o|5-ZFlZaE_c?5uavq|j$)4Tj9QYfKC4g1k^NdQ zpfM%5Yf=yuL?YXH8?WOlhi(bm>PkBao#*f2uX=Ft_#kLkXGwt+88udOxGiYn-mF2i zCi!JewpnPLW)Ci?xtymU-Nnq|rMnWGv1^Z~-m3ng$IZ8xI8H1C|;6M|qT=*2fQM$Iv$zphYj8 zi||v`QCoQS5Fdn1fVS7*^ougaiv{yLVa@4G*)hUI1O`6Bx_5icc4WBLnbbT01jjmP zR?xKRE?#X`SsC}sIfMHUrBY;Xuj$Dvb&$EV^EKSSAH~H8>TQ#c}<`L znKl^Fy_x}FfymuCiJFVaB7Q9vlSFKomm_cm-gz`nZ|JNOnbeZ02x$YQ$_*Nmy$0B9 zVhc0YgqMHJ2Tah^4p!;3Fjq>>(hfF+HSZfV+Fe`Ys-``cR)w#$UQU@@hi#TT!g-`2 zb7y6tbl^lYdB_oQOgRvmYf=@3p2y#lQ@P=7k_{eydI=HoH^Ijhtod((4}-EJinqsA?%`&RSW3N)irZ(BMmNL@2^P-r?`{r~KN^8~wJ3~s68gjTGj`XlaICY5nr};EI<7ZfJds5L6`KyV96(*js>UDcGyy8s%9|BQb zIj6=awWLRI_YQ^}l6png>*{XF=-asWHKTQkGa{z|%PQ^B3MO_aa`!jmNE&HHR`tZZ zdoh=;_jkIhTGPS%kLfP>-{@|G!+chJsYu+Y{;2L6saRU0V#Kq!Y|LBw432EctzfJm zvwsA(jJk3w$D*-IUw#Yi+oq2ZmpL-;S=mGJ zn_kzD?xX<)ZgE+s9{VsNEQ+=MnK*k#@8L8s^l_O#Im1(@TU>Lav$d3^IBXLyyitft zM^!T{*e=?d=f~_)CfthHn?DGZWk+xhm{XeiuA-_TEx|Y_HoUgRo?kdR#;8X5UhOp~ zeQ*Z%KG0k8k+ZG07Fkgmj~^6aIeWfoM}k$E@j-9;eFS)%m&O@8!=aU<{2y!(Wp*+v z$E`5>39t`dzDS5hMRdA!A$FEw4R$^?)0LJh`4{ zwHYkubo3H66qQx}pd_+Z#1N20ax8C>_#vi7FAci~0!Jz)3s5<6J)EVNgdyF9^0II2 z*w?W(3SeaMG3ocofMZj$x z*Q7-xy8|Q=bQin!Yk3KG&x1btnH{2{`nosu7L?;5rP-j!{TXOADRwUTetHFbp=dc-n5_)4Sm zfZ4Z3Jvu8_(!>NAQ#@jpvD7vOvzL!DH6M9lirI__Lu{h|@R)F@X|IKcDwIbh)&aGO zHRTdaJeQ;Zfc;1;}wAgEql^C$%s~02uFEm|MU`YuCGbbYkh*BSNl&4w?TC9 z{;-_+hEUk`;p&XLpeyeXkf$0`t3Sy#bR*TwJ$;c~>^QOHR*Q1>XqJo`f-{R|-2#ky z`Ad0k!?|^899N7K83+K5p$y0kb;g|&(=zu<@`cf->Slz+kNj64a{8j{jUFwZ{5n>W z;{X6Wm`4Y6sqE@cL5>chH}UgnKl{VPdLFs}Z7Z*`zt@7KIc_n|vH`h)kB#n5Qjh72 z$Q`x*KUw4N?*@@zW%VVu%8TM>oOF?h6=jDoMNb}-)$~cTl23ibns|7re6=B#!Q^*w zOEPl?%SV=7J!pn|YbS<$bJGv>mFb&?^%gUevj)=}U-K@Oodn>HQYs8+!AOYEw@|$- zZuVd!ISA~&WZejD(Vdq7{6vV5TU*ecB!Uk2gVr>!)9__)NzM{DxCRvJO*oCfU z|5GaT;zwk54ij3tI!pXG<@VU0$MR)cLx*pPjS&hJds@t}I?b}GCU{lQQvs^a^~w2& zzRt#|9=qv#qx637`zCuvx=*Sxl!Uh2KVWgn_Q4shCJ~5Dv5%WObK`JxX*FP@=5pwC z`kOhYtk?y_rAC6-PI;%t)lT^F=rR8hc_oETCz^hwnPKsqh)GquWvM$v{Jl?9$6bV9 zB!?nnj?1^`BMU>#f4B+Rr}s_`wA@HKbx+eOl&UlKfTSzMO^XaE&kmX=xf^u#2i+}4 zsXNPxLi~ndgTr7AyEkLpqOa^!+p#L#U{P9SIeVY@KyL3;#@6p=Y$>nmxV59UWu&U< zKp!O@)S=ZDf^==fvTYYPij+E;&|?tiasAlf;>Gz5c9*qN6x1xgiON?Gj**Vt%Zq%@QbhArp^>XjIaiLqalcuR zf5$Czs=Ys2TMe55H)T#)XMa;KKXXv=UF3){Z6pqYD&+Q+%)J!i_3KU7YrFk3sLf)B z%cTGFrjJV(Voeo*6f`W-M;|r;R8`;ruVjYlm0151p8t&NR)?_TNGUajJ1Nr+V)j!T zRrPF8&F}AW75#l!D&#F@iD(;pmT7BV;%P5(^L~Q<4wAQJJc735v4YgK$=!57iLLOg z60auc*-u&p5kg`zmJaSSr6HcP<#Is+8E;HoUO$;vwWZ7iJ_qE(3ioGh0EIr_{9@X>- zh94`PV%+8C5XJuQA!nhPPii0RqiPB`$g;$&8gDOO-xpK=CK@^1xs~+6gzO(fZ=6ni z)M2O>buDq$o5LYL2PpvZD~xC+6T=l)&34av7LQefC%(1OBZ%yx*4D+7gA`VGF#aShdM#gm z@YH`LFa6@`gs|Q~FvAJJ1+V(r1_O1mQ{ zq+0$_*>Lux=bz)izEw}|N#^sfT_-nv6OfZGByPwL6HHj+zsL_h&#&BXN>?o--81UC z?GkGF(rn;Ve^UmPrcN@pI@Z4(eR;6lQU6*f>GnYWtO;8j5vZI4*Ezr?;&(OD2;p7H z+mqIW7G{^CP@Mz1wm;_5g!rk%i>UNmp8SNWI1WNtx4O)jLNteyHv2=IE$gn*mF8rLSGpEo2gDCPI^nx>Pv6|z&K<`5%? z*1(Asy>876x5wg0O@6?2i5tWr(k9E*+t|?YTKN_lGgvkB*+URb1$A@5-IX>P}YoX+I^;{S9AL^VaA%F4=z!7ME0+W^y4wF@gM| zv-|0nAmToxc+MOl(xc4U#<}GODhPp9_uS~Oa&Af7fE~jtpo&>Gghm~C!eX%uieG%f zt|8~Dvd=(-t)F8PXYX`O?2oGfLPZNZ0NQGqMLn`j_67pl)qTrF{g(XH2K=4d+Fv>Lx*xjOU; z!0hn|vPkHBO2L6A;ID7;?Yx^~&|BN_5C#gJ4R5_a&$+a6X1}p4>vV5yoK<5vQ5-5D z8`J@+?6aj|Q>>z$Rm?56SPQ3WMG zq#E&7%I~!`*jQGK2=P3VLS(uZnH`nR_&(P7xMO7};9c|InwzBG=LOqoswQU*Lzx>G z@y@YQ+{sKx#C2w3ZdMs>q{+T-77vX+LvDRUxyw`L*Xr;qSHzbM_-js>779C8)k=2v^d6SpTJo+99kj2FeK_wLhjj_?n%$r{-N3?L5n&)+V{ zH#FM>NC^FfEr%hFc{^=O~i_%OcT|=P(d6QTJ(@ck*8%0D^QBs zL8K<4;953n47Lh%mQtv_D4#zhjhpuc2#-=)6gZRpdI}~Sgu!Fo-vEFmR@~+bvieWk zcjv4g!gcxz65K&24)7|v>|c&BRIkC&c>h7+PUw1G+oExf?@EIvOVAy8zWWq&;j0z% zfw6y*zDczrc&HPw%%HK5z=>_X`^9+_inv!f_5QPTcmHxY?5xRjyM*aZwfGi$=@Akz zd-gAjSQ($4#`)x-8RM|b@KN#;#OcVgt7;Xo zH9#XyZRn2^>}@EM*-oSzbhOWm^_#TE%tCdIm)*ID_)OxHiQ?r?@EK-SodK?R&ewq* zph=U;V${A2OMb?eE6d6f8;C-7FX_v4A+ie5T_Fv?_yz~(bY326NtG06w$AHTotiKA zwVP8gu*V&RU=u*F`KiXQ`<^>5ikr^t% zWnIZq(lQwL-@7yrm~QhfPc^$%?t5@IP7`*ksTb5_uGTUlon4LL{s%96`aAnT8<^C>}X z_vGdoo@w?cqG7rq;_JlvzKqxa5WmYTbnJbHw>7ds@(3!Ov7x4NAEdZww4~uZr|&sx zFjFa^fMtgYX4@H}gD$e}5CyOMrUob`>T%aJ#SoHkjkoEe;PV?r*x;is$Q9+!GJA~; z-})>|1S*?kDzg5Vphi`h0_O*fKt|pU%-X4HM3h&w;7fy1PY}nN=m*mkLpRn0B=Z^6 zAPS+LkxcUUnhRj~i@o!5C-AV6AJivpR=&$yBXMZrOK!agJdeI1QG+-y@y!(e$y5K0 zzU#xj*s*pw>}iW-mhcWiHI^ZspcQf2VB9iebvF+7BS-Q6Y~cl<_3Y#aNg30zAdh-> zmQkXCx&2``?CPrschM(V(*05S`t*u@3gVM}c#F2RI zujk~H_~MEtx5=I>3h0;)GgauX-#)edTL9fl`fX%BYg1blq|Jq z(>PZADP0_9;I40qM0&uv`$^ttox_x(!(GOjswwqr2*g8P`ug2H36#JTO`|tvt`FD3 zZ@S3)_KDQwW$Vfy;u@_tjD5Y7)(e&@`peQsVKT>?P0iyw4St`hx9K}IwX>IfMdnS; zBgM7+yPBa6m_cW|i44+S6`H0acwwy}rg=b>z@IAAwu4s^r>iEz^X0bmtzPtx{pQ2+ zrDiNtBflWQdvaQ%Mh9E-BHKDX_1|o5bS5pVRe>N61sqCd<;-F>mjNNE9maWl1TFx6 z-kE&njays-)lb|paP8^ntQ_9&JCiXv&}1%-@O~9{N8jZ>KeInIG?K+TBn|!SBNB({ z0Pj@A$=Pj^M=%VjP9?lr8?Hq>2v|9JGU45IiOFjGa%>N-A#!yC6yg>BU&>gjnhDn` zipA=Wn8sKt&;5${ns+gxOzr2)4v{I4vUMByE0*9R^m0`+0yBOW_ox|PMj)HqzN5{l z5stq0hQy1Le5fBA8rE(~L5|mI9*Y0LO67vIxh|eF=KrkcI3^7y)~!1IO?6C*fs+kp z2>cuI);$yHV|JglXzp+(_Ny!;HrgCdZ5|euarKTc@f*MpDfJ5&ShD{aFw_@3!2I`M z0bixK{M~C#G$1(8z{{ie*S1EB!@Pp%wOz^fI!kxiHSj!z-9T9QIiSTZx_19&9$QAG z`NbaE1^3oeW~6@3moeDUOUqd#%*V}$-;!}N_knYF=!K}qN#?rRqa6*Qf)RC>#~KQA z=-&7_d85bp_e#>jMY;>PzJ_enW|=7vo`g{LJ~@QJYEQ0|z#}mNK6dUCD?sRujt3>( zZu5geP8=$@xz;{2q*Lu>%2PCaV4pXwX8_S8Ek_d|dWUI9q9>GKONsL~&qd@FMz8Lq zb{V2m_PwJqnEcX+=MO}z+86X=!C=pn@K8ejYLJ-&ntVXKR056U&P{cFgyicvEVW%Y zzNXPCzct*cK-GnGL+yUzgF^1h4{PcU-(1lLrv-)KeSfwr0*#6Cv7l{thhUHK!Jgtbw zK^K;KTU>Ji_IIj1Vqugv97D@tKH+*;Lc7phU2yCG_%^E{$`cgx+ib~rST@O zzM~i>y1(*khX;4z1_t`3 zkHv*7FIS5~`aeBw|1S8xX*S)AtSRr>Y<6M#;Np0a)4`*{AWD4MA#ttV>zl0OpFE+D zxyXq467L*sm+pOVbj0g?ks)SAYamOUV>xYK!(F!BZS*cgT~V2WNi)^ zH>Lw;`$2r(Jql5S4XTAb9|HDw1D6M8JRU1{HJUb^9rVnUlO0%w!WFoa+DmI`tF|D& zy6&g&a!!|+OoV!1e-7XF<)6v^xotRa=g;$bk;amoibqanRXCmzB~aLI{cAeKA+>;K z;YQa`olA3f_!2S0w<(shdCaDFmBG}ojQSL9hHCV#mf~x1*<6Jvj?LHAn-)#l8tW=R zx*{*tZ2FC*if7oKCU0ew1;2hS|EK$QoY&04iPwTccnH<`BMug_5}=3WO!&> zdYg8zDO0|3`0wH1d;%MqsVl=rYxHsBStby0&m672hmq{CwXN&kfyoFBZse zQIo(u$!Ds`ySA8JSg)-u^>UkD+i0c+^u=>rcwY>!IhTB19hH$6cCO>1D9 z!J#S#9N=v6=fB=L*z-XeNq(PMUj$^8U>CdncFHWss^V@VuQiX(plR`ueOXvDcY2fu z`z%>1Ms$K_U+TTYKWPh4Hv{oOY^NJA`l zocZphSiPwGCdMlVb{tyUA>K<9n%-{Rv$_d{wo%FbR>sTAWql5OJ@iIyK$w|?eS(sjS`g8~@7Y MqT_`Mi|c>=FBGFAlmGw# literal 84515 zcmbTd2UL?=*De|>q9S|4MnnV@DGCA#DpF$s>AiOgMQWr32qnRSND~3+%|eF|dP^WE z(wovTkSJ9M5DA2kge3PxzwbZ)ch9)zKjW@3fF!KEYpycqeC9LfiZ(XX;yQZzCpMCzOTDL(JgJ+h3HwWEr8QcPasuGUv-aiDq=X|Vf z;|~G}z1aKN=kT8Q3Gg9LfTneT8N@Xp=)Ru|NXyT~#mD~)JHVk{Vo*M>)2Q;h3ZNzaq=x({M)J4WO60sAXkio8+xNfpD{HC6kJ z@EfW(1Br2i5A&eIVPDUvp`IwJ%hlW*N4M7p&9z;BmaMv8se0ZkTYs)Q=AqK5s`Hnsc0RKa0WSEUy7{%HhQk`~UuHZ}izkdB{4#>aP zysqVRGrso-Da3eEM@NbUHiM|*Gb3fY+Oqz&A9_<@9(g}va5K?*huwFneoPm9?}yrP zDrsd~%ws?&wuzRchU6)ji#oRw6qs4LE6B*nEu0Icd9!dKHaOGwSK*nHwZ)K!qYZP* z@X%)kM^jzLmeW!>%Y9Ez&X$fm5%eBIaQDFzD%b=o^XT`w)n457nw7ikWrA0)RmQ|0 z2|@LzqE-LAJbOrce&3&$7jKGk|9Pdoj|aB*s**1lbO3bLaaIGrq|P`*i`+oN* zWok3Xe9qN2@;T_T438wabrb_VaoMpEg!CQ9whp-O#tvV-3#CN+^ zv(^=vP%;fgH>9NuwU|j@x7Wy>f{?_Gq22d3r}v&(&&BzVeM2Kjkf5pRjoTEOpHQ*| zWG2Bk^vKIY%26AAPH(^)YLIRxR-e=PDe%>l4HO)?JI7`r5>a6rX5>)(wghb)5*E8_ zhb767n-ta0J8dp1W)$qRk30_c28Ix<W$(OS@hF_xLh*k6iCfeU=T)jXjbfV3%LGfF&kmR*gl5pN{5*<zm{$MRge`O3F|#_7ql!wT__hk|FTrWHJ#eL+-X*P9LkN2~jTihO%EgdsAZ!s%7)=)+uNM+vKn&>%(&5b*A6 zfp*z*PdGrJ$GpYqax=b!Lc=#BJ&fJeThS__iquEvkh83mPy)@lm7Id=R>5z`_z}l( z{4WS|$4RVbq|wdt^A%!gOe<;^+uFo2obvUy{E*&k39xy6M_4gphV#r}x$wK{l=)+1 zsFPxf5qq1LR_8%&SzLK%wb z1?|jU)NbZ(51852pWdxPpg{WaP`d&Osp?>A4fZU7EJJYaw5?8JJ3VF+Ty@|e?E^8|J~>2;m}LQ|bhQ`BS4KvD@IbKJf2{OZzJMx;?6KX&I3 ztrQjG6#i~UjU1$caI$4nVS4hKb(J-CizO4_Ur%uc<_4S1KT0dgJ$9E6>-_WFYfN97 zKVs2%hS37E$nX} zzsa`6GdV0w*K+7}r$;f46Zgkl#zURzT+Mr$>D;>(G$RtWn1j;lG4;rd6I>S#QL2+g z3s$I0xPBw7?Y2zSKZZRI0L~dMMq6ekdkB(xK(Eh@R%^!9co9!eh3H(>u%i-2U9odD zh}qP}q{so0f9k{Dw^%43{j4hhTIsK+RvMJVP$T4%OZ3@N| zlb@t($PA4Hzvp%H$i2Xxm1L(F#=wx@N0r&j2}~o`(r#(?5VnBLN+i+lC~qu67c4ki zoOUCfhEZuI(aM@BI>_^vHVTrGwZK~w{ptPna|2~OQGuTfkVUKsb}5|M#eVkQuouP} zrLufyxNN>6xeWT0NvAqC>ZwcYPnbUP*I0x>+R$b%Vp*7X!6=-Rm+tMER!$~y^gX`1 z4|Ma}nyzZiRPy4M&5wTm##{KERg~E2StJ8OTtTGCGEjI&xEc2Bw%W$0^^69c=xT2# zcB*0@Rh1#!1KxC{fmxA|*VwN+E#x59ctan7K17g4tkKkHBZyURGLo?6LK}sI+rod$ zTFtK!e!*y&&t=G7rIc)swZdYJRNYC6`fwV%53$9+6)8~sP1{c; z_Y0zo?5pm1Hdz!i!&#`^cpIWpT^_MnUujr_`C)n#tbgH*0SNTk75$G8eoIU^qO4(^ zRKQ@&GiOUVt~)Nii@%Qz#5cE#(V%g5aEp%|b_Yor4eopDvsnj8A_Y%0^op>kSipXO z>DXj2*~?L$@H%lQd|gp&vj8DZ$YG|RVWtfAfW5F5>U8c_2Rsde)oEo3whmqrG7w)` zb)Ggl&hEJMG2quyuW|`>g}_9e6pnaj`?*9TFVo4y!KB5~xwIf>hL7TIf?OFj^HTG0 zvQU!ibBvl1CE>74yE}IOgmjIxI^mzCv0nK+X(V2!B>34ig0G_Mt=a}Ym+*u7y~)li zuEupouJxF1pF65zKLI~N>wj%YWZjm7FU<|QjVYXjZz{t3;$-NbCE?Iz|5Ldy?(q!y zr}SV_5}@?Vm(wO=9`MXQFhUUX94!+Snspp8>(pzsyUDhI6C2=`_~5x@ z@*;}iLCYb~p6VBU1zStqDq442fJ10$Z_C$+-{*&$W{<#5}>5H+_Y9k7u(8PDi|9 z6Mr~m$rQaxn;ARle(UA2RUQi!p5X(H%fmu5e`UeyYt;SK^K4uMw{0?(K|IzZs*eXt zZx&?^K1*QEAj|=!4tjo~0m4=>g)VZ&NKLKgvH47C6)HjS$LFG#Hj-fM9)zDWekyJc z^=>_r4C?>s2L`h&Xai2{@-XHEqGh@ns>i=ulgBK_Y;+2eJ+a%KR$Bc3+cYqK+wZbE9VkX%j)vZQrldhiiDD6VK z8QTZ)>3Z1VvSyY%WWmIi$OsA#o%O!xenru#y7-zSG}D5ZhFq;G4=>0J5mZh2IYq`2)0+z7`!5)rQnn84`fn5uEQx8iX5|FFT>Ky=BeRxb_+N> zB^3A-uGhMWZZ+5@6V5fjhwKKnhSE#r zeX0gT=HaHGemge5lT4G>a%GZthg_l5=NCt-9kEvSImn$C4lQN)0YSf0BhUIIL7=l5 zNy*g%lP`W6r`+dVm>krez@ZJ+7AzZE6(LOPzdr);&g17Dk0y9U{}Os&KtJZu3jSO($%B`(ovf^=gu>eWdKPUL zn@JgI-K9&_R%+Nt4Sap`R)Y^C-#aL9^_LU&8sZJ;QWsbbu|y89mMq4B$gLl^kZ_Dy0qr6$$SZHAn19sKxc%J0 zl*<(+!>CMZo&9yM@epicT8kS#vj7bQ3&pDh3Us(`+jW&LnovTfI#RuWzPl~ zwM5OUjPvNNE;lW+ZBY5*GApT^os%QESs1q2eo)<-2j5oj=;^9mPCCTkK#$N$;u16GZr0?xfiB+C|aD(d_hNDcx(%# zi;sEKzN*N?1MXbuSwD-$41yOMU3NH*f~-1UMPl~dDicmALi|HJ^Q7pW&GA)c_gyaO z$R)h zp6AL>?a}T$9fOSS&KK{{HyPCn5++d!Wqh#LFDHkU%kT8o3p~r5g5cgt2w0>`PvSk^ zzd|GpEl7b?{*39R`{^X?ko&75`JCo<8#U=9WZ%@5{%Bv>5&@2O#=n}C#<}uX6g(?E zKGfyff9)qUKjiyAi?#`Sqy^A?M4QJYQgF$)izGKYBMvM>OW%`&|NN`X0<9q`S6Gm> z?y&-mMB4PAxN7Rnyd2UM`A}Xf5F2IrH+Kg!Ag@|0oY{T3-37QxtO6M_BIh zrQ6$1(19F?x-+ZqjZ8^FUhKt*HuZ|Fra$9O9_HkQN&M}aq_Uw@^kme}p(NPhK0{P8 z&G7IPj>==~p~BTeomtD)wNj>s+v$8W+*j&2Fkoq*lDixdTe9IT>TI|96H?L3I`pO+M5Vu#EH>k^MC04_g7o$n9U#nD zKtdBRlVOwdx9)agWn(|(lqp^C-kUUP)}k;v>yPpA zmhlP7AGiX_3`CcgOkeNP-l;eco_z^$`PUMgr6?&YXR^8zc3%o~3>4*A z`TYGyg6Q4v+^p{wGw1)s)U-(?b_1qhubD<@2wxI+H(Itl_WONh{FWN|RYJnRh2L*M z5#IiOezOwf^%=Aq{$J`>>Ag#>2dad(!NWotFsGMj@M8TMRSo$c?zf<_1_PQ z$m$zRERJ$`E3!|~f3={gHI)7lwE zVY9r8d>~Nc(a}01Lb9Zh>@^LYaZw}j_}pDZ*MqnRA;h5=Ot4R9-~kzcTbvAEnV%IR z1xE=0GtRo}z}V^#pG#_l634}D=b2xI(yb;X!eswUMN#X$27W6FJA(Oi{fGab1JS7T zC^7B9fA!#yA)Cex{ZX#(i`FfgfMfd*huBep^5}3A*ntZ7Eg)$uZmgay!Rsz+xU(1I z@F)>r4S@F8zkE;3&+DxKcKziRz@x)8#G+>vtQgK1x?l3YU9qJ^srw@QRD0Pl~rh4s~ES z1YkVMLl9FTtZm5xVVJ%9-ns@FEx(n@!9V!q^M$BQdF$K>$mvtaXEz^yYX!k@o1dB> zNTD)LKCGFaGz!0am=ub;WJAG&e+j^TeQ^5nP}E79qt;%sct zb*ax*SYtDEa@vM*rgL~qh^mJmAd1JHC=(Zl2#T8*eTgQcTQBF7+4g6XqsU%`mxPwO z$NU9|F-#3%bz+>`=)Hz<1tj&bhf+|pqlUv;L)Sh~8%0V;yKcna!vl9SB&YPJYOaNq z*2Kg|OZvx+;vGQrduZgi=+F(u*SrZGF-4`tItfPY7M$+w_qI72zKL64Vp#$s;gk_m z);q!*YO!qXU`UvQK7V>ez0{BGc2W|W@Cc8O_$3b(>L7)tO=(>#mhJR?|4Leh99A8) zQ0Gpd*~bo_HgfqEn6UCTHJPpuo?)0n?c`gAe}Bi@96FfKI+w^@=FTh)=rz1dP!VQE?Uy;n8$ub#*}WNyjq6`60jU4|%Vn z@~-MgL;+?jWO2=Ox1ynU2Rd@vz^q4gEM<#V6!EoH(%}pLbVYrL)M zVjYdOa133HhfUbdblh+p^^K?7e>brr#SSaWmkh5mIylD`KGbN>WNiOHCt1jijUleB z50rH|r6ur=9RNLEGpBy5S=Tb~^A_a>Z#A3aQ68)1)81Llb~a_LjwkorgBNPdc0Qci zKo`NBg``r$=J@C59IFkW2bc#S$=vFjn#;^Lu%WIDYVx4`yJ*!h^6G#e)hLv^b@KJ3 zJbD4f4r&^SB~Te@wXbj(4P4xfirQ|yPXTpf4sL#?c@!JK9@~`#h{?z`U8faqmWnDT z6x|h3_gsNqE5>=0Kik{j{1FcsGJHjG{=?7?ISjc<(F4jNA`Qc) zV0}<_?f@ua?M({RN~2jMr+fZ`Lt-yu#xnR>=6rJs zu-M^t@zB43<%tNe-4KSYKRZ7y`)>Wa#KP|3cQYO{=M+OhFIE;;@C}2Z9^Q`~DWjIu z{UsrUyvuPS4Kf!ujhN(B=5zvl*mg(?XYb;OfXy~6FM)xTu``@`xTL?r-8doy0=XxT zWnehSHDYe@UV7V`7kr?