From 57e2ef19912db209831a0f53e50b7311d6746da8 Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Fri, 16 Sep 2022 17:30:32 -0700 Subject: [PATCH 01/10] Add smart app control docs --- .../code-signing-for-smart-app-control.md | 24 +++++ .../images/smart-app-control-block-toast.png | Bin 0 -> 109594 bytes .../develop/smart-app-control/overview.md | 50 ++++++++++ .../test-your-app-with-smart-app-control.md | 90 ++++++++++++++++++ hub/apps/toc.yml | 8 ++ 5 files changed, 172 insertions(+) create mode 100644 hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md create mode 100644 hub/apps/develop/smart-app-control/images/smart-app-control-block-toast.png create mode 100644 hub/apps/develop/smart-app-control/overview.md create mode 100644 hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md diff --git a/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md b/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md new file mode 100644 index 0000000000..92a85c0e5f --- /dev/null +++ b/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md @@ -0,0 +1,24 @@ +--- +title: Sign your app for Smart App Control compliance +description: How to sign your code to ensure Smart App Control compliance +ms.topic: article +ms.date: 09/20/2022 +--- + +# Sign your app for Smart App Control compliance + +Code signing is a cryptographic operation that can be performed on an app in order to verify its contents and publisher. Smart App Control considers apps signed with a trusted digital certificate to be safe, and will allow them to run on a protected computer. + +There are several ways to sign your app. + +## Obtain a code signing certificate from a trusted provider + +Code can be signed with any certificate, but Smart App Control only considers certificates issued by trusted providers. For information about how to obtain a code signing certificate from a trusted provider, see [Manage code signing certificates](/windows-hardware/drivers/dashboard/code-signing-cert-manage#get-or-renew-a-code-signing-certificate) + +## Sign your app with Azure Code Signing + +[Azure Code