_K4YuVnvyBog zd!M+ZGj*S-qu)%?a$|-t{GlZqA6G8WO{t%u6VUw4evT#NLO>d>d0xMTwa@L@oj$n}6?3tG0I!K#~9lc30C8zF?sQ->48!aQv3spUm!zdtL@-2kA1xSMKwD zmFcZ)Zk$tYp}1)}swzH2|Cld`B7fQ(%BXrtIuH1sx;@`ReiejikJ|@|F!)drPR~_^ zJ#dtvbFjaQ{KO)b<(T43#eSq+!%06eDv3a_kHriUtQ<6TX1#5veG4=Jf*fc!n|Bu> ztU}@O#9d*S+**@N+YVX{(WLd~zish}<(}UA5A@x` zWI{dM*TGXnEhL|fZ}Qh-bNQE4)aktb{4bAQG1$oiEB)6jP@@ z^OPhHg11NLSDH+oWxl$s=^hUN>6&c4<1Tzvc}sznl10jY9wEmB>%F3u=wmIQ%>Yd zq58Vq`aYNUS;->ELwGla^`+G!i0bl{ExZHD>(5Ay7(H=vt9;Jji^`3@tnPMvsLN{k zkavq^is6(YPmT`rj;M&`h$C9sW+|tq-K}6Z#IwFXsz6#O$n~PojXrAsaB@Ofr|&Sc zI4eFgtX7(g&km_0U+1XH9?e@uZzf0&Gb3`eV-;aL=a$XE7lOuO&U_`F)<#|$ruJU* z*3-da8;6)~D@j>yB5Brv$GgZMsg3>>X4n5n=hazYH_x2H(i66Rtp|ka*;JPuimR3MltIn~%@matI^2klFD(H+^$9y9@|wG^cCDZ#71<{n<>s5G zx7KQ|qUNT{)A#DWrLH)|Bc~bwH}==Y+S}G|RUN|Q9__H4jYao3xFW`?4OO-J1G(yd zg>r%>In#9K!xu-4=C`z3t+>I|O|ViZ5>GAWaGFFgvu}QCb;=f|Z+_0YQ+MK+5m^&< z7q2j+OB+Zs;-x*J3Me%)gkg6jG3H4gt-r(hNgws?~=HjgW`9PQmuhN)n*Voml(eWnS5`-{HFHKeZPq!~b&12#IE*NiHp`O0?ZT8>GU$6oR3 z{z175*ub08+V=x^5`#^ms}uh@>KZ_dTL`m$tp@E%JvfSVdNI>wIqV~vfL=M0t>T#} zxTS2W-8?LlpPZbLyLycu+}P+IdvtiKD(An_o+m*2*%*XARW@S3uZxMPU zCEZ_YlVfwM|Lr2gr08kE1bFKl%z?md6c0X6@pH&kI)b&YAG~h$Bk&pXwN9A0gOwrP z&YV++^6k>YnKUC(O}f*%cKcS`$9Gv2Wl3>Oh}uMW$0@)= zB@e}3y*>L%hiKfK5;GsQ82@_Qa{CT?`lRENkSUL~#n5}!*3vg1w$sl#UHeMbiYNUq zaE+P0vmWIabep?>E3!Gh?~CEL_yv0@)1IKu=(-wP2+Hhr%n9dJX8cRVORR^!_whNg z-w+hmZTmR`bAIiX=qp{_smQ$O<^*!9KtqRtp6sl3`mxs7yj$k0eAWr-60yW>l4rmC z<^hk?W3qb3kASQPzC~kNsI5loxOtT93$g)@F1O{wL&^0c^}T{G zo8eYdSnp2$l5vLx6aVcm6?0SNmM!II%;6>IYzc-}x}QhQFpQV-wyJxu zH#a}mgs8*XN>kF-I%t3lNC__yF?R{L9|-q5_o3}jPt!fjl?1t`3#xU(`-?uWVcF+= z`BzRC1&E**GKwXhHAC-hT?tXX{VKA#QIIU~xyvz@z()ujyzKKTe>GORJ#|AvMDoE+ zP+RY-SFZ~5=%Yoh?TGDmnIhqRxhE)0yJf}=AH!p&Im%B=Ub03xzZDvOxvt=Ia`b#k zk?A8tWW#~ozGWBJO}PsH!Q7MCaz3gzyj8tVuKEHoK@zN`nD~7KlbV;HHTL17@)++n zd^FV2zG|iUeQK=jQ1&;}(~NgcDJ6JKzPa?BcEp)gN{6?!7h0zo0`y>`JTQ_p)SdM@lv(wwlOLDfUl_p2^bp+tSFrzGA3``cuz`~^S$U@;jXN3s^V zbT4bY_X`#z+6uDFZNJC3K=d5%&N@^&zDdK4i<>kMJIy;&D&`+FBPOdUX70K>O!8>T zs?D(u4eq#@AM2Y`jRk@V$4Mj5Iguvp)*z4S#;RA zu~Dp@4|IwdbtpK;KG zim5xZn1$I_UoANC=OHte5oz%)=6brDekF}_8oy6G04IJJ6&$L_Jo^4cO@*-fv)q8A zp@U~)1N;WpJ9(s~DGE?5<_?0I`%xJXnCH0eP@}H`z$_$vC=5kmbch7b5fjj zm9Vw>RNb~lDCW%?BTdH6N7HfG>z8#ijHKRW)0899OS2Xq)c1q9^u5xYh6m$B`kG{u zo1Ll^*xzs8tqHv%ZPN7!=Wu=7l>3^^f6?u%(D^pcog2e=E275|Y< z$cK5Xo6N?c717(}+ZswjVU*25*Y|ca%e==oL#|0(7Jh;MA_$7e8uU)FO0|DK9t<3Z z&_`CM6i`qjdG>*Jul30G&8cUdNwR5gvaS+ygQ>ax%Z$;S?CuM*pPVrrJD=EpH7+pT z)q_oOiY`(@H>!-A&e6V`KLDP-HBdRrH)Lu@4@_2Z%PH+cQeP*wALQnVuKsm4F-5o+ z2peV1kmRGH(YA9X%Fs&#UuW;2KmFu*QNp2`PPYQ@+~2+#BhGy~)?T)|R?2)v@*zF9 zG=J)GvGDx;6f1C}9#)`+|LbnogN<{K^{DMrts%<4%JrMnF5X}d_{ST~J#o8JCS9s> zi8PGf5hxc9<;!oH$Qlq~XK-|c|DHivPqE;_3_55iE(WvPTjsYr>!6UD?UAS@&z%NP zHg{k@XiNQ*^xw42Jq2^ob&c)LfY3uAG3tB|@21Ds4_XOZ1eKumpV<38GtG6c&o?31 z>U-SGUW>T;UHEs|&>m3>Y~|i(q9u}p!^o4MN}+#qC!l=Le|_N}Yn4Q*5qz}^N|yC7 z9!bvVZg*?xsw#UYp_g|S%R4%P%1wzydLPEtw&Ax{5a9bZp&Hjgi2NgM-Z^M~uIG5FJco}|TOcHGE)M)v5$dLLQ z*n#UK@4W#8du_y1YTu3GfyIfrZ?l;DGHgryc-&0s7ate?s%ee*w1V?)rb9}kQ0bap zxWBE$AMWgI^#8)C!Fwz)`IbsF|7F-t`5Pxl&!kPB2XX>YD68ajcujvrgojp{iAU)c zWhd&B+PtTVy4IZ2ub~v;>`;1By5q=JB(3=mLd`lE354)%hWlS!N^6lu88A#!-q&^x zGQ3lo&g_9yMO>aC?!kh>A4=uagV0Uz9V~k32+C=4pNEK3?p#jhzQM5ZFhQzJ-=EPLiivYcAuTo z)2fwwMec*zdD4cwr$Ux);KF>1=B6pSzh0l;W=8zFBt>C!TUU2D7jCTXIzC5gjxExI zCNAzx#r|1`hQh>3n<<- zUtZIW$V*^@x4sc_9lh(Jo%tAN zKV99@br`TOo)5XvJ72jK`^)mH{ix5@!`H%SsXcdK#a()S#%jsUP^=Q=ahxHgEu;E` zn*;ZvAQ?rJ$I18E5?fVM=2epu;s-8>rkuzo8Ean;-s86-`hn6N_j!rXkm`v`=|QTz z?tB!3$eGw8Cg!T&{hqh^n_TlBX;n>ssigS&i!IpPJFPhIj>keWw1y#VG_vavxl~Mru;~wn3`RsZ z!+=#VdYwDx^2k>Eh4EI5^_%g~(3-V_6VMFrChCav(D)i+*89y~tRCWl3?I8DIn$ed z@}5pH;{<)(rMQvX)ORyj>NWLMS-7~J5X3F)OVazyMTd*^DB+<&Ykt z=99_ml>KtcjZ?~Q+V2XZUf;)PaT$5f>p_BCr_6Pg7Z>Yg`_cDJ1AuU`@fHx^0(BQG zGy1-hK=7LT68^NT$+qal#3FaLvH4S(uuR?~JI$4{fp5+TACsSr zjm?sal@OnNTmKIJR8@zMERqEHn7a5OmvpRm$0NY+Dav{4EFH789(-VA7X4{A*S=r& zWT$;&tliR4i3GH03R4d$d8&OcN8|d<)Glmq4m#Jz>nz1d5kGOhQu@-m`vy8DS8!ekyvHQpF{L88WUMGynjLynzq3c&@64B86a$w#nD#U=lAdt z{zQSTrf?r^SdwFDVf*$OgX$9iKatv!llG&DE%6CJDDwyS{D*0(bi7wo={4p9&)shK zLuJGYg@w1uZ`OA`?yo8**Q_T7g~>L3iMmrRdg(=U!yipseo@Zr>7UL84%Gp zx%T;J1m&^B27gV9?BL&433ZkEGb>N7fI!yIphnkx9UXwUn~0r$%Un_j%;5m7V&vy;%u9KM9-UTygCg4nNBsAUt&J*o<^rd|mE^?BteD z#{2m78IvFmhS~nS7AiY!??BaQva8oc2f+!1f&eAq<=3Qhv0m zEs0q5^lkX1ai75J`poN9 z88pve5oyV_gEQo^PHUsP2h**T(h37lr1VY(@Wwm%Sd7cu?mh1wf-}Z}D|#yvM@CNM zT)5EFvaY*UbyaJ#nsOrhMvuN-CFS?-Ui1$LxY`m#$`#;)(Ne4yb~@0m#~U3b<<#Er z=OPBmJi$Q^IiYhdH{+Vo|BcVhJ< zFdGf=nt(Sq1(^48=4k2XjM8Y;U1P0MW{JKNK=S1L46zjUF}OPfr4B9;q3!!$263p$0R&Lv$+QA|z9;ag}?QUHR{ z;p%N~Wq?X`9T5BT?R%O4n$Kdlid;om8kcu7kn@(?>kd_dIb0r=vGq3mwqwm@mxPp( zLkwHk<*J?u6Nf{ZU~{cEJuj!++>!{H@gJzH>~E_*mF*oW%AH49bZUsSxi>Q&Xwj5c zXI0u;)Zk6JV?H&#;KrCE`kiSR=yo5k$`~rs5PJ5K^3yVnHS{N=1S;EOE~H160pcRz zHvt47hfnT40C{#1i%+VmksW)FWXCC>4ELA#6o!|C$lx7A4IFE_aN-w*%nL>oI6w4s zSJ!pG~;ceZ4w} zU;SSh+Vb^b88U0tiK!J5Ohvc4ZGT%-8wlJesRyFnZ@)t!^J5h^k5&H$Av0nrrXJLS zZ_744MW>pmx*L=PB4zorLxJc69_P6Pr4P*lZ)=#_VN6ry*QFQ$nDD*-iEEWIL(O4= zoOw)?|DNJY7CG*_SbtLiIU+Bh;_HgU;VVMaa9VXOrD2zA!RrsEQbkZNy*)m;J%{h`vT(brtg9qD5eGOUO=B9=m7ClhUfCw)2T4_@;%C=`*t+v9;<4|SnA2t=STG{BYS#7 zbCm#u&_%9tGndyF@6M)h0kl+TPt`30znNZ)Cvu(Dq<>kdfyQASJo8ji1mRH1(K8a9 zrs7!ENPqZPZB&h!9saK4`_a)W$M6bQO8PDx1KqTpq&N&)Kb#8FnE>cypQrI^tFv0* z>B}gd)1$lGfxpzEEyeMJ`93oUZ)0iH=xqb>&yMUbQS;EvN4VjS3Z`-s3mGrxC+B}e zrPg*UxP(0J$T%|7vVDiVZ!GDuuP}++C7t1^eAv_Xz!L0O-@P`*)u-QGT>SKHO>38; z`vVS56ucnfMWBe@5;63^{a?YT>Pw*St_o1cDwmnSjvC$Y+%QLGTV=ex_xn~rKr7Gx zL@jET%i2;i*(q->#BMDi(YoH7ZHE;cz}@HMrKEaH^mdIjWrVsF+<;QJGb^pIL4*XV zsDWV0jk`=_N0_J9cl(o6ta8(oW^W0}qK}oTh{bZxI8SBx=%i13ba{rC2^}!%UaHYi z7AR~5Tk74SoIT+dYE{*wk@QAqAepG!;ql`J9{t!*<^4bT?hP+imkKtnQvU{A+*N?! zgW6a5t;{8xSd@NvPJIAmih?u$gX2J6{8d{_B9s!k;1-3Ei<5CS^s$nEGDkKVm1JHP zYh6U&sY6K^mYJqsXKcE&pm9Y5PaEPC2wtZ5lh}NK#0>>+zXf2Fn4HcTz zi#$I7Y822Nb~NSC7?M0%#I#>PEStWrMpwF7dS89-msgszUjpVcXI| z3s2=8GwVx@E;bu5w+q`VJPH(wR?Wu&Wh_Z)xN}Mh6WX$(AM7L>!PhvYQvS*sAWF<; zYDxT@;B0_Z_cz$5e|G8BW%h?Y@Ryi%yjf;#xnBA3%4-g;s%=T>f+VY7;tYZGT%-si zDdy`_T)+wJdbM|ud-eDl13-6*x+Ox%qq?Sfm#)B8N8j*$oxne(6qX`fiKb95i&w;u zyCn@s`V|wkIaaE!=3O*B3draI79jI;+BpQ6^1SPdwVwgN<-LmkaOKAOVseMbx)VY zgZ&xg?g;~NCFmjeg?J8W=g}~p)E)sj`k=P?7suBv&oi{3F5sf(e_%77JZU(CtIZ8e zPFaP-k7wO2hp@<7$TQkfcdy`T*O!ySY(Q-T`Ri##x#KZG_i_~jB-GN0hiuJj zfX&l5frf36gKyE_XTowuXXSN>qkWw~Rn6Ho?fG-eQ7&Ycfj~-&kHp|xk=5^z_`rOB z&%vt*?6C2=T43)c1sTF_76Z5?odOlep|{Ob+TiulX5Pl3=3(dllyLU$*9Bqifl#^R zJu(9yj@9#C%6FNUNltd09d)~v8LC!e-`O&?v+6p#(S;tpt|-Rsa1s>pS3&*Ofq}_c zV)9P&Bi65@SwN2d3-Xt}&#YH^Lz0If6WL4;!KuFKC7*=prA3#SF=d55033~ZU$NE% z{y!O@!}h4;G~wQ3LtwYg9d#eMlvApSEmvm#a5+ap$n(*#x}N~|Lnq~^1Z@#6H~7rh zb|+3_5qT&7&G(#s{ol)wBCZune&3^gfEGd2_? z24IW+dJA>lBXryom0eQ-+=h&J?ZUsv0lKGK8r3s z^$6>)`c#jh><2{{i;-XZ0mRr*(<+64+~FtYfD5ri)i6vGU(AO+d58h>7bSsDk^2t6 zC%;Hx;#}=Bw96VKACitX>z++ryEnz@Wu#$vrzp~7#)NK~^7N|3vD-QC;s~Aj7H`PK z?u7{pJKwbjPmWi`Ss0Gw1pRhEiZTbJhSh2l2(!CDiHI&aWD@euFngfc8bVvj(FKz} zAFa7GeAA=(BUZ&**?UM9bXShQxP54lXS7QywWPNy=ku|baz#9rl6EAe_C}?oYCaBR z>)=ak4F^?+>I7+TX_NAUfT_?F z=Dyi|a9&y9TT0h`#vxE!r#Ldo+ZQ_fKy4{+V(P(O#l(=VXyn+GPO9CLS1z++Q;ya- zs|YzeaO%pJvaSi6rRreG-WZ&%isgO)Xq`=r3h2Y9hIv&k8IfIxZtE8AIbZDHbygfL zHRB+OzbHI*C!qzfaR-ecxhc$!_h)ehxraXklfUBnb=ubrkAvFy^lZ5qNK?rd|0^*O z@?|38QeYF`vbAf5ftQ?QXe;ArMe87CE{9844gi@qe!Gk}Cjdhyaa|FpY^_}Cuex9d zPH}yAzQrX&wd~qWXX%JPsJ1M6-Ld+K%na~x70BAQk1WF zIjStrtA|^Rp-t;aw0bY#s*1I%jed3XT1nL7$-eT&LA?%@ELBH9rM&iznoUVw=@IY} z*0jQ>(_VN0?S5l!eV{_EC-1^i{oxCGvL@1?k+m+&t0kk`5>B!=AUY>X@01b0Y8-wR z`Dm(YW&0`d5a>G{X~`{#CEh!P)UWh2WenW|(-jXYLM z&#KKY=$e?x#h#$b`P0I+g&Vx+!TUguYZANf&`Yu|C1lC_?f-5Q#2xPMQAV-;jb>3Q zFSnBGffT^LqoO8AP&QO??Ag`+X6}NdUq|Z%8@UC2njWOtRmYo#UK%i&TD3C_Q4V*v zz0#k1w&BzEajNijd`Qmy$f!ub2npz|{D}Cae8nC}GGgwnC^2uom});gI%00XTq-ZJ z%K)DP!<*jT3qSLIG}Zlbs?tAGPM)E;Pp?u#YAA=&Y+yN6Roc7i6;^P-h)Vq5umRRN zy0>$?@#%ICK%if>sxb0rjP2IXujiT6!5kGjB;BsTM`m7oublM1s#N~Ba?;6*EAHrk zvO}PI{Qpt5`hRc#|MdLdZz}(BDR<}wwx<2gVsl(|PckY?pNz_Dx*PQWOfkXv_S$&$ z%obLZ9S019w3!k8#l4wE=iKhev-!C~qy5zY{fcy1y>IEp(SRIpg#IZ-gb zD>N!^TFdJqWlgOpCYF)#W8}=^`j7F6@6=7wothd@gE*_P0Y2u(-59LnXIm7wnA`Lg z+=(1-zZ=%-_l;-|WtcF4%V$U5e3M_ZD)8qS&s5XU@cRB?ML#FaQ_k?%mEbRb6_Hcx z)%@#a-L5S3jwci-uVw;qYDC}pJ(IDnr+GT**m9w*a&hmkFt5&R5N5)6mLA?yDwcj? zx@Gf%Uf+ z+OsANg8hxdDcK(0t{iJpmFrvj@}8pnA4<;<)fIcSWm8?Nr{A`~oNtGPKe(57^TvoF z(U9|uhn>fCmQ{k}5vf~hla`tQrG9h znKkw{brmYQ>7V`eWwULs$u-;|2Uq-3M(o+}cMtX|QDqY}gadEa!wc=Qnr@-_yVK_1 zeoM?fouQiQ!)iOY3eZvs3)2VL8xHr@lAmW^eX+R4)jMufaPbGVFRM1j6~HYHhzTeK zn19K4SJH&xsSnz^J)4_&@N*9QV-7EA>w=_@3rNz^*<-D;0#@;E^66IFW zlUn>og3=zUj;bt>#K zf{_2 z1LfndkMBiDZx<17BmWex$YokO=xeFLz6`|5B`D4vUK~emT`JWi7@y`&a;(4}hhkMJ z8m&JqgXjl4F^&V!b%55&DzYtJ3V=)=bgy!$dZINWVkNnmq#ij~FiWdA4dG#AfLMypV1NJ=ou^Ci@wQBQ7N(^P+*ybTnI&Sf+#6=qo>YiwDc=pk zE1HCq%%ph~sX8I1<7?!~MpIj7<_D(~#}+IJgf4*-1=WGE7|$61QppaqifeS%8gti6 zP=`Job_kb?=ek5Msad&g`(1~6-!&TSnMHphQ0oWCJ0bZ$*g@|_#*Jc^{GiL%dXxd7 z0i7wM{2%$z$~g%crDgN;&0~LZhWQ)-G`%#&Bew??`{N6Lvr{+eiQVmkQgtw8>E92X z6#AcG@b8YG|1UEL&?$Ru??S+1Goa+V$63tGtLHQ35a=fTc>dz3Tip|ZnZt^$uVy|C z9Ry0#Zvlo*(Ot*nP#?ZBaJ2a8;QQJN)!D#jxJkbi-iWeGeHylsLM7Wp@@i#z;}~=% zQP~kliMfo0REw=Gn|~8mb2)a9IGIl=sImVV<0gO2t*7?L`dodu1Q5)g0F+oU<#Qjj zKtAxPi{w4?_F$6ep(l`AM?WOLeCwD4ipw{?{K4wMrKR?#s|)==RAsl|K9QVOWhhj} zb6;uMva=@GRT-ZgyX6c72W{8RB}Q#Yn>!OcOjD5)nhqf0J$pF>8XXHo#l}u7bf9OE zc9fKY^LO0mv#G8~&}!M-c8aV20t|r0#r##{=<@sb)a8bQD{qYCLw_D5^Yw5K2*#i= z+s)^D-yK4|3Y}YlbhqC1X)kzHq=>XGi#&rWUb8{9_zgCn7FTTzU>}MQl!U1Xlq0f( zR+aUPURGGG!uVIR?qTlXEkC81;i^`;9$d+9wZB@N;xc-s&t``Ii}sAi*OLx|mEp%Q zMNu6m;blm(79k$#=bgr`FycK4d};##V*ZK&R6yo8T{6i3SF(Pip^qS4oYnwp9;=00D7#4R ztO_-5u59ecUJ2FeGF>}pCkRv`-pQ{<;Nqlt-6`A7t0_VEXFmFUhD@xj^Gr|dcA z9y9`1Yg3dBQf+Hy&yh;7UUlh?s z-X;8E;y(WakGIm%XU9Y2FVY)G$Yz9!<$iTCZS!t8+hSTL`r5=aN9lupLOpnnPx8@;%eU3~_quaZi zLEnZCfA7F6m9KnPZ}C0g!vL(V|M7WHIfZ@rEJApH#R{02SiFggk_2OhsQZR45c_7* zhd#%?R!Cb+6yCBcQJeG9cLC$yB}Mg!M^{wD0v@9>5s2w#R}?mYcd1s;y((l5bw$E< zU=%8L=X75Qo}9Dm5O#C;;8_$rO-Zo($MmLj^!R&(Of3*?s~D;8Ahm3O5{Tp7D(c~0yT8sf>T1U5r{M8=$&83$+`jVt^~N7hlIQ7=mmHoPW0UMqEXP#j^;iK z*O)hjcu?zFt6w>zK*1Kf4AzHaTAiIMPcHasr7WZgF0=$XnfQ8DGto;^H)7#w3T1Pb zUynWUi5bC@TeWc5S-nTSmf{kcfk}IgW3$nAYtt{+$)g$$(f0^I->6yAXK*a@7P3vv zO7Nnd#Y}5Zr_SlrFzks+nHX4AvKMQ~{Ws(tNjyT{`u~Nzu|UMv-M)?WQXF^cn?4z} z9qDd8YDZ6WzwLaG;?85?vVwC!?R2J9%v66|`L30QmizJHQhZK1~{@r3iR_TF7k%gKE8hgC0`5J6BJUWe!Js3tg@5IHPZud|DvE zTT$+<*=FJE+-GKkuJU24jW0=)_w4ZAz>;dmE1`?%G8uJ1=+q4Eyu=k$cMKR@^Jnen zks~AfBZg%A`WLK>=(-It#@KZDW~;qt?q3=Fy_gt z3MGbHhVp&Df)&da0G*>%Xl_j7asmYci^_}}>WFq-h@ql!0JB>=3)t>IEJQvq6kA-y z&M!-il1LE>b>M2fM7k=^Y`8)5!c)oo7N|&~+#jPJr*4L;vAuMKbqkWnnBzdk;!x_u zirX%{3g+dZ=V>bk2%V8Ix$(CnLm}Eg<jD97*@*$`kiB?9{TrZZA+Y9mLg5p5=7 zmt}e_-=p_{Ea+&FIktG;NWocl*RG;cQZ@l|u`A4g0A)BayUrGII!svAD7YJ`!!CE* z`63P#H{273JiCtKvIA#*;O+(3ZovU1zS(Jd8J!%~_!B$Ic!C$-f3VX#+(o|d?duYM z6P=`}W(?aDZGgnSi+tP8U8^h;&nT3ZWNwl^(8*i|%_i1rD~pY?C5XLT=c=SMYqB6$ z!4fQG{iPq5G3@wAvEsO~SDMTIS?K-9A%1s}FZnw5tw=|zUeAl9H^^HY7o9>WA#O}-YBy!K)gz|s=X1JYFApkz z0YLpY>`U(w&JeafXs9?U`%cfk$yPtSm zt%;-+XH9&pmu}!bz3L!gGn7|39yt_uX=|o$3RkWPw2F1QW0^3v)PNV*%zurq|diz1P-U%K0XQ+P&th+(evWGwWUVqyXNY{u^=qI}g( zb<%xF?J7oA?igK&j-U6o_ig_wd5OWW8vW(simOjrc9b3c3i_UQxwT^S>=nV4%A)wg zEXR_N)6JXkBlVC+zYgrYExXu|T+6gG2D@z26+WYMBPd?Zid41EGM6T-lFk`FST z;xsBI?HLE|^I=dJy4xwj{isX-kWE#CL79j@Fh;O9{PjBy_GZ7&}PV(%NTD3@>5DK#g4!w(39r1NpL+^JJ}zk<8rwbZ@_w~A5uDRF{R{%P9;*y;GK{v3(< z#Hu!=UKAD5sbZ!Dqf(B5>@5+kalZ)Lg}>Nk`QMnD-q|cqL7etT^n&5)g$e$EYI%&X zB#jEUmPds@vI*3!kmKHPxzZXsoj_Lw20FPpef4X*iX-Z{a1B#)4YcODkS0A zzhvSETw>x<-19Gt+8qtOy8}rj-7X})1z>L{$lrb)a#-mD&Z*mgNA?)Bji@o?o`UTJ}iOh*o$<$Kf6mSbK)v0&eUdC>p{axm?}c zMpk9P=D0*Kbuy>4Q&~{cO}DXJdit2BV)s@Q?dQpu$B#7K;y?>k1y-qURgP6)eh)u% z?>}2H4?8hf(A!yEe29p>t>h3=+JOIHhkub8j48@nZ&>Ic>6T|;*mjFoF4~zcPq_GW zGX#L7ZQu)C$E~rLvqE5ou_z7Nl)AeLo5&loK$6+AEd~0#C#JP}^>v=pW3@?W)MJ94 zpB2|nR^{un)nZlQ&ZbM{=-0`3pFl7BJ2h|0#&jXa@5g((K*ID#Kekc;Ul@SWrYcf0 zC?4G$l+=a!X6P^1h4ls}g(O|!+BWfQCt~B77v3@#A0}Yp`)DwSk$EvBT)efJ-g)0azj9M&mS&Y)d)b* zc2MIC9KvAO^)(P0TG^*h;lRiDCKVO;h0W8Fp8e4c4@`FQP0|3>;jhkLu$*}iW=(6$ z;*sTQ6hAzZ`pgA}C_$z5t##_7gTGwZ+5fd;z`>6DIOC9-(+w?|o*?;SnTM66LA|m7 z7eH$zRJR#W|fzGHAsPxt>68u@AFQL4g+evgc}i0a}s7YKa|Mn2_U&_~5mx zd>=0MNNw}XOqNIL^hq*c4j{OuI4j=UF~8JObw+h{&C;nxA{NyeOKGR&F++rjq-qjt zy2fNuZ=79%-EGKRnuYsFb zDYbg`2Il-KyJn_D>1E}EPmv=v@5cf}0yNDIZk>@y2{N7^PnlaIkC^s-l78OU862ky zEl?Z6^R-yuvmwPJY1+elt>X-~sqXhBt-wrJ(J+d9S*9vh7jraxh1wIB#2hqT?i>46 zo2&SZV`oM^M_)}z<3V8&BQ4X(v`=;e-RWO3S_;@a(A7`SRKMcBPLsx{UH?;~0McVP z!n0557n5dBV`vf}(W{D*>hn6=U@yQ0h@J+CZ@N9o)_cO5;K~5ySjxP%IC>^fia|Y;3j>`owpA7RSJuTt%f*(_iI{cBN`HI#3@pvP6K zK|Rv7H4b}yFVBE)Eo1V{ubqnCD=Kcc)A3S&l&?YL^Z0sPv>%KWX*7KJda!dE6z$CW zGjnrKyjR9#gt^z&c+jn@VV><5pVp|Ec;66^{++@!+_vSSp6~S!iN@K_s`Eq zUV@qsEv5ftq@MQtXL&Q9aJIJSBALv-kN3oONhE|c{p8Q(7NAi z5gYynl>%~d=WQj#lNx6}uyoxf(MS{*eDx>n!q2H2$l3 zcze`5TsY?TDAA@#Z9CC3=Jy+R!c%Tc zGtQ>k@lSwEWa((3;~GyW zH9A68<7G%w*jsi|^~I71`z>U}L(nt4?lUj+yhV?2842yR5s#~(^@JwI$S?&LJSuCV z^?N7s$}S|A-ws7;DLiOEOK}oo9}Kek^f7=^644LjipomfLY<7yl#z*Z>yv4u;17h_ z?Y(vqV_@l>$rQZp?0n~0B0bm7D_b1nU-@nVH$fE-Hm#cZcLSYHye`DVDcBk=N=yC4 zSxT|YPFUbx5L{&W?sPFxqF}e5Wg|rh6??yIZuwJizQp^gTJ3iYL7f^Lic4VyZad=h zjq^a~aEH|A#5(NjB_0^P50e_7r#|q&}2ADil^m>{`R`y3I=Oh#7LG*|!aqp^f@A5_m#Go+C6%Lx?>OXjjL zqdq1WF5+}xMOg3Q+hbd{$ApJgWqL`4W8g}eKldL z;^jV!_-}54+asgyVh_!Dbm1)XYF}Qkj`(GaIX%Xwn1%3aEU@!t!}sl?6vv(Xn`C5C zul_dC=vP(P+0=FA>T37Q6ej2)a=9wK)@L&zOvyf(mrM_*1M%78C$L5l*so|uf?fciorHGe8A`A+yblDaEB;6|4S|@xS#*@p zr(PCXC*T7K<)J;RVFpFYxA2CK7Ht>4Gi%uEP4b&q?hPupw< zFRdIaw5#mFrUU%W36PQD!kD1`YOEn3$lA49idCC<58r)&;XgP}0gJ51$e%P8oxN7G z;B_!dIrWyTPHx_Fa9pxE<8BO{;}-A~P&E3=MC^ z{cNTUOcG9;TXbYYX4FKo?-t5p_K=@Mksk(Jl`S{jWj4#CVtqM5N)zmoI+4knl zorLL*>4D)irpQjWYf55ub5oAVUmHyV%E$a`uT>hpv}&0xUi@Y9fqhpLOcR=`JtU^v zVOf*=m*>M`ZJN6V`x{>Wu-Ua!KO3_*-luCc(tJyuuys?CP}c3--kPp@$wfA-4=}50 zEr$d3R*QXH4mUERlziq)Br%XRVEUV!pFdpvlSt=hkkrDC$0N{SXgG32}jl)8A}r z0*wqGv=^leQoMJ7F5tZu7l{5FwY+=*cVt&mF20Th(`$FNWu9o(B(b<<#7+CJF1l8& zTf;Q{k2xT6ZfZKi#m-GOoKaaksuF7q{47c(UGLKPUn_^c**MW6)%nX;@7Jjh>0uvx zsRU+={S?7FOdiP*{6YB&3wkFe#mis_U?Cr%9O zYnvjUT(4sp@B(9*sT8ttiUYO2zRR>^`DaR`?K)5kJ7{V093T}d-#sAB$;OO}nDsNI zsJ29=;qN-U5pG6g{+5*OUn?shIRJjtGZ=nf@aDY+9V zHV^tySa_J<=k(#2&vR^+&{ojdPV;@!LvDTCvhvyv+>A`2ZBQ#D;_i&BJJQZQGv5;V zoXNq}anMd9i@21IyA?1T>RIe6kqAKr~ovhk3p#`gL(9_S$~kE|QS& z0KTtiuB`H{+J$J*BoOkH9_E*l0XctD1tP(}pR&(j(XCraaly}^S1`d(k2}w7(>|h; zJGL)0*Yj2#wZY{_)^E+(u+*t_s8f?epRcM*oCIiv-1#3 ziWXB7gz`}%g3xS{PjCTn|qBEcem=j{hNOjcf`THtXUdMU{hP@%VVzVB4sq-yL7IZzlTv>UrpvmV&^gC#)L&V6~>Zum%lzF!?=Udx2 zF{vw1S+M3$C?BkFk16l6Vxr{L_qT2?``-BO+@6%)o?*4iBr2o)t2#d`&F4|?`MAQ! z;+Ao$k(1ySKe0%5twl!SGxxdOX7T*H6y$6+dRBx}1qX;P-&O>8K)-DOHHJFo(heu+ zUCl=foA(!2=skVmWcuOo*jOoTe{6?PD_|~Z={c-oti>>=YWY3%>~Hslw)*wh#Qj(= z!Y%vrbFEMC7-f)3-owUBJ45u@90jh)xB#>-g@~@+797A}tBMc{=Woc^#TEVD+2Yn! z=mU=I2bUMLd?uMw)x6>!Y4R=W^b-bU+7?fzq>RR`NBZpb712q(12H}>u)$d*`@Sc= zMb^H0VU(;=Ek+;QiZI#OMU3@+C+Cwsxa;r8p8opD6 zWz>3K){@D=CsV6d!-^5W;aD3TWpv_3l8~=I|60x~=il#o@w&~!^XDffVJOZWBV(V0 zjfXZ@t?u8k!^?Zp-W+p*$;NBL&06@DhLRmv?zlDgGw1uqK zXg1qe(umcZz?>~wH{znyTQ<+lMRjt1pt(^ujO;AU4c#@?6R%wr?a$JSx80<(@zlVi zYO9M-+1JdJzm)23ma8(=926(4yHrJydou)MN9qu|TLEQ$z3a~HE84wYTGcpTQ8(PC zn@jqJ`}&Z8INGyzF6TF2Vn3ne0QsP{Nfk)V#Uiosp|#!1&_*pW?y{Fxw_N7NbWtfA zkIELviR%c{bs%M7)ml#zuJbOfs>0@O#m57pg4e?6bMCU@%sCM(s(etaB5D#j%x)4_ zHlT&{1!^e?E?kKtYv`hB##q!?Jo|K1#wKDSh1gtr$tW*qRFbRLY$UU5@mF5*R3|nr z?@N$fi$(S{;36P=dIc7xAaagcA(0Oe{Ft$ce$%XFmiZxOqrk)ccn3re7PT=NCioaH zd3*hilTXWKn}fjDLo_|84?JO8R`x^Iq*zA74BT$KBqRx-_rpm<^s1 zt!@3Hpxra@rFU(6dFN1ezBIRpDSrGW%nGGKRmZxke~0*|AFmS`uBfwxW&uU4i8#^y>jVFYT@z>)eQRAPazsCOMy?hWYl5qWiq1u3x(2ci zCob%(|J)K1RaEOYii zbd|3BE*{UBaBde}TzNm^5kkb`MAxLo7U=T;(GKt|PJ{ zh{FV9$Hx!AoZ=G$9u6q86d|inzQhEK6T>7RWl(1TYnF2P#=>JmY6aVNHfs^&%-%SI zSe>A)(zi4&wlgffY{zxztDSjW`ILMl;T|pFPOm(TUpC*Ryw-d@+Q=Wi4XE+Yz3MKo zJhfOaSeI@uJYMh}Ug^+P+qn>}YHTWrqhFGgxY*!OG9hb1w3+mO82Tbm5~yIOX3rI^ z8vK$pcIk1z&A8?4hJCM{jT1Cup5}OcqG8gb58J-g#Mt@3FMeiyHwyanU{0u+kFidT z>=PEyjHl@`B@T67DVyuv;^7rL$P-D$Z_X6-Roh+E&rB{k&U=`bny*nMP<(-nH+GHx+BVlzzT@IwA0Ok zR*?{Xr%PlLLf}hcer%?E;vAU(S}KW6Qx@QhD=>w3gwT)BaThx`Dhzs$vez6xoNOGg z?)aL6mGTul|v?cRT9y z2?)y#@~DRs+=V7NN}(Q>xwHZ6JY$->pb@uQBiTQKLfi6QQe{E%6#bu!8EENak#TGb zCL$cgCa_odcGS=5UXOyEB7^W;fqjsF5}tB#x=pQ3Tu^y5A4S{$+k43T(Rn`iIRzVvt$Zbz25W z8ds=zT&V5(zQXp;84Th*^VkvpM&U9B$-5&>ATN!pZCMfam*#gi?_)> zS&>>KFtiBO+2nZY*ZqOU;gn7HB%SHgn8UHw?Aco%V@bkVTGQAex8tkVSqvx-=T|%2 znNHiY_BZEFR)It;yQKc52d0beXrug3Pp|B>%J_0A10t#KNLdM(Y3+3&s?uvZ^12n zoik%+lq@F6%PBl~pe=mHf+m^ReyXadcIjofs+i#%CzTD~xckd4mB^bNx4A0T!8SYh z=(c_|nxJ|;j@y_b?%3CGUt=`LseS3gJmSPW`>YhXeGe~zaY#Q#W}u)HnRKA%g+-VX z4KmzJ>ajw=xU8y$e%5enSk37^U*%W2S_nt6`V z;T`868Jlpy%t{~<&|hh4{13GL*r@CPu@t4BI~J~RUSmY=3#NtIG#7iCM<;Rl2vM;c zT(`K}_gRahuzfEC$86BS1#Y#+RwTfeGSOMpIlNl=<1^}$wX=$>=#34o?U7{~le+>l zp{NCu2@V7U%AtccJn@m*rJ@>{Uiv-YhFss}*V=u>aXp5-$^$cQH8ZTK|83MyBXB{I z)&}lJPIfg-O}5==I`LK4UG2>G6=yx=U5IwZqrQnd;&+;F;2g|-^5Jn_dBFVBXMTK` zJWBuW;Lg1CgDSPaq}Z&L6;4M>=UJ;~%PSN4*b}pi)M~GC@yRbPs&jM*1?Pu+yv&*& z%Dgi<_%lHxpw_#{i_pVvMFr`gC7stR;Jos^(|6JRDG8L8G!n52b=3X5q@jjH z4aOyqYJC-`^+TjGnEQ$S_N_MMeVtT_AA9<}eX7a0k6xZsHY2}p{GL`%(-vESFQ4#w zzy56Ob>IH_>kne{CLOAh=OWTq3B_~JpCo?wh+l zB#T}-X*A)r>Y(^&&bObcGwL4XLQ|ZCQ)PuM*>e>jJ!Y9W8EoRI29Le`@b;*_n8g(_ ztJ_r+#Yv{4Uxw^NW=`_Jot$K$orRgYiM5Qz4<)?Z$!*RYg3Ua)S*$w(=8T6Lm&NcIHT z+gJI{N4a6xC%ouNUZD zT}oZgmg`zbo8Kj?kp0(+#R0$XVz+^<{*%YWjR$x>qi7?Mrt6$1pF_d^gacj+4@RYL zlDc6Ce27q*X8d2z0l+qJliTbb2E^HWT=)-4Sw=3N$g>jCx=adk2amVhK)CD=T&2QH zEzcTwwWm2zGgH^dMQljoM(;1F0iw@VcC0v<%*f zG_sVlH<2nPVh8fjz9yNgj|B_UOaB5Df3z-z2sGO;Nk4gWyZHd`IEYOlBDy7tq61V~ zMYSd0+T~!nCei(Qp~=n3iio)~$v?{J+?!5kPp9`^lE>WMnAtL-N%BIrS-Pvd{^Xtd z!tFXpO#iA}Ba7ziYeYR&nguAIWOR7z1UAA@yyq%7YP%U3nKeW~%Cl^3)ZKJWUR3~6 zHjzNLr1P17!i3bfm(y?tHEJ5=B+^34brM%hwCt7c4yijFNZP{Q8y##LouSHdVROyT zPVGxwqsq*_d=|?`m)+y>WbJ7;x3X7nY*C_f5l3K|3H&|p=_&>gH%^Q$SIeQ70$EHH zK=?TgbjHc8z;iTm7a^p6v>3+VL)`P5wM@S@Qf9q#gS?-{(n~;7>J5J#MF_+gU$5*6 zQq(G!=!K3xBH2NAufMllaP+arh-591NM}X!0%a`N5JNj8ZAa zaIhx#u5oS0!5y>R*;NJP#k>})i>s#pTnjZvUx*Mj!bpqZL(dROl?TxUC&(OLXbmI7 zQop~S?X}TlY>4gv@Vf9isO3i@LU+s6$_wjyUf+Enf*7mZ0}V{Nli>1bIoku0&X=s4 zWbSd)h{+I85s6zjli$26Wc!yW@KkQ5@e^~9JgE(*Z`+1cSIAgVL3FBOO zA>HLA?cA_%;MLG|+JkqNlckff!>&yd>9a&>XGQ81z^F}HAttW0fLq=4c`}r}*+$d!_st1>uGX7s5O z3d?J>2G9BZu8MSDI}pNdp?Ny{>4#y8sXv|pUo3{^85X4pq~68}Uc^9wipuk36Slx) z>xS^x-6~)q1WTM^PX(Rh5`Ec+OwJ-*3tP zvjZ$r3HwK@{S#2%Lc5a^zNtXUYjF+9QB*8vavX=OHQ#iO0fFW@rIz2MNg5eddyoO9Dsc z`IV~E-E!!%v^ipPh$Q*9;Y2WlDeF1wYeLFQF%R;0Tdo=qVie=+)kTBb=y4$U%%{(d>X}RCQjz0N*`_6ZiLxup zYKnSf^dKtghk4w$q8S)z;~y3vT1-RHSmKL8MgQtM6!@B#-`<2PvGxFaf|If1N~58% zY2GMxsrA__!n+qwZATdv6N5vf$d#W;g@OGZ%(jY@x>Pe^LeZ_YM&_xo=B1M2`Kdq1 z{>ULQO2k!9KfDxs-adP<`>h)+tr1?=nn zRh$Btsp3Z}Ii}X5af^;N%T}N9m=^XPEFnsYoFX*EK{D{Na2561*IV0zd{!a6SdmlXGQKU~7m zh~u)s+laz_7Zty{vGSS`AlD2ldJo@932eQ@)(z{(Jq-WzL%>J#2_EShQmLB?tp~f4 z?NFl2$>+%`9D`KTw8ZaWLs5V+?j0Jj?jwvr2 zy?8^6ayZqrufqcy)QM0jJkBqSE|-$COk_bNu9uwd-`4*UphF^jKFmas_E@2 zCX6t1=wdQdb8G7xwe_u@m%B_z_J^u2QLwgSCZ78)%~u7FifnT&gC_zBNnK3b79y#& zY4rApQP;_?#(DpGwV#YUjewPk@bx2q1^7&5d;M8IZu}dY=Kp7S-9L*OIV^hr7mwx9 z3;$b5J^Cdnz2uPZyQyq%4){Ls_!I%+BW~unW(aTQ9sDFM@#*6O}+4g`i$L1>c1 zdML2K?9qmJ?V^CK3~zIFu}cF`a%?BXjFd>SahOP=*n4=39lBtiQx-1-$fPLA*mIuB zPHpD`e>f8uXcpr}(rB^4mjUvl?Nb5!p=p5HLI75BbB^D@sE(Q32RS60Z1UUHic|IG z`Oe*-kIiD+{@~RBa&`5NH#TN|l&KlO-dgeI?B@3Fv7HAOGx*l3K&dHZwN}BSH5lJW zSSICybY#BeS<5<+M+FA;CN_VXSOzi{|Hj9_#R~qxbP{w&Zp8t&kaRi4pBp-#U<=v} zQn4(*rGcdQXvBKxv3;HjZ2MA=f!uCb8C*DDZ4I^(TY|#b1u)lr@Zmr1+I;y7-x=Qz zt5o2Su-k!5ljy;`D-ftJomgeRG_sQ>BFn=xKQ(P0TP04CcIA65aa>P+nCIQ-zkLNJflqt8CpwX|AK9IE%OX$UbXpqp+LvW+@ z#yN*0X`M;{j=MI?G2;6e)LGCCsE&pbNj!TVvbah2G^pI5wqR_Ee@ZSAlf>3o1~ z+7}u6R7G!_#gh^$v1aZ4fFM0&46I155BE&WhVntRuE{fdX?26a#UD`PVoi#)(gCqe zauBjm0o$ysoei?GC4iu>=cB-3Ri(f&eK&BgpjTZtn{Rf-L^xL|TRO?p2G$f-n>wuMGBH~4kwKbao^or%5=w-D_-Y6!Vy)2j`AMdk&KSExw??vhzc9Na@eqvx zXNZJbY5NKOwjE+1U%`QF)}}$y$2EuDn!s9El(YzRRNGlrW>5wsx+pTj!ovK^u3MpN z-Ch@OSS=8)+mAbaW~pEV7K8y<;>V94=WBen+H$|*(AC_{0%IZ;pNNuP^B<~z?zvfq zlQw<<55;sY^|S>2uq%JJ?Fs>p3}SBC-`zUgiHh{9OfZ}!{R{54Q~yEo|L^`}p5R-f z>>J1srqKs~iDrx28&8sf-CE_WGevKG9G+T^T+tC?b z{nDxMq!LS`lUpvsvb3O2COOhcS{}8+#gpMZq{dR;i?}O^Da(IJ_kimH*O`S(bM~N@ zOf@th(Tjnk_XZr{a1W}7-y(HKgX6PnH!^(m;yubKnacMHK!o@QST#nYhu!W5g!Pv- zo~sSpt+n0Mb>0nq)<(ZEQO+Eggh>%TS=DntuF<&hN@?argANnZBAD4&L>$;O;tKDB z{TTcQH&=~!dtKEZ*!k24N(UpofG7KC??l5U$kpXvQog(T2#MjdC{mUYA!v$$xUJAm zO*ZhLg;4q!`n`GzA=me6PV%bP=#uj_#@dvjNZok)uxqg440$B)#~Fi;1wEflAejLH zpL4FSmmm`|GQ8zKA&#jFOK-jXGG+|*0?>tg&NblN(}BYi+cJd$5*&9z%27a3s|U$G z!T3c|-oh|*MK!s+F${i~h2iHWQq4B{M$hxWF;Bc480Fl`YYx>#?3eTz8Y%oq&g|Pg zd?FRK+Vhg~u74&V@m(Zed;cNS8D#4D*5#&{ZETg65`=6Tc4{zQj6Stx?mBTw*u5<0}C#+-djj zWNK=E7mGYOv_J^Y?Jpr_?N*Q+*epj5Y!bt&4n5Xk3A|rl=XuX}DAzc0*ejn_dn*wg zHc0Vef9T^&TdwmmLh?^MOu4&3C%c_dKAmQ8TYYwzr!4h-d5`dmx#D8+;nFxth-vw9 zN>@VvH)Yq}4b0<&QZ*pdW%#{ae`eY+Ax>vR^yO|mT&qR@(<_E3$lfet3M*M*O*G!N zykf`d@O!|28klXn@+26GLqcLKeawi-zhzh+o~w~`Nrmx;v1AlfAj_txfDwZHZ|pb% zQPDgbU4o6w<@r?N#Ecydeh3wmi*t*KU5C<@N5e?8u!m=Ff@28DYCR+}^WurSVa6+@ zvjj_Sr_rs1i9ri|4j3jT<)=fX-0?X7Z9iP#A z0>*+=XBAZ^u%*0ac*>`7du`~|vc^n9aDx~G0p$jO1g7WUj8h61g+FTJBiIt7KK zw4;-dhu*dK&AK?tbFO?g6DXOK6rh)KSoJcomty`D@{JIu}TV^0tqsQ45@zWnqrcLoA5&SyW3gUBzjK$(BQ_yEr_pfqwN(z zqgV87%i3dQSWC1grGCq@?2V&@vZLF&bxBHX-nv7Uixq{wT@-+p@gF@4Tj9=qFF#zR z>2o!USgRO`i7>m4@vY<-{<&hR=DpJ)o;@8T*|g(e9kj%>n$8M#%8Bc>J@%cbQZay) z64iSH;lE*k3A#~cCF#_fyXe@-M5VCVKa`epwY_G{!LQy*&&0-|=1N@@0S=m-S1td` z_F{jpa`j~e3%y>>k@}Oa8vU5~{XGN!_FMzwLumemN z#MMXZmVgLaDuT(^CC}NYT~a;)kcu^|Zl|Ox_#Q6OFMTae;8{A+v-8R5&(#9TPg2~2 zNC;wRG*WKyjPJ%~Ao2tQw4Ks)HT(->bPt(TF#f5w)+PJe^DXG;k%8fHy{i>-91`XFgZoy8(sgIlBe2U@#FN39@wm{kFs&;h zHpAMHN{I1nGLrbwK6@{W4xrMe{Q8JN=aT8S1&jS`&+``ZI90Z=S(Sar=DxhY=+fh;g>hc5$a_^qm zdY=txZ^stRp>B%8+uX+Ei~Z^@^BCp?3nz+HmvGp9w>iF)Wko^D_%^r*C$qxM%$Hp~ zls}AtS{ss)&5(BgVUX+|zR&4w>&L7cz!6TFQNVmUmt>}9YM=mt~|2oq?adiqiqU8Um1-dCu1x zr^y&cPyeHp`g!j~MLz9V{FiVOsj~g>UUF+XGP08cFsp8FpFv;sssqqh4}+dltAjE@ zxa2$ciBZA`-tK?nVabdsw8t4B#Rl!D=w4-6bpAszZBs3Mpyxu6Zah%SS9P-0CZv~U zvs^AR{BmxEIq_6>%j-(kG}6A6M_=zd(E*a2ZXQKn3j(i(r4D={mn#{&0Sx3%bpaOv z1TmS9P3-a&lKMhBJc~xfkk+SGK%`#HmIdm^Y0Pw&{zeUq96|#?f9b`Ge+T+0HNhx} z>)CN3Qfd&`1l=y3t(?W%fdL|Vf5rK6O-EtT>lYyU;|^4upi=t|VifQSuRyE&JND1$ z4GTRXuMzq@<`zvWb}l`R96V%0-}?g5QZdzuPn5PYTrjOa@t}hJhFJ>W1`bVDbYd6B z;|ruXNttxI1c}j?C;;W*vD{%BHMTwF&zA7yq)(uKVAF^JC>>Y69 zy%{$d$(~!0Vygr0;}yUp?XbpoKiq_+zJa9La8#LIn3qlKi^?zCB_;0ZlnuRmiQ0W*Yb0WoTgjs3O^MwPy?ctX=Y_HwQWMbYKW7u+F0%dVzKL78a25x=^sm$v)VB@P(EXXC6G0-^hGzAnyWC1_JkZf6jhs zx!hF_Pdq4=lxeebd5&5S_JA%K>g52#7Zl)PP|}~&?BZF{RXP?TGf=%%Q1#yT*nwxg z?YST;k9~S?6f)C-eZ)z!Pea1S;uKAsI@#Pir4^(2RbmT?jW<}7dd|))(bDocrN5kv zjNtPR0DuW3Z}jGkXDr8iR${-7V`X`qK1w^AValp%Pc4BGx=>#bw6g%)$;bV$6nOSK zGEsNI9W>DPq^op5zv8sWsGSo&Lcz1Bs8T&ndqriiwmBSL(9@9Ec4=&o0hJw`DxN?a z4k~+zotA_Dahk==)aKUfcbh}6zOSGO5-1cPSWE){ev9w1s_kpb2y&GtOKRE-Vgk3fvwb8!y*h^nQ| zTD@A#G?d~Dv6djniUb-BdJ@MNpbVYn5*s^hgd5BIepkMpaI0hOKeJo}F057M??8Q??