Signing](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-code-signing-democratizing-trust-for-developers-and/ba-p/3604669) is the preferred way to sign your app. Unfortunately, Azure Code Signing has not yet been released. You'll just have to wait. + +## Sign your app with signtool.exe + +Signtool is an app included with Visual Studio that can sign apps with a digital certificate. For instructions on how to sign your app with signtool.exe, see [How to sign an app package using SignTool](/windows/win32/appxpkg/how-to-sign-a-package-using-signtool) diff --git a/hub/apps/develop/smart-app-control/images/smart-app-control-block-toast.png b/hub/apps/develop/smart-app-control/images/smart-app-control-block-toast.png new file mode 100644 index 0000000000000000000000000000000000000000..b5ca710601bc8fbd989eff6e722ed10b69aa8d4a GIT binary patch literal 109594 zcmWh!byU;e8{P&;eL+$L0TJm`q!AoAa?*?#sW57U#6XZ3rGSLgknU#mMwdlN3Zp{- zi4jT*41fI2xu5en_Y>#bKkoay@B2K@jWN*Eq@&@W0RRAW+FB4J002|~003R6Zd^a9 z{_}_9`Udnd(o_S~jBsvUPsp8AbyWd?`b65x=M>j->X%v;J^;YIssCR<^6aJ@0N`JV zHbm9rmCa5LMYfsx>A!Sq1~LQH5>~RUrQ#s~^TRq?7REdEciNc^-tRH=?(N+o-`evC z%3b!k$~#@y-?8c11D%`w2>7r#9k6(|^x^fdZyBfA8Le_9TEnNib%(#;5$#t9)a%Q6 zSKiaBytQRhQ32fkMe|hW-Eptee~!oebll)8#8z?~<&}Fzf5g9rZ*M~yzrE#8bgTc? zCudo-Av<6HNp{|)*0VmP@5&KZW9#@@_VSC4^uK{jl?S73AHMpB^N94+(s9e`tNvjo zY~tDQHr?V2)EliEp7nENa+cVuEbOm$mer2S%hg|LEvw&qQ{`_K zEab&Iu0NZON|#B)elt%kt0%~ql!^CFJ?djm-SDygp7k{T?)BdOZuJe#P>;nIC7!b{ zC>J}v(5I%h{gD$zeYzz&8~koJl;nxGZ5B8EIX7(jGjrJVa$DT=Qe+^_vU-NKdsf9d zw6Rli`KLqe5Pl{%2e;U+{-cvS{-cv?z%NhJmWZ`Dag5*jEvT}1a+5KxmgI>c*bsN+EVqT{LSyks ze()y>$xY0-$Gz_ol%6-TD(VfbHc8%#n)9evb7%6d4$;>dd^jFB_%Mr4@#@2}*s(L0 zf78gc)Ul9w;@lc0s!428XUJ3$FVkR1Ovb>|>z=t6xC^#9Hqv1xd~-^q2@OdJF4fCf zZVk$ro=u$zb9NV8-Mxc3tpk--xB(88hH*Wv&VjZd+^k1->#T=u)9ju(e!v4>H(Qh2 z^+i#C&W-I~%fLwbaLys=7V-D-Eu~|h*-b&q>fyIpyXB{H7Ki?_7AeiL7DaNt%GxKy zEO8=k7;{w#k)2s#O#`}leRM?f^a?x@;DZn|lEvJeh|Sr5ETQ*Fw+1{3&L2Gq=6y1` z`4?L=0&R{B(o-tM83{-UFX&=->xoP#!iP`siNA7vZPXz2omprjMiI{sb#I>Z6i3<6 zYBzOR5SjeNE|}+IN|fFlUV7@-(`x%D8`G8)MNKTLjZR!5c2ny1AnT7L#Ai(d-2Wuk zq?yZ32fp(POlWboZLH5~PX1+&3Qjw8Jh*3*nUJK%=b==;ciLKVA~)VJusKXHxhjbH zENO8%@hX*&G_J_a&d*-quD!