``7K62lz{kpIO|&{>VkbvW57*SG4L))sANTWO zE1$km)~;IK?z%HGTmo-`a~S6>r929snVw@|ub4!yzo6(L-xXYu>OD!Ve_R^(5x%1O+z(Y2l7$PwDu7x=vv0nFcoWb z_$gKYjca;p7f1}iqkFa`hHIuT<6+d5`8v<#k#7MFBUqUIwTG_15B!XN0Ju(i*aGFi z(NBuU{yP*0zyHU=d-THR|1^U7==p!F808w>an;M%~ z_H^gvaP~see@O>EF_8K!jkhz;xV5?dU=>ri6ddoUAa*!fb+z8eOIV4yvg2j@!>%Kb z5)g9ohw91usn`k8qxd7Tk*g#;TTHabqpDgH=l!{b#U;s`&ZU=TCfqz6eB~j2i{x!L z&E}QJJJuG|;gGi9#54$N*{8)plFWN)dC zSYay(TNY)E7Ky_#<3%zyuS-hA6bVG0g3Ju(-UGQU9zaTS`7^~AfTPpOo+6ZU7EiAJ zRTn>%4R>!wRP8$eyIkzU_QAD%-+QjLk47{uk)ZQVffS0EHkRf_(J)L;D*R}iW*630sPj`)bm;!)vWB)V52)gVQ=(89D88cm-PaH!Nn=U6~~c4`EJWq0Y2 zqE6dr69$(TP*xg>gZpa&h_zJsi$zSL zy}y|YK$~Fu|CoF0xTxB$ZFo#9L`Aw3M5K{!RHUW5h6d?wDHRY9 z2?=Rw7`k%+MLGqB8W^MmW(bL41O&cwxUTDdzWBY*{d~Xo{^Q+$@f%>z-se8|TI)F0 zvDT6ubSn{y3rElo8Eg=V=8kLGq)=ICmH=z`>1m?wRv;tRk_-9|I-v2TH z2kS=*yUF(Md2OeH8s}O12@x!ZasKOpam&cajQZj>lT>38jl4BK7&Y5=24em-!I1oH zfFVe8{~M*z-!|d@1JC~>HsP<6|AYAdKII6QAZ7ZHfx@wXu>Y++Pjs^3;8};9wUM#L z#A41JK}H=9%Xn{4GWEWwSOA|^0M)Ocw+vtH*VkPm`g#N8Z-dwM%+~a%!Hb z;6+bv`K|=+t1<&9!ngCX+XnIJKKJ%%qFiW(t@D8mnPP83(I@ zV*<#%uV*sog#G4c+9Zi*BB5<`*Aw_U0`wJt_c(9gx<4nxE%X*-7z5ee` zVu$jlIv*TUu2zJM2;LUb>`O&REq5%`-nKeR6-{7<7h85-lOA)vX6OOB3#05r)ZIrkN_*~^ieNTD>T>?_2AKE_r;fwJ^|qigo{-amQ|lXnD_F;~msf$<+Tr%khp_dc?cHy9T-7<;T+)&D zpqSo)>gnLsP|u9U#oZ^m?Y(9h(QGL#27Ass>LsT$$Et78N>oSNDrR=x`w@%xAVv;0u+4*rT|UI-~E3l2sI9ONliBWmU?&B#^Lj4^UF}x zse60YL9RPa2JxA$JD*V!alNtQFSn68ys4g&noJCf`)s%IO&E1PVOI(Cb%;veWk6#Y z{00|aT=z9MT6ez2hUrIY5Os3x9!7mx@X$gAKp=Nih;%4{_J`j+f>Hw^RRmnMQ@h1~ z-=FLMH04gt7a+QMA)T3|5P`z87%JCk3Z?;rTG5Oroag z)h$Wz+v;1vV^SxFdtaOJtq8Q-R3RJz#FqcjyT3b@P!De#FBq~A%u0(aVfV*vcTy;3)A$RErtv4|Da*(Qd6``? zQ5G63;Cb6L@oEy|OGoNQv>rgJ8+a|O^c?~RA#p(A|Cr^AL(*dp`Tp#aSz z(B)-&>{5+xmV>Tel>@x4SR6#@lQ%(-jFh)e`jEoS;tM(v&8wJ8a5rgy{*tl`EAI2E zvo>I&%P7Nkf?W}q%Cp2jx<^w;I+tryw>Y~1Vwp5C|sdMeMqOm`{Pz&NMExHw`s&5ndz;`0=|63-@pf889W2S-n zsF4CV0I)Kco&UBUdEhK}%(#hUh?_OIK|p$~05y}Eg9?vf)Lt}DQgEs_R-cI|%3VRq zn>l}zWJ%m){KkWA{2xOm<^F@I3WrZ%I0If=xGFzZc{Zd$tD)Z??00YzykM(nP=UVQ zH_XTJJu|}Dx8WiMa?(}}e@P2n=9CBoCl%nG12>E!?8RVEb_U(J4YZiXYI`~Y7^{3EAG&>0_JR8!R2K^`8iJ7$ zGd5)Xq-aYkRwBxU;{G{P)KnCYZ;N}ce!)A#Js<)qMB9PKH4gGY%s`#;8jK3_;fAd% z9DioXzD_Ky%wc}_ir30t7Eya7?Q^53a$cbWJHArurwy*qE!QlM`O6v}-922;)}9c7 zW~Oe4tXv%NTTigc;;6!qLI%U$wa9K6syddDzQwe)vRc-h8~0B`NNpSf;m@gr?dHd3iPo?84EbsWB*x>oVt6XCq(UJFlCe^>} z6eM~?%jJzGc}6~d`N?GQa=BMlSHZgzTIu4oX)@FTeJr*tIRI(mZuBxd92334228Qu>Gq8$L0t8I-l7UKFn{tQN!56jXHH zs%mHS(+^cCpG2k4eGVFZ2B|rDrbf>_^L4{ZTx}a|{e0ZHVmh7Hd4HEIYyT8L?c_qq zzMm`UsKI`>9c$`C@|nTy278{DWlIJJ5oi2ryql|sUD>nOvC@Cp0DA#nQ)o!a7kzvI zA_`@BnL8(~jthq0$ro1LfSj5pE!Ns!C=rg9a^$G7zhJrV6DP$koQ%BOojeC72xwIn zMCDYEivVp7weWfGZg|${>pIE`rO&Gx9kBOL5DPvJ36J`UV=3q4$J}Ng;S$O=UDXpt z$JLpU=h#V9TvybY=vQ1yLQ3@rw_mh-il*$m9BDV-FsWd)9@?9ztzLUj?D}BwM5<4l zn0RN;dc_wPe97EYgwDrV;tbGqE+=Rz#WQ zv&FH$55sNI^?ooc8(lyJGmS6fE=uYH`*v_8YqPXk68$)?s zf`oS8gf}cbA=l8h>ta=EXN$8)!*ev$osq8}LBrDY{qXSj*U<#-H0iVwJLrn6jn~F2 zHZqu%>Gb+}2yI1H^&sMS?HL@A=(mQ<7$6W8I*-e%*{HPtjGv1qYg>C^ykufv+{a-5 zTk_+2TJ#s?8t+w7a*7?>0XnbfI3K~zV$(rTv~!a@NR;{_VmNJ}-*-rNok|XAL`k^3 z2YVB|_mgkyYRRHH_7{PX`)9iS&-qBAATBxuP^)P3@yJ^ZH&Au5OEryt{*4YT3=2)S zA>-l+=^)MFh4s-7XFKq$_F^a#_;HOmOlnQI{0o~#~>fw}0>_C}l3 zKmx1Bh>gj_k|x~Ja-mlAOwJ^7HD(C2*_t1y!RgCd{tqn~+7hxHw3G`7%R-Mo7h#1( z-Th14OQPiceLP-IO@lU@_gb%|DOq9v9Jn5zRToe0LGhimHNe|#g4-@8Nv#L@%J-#G4gzfxRv17_5p_`f>eJ2%nKOAX= zhghrEQS`gH(a@Zf3>1Tk!}DeJ!u)@bKej4YChkn_Kb|n7>&MQqYhFe*z8yz$Tz53Y zHTZ)Yx)3C~lw#AJAgyLpY+mC6jmS=+=G|c#;n`^hMVN+J1i-M|B;jT0DQNkH>FtP_ zxrpw8rSgYx-$bM#Mnn3g%ibFgt3e|*27KACA4hW25aqgPjAT5sv=>5>SIDa-BG1(& zcYpgmo5jJf=$W)jh1?J0hzfON7LXx!G<>*R8`u0SwYLM?(3%c!7<zguQ;k;YISwui-d{8_dU&$s0)S z_r2a=bBV>vdP)p&EL=Ig)-zKiQiCq!wY0otcYi`H(P!$0i=u^SvFxnf6EBTG2l{1? zwFLKunz)Esov=&3llmBEixY>GKb_Tn^nH?7>wMSCXyru;AF*4tPiq*DYR3nudUbqk z)c7fY0h04JhG+MP4zxrok{j)rr7nJ4XPuewubOO$HI%4Gj?h{hX%XCn_Rz{|^1-x; zt?RWX+_Rmh+2opv%kC7hu3G(cDekn>UQ$z3C)`O!aM5H4x7J8lQJ8XY3T*@0{Hkh)Yt>EdvCdtq`T&}mjT zHaq6#N@jMq{n-rfhvI(rO&BdK)S1D`55_45LIXT05KB^j6j3_lmdO^+M=TEsW1~awJ zqWR}gnAOfDy~W97kF|@4b&JBGO~;KP>x7tu3O0Q;RGz6PLFrs zU{fu0PlHBKQmAgj+o4QGcPuNrVdHJ_f#S=fN$cP~$*`9nMRPo2zpFdGqI8WiMzE?} zB4=Pa5BcSFtGoT_quSDS)@G&barjr;8CJ^!dFf^KqifZN{^i1nwtTz~xT+b#X`h)2 za43wVua)5*7Ji{ih^wn!dw$GOxJ|2_2k0l+?LtkFTy48Fg$6$pgSTpr8AXyA6=*(J zig-~3<#k}$S|$=RCmZ9^a~h1&(Y*U zs&1r*PAXN(5Rl_;XgqD^Y1ngMKM!d$lK~r@-~O`WSh2$`v7&dlTf%&9X5tAEszQ0^ z)_E%<^}ms8NP0coh#0fFqpu!07EAdPeN$-a5wqjGwL+3ow%(6J&(34Jv4IYO%ftc+ z0N>WB#*H_)D%U)5EVnQ^+_yS4A>$CZx9s}bID1p}k95$9VI8Y0&%0Vx&CC15)`)i6 zg_4Qoe|b|Ia%+3qMhoeXKMpoWI^%uqBsMtFw;r)|hBO{rV}?ey(^FXQUzto`E4zTL z?1=ad9$9yk%Se>fvZp`Qu11W}~O#g8cc57o<0 zL7K45zuEs-uT>wnv#fA5XEl^Qbt>%*5U}3+rH%-)z3%oP{r%jOLvcabU|>^4pPXD^ z_?*K+gii>&gg&9Ynb7#v;8A2w%a5y8P0x}*6vW2&KAwR7H-8*~yD$WD@cbSTfx_&m zeTH(9-}^_vINiMP&*y(R-T$Rm{p;7!7yiAYCK}X84t~v>e+b0slOIJV8d$cvMvTx= zw*70?8?Y^?VJu&Due%qQfS&NWr{}#p| zKEJ+Mdf8sR$uy(ZXvmu9Awh$T5tt5 zmgNvAzHeR!5nsYc45FV%O*WB2Sg8dpXYyAtNV!aL4_0t!>pN#;e5IwXDXfU zSo}tKjHfnN)ODc%^eehV4hW<{OZ0Y;)-L+{bDZIdWshx}+TkKY*|7=116#`{_768o zyK|F05S6bvHRh#SFr|DeyK zxk3XU`BIs?*W_B5A!t$6R2x?@=;2LnLHmeq`UxbkD-yhMfrwA8TS>0|?73~XVk$-5 z^%H2Twi~SvYx~^>I$z06^BmWBJEpDaghYqAV{&?0VzOeBqs13!D&M6`yIRrP*5zb#d28a>w>ofIP;-jDuIrnp?S3x;WneSz*!(cskFzoJ zM&C*%x3YunLHLNUV|TG(Wk8~3+T!r#^AJ(XV5R&jpOZfgCy#bc24%9+h-;&=g5Ts$9LQKk8=aZ#UtA>mF760!+Tve<%lI?htNZ^0s{ZHZ zzYw4=!GsgF0DwD*qG4s%M^e#IbFqtSGl2I*i{+g*rJP?yETY$&{ey!!6U{krm!^1gm%<-e zwAAHy)o7hRpROtKYrbLtErvvb*9rhQoTq^t0p!Q#D%4KBRVLNQC}k9HysH(!!=ZaH zG54kROXLZ^bS?*z)Gu zS85IlJ&wzvd7Mjs3XewSMXQUF&DFGvY1xI-bIaM zzL>C-L7RJn)ZlSe+ylmtFFvAHcB_(cGk6ExX7h-st1*Ty9U5n&31sIJ5&ik5guAog=ga@bel3*VhJYeOhAQBhqZ~ zBeSTqG2VkYw7wvPv63#*ij{8`0EtUk1w!pK-Vilcj1ETgV;GL>-5zXYP3}inxg6HB z++GFPl4nCgMFT2y@qgT|p_%VG3^fe95F^QScM8(Gi(0FuIkFF*agzZtcX!RR{83%8 zfD?m&yWXd7h?f7jZlRUiX3_rhV%{qob$d+vGH35-g3<{MEt832v&&YQI$# zv}ULzW$@l!xFq%u-6HzGO}G3T%Wy9q40Jq;|A?j~hl+ZQo+hgw--ZN=$QXi+wu7gE zIXGU%=eHsE^9Eku_3$9AEaSeOum6{2IH~7}GE2G8mZ|QpZ;s%%-z*2yq7ADFH3Rrc zPC0V}ick0otuF~di)K={uJ5xJZYtoKKqz-A4S($|n{26$>`3#UsT==V;Vhn3hjr&+ zJ924Oq^#I2oGThqwIGB%5eL-KPOnXl#|oi!e;4oba}a`TpXum%L3(o@TKUDjr_WKF zZ;7u^^{JL+wK^Bx(@-?81ct~*v3G<+>Qe5=i31DS#LA#!@kEwDVlo+*VzQ;`)8@?> zw!J-srb77O+iwR869eYUr^W0RoTv0PHBU@5DAld;6wvb_0>~58?e6wPV<>wq)L&oC zFi9-oM8l|okJ87(QQ-J!@g(wO{J`Jdzg3gDYx7%wp9Y}=4kxEQLDQ$r5aS~wjBRks z_HUN052xu);TvdiG5na>Uo72%O-q~l^s2KokwL{_!17h2bi#mlzkPWE0fqz$WqIta z)kkR1q1}qC7h9;MgBUZx@<+%+IMo30V)u@?tIzAz%?a`hh_5ICK^o6_Z?B8RAwMVU^+c_^%PlY0 zT8`9GW+mDrJG_S#HP?6#rL2tDKyIed5%^wXb9~N1&oC=o{l->?5zDd5{a5_Df{SQ; zKNx%dxkAOF7n4+zvz^7gJ$(j0jD^uvoRWMo@tvdd@WB+sl~U5bf?&O*^v2g4d@bz< zFQ8?{4eU#Qs);|AavF?(bkUa&;(5S8WV`%H`c*ojHr22x{~~NdB2NDJLC3z%oIel( z7Xo`j-Ym;U)7Lyvk!LO@E;HtRn3!icE~TXWnBh@@(YB;4g3Bnr45SRQcFD@?6Lb#> zRdIKht#w=Za*qusr(a!mO}=(FA!@1fI_%*^!H*;FHDeige!V1ERT4-XqO3vjIKz(K zgZ4t+jgqjZWbH@P+t%NEAWu>0Pk?Ig%#L!@9L2l zPtB<{5^b_sVT}z9k^0&J?k-7;2(Hq5`+2eY$KOR=`iNE}w@?G9EpP z@Qjhi{z=9hx~DAe=J}Y_xyOvE_Y+bdma&#aOm46_{#2{rq&$?DAxR45j@$P<2McYv z_Db5oOFt#=wQGB=K}HkiWt52_ooaNPB|V9qez&T2-Nx806t8uG$8TAMCE<*;7#@p?eZdLQqF z*fS?}I~9^O>iUAu4fHU+O6Yn7tM#`viWE<@g%=mMzloh-&73in8u-YklgK7Mq*O+9 zWYaoZ)z&Q>h&_vIwC zdp$~>-9xW~ywP@|uG`hnS?NYwluf-}YX+)&hGwS%!QFnYhxPP?;~Z?I z?SwU%jp-mNQ5^8n= zhpcoD{Jjjd%91pD<$~RsU%2a`O?HWs_Mq%rewC%gjN_nQ)=a9zkb7dmEb4TBpx+rG{Woq_H|4P z7Fl}qBsS;Z&cQ)tUBD0eT%KZK+aci^_Sqv=Fh2DP*kHfbLhR&>Zc9`pr-7;~%`?}I z(%jp&E?CjUYV`6fe*4TjGLdZ2jl`QfjEd@OMupH1hesgqa$W2#zjI66`u$24Z%=>UOKN)`j3|}) zIAn1zE1K@Hfav^5=IB~+xt)rGHX zin>3FocZ}mpX0+C|GLfPzQq03p>(mT(@4NheXJqxi6G-#jUo6E!xMTQ#C#CQufW^g z7k<4gO!o@Pd~)``qQ(G-i0Yx!Wkn-N@t;JK{d+R$>^~v@gRBquL)!FZ-<@nch?t0K zVNwv215uqX2AjR*tt@p{t$NokBgNg>j0!sl@?aOlwsP)w9S18}-P5$4 z?%dN1e9SeQG?Wy_>!>N5L9M{`P$xd<@#(SmBXC|w3J6RbY{wIL=z&0Oy<3Ar+Ff_G z%}`~p8sJpy_h7pEqu%_bUE-K&pSotkk=)b5!xa7HlHWg>mW$}VTY@tn0g2Le-{VTZ z+F{ow&XP!YHrru3ad8srDKF&{5f+EceRp3pWSEQUv@UbGe)Rnu!DwV3Cj>%ZDx6UE z{Bkc_#c24BX_{6<`lyKJ^XgWxKO1 znn?N3%!;z7%Nk1W^d6=0ZE!OOS{2+h|DK}2UbzBQ)w{ru269;E4<09&Df8^y{k@U* z2T(i#s^^48wOdFHw+kUZgxxFHk++a;YemMW-kY_@)!)t75zSh&9Ibb^A>kd`%j(1o zFSTB2i_Z;jkrYMF^PgK^4meTYK?I+Cda(GaFG~8$E093j7e4DN{M{_iDtt_$xhaV#1wmc+c_`tD@*rRHpI(mKi{rPTACXB3N%NVrW+{oz+24q+bRF%;2HAkb0oYUO4snWcw18qi{N>n`7M!dX9kidvh`czVPA zah^%hcB}KwqLR9#!?A@yjb7)gdESv%`=j#y$$;DQDu-R5=nk%4A|6`?L=N8>k<(_F z%%7Hy-IvuqYyxVKy}#%u&mOAAWKp{sVXn~bkdRBD&<-yR`pfM9PqGbv{pJ6_LEN1D zue5~M+h-d=*6P>BSH3zMB{bNu7Bti1B>|}E+O_X3pznh?(9e`&qe?>RZQh3(c`P=w zyg|rc);wPHb5g$il~b<{RGIW#y?cN~+rQDa^fhKa-c+Id7++kfr#4etQoi0-kt8D_ zU%zOK^egXOZ9xJa?j9-Fn|hdDn|Jz=JqR0m!a`ZcObKMM~{`%W666J~95x zGp~*E^)-vChcqD8WTY-)Mct}$0W%@j7UHGVJdxBaQ8EH9f{DMvadY5OAr*LbB}uyj zdsG;3X|~17VXxr2M;1?+bUwV&VZe1fVaNQQCAs6Y+h_%JKi*FJMY<>w(1d~QY9L)| z#viNgAV!WRq}#mcINsFdu?*slu~t5c-WSu1wvD5=xTe9hrvnBJw2SHU>hO{TjSZ;J z{2qJ7!R*-0D=W*=0Y$lr6EA%qqR#%%x_AGe7f@G>{S?!k)UMIy204qnFTaQE zx-|g>h|?tA2Y6#`>NjtUH-U@X6K;HP_=e0_aWSiV zn9og1Il6wi={xbg-bx@X-d?FtTz=-a!ZE4_TDJe0pM3c;bk{8ce?5Wt^e&v%Ny?h= z{d`(xBahA&DUg`?Cq0`!NXyKRIFyx#S?LOXCX0?UVr-$gFIm7k2_>d8~Bai|u7U*ho4N9vPukv#l}BU9S67Qz>eAG-&sdsRt-K zAveQ}2ok0(lE`tE>SBGVjjHf56)klQc#72FK?LC6tdfX_d3@V1F|G*6xj-xPeUX(@ zm!|o_ZUX!6o?1t1Mb&X*_>~ds(d*U<${Y*?s6dfH!LM1CW) zIIo(lZ^1mH739pJ7LOJSWKo@e9?Et1X|17Z?L2~NK^0yd(D>-6$B%Ztm?m?c7*|xc z9{-s+&&rYZ!TB`Ny6Rzjr}YmL^6!=Sz1G!3>rpgUHjxHW%~j7!)dnT(Lug;eoXFLG z`SVcMkzmsP%CWeeYva@ik_dmz>*v8WzjozpN|rEZ{COgv#4u?S=hOatPeEchOL&;5 zes~Tkko2Lx!6U93h=6{4FYw68r{&GWbn+Au_+*{M?z4?m4;J6`*~zI5I4)<3v#iY( zXe*j8?6ZO5JSL^4CpDM&mjvXvI4@CTP{KEBWd$C?MV=uqLjsZiE`e)`r?$ayuzQHL zJ$9JwOXS=L$Pn|jJf&I&wVSq&W63z7!wi7%#vk1m{uer>zkdB6uyJZ2&E~{*Z1LMq z3pwbUVi8hUeGN~#Cv9+pI0+p02=Tl-iHeQh>D;*Fby=ZvwXbp0+9(*ePKmh+g3eRE zOj0e*X?kX{abu`5pm>6{Ic=d1QB9#qI@S9~m=Gdpuc2<*!$vSDy^I;)O>Wh55 zyMyRX&SywFG-&+kQoU!P0TdVRBjnrqKq5E(xNO;zqAZ<%Pb8P+Lbizab`D4U!N8%j zFA&I#eEe`Udd9-NH@le)Xz!o!V1t_1G6!g5WA?|-)?{})#6UPieHknO7mu~46vsx< zG9ktI`?h#L6BNAHfv-P;y+KbgXC7)&r+fo%UwghD8{Uib8nu+0wwU!bR!xj?j)xMS zgAMpXlM}}aJ5-eWIO_eY_Jh*|++%r~_K$A7=#ng)e476bJKp;E(r$h9ZvK9qeta;d zz?CD?q@HX_Bh~8@9HOjtP~tfH`fg`_jQ6!f_j0mO(;Rn1td?CvF#ED4v|@*bs;E!ut?xeG*EvlMt)pkOvsg-W^^pIo#41 z{B&?hjo=MmlfXNahb?AFUSB$4L7jQ1|2`Dr)b>7oVsZ47ZzC)ni#FB#_HB8U5P|RHRQgm;A8n(tnv5MIvjo$2#(82}-U9&8 zb4T`4Aa&8r)bxpQjGG;TFcV2Ti5*Qso6yXTHvg`sUUe>EE45Pl09zjmzH>Yd1Vr(A zwdfkhov5RtU0dc^vz6_o)P4-XBR+&AWpy6QHajRI+wQBp~ER0ZkHTne$3F{ zACps7CzB6}!Er~%HzWdqOq&B>@!1jH+pdNd3#hH0@?J!BMu~KJcPq0Xixi(){?Z6^)^zmkyRiZmXUSgW9 zSp##5Z@W;tm-|p7kOGjLLj3>-=9`Tju($|`>aOJUThy_hkZ>q_iM_au*{umx6MRn~ zR2Zr+tKST>@G_isiVb1?_Z6F&Y%w&rN-k3zxeRjYtte{%yfZUH-qMmLlU{s4kP{ImEUw|Hf=8C|XO4 z^GXtyl}y4<$L%>7j&hvURqjA;KHV-fC?cR*Gi#U?nc48mr!_ShC);O*)in^OrZlY; z_^vTxe~c2f-7#xGC*0XZmV`H3B_eb6cFRh-o@ zoQ+~eh+X$oob{T8{!Wnma7I6Qu3<3~hqH}|oJP~9;=cR+Cjz}-M%TFM15Rl3XBk>2 zt^~ien^afZC2up^H-OZ*E*%B#OOpuR{w=>n`G9>2kVw!IS|^A`ROK`42ks#U=CL(1 zW0LGzxZznRb9hwXU*V0gLnhs>DdpE|A3&1>Yt4I3wz{2 zR>A+vx&HtuEId}ZuJ-78^M|8Y>Z)l?-@B^u<`2%95R1nD1 z(LB{U>G3tCS@-5b(@IQPj@#?=eT4n4+E}2bc)|^$g_?0dXR%_FWhGfg^jC+p*_qLE z>lv*xQp!1gwFl4V=L^r=I`cnn{UXG;EWyQ<_dE7T9xpV0AEAhsOJ6e+LfaR7(zsRT z``~(-k_)o!>X>^JDas|y!l>`rDVWis{n14U;|s_@Phhu)>C09*k6a82dQ>b&ICSTl zm*E}k z3lQpeS=D;}WP509$yV39|H!I7q|54Rdq(^vC;f(Mfi8dJ^%$fy3@_5*{TqW1>mhw>z zCdMk;Q_52}QIJ*oCOq{i+@0e-u>jq8nEcq)=T5VvE+=Cr`&t;MF`>jxt{GNG7Bc&o z!!S5x2rn_v#U<#BS=?QXzh$suQgSbN+uA(cv@WJgwojPCwj+TG@jr#@*4oZ>PVZE~sKWirk$J;5%8qiw*tmT4hC_=Imol zsI0f~tMc5#aU(kP^Q()ynRWM=9Kl-bgNBu+aj7ZT|$3cot4(Egs)?5@mcu_7ni6; z+FL4O_6&J3SRW$VW;V4d);? zrO!MG<67gFP5bnnwJLEwQ7x?9#9ACkoj=%1o*??VkpTX~ zHZ$q}pcAmo8({&N+6h8Pw6fB%Gqt|Z1B17f7?P?JHz-JMuGhX5 z8ge#D721S}gVHBia0j6#Q;D0+_ahG`ZEWb0!}mym96+mbHLQAQ=3}_%Uv6OSzubVR z&p&p*L;Gf*zjnysaWcBCQ~;i+8KjkSf2AbrKSzT9K&Q)xHV=c+xEm z13G_GNWfxL^bDb4_wYrBpY9F+r6bF!D(HKODLU-rF8R|x zP3GahFyYHG-Vpx6jTRxNHg+`}eN{CDx7Wyl7ou&DTKp72rz)6{Z^jFdU}k!!J@(Iw z_AC?smy39f$@I~x&b|9?kHXrpCWk~H7`@PTSk$1jTC1I0`Tjc--1L?l)BgT#pgCss z5TR#ZIZuzDLsAc7%;fISTdTLPi3n=^sak;979EISeXcGhWYUVnWgfo1UdC1;fd%5~? zTt#^Qi!N@vR3EY7)T6C>Lag2&KaU$zKbd<}*XyZH%|EL=k`v)7=Is}Bewk?DVsSCu zlmb(7KFz`tj*w&rdfa?63Epwh%x!yh%ZDQMYuMh=pxSPZJG#A0a$`OZF3~LltMKdI zixjnwJ=3=)y?#nHlXv86+2bR4dF)cUtkaT1N2?6#peF8)Vv<#c#0JPSGRN8P5S zOP}QTt*qV^W`!i(>{8c7_2)Xn+PTNW0vnSz35gADi)Fe+hn|&MeLq*x))RQ#D8H&} ze8PWnB5s26X{D5#GIUJYeXAEAPAib>4>xS|c%D>vcJW9&j*n28y9s+*xm^}zr|O8UqidE9V>m(!@%s?oOyi(KEr zQttQ>iEnZ>68r|_An2YXz(=U7p|=a>Ye<^3h#If6nb^0{t<)A15Fs0}Yw~O(BSBKy!(8)xE`0P4n`b+kZO^`~SWGvYk2WT zs&UrG404v%i$FI(^cH4BjB#s1$$xT~`Xv3fO*H7h%@7SQ-~sZ@WBfU7LB(5*T3Hxx z4m~{htsM&Q<;jJx{RPZ4`0n;mhFlAOdszp@H58@q-6|PNbqt)-q3{W3halo&4gWWzLy7pJ&|T9%I~69Cxe?vD!gyTvT9`|F*_@^e7?S}0Np~%&r zqJQ=gNO8P7m9aN}(61pRP=S8U;Tr0zk1)tM(F;=@a_X>$fk#x`%S z+k!D13(0Pmfe4*)&B?SjRC7zw?ya#+az%Q?ur?g_G|K>GwmoFAWu45ejt79!VHQAo zS+PTzqbWX(wc^ot*AkrRQiN{gE@UOR3P#1AgVp!w?hXEopmq^!(3w;}#{EnZQRKzO z3Wh8{uK}HIV6>Y(JO6Y%?%SI9_KP&Y>@l|T*o!rZ4|v@0W^U1bk37vCEKAdTpkHId zvx0W-k+%t>liHK;B4DRHg>&*+Fu9<`@Fm$|gGJ;^%9&D7e&j;sM{GHKu9BkWukr&r z)_;~C<0|WH&dfVq@A|`m?6=|>U$3?-K6K)v_Z8z=O`g&YxQF<+nPU@&cfum>Byke! z@^RM-k>pu7h-^U{ND3mHAx%Jv8E8#&#J@eOjED=$scfn4ypzJ^-J60BjCs40rCOVO z>prw;Ah_|KOPTQ1)BvC0YCxjVb#DfMmdyYipmrZ<9{QAC7m64v&dc>|(CcSfR0?p? zVjyuo%#%afMJPm#@$grQB(#ef7MSV_U~rrb!rz7|UZ)pcmr1911#TJNkyy`EcJVXL z_LWXrjSo*G7o>73M0`UE3bzjPKxB-_!Kb7Dvy-bWgV~UVc@FJ9c$;rmI`AWFYt_4x z5r!U#C!Tzl6bA@l*Z^#Q9+mWN3Zm}C94Et!P4uQ;o_S&^T?v~s| zZUwzlRt5H(-{|uK3cYcG=sF!OCYytbqXJYM98ksKu<{bv5dT?m@cc|l-;iUdW}f<) zV6}jKNSr9xv;UfneR02LWS;g7@LD)Z4gYwtlB9N}i&?Np?MmN@BTf?CBgn&1P_vwE zI!m(-K$9K3{D1@L;0v<*2 z*PZb00d}!FH7p{g-)l%8=<~r#)(FrAHx5+VXTN9uDK8YP<2m%LhI$B<*Ye!XJavBV z?~lk^QMquM?47?hhQ*IN7_mQ)shy2(_7=)9Z8X@J7VTW5ay9-O+l*%2Y&5LQB~&w@ zm;lfOD9GV_b`$!b6%?15l)wN??^MkMn_Ix>?zm0H5ttC5Gcyt$_Wr<%0MMzij|{=Onr_zNXmR4eN9vyBPg zDJ(^fL{z4qEYX9iH(&Y2RqD>1Fxf8fH7f+)Qb& zeWmtOSH-PY6L1ghipN>VRUIE!&OA&3wJRH?*7-#F8Kw1sbkIgh-~znh;SlLdIa!g# z4>y7MosTycq38YnhbTNeZ93+>?$g__3t0oi*Tr!sU-tm?KE43OnDCmmD&ilOVcu}{ zNlXTKeo%dKVw@iG2V5yYPT*W8dUBTXlTQ-IL&=stKabe!0r> zkm6F!_*6GrDw9v)nGQK&T)00_Wy16IM+?VJZM@D$8u^&B&P$#L-JI4FXWtWyS?}MG zIxjb!G_#q?KW(wFKtuL)SaY*3%m4mIKAj9U=b6S7D{X5z(6aV0@4b%j!0S>t)-<7L zKnO;6I$zYmp|b&2cHwAV07K(k_-tuqJR5QYIWuo2oCa4f9q%mcJ>An;*r^@*X~0or zuT?flBh>Z5fYoa;mKG|bg?eGc!$RMvQU5UN;)>hlPpJrrEt1Plmyfas?%s|-432?o zvt`z=Z<*PQ>iE|GP$jp=Yks&g)swSE{$7wWx-#QePp0a95D$=%Fq)}fmGNWj(&CPh z@-=qIkCU%*P;D4M)kd=Kouk(V6Zxx~N=S9Dr#pvzWWRuRjOymAkX)g@OOFyPFZLIu z%Z5FSqZ-J|(#R7EV~-mqXe1!p9tHm1TzJ~Ix%?@I8Y3ziaO~NCc9w1p$eUhlAM?%t zr9*u)cTe(DE8Q6Fw#xn<0mh;D;JPbTSe|a%vrkcLHh-qrH0ZyCH@I)Kh-|y- zh@S3EK8IuGCv7WW=gx2Tzu|ZG9b%s`&$>PdZnrw}5>UslZw<*^W0{~3--`1y{4!!% zdNoG{MVA@AcTqiaw_xJ)8L%82FzWYYvSmSf>_AN}i&~wf1@)(5zpT=fWY6VzB`@d2 zqQF(1WVc%z=wm}PX0JW!UO4lYz2C$Is;iYOUJ?m66U+58W*L#|^0dxD6*`SBp>G`P zGm91UPmVM^<4+7MYus*5r(PrHa}ifUEEH|{6>_V*>OCyGknU$3z3#UgKsg$-S-}IO zy1V|xhpewISaW=2%b!ZgdhQb?53?AihkTA476$y_XxZq*iZmC(Azw@*eYRre zIesE=K0&V-upV@Y)fYbBtPFl&C`xlwtn{YlZ>P{|Rt_)8$u@QI?lB1Bb-a0a5o_^b z0cEPjnw|M|a=iH5`fRb)4!kCa^douW^bo}Sf&Jz*Xm5Zl7NgdWT;0;n%p-2CUwzTA zl7MZJF(?s$iduf?%_nAp3&=QbC<9D*`dD5Db#>);Z^OW+0k@`x(|ws~&Cx$1gt#>N zrHqbr$A#x1l6=mj6S$^5t?dDPX$}HbI^_ZsU*Mo3yn>hTt#^B=(S5azZM?6)V4Aw_cGD5J4(3Ww0AV|G zZ%Y5SM3HECaf&44PjRhBj#Ah~;om)qKE5xy6yE4VDVH*S0xcPt8&K0x4?t#Z!*cyT zE+7Kfk&R+<(vID%o{JKsG+9slt;X_TKrs@R+C1^aZ@9FgKvGPSl-X}yO8h$788~G- z3-=D(;Fz!AFfOoWQA;o@?G|3HL@R^%pZ-j&cv3npe+C{+3HwPI-R5o(Qt8oa>kGI% zgPScu+hgE)PX=rvMI+nu$@K@owD@g>c@S)#EhcvJ={-7pLmX0sBlYoin={zO5qYn# zQkU|{t>x7*LN~3VhQnS)dv3WGCL?nidX?$dL&9~2Yz|5B#4m}vOPwvs_JMj3d;~N! zzz_eiJKg)5)uK)kdh#W?P4BbXcZizj43&2xMf8XUk!hnH;9~7o)`ASC>0G-{U_E?y z2oz3apUg)1+NauR;79FUU?)c`n{A5~1bm$@TX6+_6Ih5fuMw6R=TI5qmUWwsdp&Td zCK-P8vX~&4(^R%MxN?lFPE8fiJxZ@gotbYm>H*JAXB^f2rs{?+=pDSiGRrY!EhNCV zbWI-S<6V;kQL6(q0Kk)3obD`-3Pf>y$c^@tQ|V`#vRf<`tsft@MnzOw)>+_EkcqE# zUI_+CIUBUB->3Ll3g7q21?+O`_DB*FEdlmAbCA8$v*OhOpCv!m-euksY}0cuKgp$N z_?+;!b|`{$0f3uNXP&IU4n(k~zs?AtJ`s}Vs=_W3t!}#f_^5XG!1SoQSg|DjC9Z=r zZ(l1_yCm-5ePYFGCU*LhCnUZ4=90?xE@aHPUk$`MbXx9qm4AH+qi8xtfy-Dl?z#rCa+pZlqz{rejXr&=@ zo&D=%<&#+@nOdp2RTc5?Ai(#j=Zl1`&8U@PiuadnWaB5p0*~={#=ogsTTXsQYyLKiD4d zycuDUbfGhYv}drb;t47f(Yx5xbJ>*`hvBHpL~t1S6wt1(c4^S=7A}wUn9~mw@#Ye= zx{TR+g6ZNI@E3;HQ+#au@>H{$gfg~8c1FAkS8%M#=D_X~W z`<$i~XvNgluU~whNU>gNO}D-Ygk}*kI|g+6!1K3i^cL=o$o|qL9&IzZ_1PM?K2~mj;7a&jLxvX|GE>KRr2?C1 zE#!@C@pwNFj#@F5E8^TfMMb~L-ECatg~KWFX@x~~T*BjE@PPXox`nlJSMJ_1xQQx4i%C?8U! zhX0Pd*v1k^pKRB>mu52xTn@53+?;T=e2vcCi%#+hLguQ?5YTCJv@>Uws(pNJq5tE{ z7DNCr=IDOZlVZ-DtYIU$4NAWby?jc<^jO5$#DMZW(7YX{Ld)-fvWMjyv;=vd>Q6 z|596DEC&ynP4UpLLe7@>~(T2&5Rcsc08*HL|BY*0-7 z?Ez=>YWu@M90 zs}=gJE!N+|JXHI`@TezEQz->gEBFCaET{P!Pk6J|wk0yAkqYSZ$!Ltfdpscqd6vt3+o*>)=Svm_ zyuY(HfUS#XaP%Gh`j>LB(wX!DJdhZ`TOpWWg30k4mCj#<@*3)ogEfWi67c&JXOgd4 zIrhD|0PZ;oS*Z#X$*hE?#%p{kIBkTSY{>us$%B=W3`+0&{nfvL!QbEfKL`Y@Qv)Q% zLHfiOdL2gkWU*d$a4LYh09k@lCU?n@L*bu&DKi1zcxRlhD{)U%>l}|oO={<<)xpmm z<;bnO;hq)~xBlp250M2A=Mn(b@^lAysTw{$hY5wWf*{O$yCc2_VMAFF-jEUerDvjU zvfyG@hE;;D($tL)FKCn{ z0gjH10X&8*@YD7e>eXNX4JyDo`=vgo;vdz&cg;R*oV1v&zx3iFU(VZ1azj-n!TDpp zRtJL9T`I(&Oqga3-*n909pitH7qJ&_{%M4MJ*!JiT~(IIN3rPXkK>N7w!5F zP*Tvowf6_EAt=^DMTnSrS&d72QUdi^!^S9$GH9w;Ff)Ov{#LW*tO-+tLtb@8`fAK} ztM=|-$vHq2YK8w$f<0QZCRN`J2VL0fB_8VZcnN|K5cei`z3cJs0hWj|zeMSFW$xGq zMkmE&h<8)X0${aV-rypwfEj#djk#le1E|@O>uU;laBm%iKOD+uS{6c0*A~%#aaKQu zW|c|-46uN&WnZz1$kSQDT5T>W!6;_ZW^DJ+%S@M^eEm;Q)eqFBPrTBXRw7E)DhFo8 z7*`*r8Gc_K`aC^;gr;*b)7SsjD@Qr^u(m64dH`DbD1Gm~E@KA{!wKnO&icK5K$X8SqT^1p<^yQ%4OrnYz?&Z5}uvs!gF%Z9l4fa8>-gw;}J}nZ2ZExL?a>D?q%;- zap-MsfUWl#=$n95g%`gk%KdGY>Z=R9%;R*^LbnroC|-VzW6g8Aaigh-{0St06n6j? zYy9d2fsGJxNJ=t93}|ZP=K>eRX|r}ILN-YPoxXrlM~&JC;1w`OTaK}JZS;(TWsdRq4`hv#I5=%@xaSQn$1;Km^n zb{rmkm3WH#KP7QA2}^9sNuH-NQQek?N(gP%>&YT+X^_SCiPS0W6>ypqomHY~gmdeK z?AEAQ_&Rv|E&ad2g^c3efM= z*_*C3wGLmizFGESzy7>w`pYCmO`B{NS zW|2xi?_RTtC&zYd0fg;}p_zdRtojUNzK=Bxvb)>ODHtoF&WP-Zc>qhnjA&)QhLucL21V4>FM6IYR=m6z1cZZ$b8$f%eCa zvNREV-VpYc5#<@-j!UxaK4 zqonSek+L6EssNE+jIRoUuC1Ks3j^8>A^xio#a(^=YQSZpW_+qz@UO~x5meUkTeou^ z_V^K;a#F|Oy8%&# zD$0?o8Ep5B6`J<>jHN*3m~RYD#?w^;vDQW-iJH}t@wb`NPj<69VkLM@+2%n9^H0`% ze@ey9K!km4A1JKP8u;NKoW(~x&Ym=)IfkKl#!fmJsq_~kF}P~mW~q~)8?4CF8AM${ zr=DyVKP5VsGdl)P@Mb5LwqFI25IMJ>Q;}YAQ{;6-Io-5x@u)0PA(Q34nZ{6@Thuir z*mzV#-$W{%Q}t%!u3an|OkjH825yjjs55puZkmSxgFT#dFFVJ=o%PB%^(M0K(P$Ob z8s~s8F9=M78Dq+6&xAQ&vQM)#?mktca)2h6w{+&>+e@UsQ&LL^s@H*({JA`&=2oyX zL;JuhENxG%)Tg1@Ho&FcCadGqsrH=WMbk|_ACb#n6bD!60vlMzo*tyXQqR`*(tdQnu`7#Gf!5xAywty0EHGt$8tT2S&eV%=94 zcmaM4%YV$`pPB#Vp3sWKgZF<5S-u+{j9o%rZEzZ5Hmd?DL;lMz20#)vv!G4X{KZ&H zy-YaGEzjfj#>yKSUEhk&t4)qtFL}zzt~;H@QqEpWKQLFV4v7q_d5wLzdH`22NtHZ89GrW2r`%2C4Kr*-08gT*lul z$hM8*js$9EKwCalKwjG|D($dC9Zcha%%-yPnOyLsTcO*}M;QQk7(hK`)3cEgs*wz# zgB5`?g7qTs!ZBu$&K*k(JxS(%Jx;vN{md5tP2FDq-@?-0%epKzw21?=78rD=<1@@$ z5(lWwk{!GT$zv@5tg!TzP^dvq)mGU z7WoB^3$D$i4nTLzh>u#mabd^J@s(=Qv(PRL43CX*5(A7Y`?oK=d5gQIPe4pLr;#2; z3Z9(3#Ld4gqJ+rUTi}Sy*i#d+_k~5>i(C(;RrB3usdEJnc|TCMF$VSXtU$z&w)H*9 zBft%=S6Ikoy6&3BG)?_Nyy9A5vR(G%kDpik2($KSkchl5%DANW&~T{ZyiRkc z#CB{l%<&|JHv5YyyPAbrdrO!OiHqfG9wah95yblkRc8~w$BQHju%`_i>mia+1Gq9} z3?*ec+>?%2&cCSUiK|{o8B_1f$^;J94m$%;{f*E1ZFdrhJiZInjZK4~C6fGg$ zAt-UX3BeDJ&>3>QWTGzx8O~6kpMS20pFq9~$^1Uemz4c-Fa|*=|+X>9TB`dB03UslD)} z?&FIm1=`DAuGrR;4pMwGzQr=&Cgbt=o|Gc*NH4hT{`VdV5RxVWzHqz{SX`#=)+eUz}B6e{ok{%%tRt zO}6SV@Y_Pjzyx@-l*ePw3VMxb|a! zcJjsyj9?gXH{PTJ+OQ+B`2zh(;`vNRpN*0?i684OSs8~+~vUX%Wtges9IPt_;@q$u7QGUpX12`C}~U@-Mdt9X{n( zsNrb6_mh-Mr?;BBy3=!gb=z_YDX3ze?oyu5p?F`_=hNpUEx47iMeJck6^m#-+#bji zDawfJ4xg0PN%{1uhN))dGlP^=yM7-?it;cQJ3>sg6Ct8;X@<2Sv-g{U&GQw==g%7o zNicSNPq)LC&V#U%ZDNcJ=_)o1^H>!8c46=jP`E``;VcIuWhSi$V4{seFPXE*Kati& zgOM7{Z=Rie^=w=hGQpks2Tm|=s0|E-a6+GmW43%$<%)I0)<=B-HEP&q30oB`7pL+? z?7KkT=~;xt*4Fisc0mD8(!GE-&+aj^rA6)vlfnQMp1DN|_n$lFv-llx2a`dsnsaxm zJ{NjDy-+LN!ttbo>ZJM@QT%Sj7@AKd{tP(rintBaAkFrC@*;SiB8&@@0U zx=_K{D4aKb17=UEy6Qvb2a%vpO+)>XbY%3g}a$|_D z>al)yKZW6o;25)sIg+8@)lKcMNJGo)^`RjhH4?8vS{kh9o)AVKZfh?oQ6~a*j>#># zMbo5BIgh;Qbiyf&)Dn=Gu@wpjQ3wKwZnl=cJLxs{mYBg)eRC0?FcO_VmZS21<|K`m zeOG;LS#z629s=`+v`MNkhdlAI)NH#V=`usR*Qk~A?jK%wIq8Oc3PmR(#As|J zE@M5^cO>3km9s}{RXmCi=3ND695Xi{PJK7AW3(0?AYb+HjqAOKUild;p+Paq-D|A5 za^aqNvxSS8gu1b=RHq?(u}rp4|5Eps@X_t>Id<7NzIoti(6_EW#5ZBJP^w-Coworv z?;8V~Dd*erSx`s${c8`WS2p5mlA+*NcYRVA9GEc9m9JNV}ICrV$F>2p%u*eeV(nIU9}o@&g1;F{h2wJa3sqb{(ffnQ6_oT zccI^?>(u-K>PnM1fph(oj(jLo4p3M7P@NOj=~bnzsa~03BJR4#mmvlGrG0!kQ`cqM z{Qwv5GVQ`nAHNem`jN>_hGlcnr=#?C#%Pw77*T1ICcG~8@1=TFLLTe?%wXi~qlgV6 zwl;TkHuq!`PIJ?)>vWfU{W#R)Jh(9yjbUw1by7}9Nb0by-|d+bc;6GIkz#tre?HKX zND86J)~d1Oas5hywG{8+V>@trL3{LvSgQX%y;9N^5SC7tN9-N?dz7p}M@H$C*^7dB z;L^akbX5DAXW~(A*bpA-p*c+pvi$FVqo*1GVGbi^=6(%A1q`-aWOc`|j@@DYXI=`D zKP3V04w;~qR5fKvNKfDdx4Zj*8W`1;NsiXAycct*Zud7H^o&mSemJa_ktWdXp!SA% zgv=vyc+l*ejY#mu4=Le`IqaaiQx2>= z-B?0CIVFzE33>3MgE-r3|t$Oawdu+@f6EMybcN z3MMhrH^WmX`HEc3;Hi_dc=cb(hChqE=vv}M7RCu*i{?RAKpwo=?xCjD9J!ZMLQnSI zlb7a2nuWDN8Qia58eUQ5p_A(tr$~)iHKZdJki2dz2E^<`IiA8zYLQ7-t{`z56@v(C zZ-(J3+(>%~Ztmb`#M8x~M9pwZ)=pIEkLDMMA8?|{^SkKE#%m=(!5M{={YOOc7n$D9 zufk4r#qgr4#a*F;@_ zl8r~k1=|rJ8;xk->xp@bM_v26#$aR;YaM3XyI4R-G{cF+p0Rqd`7(MMcgLd?o*^RF zwJ~N(x@$5dFpXg0YM73yoX@fHB9vL-Vz59_Y=36n!w@Kwmp4B|)~Hs|L8;~c6>D-| z4b$~-y~j6_brBMoWucf!CB}4(zZB^gs`2B-D$-(nrMWvi{C$fl-C^yKnM&r}S`_Q2 zJhTFT0T*Vc1R#{prTf1{-4AJYh=H^VF?9Cx;>Hp0y&RR)|CN{NrQ@2Ud@Q;jC0NKL z~Fn7v~;`sLYS?INO!spdLQjFx>Q zWJg8078b@97YHdAhUkpTc!YaSw1x)9#->_I@mUV3(R|2N!R#M9y6-9+r9HoPj-<)W zt+8+v%c2nP43vga`Kcctvag3ZJZmh=C^Y7u%_byT;SyaJ7VN)=H|&bEONYd{mRCc< zJ8{gZ2-DQUvc9Z{%J>YvBf9fmu7SIo4!qnEBPGVm29Q8)kU~0-ql~F=#AB_#+d?-X zN}lXO*vH~yP2fuNI9DiT`b*-c9@<^^#1+RWcbNEr?CEny&@|@>=N0?gd_5yt(OW3( z{QCjVcp_t07$YpxKI2gkFqQrFH^9^`QSqKZZJ|?Y-iu=^Rwt4t*M2#44_fRG+*0p$ z6}}vSj4tWmA-u?x4%Pb7+dgc2sR3f`$JvOxy&>0o23qm?O8G4Pg!JUO!Ql46VK-P5azAh%H>jg#)#k_! z97hfCKsEzc*sy3+iM2$AYDv8v-VK{u=JkG>*+XqtB%y3qU#UvnR$0OX-egZc9aS(- zCxj7^N{X+jE{Ft4XlKG$#A%+b^`KL1%6=?^F%&yluF11(#hsMiG(EjcBBy7l+7&H_ zvRkX&7}KAWs;Y4C`2K}sxx@c=IQEU6{G~$3f%NUDbcW!`sy7JRhPeW>F?l5b^0W!D zkL$B0?m6;ZsA2~HSG<(zs<$|9o_%oUgx&0i%P(|Un? z6uz`J z0>BU{hfvtV3~t)kcB}pA^CeUgHwf!>-M8sP#vdx$Y2RCJN6M^|a?5u2+GJ!%d6$UN z1*${e3nRVSTrHL}BAm3u7n~-)o_GociIMFDNJ_qVkd~@SYD>jU4*`G=XgGW((ezA- zZEPfOrr?0?y{vzOx+(t#b<@zc>C7LqymDDQ$z6JvqFb|J-KVH}-{}AaE*Nl4MWd-;bDZYhgx zhIhnqQz);5Vw_lptz0&3b6ubZkv1!UWso;C&h}G>%P8&sv9LCAxh=bJ0FLb`S}vll z2Z|+Cf*L2#wUM3}@I~BATa1%cBqDiE!UU8A@P5RYkJK|vyy|rEn3Il_yh=e$rp{BP z^}5W){VS@mc)h}0pKjL^>ds|ep;8e(L7QWNq%XYP)I){y+9fyN0HM&CR;~P~@)8*3 zgt^C**t1HZP)|+n1u3XaEK0Q@b>@}e^=4R(|EIi-biToj@4ey!2_n^5UVye7r9*nA zs~XRfR9>Vt=JOot{k2y4gfPvS3apzNVA?