}g{oJ}MYF8r~pVQ+0xAI38wt&w+_=DS5>Wk(}n>Q|b ze1i9?`j|g=NYWX5@9@vOFcWlhLJP1^3AO_7BUFlT~`0!?rh;A@)&~P^Jy{&PxF=uEoAZ z=+BxvIYj(o*Js)3{!YvZOuv}lkF&2$S}?NdUWE**7G5p5$Jic{Ie(Y*E7Hk(G|ikq zP|)idHJjMJwA1>*Cv0@8*(|9$WK~gy5`4nXS1(Q~yGO^j^~B=GQ64rr67l0GX704H z1feA*2!E~(H&ts8wD^&2TdnnJK<~s^TKxc-D}6N;E1QuiI9zHm{_DH@=&wg^wYMI* z?PDIf@0&JOYkjxC`x669PfJVu2Ktb@4KZ13qq3H;dexGy%0omJ%nmebj`{wU_r0GWULU)q0-O*)_W?`IctD;h}+PSD>GXSa8G zo0!&7d|Yq38J*5&FIMuAN_6oTnNq<&DW%g@UBA>zFMeg{!}@8Po1P89dyCHed)Fbo zR6nA#gdfpa>>$v0c;UEwKe;OXK9})ZLBVbAx5B-rIFwdmr~G=>lZSYPQL`MPs4WiB zfC0GZthV?k#5UArt@7+*ajx2>L#W#?EC7bV0~Nni=2*`lgc9B^wwb- zF5eVZk>Gc0rlKalOrgR>#|_PJR|S&ki7ZrG`9N3nyIIcILEx$(FIccg z3M{P`7N7w*pS)Fd+4A4cL-r!6y}GxuvjsOj@K5(r`hU~=0op78ZL@>R!mG?^Osjii z+8;pRcSog_H^cN`r~+W|C%|`^$OI61DjtGRtCgmz;fD)v1QF7WG-xnJ;RNhHBn9<9(_|{lr zQvn(?>0t)wf}M4S;=>JMR+z?~4U9`!4!LoCcj(-m3hYdC?d}z^ZX4fTD7-Obe`ojX z>dsDFy6jwlXXV4g9|FYkuip^Mp73EH zJD(Hf;FkG^*0Z_!jbAJqo&W_`G7jeiW|uT%0%coDntOd`c~>%2LQ+!x>khK$8KC*BPG_JD=LRz~%&GBkyw$py z0d|r=Z{KdFvufDmzmc=2Xmb=K4$$ji-JDbeZ~&b^iWYavRTK|-wGUj)bfD$-z zKIWfbWAN4q5OW~R=+Z~ zd&YvB@`7prEH3#dzVLBfkO2?NW-1_$9xT`D4rscD^ILJhbU=@ZfI@)tsBZX}uBm31 z!cE9}AMyQW`; z(`#yPqXZTn6DXkMZL8JhvmP!x;h5{?myd@~z6X6a0oq#u`l+0m?J_UgpQwaCOBhg+ zJs)-_%bzOrAss8H1{x%+$N+QDWzaId8>OumOns$WEn1J`T(^2t5o(-58z7e#i@VHm z$WVCBK1EJa%W)gpWy#Ogdbjp8qC|(6A-?#*kbESlkcl#%?!`~AbokiEa05wo@n*J$u0)EHO+_SGM-2{#1$N`^WA_!>T5^vk^HB7MFj&$EseMk$T4trB}( zJL#0dB{5&kdodJYK!N>CCd2x^^3VI8BjCfQiNoOr^}X1vos~OsmI_n*CAA9-9m$kh2JJ(;!@-4Mc6{@ojSV+daRES^vezi6O9wow$nhn6joyW z_(>nZvl`{n?Fa+Fkt1aRpgdwM z^^;9w=XS7jnq;o$RxFy(X1TIOaeKF*zoZxsZX$HTm&z~|#WlrUkMAJ5TE?r>S^<_+epim>hV0z2z_}jr&lYOu9f6wyqFy+N2Ha}J z!U|jR!WzMn+}X}Y4oLg47cd~8{)C@Pj{33OJU6v)C6zN{{`asA0nwlu$Pn*_N7Kg* ztr1LiNpS2H>t2u1%YZlFKfYmHyZ{sfjW2%sL^w$v!0KBH%n@{1jtN&?BPR)X0RlTP z4}Ty1&Y;Z)jb7K|D*@F!e{KVL4Grub0ka{GxqMxfj-5$0&iwgXMY+P^`fQ6V=53pf zPu(}_7VKPf<;=%T?^Mrt-Py^fzq9ju4BV+Ll}*Xj}1^nYVyk7phKi9!?)S02cPvr}r6$k4wRN0Bgdl+JCWISu%B zCcO%7NoVv2sgGgY7hGW<1Tji#&b~M3^Op;w5W(+}ho-XgU7>p4APGzg z$y3shnt>j@#^4!Gv-su`J|Wze^FP;9Z+`QgXY>VSCiTCi*U|#1Jz~C)Y6?Xrg;Gd! zxeYD{Ugy~R2PISw=FlbYLO^*3?UntE1fV`|zMgsL^P;KOHWy(Az#?WWSuP5#2Lbdj zQDI378q`ooh*g@a_+KPX)6yf?SAhZW>8ZeAu*rtpX6JardB5g=Cc(V_URH*)Z-my5 zOPuK-LXY58-mPHiLrrMKCC+Z2C=~dC)|-0f=mFIXZ2F-W&!j?