}n=4^?5MwWu|Q0qOSgi=7`>0e8nIN!;xpeMYO=6SbU1VCafoim4vSA#k(x_6H`jxBgIXUIb0CnYW( zGP1GM$r)A_ecim2*dP;uP=npcpJU>M`U*An3c}KMm z&x%KH)$-F^q|w|kT&N0bXv^j&7TeG(A+qD!9Z;;yuBl-n0-O0KC}>-p4<(`~P#?)M(D1zo-L=D%=p zOwHBj9{L?S?3?y$Wdg2+R6+t)xL0kR%%gMvf{GobE_0*AuHiQ$A7)+lel2Fl+P8`g zhFQ4R^l*x(Iw!nX3E-Xl0Al7=NAKhsJ);YaJahAFt$pTV5plJ7w^l%E$9UEGaSYts zwcO|Mz?-SbPU*c;ZMNW?D6eQ`ZBvS%oTTlWx2GzNGku@s%G_yJsu?bK(k}XinJouO z@dlt&71IaVb{dryHeO(ptz*4p@UW0+80a1rDK~$Q@(?I-y#BVg1#(fuyMde!UXN(? z0@O52N&kQZCBE{wZ`7yM*855_WBdVfbaf^^9H&JY$9n#sBF{J&g6J4OUQm2ho&NI{COibian6#V-JoSlTk2wnCiTXW+MkAD$r%5gb+R0& zUue=uoAIW^>+m67({Aw>t61fVj&fA6sooPt3b8{gtKa-ntg5`UPu*)T{mQj?(~N*a zxskY@?hZVu9$X)D#ZNlox5YhU>y!FwI8dvU8dqW?tKfFf9o+)dDJ@bG>4NAK=3zbZ zQVI3PWX7i!R4yroDFMZrIlPxyW5#K+Y>hVkLF=%=MyZwR^he%jsC4RVT7TKRyXLIq zbD2ELn)*L|5q}aVH^Agu02XICll#AO3Ax^ASGAYghxWF|WiWXlxUfHU_R)aIVX51o z-54w}QQWp@efc0&ahMzkZ&4a|woY8Xxxgu6HzLBz(^v}vL%buVgh>{m$PGqq_bTu> z9m#iQ4i;(S+b_Mz60FT$Rhm6ZMDe$4+skLc!oIaTjHFKIMlm-_fe92KQTKp-#Ervi z3rCOo2`+?IS`&|bjx(#66K#0J*Z8&y;FBXvzjAMJ(RHbo6M5G9cxuTXf^j9=IhUmq zxoey&^yC7vt?Dnz-Ly;(ky1Yx`oznOSl4i|>D4QM>EPN{A!CCyx^8co=&SR@;`+Pi$E4Y^lZ#1f1h%uFyf zcAI_v?&k9g@$>D|;5L;_fb^JG+YV$k*PxLQ=@)~lz#3(xv+0+WjMOn+&A7f@WTwJ4V69Aykwm+sJ4=)#-*fB2aY96&&qg1&xs=$wX}0R~O0> z)^)kj6a=2|+r zEN|Su+Eqzm#~9kE_s^reef7@(r!p&#tYd2()Rf#{I@N}SCNXW!Wx^$zW&^urG2;l|y($j!CtYKK+#aBi%`8<{d z?Qe}Yi`xa;MYFHwIHU4XH1cW=#u?VUjbDguLy!8B?)MSj>(IwW9v!!{75{x6-PKhg zwOs{$yM-)C|y=K}!vf@{v(cK{?jLM>Z1(hC^GkCmJL zjq30LPkXJ4U*IpZl7X<4wXZ{hRqO8#{;~xK(8%6}{PvyHeoz>I<+mHtY-u(4;HLev ze;$KeA>(H_4%)V!^&{KyMOK08qafqA%n(Tu17aZR?~Z6 zMD|Rox9j<)B*KcpvIMH8^fQbkcZ{XKOuo4@OJz+kbthXl5IO1z3s8ubSiOq)^H=3 z9HXCSE>e&VRNKa}E6En?vnSz6rl!q0tabDjF)t3^R3flMTXb1&d_4a5GN0VEyZ>au zXat&b8qnU`1?^OMQSYZxt-8WA;01{4XWOK(ieWHycGb+AIwyF2W%JWHtZ?eY@m#mD zXa?EQ`+wZ?EV3zxK4OzV_m(zBbtG)X-L_`lT>bsFxPvWB#-h>R#7zZt$r`u$C20s_eS^8mt|&2$<%uiS5&qu#7XUT%Iw<-VS86_3*#n4hTFKtvS(8!!<2 zsc8%I(C_Yr7%P=3Gq$iuRH#$QMRjgb1K`8)I50+9QZ$LDwwRaSrw5Aijv2= zWM1UU{Yk&F9x3#oYW2mj{NC}}ThDL(Zf>4hlOMW!RAr{AuuRnk1eu-4mIISB6_21V zGZD)B%(?NDUVuM>Jewd~Kfw~}Z_dZP0ABv&CTfd{|4E4Sx5%KgHqC(RY38i|s9#q$ zwx;utLsWsZ4N0^6miF*s>0ln2q(M6~A>3399V_k z>Q!AyikhfYZHMuT1SNtjVE$bRbX5ae7m1(O)d>TAFx#*@^D;mfGrp;He<8=SC? zuUbuxq4|*i3uutu(*m=fy>0xzrYSFiY_bPjqK{greuXDXVNG!#SJ-EPFzi$sSGt#{ zJka>4(|Q(ENZpKo3QxDZJ1_o%u{|ybG4R^hVz{!ImnY+GLpH6fS8(;cyoX1=u|M~+ zcP4X7{nfMmX0!>3e|f!m(xo(Ww!d$r;=z06<$$B_pUSpkac2R*#z`yaY$l)pbk|SJS z{`5`NZ{J-Q+FQE3z6F3z>oxXlEoffbM_AydqPS~^0){7@mN`ClE9jZ5#o;=ExBS%%zVW!{pFp9Bk z!72(7xopvuzmQA4Lo9!C)6f*NMxuM_mj=NJ`!Wsw2>>Sw{0fpMhf~e(4w+AFfcbGb zD9pTnvC0XlWGuVA2!GTh7l?!e?Iyqa+Qd$cSJTBJqi(wYAAkdhp@D!yTCKWac)(gv z6MXOR+~pZ;^(-7J@kC7ePb~FR-|F;i_-(d=D2~y?zbTIMLS{I-b71yhSYqMO?Ahn( zdRx5;T`O@>=*$;m?U$@rKZ1KquERvc-T{oTFB1>&^Fjst*R=c?d$Z!6KjyTw`}7Bm86faq|?KuJLgA zyfbOh+4GR7foIkt_*9mG`B>88H&(bEB$qRV*mtivln3T7o%`?yGdyv4etyH>f3wZW zDL>rX?J5XM(u2}D?b!uOVDZEf{<0C8&s>j5qj}j#cU!yt)CgZ(8&=7JZQt&YtvwFS z@3RgF1X(@kT|m4-hkV}K4j~M2u)CGbKgc?UTKpSv*$Aw;j{jwLmyG0Akz^1X?$5 zKDHG4k;1pWqR|BZU=EE`!E@oM>gHc2kExTKvh#lVk(;}Iy&*+}gjVY@*iQIUyr)c# z#@Doz5=pm@5=UCR5kC>Sz*Yka?f!X>#~VX}{RL2$?wJfG%DBfq0vD;&=0f{Ql2@0r zbTmZGiw`Dqs2x4}98qdjskGmxC|wRm-+4g#S*U@t&$%ClJ(;_RmTo}UzW<%<*(T}B zTbhhmQ){oz1|WJsetC||(A2eOLov$LX)BYMB29sw%|u3t=aH>kS~#Cs8=SfLy!p)+ z^G6+yUu8TSqtbF>t_+73T0+Kg&-?#k!I?F>BQ zuBv*9I;=?>^K(l->)9hFvBwkw3LnEt)GjDP;}nYNfy_9A_N)-6BQR1}`m)8I-!<;v zK!l2q3|v%K3s$Cc;Z5k#O=4W-k!R|&fnwAhv`Vee#p7r&|L(70rj=-frfsY4-I({G z8>bWid603zMXrmsGRd|idjMrHCLfDc53QCeRh6*z9ISE9+kIC%a7~$e8&tH7`v+A|%)l2Xd< zH9#LV#Q3hSuEqYt^-$XZ5nD$D%g5*6wvolGeC_n3@>bpIp~cX-S$JlkR%c*soswc? zl;cUUVp0Sbnz9GMqs7f7Z<`g3I|Q1xrE7zXP1W+f!6<+MR)`|O%tkt|cxMg`$dh|I zN`<}JMd%?k1?t^3vFoib%AWK#WM5CqNz*D-XX){ODv^kna^UOVzIz$Pl}2`xW=83N zH9#d_#|R<0!;n~%=xy~fh6u{;Z7If28Ei4z$YfP4>^mU^Z6Hec2)Az0Gde+%r@v=| z`EEZ+d~8_Y8sqKmX&dX>^90D;e~wmgUoesG>}#N_BiBALa*5wO5A{{J83c8OCyVph z0hiU&5vW(?>}#RDI#qL3y&a5RO|OfgUO<#)B(V#PAX}>1Ocr;Mm z5LKTv$+^N&vQ8p$8g5hxQYF(#&nZ<3xJQn?7mjExo#W0_Xn;o4F-Y=&Oo{Akjy-{$ zVQLA&s&4nP`-`uoXpS&nNh#Ib9;H(P$DWil8RA-!En0P7=Jy>X-7Ao0Mq{OaXkx|H zXN`=y3mouI^ZQP$3?iVAtFr^?mWLdkTYSp(Tom*3(i$VSRXcGGvOh>WY=6@V_?pkH ze>;Rxh)l2>W^YcgJJQ#)GHbmhuHK6+EVdy=llf8(q}L_xl|RE@)6;5jAHFDkW-Bmi zx-2yu5h?~libt9?VleN3tA+n`OMrp*g=jEBJKUl6AVM{8@R|0mbc`Cm*_dJ;wDa$$ zX#{sdM8YhLkEacZRUcx*rN-yi^qj7OCf4x}jGQBTYJ!^)rFDCI!pGhy(SlzA14_$* z%b?S7d?Rqda;9eXIzD-HOH0^w$zKC1^z%Gw8k*AT*$jbc-KsRfZft7k$)X{a@8E&`;mZG)(FgdX;YN7+uAL`C%-qURNqIV=lE#EVopn(o>Uixg_8Uxlwd zf;)E?ngX&wyn+}NQB9qT%TZa`7!W455U1~lKn_KqucnsGAJxu7+TAYbbiA@~K1`<> znF(3#TvPrgebs;W%oVy{^KIWb?8+BX=gN&Yi=n0nQy-w;L*-ik16M^w-38Ma|68_=^1~ytF|MBg2wD=PkrG{G~s?8&nIAYR*Zv^pL zEA-=cGXFnq@>9R;AM$LL)RKnXo{<-oZS!R{yFLNSh8tiWosdJx5U}wXx&I(zIY7APiYi@g^0 z`-CNh%Y3kH^+?Ci7q|Z;sKpsrx`}y?DU@b-d>U62h36T?Pdw zxd|{8ISFkKCVmBmRK)eVfy-+QcD*NA3CiXc$B5bT)jcV2wzh$jF82|V*^0Y&;}1pG zyjvq3jN#aKc+j!Hn3~24H2|c+(3g`MUW;jT_^smN$XPWPKeE9*s+#P-%#QD+XgcA> zGva-ZuHKYbn%#7Ivz_CF6I6<^`}{5~CE!cnL0}Vs>w)1{@a$3Qci@G6S{sK_SLfdt?FNcGGZ+AfsyKEgb%CEs`AIlrVAP)#c(il!$#mlM(MTS?&nd9qW@ z)H;JBN3&^Pzi+ww6=QUY6Z=?9;_-p_Upb6y3CF$)y@5jGOH*=@8DwkqjbFcn6 zR$0m))-%^c?cs#h$^2lmoSaM98Eq=ioeziNvYv$%s$xGK?Y9A1YodLMjPy!hFAtQj zz|qzdUThEILPZsiCNVoDd^?56LNw+!Yzq&??Fs+b+{G=*O{|xwWj3d&p_w;kmnvVT zS>nbT-aawRTdJ)Y>BagPba{4$7fKqLsszlwlzz$F-XnF^rAP z4)^ZgJ$=8w@9+D1{Z7|E+q_=)<-R}H=ej=c`*V1I$~wa+OJz1Tribk2i+-z|BbgbZ z9G(J3+mNheQ=1=4-WgPE9uk^Ve6Hg?xz_p|A*4;8hBS9l|5CfWCWcnI(6egUnqTw4 z-JRWqXS+j^RzV>S!T>$hmk#BUfsi)FRnZ$fu2W;S@H6#1$ba*oQaV8M%*(=x51s3) zsW{fQJq(k7X>R*Bb;=)5t+fj3n$C0A$o*3S~=BaylC_ediU!{lL`?f1wVTq#p^QWk-V zywh&?&ZfProJA?Y#k$A0h-(%(PgFOPEJE&&-1NhIt^D9^JaNeWO_Ng_ws5tN>Neek zDxbs^mCXIKc2!$sFXBU226f-{R!XI~phNPX2> z5|qZyd&`D0*$QVQlN$jQ$SLp>R9q|mUqHpB;~@~8Vj+zo9~!oc3M;;Uy}3oqOgzyp zuH6uScrw#+psLH89^B!+s`J_NY%_grMXPc}j`>QJ^v^9T|1Nn&ZmQuu8+dtr;=Zikoo~8Vrq`D9z7y$lMW5k- zyZBz5@HERr&Uuw(61AmR{mzF~@Ak9HZC|F(%(L!Yt^j|>#BXbJ{Ov~OF|MntxDsEt zTI-qzFSjn`7JLVZ)nuzo<6loWtRu|(%-@W2+6E#8UabvPL+^9wjQv@u1*A+*q!Z8u z26IP#@xL%eQ@HH3SP=h87&M|{@?)*ri_VG2ud+n)cIlFY!x7&1xZ5A-1%Muv`Ur!; z0bF$W>rFb_ix5@ggC0$wT3OWfPd)24Z^MQ&?#VM=XB&F=?`v<%S-Df&8>Fmn!oY;_ z3-yGDp7L2crG%CkEUnOMk#J9DG}ELnV71p1icbb%SCBh#&&Lafn-RhulX|x=xKGjL zzypT&GAs`Tt9RlaMQGC*PF;1$KffyMabhRkyGGR2fu~viIv^{Un?h8x zfHd0b=gy)xoe++!T~Q19(V&|TQev%7cv*$5^%Cc_Ze>1f>mwm4?rR4Axx4-!T}Av4 zRWM$fT78efoV#zpPgS*Jvz(3gd#yZTjvP%o1(>NQ#vAE>ZFj5lzQSAfv~&XcL+eJc zbJrpaq~p}jGPC2IS&_)b)``eQiqEQNO(gL$AKgfMrYjeoL$W|z3n2Wkwi^09O`B&t zHU2&3pq&yK+mW)|pWpufVT`2|q$_WpU+BMwZJNbbRAcp>q=E1u?OPcVI~lVM(Dp;| zLLp7srbdL9yLsHB;-5dX^=ev3hK&E7nW4+y`2AAfyu*?_5^W!#ebzfrI|I6>PG(Cy zdrMiO(s3*jJ-D9LGF`r7=9s2~s0x-0gPLKbmVL`y0BbU1WbaJqvoAPWEb+dHnH?phzSnh$sIR z@8PoskMyu1CcFv|ksvDtORU1%>RhjUH2pO&?g*>^M)d%5KrYrCjV8y%&+Z-boFe?+ z{wx}MrY(;$|D&zlnY3J;ybjiyV`;l)k~Q_9!d3!-Ff?P#Aim?-njO#ma$8rLS!xQk zA~xr^W0rn(n-l9iQ@T|@O+$eD;c5oim1j&Zhg`3Y0a`+wXBpKLnULsGpV z@xhvIGSdr$~F?G%!hHQlBr0(lMW!Fv9fLUYrkM9a~KWlaOsgrYZXIFSYM1NYL}d zGPsWcUr=D@KpPFWh}lW-sH4(iq&>Aah&{~dh4Mvl^4-FoPUL4M;iTk1%d|M7D7!_U z1tCf(75=mA5q0>_SU&w-pzO!3e2=eUHQ65bgXRB}v`T#mAiH4x80K1$yaxjt9``|Q zt~IfeQpqjG8y1tD8LMRkL3$OuA7Pl}1E(FkoFphf(=SA)JRmMZvDS;>HfFo4=OsVF zTHjBf&(+OpQz$04DmL0qmoHX)Mf8$Bv8g`)iX9TBn89Alo@{XVCAU>TDqD%xxbNe~ zcVac4OeAh>m@A={ID$J^tI>m}{Yhn~>r@FDQj%Z5^?^6O^+@9BhMb5rOQU3}Cuqm$|sHsl4s8*|}i47o9wM z;W(;<*5gdxM<*^UVG302)tb#*4lvT6H?Wc3Whkj+v*&GjzVxkXD9C};H*T*{w!VmC zgu31E6>x<8N=;!j??W?9!&>*(Z-{?N$KcQHc8A$SwVooiq}4B?diXnd7pK$^A*+$v zRJzPr;Uo^OxYCX)vk-qAr>mM8mf-s6L$q0cc|pkc@`2BOw3Bh{keGM(D+4A}m~sr^ zS*np)Sa9DMN5FJB9);w1i5q7NEHKodH|RTuI*zq-2o{WFOl>M_OkdGt4D1o8-`!Dv ziAC3>=D~R7hNCvQdJhRjhxN0xp5M`JkgFmOz)0fU^UE8|Y9@@~+izc$5tJzS5Nk4) zupZto|DkdW3xQ%wr7IW19Szm}ZZe8WsUoZ*(VtopdF4X9(%l!|?a;_tK~O!bcBFJ5 z@_zokYC3!TH6vb@g%4xFK1X*Gmd@5WxiwLSxuGs`5w_!xbDjM>Y98wvBMUqS}-gnKjxG{kSdVkWRpeL6)9=@CvkbJ7*c*50+s z;giHWNQ%6;6`YS9lHVgjd+2?wRetlFUo?*&TYq)-!ox_yjDI;g!fnv{PTX+|@}|?k z2k}8;=*pb6I4qj6J()3%i5Ew*K^d2+>YEmO@e)wCx8@DuGLxN zofq*!(E3}?FOAK*zvD5)uYbHfrc*z+p0-m<6qVV9lN2H}d28ad#WS&aWsNXSAq3&y zNpD4tq;o%3%B#{O_UvFj%JmzzL5cY~ZR~brE($fI~WD_*>Mf$dEvF6_yfGC*b+ zX1Lji<6gYCV#{Jj8Rgc3uRZm1A8dC`g<6>S1!P{CvEPPm@;nkmZ3j24do1~tkK_x) z9pdXQ`z)?x&jK`W)%?^t>QD%!de^BE=wo~4cwIw9AabtJ*N=9_!Ti+p(=wzoLpbGk z@LyAdGSjLaDC6|3*VGxma}=a2r;+=mgJu^VnO!6TL;-Qm2yM3uaB@{hkLL2=AB)+t zO<98S(a1GBwk76wq#bSuPq6Wcm?PpAO0z*-Ir9D|s|WTts1azaqjT>0I10X}oC}Ppfh;t=W7vS!=gD4Gog+9PuR1RY*-G5g{l({SR}Bdwrn@RN6ygjfIDIDUJ$zD>-sM! zsDM~J;2N<`8-g)My$zl+Pw_LO$}YO2%2o_^FDA>s=#q0eJ_{}pY!OP=G7iExsijIs zw8(tUbn^K|3)FgKT@q*ah9V)HsbQ|i8g@kND@;JFG~p#-dK;6i<|0-F0R*<5&d8PV zwE&b4d$4+JS@xPiBJ^CDX1?Xf*c7I)G`0R}EA3=MofBD?aybG}(+T(jAC{@ma1U_a zMe!?CidgJLK6Ch6jH*?h@F1~9TP21?{`HPBB%V}FfU;nBO)c?;*@1~5Ko%s?LXiFz zE4_2YKJESU_Sy%-TtI=5TqR6iH4%HnM!Hp~^63-L=jPF_y>*2 z|8sM{``x@Vgvkb2LExgHM)dqP+=esNMN7`)$270{wswB(t$)F|4Mhuo%DsBl|Iv%q zZs>c0vJO-`Bile}g`gybAyii)){KZ#(3);^3XkUo>Fd}Tm|AGh2)oU8#j*tDcVqTy zM2f&F1~e2jY}mMMFjUAJaMx6UlO_^mibN&S(Ddv-F4;A8NgO;zs13qP?|n3M7ix7> zs9n3WawoDEYh7L(bS-jJ9}4Z4rE6Bn%hh&|KNr}VS|p&)1|wR`iP<5r$c(v}WB6rr z^Nq8;UkXW)=7h0VaWx#ir-)0LZYH>4WJ%ev(9{CkeOHT0`Pv*tm-L5pi22nb9NxV8fHgiE?V$3>Iq6y4QgZ_FMLDGFOC0sf&FMXV9JS zNniqTvS=cm8NIk^@>mZ0wz2oBgMq>F*(D)#yqAa;;DTi)ZwU;sr5}T~7SP=By3!d> z5#|SnOJRqkj#j9*Ze*L?KFfL4(8j>ZjTRx^rM$mDy{5h8xH@If(Lw71zY3vkv)WXJ zJca=}%I<`GjFHq(i>c1CaDCAHt};t#j8~YrxF&(B7m;H@-#~9mTQn{i|3KLRI zEFmzX&C4>zcsV=w8Pv&iNY@2=t}@~o%E9~}WV)-3Lw{-%=rf?M$CRNjM4w34fs(38 zZ@KD|pzXcC8-flriCZM{K3fTituT?KsIRMU4&LU4r=;L-lWOy8jq?(FBN_u2xV=FG z)PBV*SNOK8k7{Sv3+uN_K{~Gkk0rM9UIYT;kJQycK$C#wf3L}}6EG!xT!(tQ>7C8) zs;8lgI7yQMyJHI9WYPBHWsPYG?At{7q|)-Q0E7u!rwNH-T~1y^2kNdn@m&FLQht+d{c~_czZFd`nZB&_tP<%D5N5uMg;4y#^x~ zCsj+HllJz9kaCv=bcBlTQpoRFy#tHL)tui}zBIK?D#q1$vEP#tTaMmXyUCD)M{YS2 zVFd71O?JX9Bip+kyojM#XD{=V&3ov|#i;+*bUdakjj)d$>h?~HJam(3gCg52!J+Eg z^{(f)9g4(Xy+cpk3Y6}tG=fxT1F321UCypH-ZXnbq{v>eCmF)h-B^<~*Z}I&6Rx&S zDZ**0#JGUWuxd_HL_62UgAn2zXxjcVf{<=!EN{pR%ww z7tdFYh&AVao;Sa@YtOTGHmbnoN;K95F5#=|(Y0 znqN)5Mn`Pt5zPc!(<+;FYQd%Dw&^ZHF$}Tu*^Pn-N4)BjtH^&>ef$cAK3gyP0*S$p zWR=Qe3;R??mvkc_sG&9pE4vc$1g1*X5-;(TMUlN=#N)o^Dim4D5Dwa)vIsF+(Vez7N zC&NP?Yc}cw^Icf3JEP6pyY*2xZo{n3!_Ny-b2W>Y-NSUaKE8Ilyh>IkzaT$i_R)_{ zH2tD6Y|a+%EGEo(4fvG*ZBpt~u6XFg3_Ee+uaw@TY>VSd4dLN2n8EHv^meeMrf?|O z&MXx@a8nU!w(ypNSAMH7`DnRc{_0bXPY#m*bn$ViJU_a)5a)X2MGv$Q)8*N?Q^voa z5qCMk0<*gD!JXNm({xVd*PJ-MEUr>mI`g Date: Tue, 26 Mar 2024 11:29:41 -0600 Subject: [PATCH 6/8] Freshness update --- ...nd-windows-defender-application-control.md | 30 +++++++++---------- ...tion-based-protection-of-code-integrity.md | 12 ++++---- 2 files changed, 20 insertions(+), 22 deletions(-) diff --git a/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md index f268f032bb..05fed4e21e 100644 --- a/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md +++ b/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md @@ -5,36 +5,34 @@ ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa manager: aaroncz -ms.date: 03/16/2023 +ms.date: 03/26/2024 ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Windows Defender Application Control and virtualization-based protection of code integrity -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and higher - -Windows includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they behave more like mobile devices. In this configuration, [**Windows Defender Application Control (WDAC)**](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) is used to restrict devices to run only approved apps, while the OS is hardened against kernel memory attacks using [**memory integrity**](../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md). +Windows includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they behave more like kiosk devices. In this configuration, [**Windows Defender Application Control (WDAC)**](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) is used to restrict devices to run only approved apps, while the OS is hardened against kernel memory attacks using [**memory integrity**](../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md). > [!NOTE] > Memory integrity is sometimes referred to as *hypervisor-protected code integrity (HVCI)* or *hypervisor enforced code integrity*, and was originally released as part of *Device Guard*. Device Guard is no longer used except to locate memory integrity and VBS settings in Group Policy or the Windows registry. -WDAC policies and memory integrity are powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a strong protection capability for Windows devices. - -Using WDAC to restrict devices to only authorized apps has these advantages over other solutions: +WDAC policies and memory integrity are powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a strong protection capability for Windows devices. Using WDAC to restrict devices to only authorized apps has these advantages over other solutions: 1. The Windows kernel handles enforcement of WDAC policy and requires no other services or agents. -2. The WDAC policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. -3. WDAC lets you set application control policy for any code that runs on Windows, including kernel mode drivers and even code that runs as part of Windows. -4. Customers can protect the WDAC policy even from local administrator tampering by digitally signing the policy. Changing signed policy requires both administrative privilege and access to the organization's digital signing process. Using signed policies makes it difficult for an attacker, including one who has managed to gain administrative privilege, to tamper with WDAC policy. -5. You can protect the entire WDAC enforcement mechanism with memory integrity. Even if a vulnerability exists in kernel mode code, memory integrity greatly reduces the likelihood that an attacker could successfully exploit it. Without memory integrity, an attacker who compromises the kernel could normally disable most system defenses, including application control policies enforced by WDAC or any other application control solution. +1. The WDAC policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. +1. WDAC lets you set application control policy for any code that runs on Windows, including kernel mode drivers and even code that runs as part of Windows. +1. Customers can protect the WDAC policy even from local administrator tampering by digitally signing the policy. Changing signed policy requires both administrative privilege and access to the organization's digital signing process. Using signed policies makes it difficult for an attacker, including one who manages to gain administrative privilege, to tamper with WDAC policy. +1. You can protect the entire WDAC enforcement mechanism with memory integrity. Even if a vulnerability exists in kernel mode code, memory integrity greatly reduces the likelihood that an attacker could successfully exploit it. Without memory integrity, an attacker who compromises the kernel could normally disable most system defenses, including application control policies enforced by WDAC or any other application control solution. There are no direct dependencies between WDAC and memory integrity. You can deploy them individually or together and there's no order in which they must be deployed. -Memory integrity relies on Windows virtualization-based security, and has hardware, firmware, and kernel driver compatibility requirements that some older systems can't meet. +Memory integrity relies on Windows Virtualization-based security, and has hardware, firmware, and kernel driver compatibility requirements that some older systems can't meet. WDAC has no specific hardware or software requirements. diff --git a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md index b1448ef801..1ef34f786a 100644 --- a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md @@ -13,7 +13,7 @@ appliesto: # Enable virtualization-based protection of code integrity -**Memory integrity** is a virtualization-based security (VBS) feature available in Windows. Memory integrity and VBS improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows kernel. VBS uses the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Memory integrity is a critical component that protects and hardens Windows by running kernel mode code integrity within the isolated virtual environment of VBS. Memory integrity also restricts kernel memory allocations that could be used to compromise the system. +**Memory integrity** is a Virtualization-based security (VBS) feature available in Windows. Memory integrity and VBS improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows kernel. VBS uses the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Memory integrity is a critical component that protects and hardens Windows by running kernel mode code integrity within the isolated virtual environment of VBS. Memory integrity also restricts kernel memory allocations that could be used to compromise the system. > [!NOTE] > @@ -57,7 +57,7 @@ Use the **Virtualization Based Technology** > **Hypervisor Enforced Code Integri ![Enable memory integrity using Group Policy.](images/enable-hvci-gp.png) 1. Select **Ok** to close the editor. -To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated command prompt. +To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated Command Prompt. ### Use registry keys to enable memory integrity @@ -204,7 +204,7 @@ This field describes the required security properties to enable VBS. ##### SecurityServicesConfigured -This field indicates whether Credential Guard or memory integrity has been configured. +This field indicates whether Credential Guard or memory integrity is configured. | Value | Description | |-------|-------------------------------------------------------| @@ -252,7 +252,7 @@ Another method to determine the available and enabled VBS features is to run msi ## Troubleshooting -- If a device driver fails to load or crashes at runtime, you may be able to update the driver using **Device Manager**. +- If a device driver fails to load or crashes at runtime, you might be able to update the driver using **Device Manager**. - If you experience a critical error during boot or your system is unstable after turning on memory integrity, you can recover using the Windows Recovery Environment (Windows RE). 1. First, disable any policies that are used to enable VBS and memory integrity, for example Group Policy. 2. Then, boot to Windows RE on the affected computer, see [Windows RE Technical Reference](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). @@ -282,5 +282,5 @@ Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true - The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. - The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. - Memory integrity and [nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time. To enable the Hyper-V role on the virtual machine, you must first install the Hyper-V role in a Windows nested virtualization environment. -- Virtual Fibre Channel adapters aren't compatible with memory integrity. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`. -- The AllowFullSCSICommandSet option for pass-through disks isn't compatible with memory integrity. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`. +- Virtual Fibre Channel adapters aren't compatible with memory integrity. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of Virtualization-based security using `Set-VMSecurity`. +- The AllowFullSCSICommandSet option for pass-through disks isn't compatible with memory integrity. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of Virtualization-based security using `Set-VMSecurity`. From c2e7670e64311b0f0abe0a926efa76f1356ca3fc Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 26 Mar 2024 11:46:44 -0600 Subject: [PATCH 7/8] Freshness update --- .../user-account-control/how-it-works.md | 52 +++++++++---------- .../user-account-control/index.md | 9 ++-- .../settings-and-configuration.md | 30 +++++------ 3 files changed, 46 insertions(+), 45 deletions(-) diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index 27338890ca..628efba7cf 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -1,8 +1,8 @@ --- -title: How User Account Control works +title: How User Account Control works description: Learn about User Account Control (UAC) components and how it interacts with the end users. ms.topic: concept-article -ms.date: 05/24/2023 +ms.date: 03/26/2024 --- # How User Account Control works @@ -26,7 +26,7 @@ To better understand how this process works, let's take a closer look at the Win The following diagram shows how the sign in process for an administrator differs from the sign in process for a standard user. -:::image type="content" source="images/uac-windows-logon-process.gif" alt-text="Diagram that describes the UAC Windows logon process."::: +:::image type="content" source="images/uac-windows-logon-process.gif" alt-text="Diagram that describes the UAC Windows sign-in process."::: By default, both standard and administrator users access resources and execute apps in the security context of a standard user.\ When a user signs in, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. @@ -91,9 +91,9 @@ The elevation process is further secured by directing the prompt to the *secure When an executable file requests elevation, the *interactive desktop*, also called the *user desktop*, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user selects **Yes** or **No**, the desktop switches back to the user desktop. > [!NOTE] -> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This is the same behavior of the currently supported Windows client OS versions. +> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This is the same behavior of the currently supported Windows client OS versions. -Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt may be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. +Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. While malware could present an imitation of the secure desktop, this issue can't occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token can't silently install when UAC is enabled, the user must explicitly provide consent by selecting **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon security policies. @@ -109,34 +109,34 @@ To better understand each component, review the following tables: |Component|Description| |--- |--- | -|