>_bGqKs$#OVfA$mZ z4-VZu`X8m3LN?56Qsh; z=z{%%LQF7@>B0vn1G1njriYZ=j9l%Q1VWe#mnXJ^?x;F1?q?UbmVhU*g1p6G=U_W& z(D#pYGXf%&!Q2`Yh3X9XCUjA}8Sp?V*7vu@1Cz3~@stnd3?{S;4I#>v^lCVpruuYY zyibmslZo1J{3B?FO5-iH8Y?4f zwBl{7^dQaM%II?5BH_2x;NuIGj9U2W>(bf3vEkg}-N6pa@%ZJ{JMQ`=0iNor@0N90 ze6hQsS-hFeRA5$$>pian+|*H8Q508>v?&*btz=P+A&T;Avj) z$rjhpM=E}Be5301O`b}L0Pv(HWIqPX!h@xbu0*ya6xR@l%amx132;WL#K21^Z0>Ym zEBYgmdNcFLbW(e~cmx!VbShUe@%}TqEkSaN;5zILL`vLt7P{RZsC+Lx{Mk*4N=rmDIdhmo zlZd`LAaHFpd`xqSNe2QJ72ZutJ$VWkd+lK2@7{DE)zQ%G-XzuRVQ|{M_A5SolrA>J z!(fg1Y{B`$w(MKCDK-HqtKHP0^ZX^CsS3P(5FZ=l!4jk+F`wUG76)mVF3EC}WZ%nW z^K2?)b2n*Lf}$jCg<8S$Y*g}LBZsnzzZagaSdc5cj#x4FF6Cj_sx$muvCbZ@#d9PL zT(6jW+mxQo>rxghNK39C8+j~!GjIE=p7K3l!T*uT6sjsPq~`8R&pUIJyj_@wb^?LJ zo@s9zQqMeg?aXIhNd;sGpB`m=WHqt>2pQ8rF8ZP?~- zN^<6nngk1CE^;@rfVe9*+sAL~QCG#HurD#z5mM9R^Yuo1&_N*a=rB;}Upt-OFEb*- zm^f9^rP|ZFG}qB>!#HwGIM_WV9K|0KHf3bI9n5N;KMIL(=(H@=HWO z_?6-t$?Y>5daJ$ekY}JvAs5$0?IXWrJ9pT%nIU#t z7#j_((Ei^as2<$8UmqOsvLXoZ;H}2cb){C91ZH%(o!)z(>_#;2UIrq5-tOMBGXj5j zq$Ru3>-B!8$DR19S%ML;9=m+f{ROjk7N#h7`U+S~xSwP_km#k{jQ#4nW!1JjGqF3WB%w>}K{TbxmtXe@`+=5sQ~X1G zvC`?c_Sm&EE&uV(IVzu6rtZyz{L4BatBhJuXmivJ&Bj#ILcVjxojYxG#RQ8nQsyWM zShylX)h3!CG)fGM@YqQbA@&syR@2wSD6fPEHuUkBqS);|9gD8+KSMy~`~SrGqaLve zrxn+KWBQ=O8R@7A-nL_T;LgWDp~e*rDoLRzKyR|lS5<&bj7-MI)n>crt^`NxzH8Pt zK&Oa-9ovy}PvztR$~%AKO)cWor##!>RU2p3V7<>&E@xQ1pP zla&ng7#T$YC2GMA!D^uRd$JYpv?zyVV1Vy^p#n47nHY|nP!`!7@D?*h(%*{YjeT!w zB#mR@5m6w&4P$F2=H5j_(Q_5loZa)&y12Rfxfg1+_Qdk4u4512zzbT6Dxs@>_R-srMi`~w!UK9EzQ()D7}@*Hu;C%rTrf6RdOuZ4dMA2}c7DF*Vs zsuFw!?bg=`c+uIWMwnOFez7lQ*z*7pVg1;v=|9a(F$GzzjtyfF z6;*?P!C$2HYJe0lB7KdeubR!*qwa>cSd-lZ%uD8Wg*!~`*d$CIkY-$aeW6e)wP55$M-UuVqfgZr@!17jisV}P-zdy95&7w+G0e_aIY z@aatJwqE_u)ABBGbC|fBpG81E`x1yKZHsJouS=eGuOrn?z50xt{Mi!Nd5x>`gD+QVkfs`cA=)ZMgJ$D&kI z2yqy8QW$J=^tih5<|er`Od?6(elns{hJ8=Hn=Y~V&x0-K#r<(S<$YYI&`!3P_%hD{jfAzCTlRv<5$MB@^Uy!=O21l(7Rc>lUM||4kpl9(p z9V&BCMxu8`je8WgbpaJTjliGy`(E?O=aN*QoH}l8<-dzo zhO;$QyKS8vRNSzw#$B)ptDsT)#*HfeC%Y@(#ivELg~uCYp_JK*eM83Z^vPh?oT=CF z!sByA36jFrpMcrOgM#DeW5OQlFCD7a<}xk+s6@t;l&P?t`A-kE>||PA$snxvji2G3$3VkKEy%RTZ70o-*;fnS|x8)G$KKK7;*HMa`NX3-Twv zyYu;m1k*WsM%Btd-OA_lF7cXkCRl#CL$I7hej%&exM{Q)lD~aK2Fpvo70o^QJc)Ja z?`Kpeo5;KwqbgXMiL#Kj6HquFn8{mQ0nxNhO_g{Zf0s4xR$|hv;>ioC#=p zUzo368IO%*clRxew*UUotN z*IgmPuLlP2HW~|vf&c+hPH1f%#nL(SCzS^+^Ww0lm!*x`T*%K!1A{S>YB7%f7;$f-ck$-=kon_ zYI>@n5U#}Xx5GGTOewT++uv0zQegFgM$?I<}X3r+)Q9< zI`G%i%7wL8dTivrSI=_)Q zvCHQ#9DEqu1Yvz1!RVdoEkJ4 z9yS|*BlI2Vmge>wfBjPWsZQH9#sZENdp8tC?*YWUN-)+4K=|kjYx4Z`0UieRvy(1| z9Ns**A5*kV$H+;CP;wz#4ResI@a*a(3N#v-U9{VX3&E^CbLeE<;yHV4Z_QUm%d2mh z&VVJ$-)-8xW+Me@A5i2~2-Y;J30A{C8+QZq`f8y)Wq67Lm%gprz(VG*vWQW8ij=-; zMz@-H2t&pMd_tt&tpWkbh z(4U^wzFWikvZlUh*#?PSf|qUnf+LU4Ifeod@rdpQQ^paQSZ5s@8={-AGB9^b5}PJ| z@0wF1&sNk(t~hp^HOF8q?5DL%+Y$JXp(N?aD=WsM`Xw!NlOUn$NFzZo4qL=Q|dF<<|4AK#2Y{n9iovnpx z!xSXT0U>v2rh+zlLreL4G>%DJbK4@D>Ik>!Ab%02Lr9|H;|gj}dDb?k1JKzLy%%rd z=R+~W5_h1ql0lnF-SUmSSR*Qu6tXCefGUvTI2oATof^gSdZd^L{3KEvhBQrclDbd* z@>}XZ@JxEf%+1^9r19k451R|mw7l7-Kw0n<*D4>dLgspT%KC-D;~^MsEu0OM*yH@d_Ia2S-2LQQ z5wva@F*AjLw|QVhw=(Ky-?!JbpMy>2#okT+lVDPHN%HNH4*$-pr9obzE|qkbq6o01 zA3m;i(*M_jLFBe>e{N5C3$zXxa!TtxoZ*?N9Ax zJuNGQHg!Y;idKxS0a@{yZw8H3g&7Q_&2_0=T+`nc9{iG)0)VLlCREk^96m18m3o`r ze`=>F29dL!x&@u=y`p@m`|=4?=Am}d*f%+H!YPeftv*D}(~D>OON6sd!60K~DW}wk zjzh2;Ow!s7<;mtu1F3>WN19H%{nnCIV8E7mG19A1WT9AkD}xg`!!Wo#N9!n?k)I|w zDaDWic4yEiR1n+f(`{QOVT8hp7)`Cwu>;0O%_xA(1S(E|fr1s~e{*HA>Cq-{M23zY z&S{tkmsb5m<`35O{+3}<;DDJP->8M1wr3}bWXx4cyLJmXO*zF+B^Ol-Q`Jbkr9_*i zKdP$qg$2C8a{Zlwt3R1m2b_;7D(wK-3*&YeN=PfO9jrK>7}`XFH)zI)C zi$_xAGqKwac+hy-RGy81BBw|afX-(Czl{G14mo-^;PV$oF^=iG z*jdDDe=AYIHCtsRdd5<1&7<(--UgNxtuvzCKa0GkT{IP)J3qm%|In3>E&lBS&lQP= z%pp5FDGkK+G1+{ZEL5d5DzseP@CFS~(022x@8zHK-Igf~!7sjT3H7ZWq$>#;U=a)- zDxxUF@`Hr{b85t4-_BA+eWRAYuJcv#@Mm16v(L?h^!F|8v4OSq#u_zvA6rWVTSxnx z1OwQnIL0}r%N$Gn6j?nq8v9C*>7|aM3#ss~?~Yv6Zk!~+{56;VPs%Fnuu>KF*s`kn z@0}{_Kozq3M0e5BlMaczSN2W@I_P z8u|DAL#Uk;+k>!YH8}XkiFXNxa7&?hag!vxgZ1djNk#T6mzv{W_Pz<6*obe2a~hnl zM0W4rcTrS}4^Lv^`R)!i=>q6cX3(p^9C0^Ys=cRYu$p7D&L8kORAOPn1rr&3AZ_f; zft2if6BT%$8%PBqCO`wD9eWDZ1JnY5qyp%1SfmA1T!KWnz?JnYc7{aKB>H#Z