User performs operation requiring privilege|

If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| -|

ShellExecute|

ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| -|

CreateProcess|

If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| +|User performs operation requiring privilege|If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| +|ShellExecute|ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| +|CreateProcess|If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| ### System |Component|Description| |--- |--- | -|

Application Information service|

A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. Depending on the configured policies, the user may give consent.| -|

Elevating an ActiveX install|

If ActiveX isn't installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| -|

Check UAC slider level|

UAC has a slider to select from four levels of notification.

  • **Always notify** will:

    • Notify you when programs try to install software or make changes to your computer.
    • Notify you when you make changes to Windows settings.
    • Freeze other tasks until you respond.

    Recommended if you often install new software or visit unfamiliar websites.

  • **Notify me only when programs try to make changes to my computer** will:

    • Notify you when programs try to install software or make changes to your computer.
    • Not notify you when you make changes to Windows settings.
    • Freeze other tasks until you respond.

    Recommended if you don't often install apps or visit unfamiliar websites.

  • **Notify me only when programs try to make changes to my computer (do not dim my desktop)** will:

    • Notify you when programs try to install software or make changes to your computer.
    • Not notify you when you make changes to Windows settings.
    • Not freeze other tasks until you respond.

    Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.

  • **Never notify (Disable UAC prompts)** will:

    • Not notify you when programs try to install software or make changes to your computer.
    • Not notify you when you make changes to Windows settings.
    • Not freeze other tasks until you respond.

    Not recommended due to security concerns.| -|

    Secure desktop enabled|

    The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked:

    • If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.

    • If the secure desktop isn't enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.| -|

      CreateProcess|

      CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest doesn't match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.| -|

      AppCompat|

      The AppCompat database stores information in the application compatibility fix entries for an application.| -|

      Fusion|

      The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.| -|

      Installer detection|

      Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.| +|Application Information service|A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. Depending on the configured policies, the user might give consent.| +|Elevating an ActiveX install|If ActiveX isn't installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| +|Check UAC slider level|UAC has a slider to select from four levels of notification.

      • **Always notify** will:
        • Notify you when programs try to install software or make changes to your computer.
        • Notify you when you make changes to Windows settings.
        • Freeze other tasks until you respond.
        Recommended if you often install new software or visit unfamiliar websites.
      • **Notify me only when programs try to make changes to my computer** will:
        • Notify you when programs try to install software or make changes to your computer.
        • Not notify you when you make changes to Windows settings.
        • Freeze other tasks until you respond.
        Recommended if you don't often install apps or visit unfamiliar websites.
      • **Notify me only when programs try to make changes to my computer (do not dim my desktop)** will:
        • Notify you when programs try to install software or make changes to your computer.
        • Not notify you when you make changes to Windows settings.
        • Not freeze other tasks until you respond.
        Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.
      • **Never notify (Disable UAC prompts)** will:
        • Not notify you when programs try to install software or make changes to your computer.
        • Not notify you when you make changes to Windows settings.
        • Not freeze other tasks until you respond.
        Not recommended due to security concerns.| +|Secure desktop enabled|The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked:
        • If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.
        • If the secure desktop isn't enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.| +|CreateProcess|CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest doesn't match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.| +|AppCompat|The AppCompat database stores information in the application compatibility fix entries for an application.| +|Fusion|The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.| +|Installer detection|Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.| ### Kernel |Component|Description| |--- |--- | -|

          Virtualization|

          Virtualization technology ensures that noncompliant apps don't silently fail to run or fail in a way that the cause can't be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.| -|

          File system and registry|

          The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.| - +|Virtualization|Virtualization technology ensures that noncompliant apps don't silently fail to run or fail in a way that the cause can't be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.| +|File system and registry|The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.| + The slider never turns off UAC completely. If you set it to **Never notify**, it will: - Keep the UAC service running -- Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt +- Cause all elevation request initiated by administrators to be autoapproved without showing a UAC prompt - Automatically deny all elevation requests for standard users > [!IMPORTANT] @@ -156,7 +156,7 @@ Most app tasks operate properly by using virtualization features. Although virtu Virtualization isn't an option in the following scenarios: - Virtualization doesn't apply to apps that are elevated and run with a full administrative access token -- Virtualization supports only 32-bit apps. Non-elevated 64-bit apps receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations +- Virtualization supports only 32-bit apps. Nonelevated 64-bit apps receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations - Virtualization is disabled if the app includes an app manifest with a requested execution level attribute ### Request execution levels @@ -178,11 +178,11 @@ Installer detection only applies to: Before a 32-bit process is created, the following attributes are checked to determine whether it's an installer: - The file name includes keywords such as "install," "setup," or "update." -- Versioning Resource fields contain the following keywords: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name -- Keywords in the side-by-side manifest are embedded in the executable file -- Keywords in specific StringTable entries are linked in the executable file -- Key attributes in the resource script data are linked in the executable file -- There are targeted sequences of bytes within the executable file +- Versioning Resource fields contain the following keywords: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name. +- Keywords in the side-by-side manifest are embedded in the executable file. +- Keywords in specific StringTable entries are linked in the executable file. +- Key attributes in the resource script data are linked in the executable file. +- There are targeted sequences of bytes within the executable file. > [!NOTE] > The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. diff --git a/windows/security/application-security/application-control/user-account-control/index.md b/windows/security/application-security/application-control/user-account-control/index.md index 3b5e6e8561..1b697ee8ba 100644 --- a/windows/security/application-security/application-control/user-account-control/index.md +++ b/windows/security/application-security/application-control/user-account-control/index.md @@ -2,19 +2,20 @@ title: User Account Control description: Learn how User Account Control (UAC) helps to prevent unauthorized changes to Windows devices. ms.topic: overview -ms.date: 05/24/2023 +ms.date: 03/26/2024 --- # User Account Control overview -User Account Control (UAC) is a Windows security feature designed to protect the operating system from unauthorized changes. When changes to the system require administrator-level permission, UAC notifies the user, giving the opportunity to approve or deny the change. UAC improves the security of Windows devices by limiting the access that malicious code has to execute with administrator privileges. UAC empowers users to make informed decisions about actions that may affect the stability and security of their device. +User Account Control (UAC) is a Windows security feature designed to protect the operating system from unauthorized changes. When changes to the system require administrator-level permission, UAC notifies the user, giving the opportunity to approve or deny the change. UAC improves the security of Windows devices by limiting the access that malicious code has to execute with administrator privileges. UAC empowers users to make informed decisions about actions that might affect the stability and security of their device. Unless you disable UAC, malicious software is prevented from disabling or interfering with UAC settings. UAC is enabled by default, and you can configure it if you have administrative privileges. ## Benefits of UAC -UAC allows all users to sign in their devices using a *standard user account*. Processes launched using a *standard user token* may perform tasks using access rights granted to a standard user. For instance, Windows Explorer automatically inherits standard user level permissions. Any applications that are started using Windows Explorer (for example, by opening a shortcut) also run with the standard set of user permissions. Most applications, including the ones included with the operating system, are designed to work properly this way.\ -Other applications, like ones that aren't designed with security settings in mind, may require more permissions to run successfully. These applications are referred to as *legacy apps*. +UAC allows all users to sign in their devices using a *standard user account*. Processes launched using a *standard user token* might perform tasks using access rights granted to a standard user. For instance, Windows Explorer automatically inherits standard user level permissions. Any applications that are started using Windows Explorer (for example, by opening a shortcut) also run with the standard set of user permissions. Most applications, including the ones included with the operating system, are designed to work properly this way. + +Other applications, like ones that aren't designed with security settings in mind, might require more permissions to run successfully. These applications are referred to as *legacy apps*. When a user tries to perform an action that requires administrative privileges, UAC triggers a *consent prompt*. The prompt notifies the user that a change is about to occur, asking for their permission to proceed: diff --git a/windows/security/application-security/application-control/user-account-control/settings-and-configuration.md b/windows/security/application-security/application-control/user-account-control/settings-and-configuration.md index e9d01861ab..8c81845b7b 100644 --- a/windows/security/application-security/application-control/user-account-control/settings-and-configuration.md +++ b/windows/security/application-security/application-control/user-account-control/settings-and-configuration.md @@ -1,7 +1,7 @@ --- title: User Account Control settings and configuration -description: Learn about the User Account Control settings and how to configure them via Intune, CSP, group policy and registry. -ms.date: 07/31/2023 +description: Learn about the User Account Control settings and how to configure them via Intune, CSP, group policy, and registry. +ms.date: 03/26/2024 ms.topic: how-to --- @@ -20,7 +20,7 @@ The following table lists the available settings to configure the UAC behavior, |Detect application installations and prompt for elevation|Controls the behavior of application installation detection for the computer.

          **Enabled (default)**: When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
          **Disabled**: App installation packages aren't detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Microsoft Intune, should disable this policy setting. In this case, installer detection is unnecessary. | |Only elevate executables that are signed and validated|Enforces signature checks for any interactive applications that request elevation of privilege. IT admins can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local devices.

          **Enabled**: Enforces the certificate certification path validation for a given executable file before it's permitted to run.
          **Disabled (default)**: Doesn't enforce the certificate certification path validation before a given executable file is permitted to run.| |Only elevate UIAccess applications that are installed in secure locations|Controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following folders:
          - `%ProgramFiles%`, including subfolders
          - `%SystemRoot%\system32\`
          - `%ProgramFiles(x86)%`, including subfolders


          **Enabled (default)**: If an app resides in a secure location in the file system, it runs only with UIAccess integrity.
          **Disabled**: An app runs with UIAccess integrity even if it doesn't reside in a secure location in the file system.

          **Note:** Windows enforces a digital signature check on any interactive apps that requests to run with a UIAccess integrity level regardless of the state of this setting.| -|Run all administrators in Admin Approval Mode|Controls the behavior of all UAC policy settings.

          **Enabled (default)**: Admin Approval Mode is enabled. This policy must be enabled and related UAC settings configured. The policy allows the built-in Administrator account and members of the Administrators group to run in Admin Approval Mode.
          **Disabled**: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, **Windows Security** notifies you that the overall security of the operating system has been reduced.| +|Run all administrators in Admin Approval Mode|Controls the behavior of all UAC policy settings.

          **Enabled (default)**: Admin Approval Mode is enabled. This policy must be enabled and related UAC settings configured. The policy allows the built-in Administrator account and members of the Administrators group to run in Admin Approval Mode.
          **Disabled**: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, **Windows Security** notifies you that the overall security of the operating system is reduced.| |Switch to the secure desktop when prompting for elevation|This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop.

          **Enabled (default)**: All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.
          **Disabled**: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used.| |Virtualize File And Registry Write Failures To Per User Locations|Controls whether application write failures are redirected to defined registry and file system locations. This setting mitigates applications that run as administrator and write run-time application data to `%ProgramFiles%`, `%Windir%`, `%Windir%\system32`, or `HKLM\Software`.

          **Enabled (default)**: App write failures are redirected at run time to defined user locations for both the file system and registry.
          **Disabled**: Apps that write data to protected locations fail.| @@ -67,18 +67,18 @@ You can use security policies to configure how User Account Control works in you The policy settings are located under: `Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options`. -| Group Policy setting |Default value| -| - | - | -|User Account Control: Admin Approval Mode for the built-in Administrator account| Disabled | -|User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop| Disabled | -|User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode| Prompt for consent for non-Windows binaries | -|User Account Control: Behavior of the elevation prompt for standard users | Prompt for credentials | -|User Account Control: Detect application installations and prompt for elevation| Enabled (default for home edition only)
          Disabled (default) | -|User Account Control: Only elevate executables that are signed and validated| Disabled | -|User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled | -|User Account Control: Run all administrators in Admin Approval Mode| Enabled | -|User Account Control: Switch to the secure desktop when prompting for elevation | Enabled | -|User Account Control: Virtualize file and registry write failures to per-user locations | Enabled | +| Group Policy setting | Default value | +|------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------| +| User Account Control: Admin Approval Mode for the built-in Administrator account | Disabled | +| User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop | Disabled | +| User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Prompt for consent for non-Windows binaries | +| User Account Control: Behavior of the elevation prompt for standard users | Prompt for credentials | +| User Account Control: Detect application installations and prompt for elevation | Enabled (default for home edition only)
          Disabled (default) | +| User Account Control: Only elevate executables that are signed and validated | Disabled | +| User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled | +| User Account Control: Run all administrators in Admin Approval Mode | Enabled | +| User Account Control: Switch to the secure desktop when prompting for elevation | Enabled | +| User Account Control: Virtualize file and registry write failures to per-user locations | Enabled | #### [:::image type="icon" source="../../../images/icons/registry.svg" border="false"::: **Registry**](#tab/reg) From 6f1d2f991073eb628441275ccab7b13b77d8f78c Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 26 Mar 2024 12:12:22 -0600 Subject: [PATCH 8/8] Freshness update --- .../windows-sandbox-architecture.md | 10 ++-- ...indows-sandbox-configure-using-wsb-file.md | 50 +++++++++---------- .../windows-sandbox-overview.md | 9 ++-- 3 files changed, 33 insertions(+), 36 deletions(-) diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md index dac2d9f311..399efd6820 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md @@ -2,7 +2,7 @@ title: Windows Sandbox architecture description: Windows Sandbox architecture ms.topic: article -ms.date: 05/25/2023 +ms.date: 03/26/2024 --- # Windows Sandbox architecture @@ -15,7 +15,7 @@ Rather than requiring a separate copy of Windows to boot the sandbox, Dynamic Ba Most OS files are immutable and can be freely shared with Windows Sandbox. A small subset of operating system files are mutable and can't be shared, so the sandbox base image contains pristine copies of them. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of the mutable files. With the help of this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an extra copy of Windows. -Before Windows Sandbox is installed, the dynamic base image package is stored as a compressed 30-MB package. Once it's installed, the dynamic base image occupies about 500 MB of disk space. +Before Windows Sandbox is installed, the dynamic base image package is stored as a compressed 30-MB package. Once installed, the dynamic base image occupies about 500 MB of disk space. ![A chart compares scale of dynamic image of files and links with the host file system.](images/1-dynamic-host.png) @@ -27,7 +27,7 @@ Traditional VMs apportion statically sized allocations of host memory. When reso ## Memory sharing -Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same physical pages as those pages of the binary when loaded on the host. Memory sharing between the host and the sandbox results in a smaller memory footprint when compared to traditional VMs, without compromising valuable host secrets. +Because Windows Sandbox runs the same operating system image as the host, it's enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same physical pages as those pages of the binary when loaded on the host. Memory sharing between the host and the sandbox results in a smaller memory footprint when compared to traditional VMs, without compromising valuable host secrets. ![A chart compares the memory footprint in Windows Sandbox versus a traditional VM.](images/3-memory-sharing.png) @@ -37,7 +37,7 @@ With ordinary virtual machines, the Microsoft hypervisor controls the scheduling ![A chart compares the scheduling in Windows Sandbox versus a traditional VM.](images/4-integrated-kernal.png) -Windows Sandbox employs a unique policy that allows the virtual processors of the Sandbox to be scheduled like host threads. Under this scheme, high-priority tasks on the host can preempt less important work in the Sandbox. This preemption means that the most important work will be prioritized, whether it's on the host or in the container. +Windows Sandbox employs a unique policy that allows the virtual processors of the Sandbox to be scheduled like host threads. Under this scheme, high-priority tasks on the host can preempt less important work in the Sandbox. This preemption means that the most important work is prioritized, whether it's on the host or in the container. ## WDDM GPU virtualization @@ -47,7 +47,7 @@ This feature allows programs running inside the sandbox to compete for GPU resou ![A chart illustrates graphics kernel use in Sandbox managed alongside apps on the host.](images/5-wddm-gpu-virtualization.png) -To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with Microsoft's CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). +To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems render apps in Windows Sandbox with Microsoft's CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). ## Battery pass-through diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index b33a5b9f67..236eeb8788 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -2,7 +2,7 @@ title: Windows Sandbox configuration description: Windows Sandbox configuration ms.topic: article -ms.date: 05/25/2023 +ms.date: 03/26/2024 --- # Windows Sandbox configuration @@ -11,13 +11,13 @@ Windows Sandbox supports simple configuration files, which provide a minimal set A configuration file enables the user to control the following aspects of Windows Sandbox: -- **vGPU (virtualized GPU)**: Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox will use Windows Advanced Rasterization Platform (WARP). +- **vGPU (virtualized GPU)**: Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox uses Windows Advanced Rasterization Platform (WARP). - **Networking**: Enable or disable network access within the sandbox. -- **Mapped folders**: Share folders from the host with *read* or *write* permissions. Exposing host directories may allow malicious software to affect the system or steal data. +- **Mapped folders**: Share folders from the host with *read* or *write* permissions. Exposing host directories might allow malicious software to affect the system or steal data. - **Logon command**: A command that's executed when Windows Sandbox starts. - **Audio input**: Shares the host's microphone input into the sandbox. - **Video input**: Shares the host's webcam input into the sandbox. -- **Protected client**: Places increased security settings on the RDP session to the sandbox. +- **Protected client**: Places increased security settings on the Remote Desktop Protocol (RDP) session to the sandbox. - **Printer redirection**: Shares printers from the host into the sandbox. - **Clipboard redirection**: Shares the host clipboard with the sandbox so that text and files can be pasted back and forth. - **Memory in MB**: The amount of memory, in megabytes, to assign to the sandbox. @@ -37,7 +37,7 @@ To create a configuration file: ``` -3. Add appropriate configuration text between the two lines. For details, see the correct syntax and the examples below. +3. Add appropriate configuration text between the two lines. For details, see [examples](#examples). 4. Save the file with the desired name, but make sure its filename extension is `.wsb`. In Notepad, you should enclose the filename and the extension inside double quotation marks, for example, `"My config file.wsb"`. ## Using a configuration file @@ -59,7 +59,7 @@ Enables or disables GPU sharing. Supported values: - *Enable*: Enables vGPU support in the sandbox. -- *Disable*: Disables vGPU support in the sandbox. If this value is set, the sandbox will use software rendering, which may be slower than virtualized GPU. +- *Disable*: Disables vGPU support in the sandbox. If this value is set, the sandbox uses software rendering, which might be slower than virtualized GPU. - *Default* This value is the default value for vGPU support. Currently, this default value denotes that vGPU is disabled. > [!NOTE] @@ -82,7 +82,7 @@ Supported values: ### Mapped folders -An array of folders, each representing a location on the host machine that will be shared into the sandbox at the specified path. At this time, relative paths aren't supported. If no path is specified, the folder will be mapped to the container user's desktop. +An array of folders, each representing a location on the host machine that is shared with the sandbox at the specified path. At this time, relative paths aren't supported. If no path is specified, the folder is mapped to the container user's desktop. ```xml @@ -97,11 +97,9 @@ An array of folders, each representing a location on the host machine that will ``` -*HostFolder*: Specifies the folder on the host machine to share into the sandbox. The folder must already exist on the host, or the container will fail to start. - -*SandboxFolder*: Specifies the destination in the sandbox to map the folder to. If the folder doesn't exist, it will be created. If no sandbox folder is specified, the folder will be mapped to the container desktop. - -*ReadOnly*: If *true*, enforces read-only access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. +- *HostFolder*: Specifies the folder on the host machine to share into the sandbox. The folder must already exist on the host, or the container fails to start. +- *SandboxFolder*: Specifies the destination in the sandbox to map the folder to. If the folder doesn't exist, it is created. If no sandbox folder is specified, the folder is mapped to the container desktop. +- *ReadOnly*: If *true*, enforces read-only access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. > [!NOTE] > Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. @@ -129,7 +127,7 @@ Enables or disables audio input to the sandbox. Supported values: -- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may require this capability. +- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox can receive audio input from the user. Applications that use a microphone may require this capability. - *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. - *Default*: This value is the default value for audio input support. Currently, this default value denotes that audio input is enabled. @@ -189,7 +187,7 @@ Enables or disables sharing of the host clipboard with the sandbox. Supported values: - *Enable*: Enables sharing of the host clipboard with the sandbox. -- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted. +- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox is restricted. - *Default*: This value is the default value for clipboard redirection. Currently, copy/paste between the host and sandbox are permitted under *Default*. ### Memory in MB @@ -198,13 +196,15 @@ Specifies the amount of memory that the sandbox can use in megabytes (MB). `value` -If the memory value specified is insufficient to boot a sandbox, it will be automatically increased to the required minimum amount. +If the memory value specified is insufficient to boot a sandbox, it is automatically increased to the required minimum amount. -## Example 1 +## Examples + +### Example 1 The following config file can be used to easily test the downloaded files inside the sandbox. To achieve this testing, networking and vGPU are disabled, and the sandbox is allowed read-only access to the shared downloads folder. For convenience, the logon command opens the downloads folder inside the sandbox when it's started. -### Downloads.wsb +#### Downloads.wsb ```xml @@ -223,17 +223,17 @@ The following config file can be used to easily test the downloaded files inside ``` -## Example 2 +### Example 2 The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. -Two folders are mapped into the sandbox; the first (SandboxScripts) contains VSCodeInstall.cmd, which will install and run Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify using Visual Studio Code. +Two folders are mapped into the sandbox; the first (SandboxScripts) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify using Visual Studio Code. With the Visual Studio Code installer script already mapped into the sandbox, the LogonCommand can reference it. -### VSCodeInstall.cmd +#### VSCodeInstall.cmd -Download vscode to `downloads` folder and run from `downloads` folder. +Downloads VS Code to `downloads` folder and runs installation from `downloads` folder. ```batch REM Download Visual Studio Code @@ -243,7 +243,7 @@ REM Install and run Visual Studio Code C:\users\WDAGUtilityAccount\Downloads\vscode.exe /verysilent /suppressmsgboxes ``` -### VSCode.wsb +#### VSCode.wsb ```xml @@ -265,15 +265,15 @@ C:\users\WDAGUtilityAccount\Downloads\vscode.exe /verysilent /suppressmsgboxes ``` -## Example 3 +### Example 3 The following config file runs a PowerShell script as a logon command to swap the primary mouse button for left-handed users. `C:\sandbox` folder on the host is mapped to the `C:\sandbox` folder in the sandbox, so the `SwapMouse.ps1` script can be referenced in the sandbox configuration file. -### SwapMouse.ps1 +#### SwapMouse.ps1 -Create a powershell script using the following code, and save it in the `C:\sandbox` directory as `SwapMouse.ps1`. +Create a PowerShell script using the following code, and save it in the `C:\sandbox` directory as `SwapMouse.ps1`. ```powershell [Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md index 676b2a8179..1a0695eb98 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md @@ -2,20 +2,20 @@ title: Windows Sandbox description: Windows Sandbox overview ms.topic: article -ms.date: 05/25/2023 +ms.date: 03/26/2024 --- # Windows Sandbox Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine. -A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application. Note, however, that as of Windows 11, version 22H2, your data will persist through a restart initiated from inside the virtualized environment—useful for installing applications that require the OS to reboot. +A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application. Note, however, that as of Windows 11, version 22H2, your data persists through a restart initiated from inside the virtualized environment—useful for installing applications that require the OS to reboot. Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. Windows Sandbox has the following properties: -- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD. +- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a Virtual Hard Disk (VHD). - **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. - **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. - **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. @@ -70,9 +70,6 @@ Windows Sandbox has the following properties: ## Usage 1. Copy an executable file (and any other files needed to run the application) from the host and paste them into the **Windows Sandbox** window. - 2. Run the executable file or installer inside the sandbox. - 3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **Ok**. - 4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox.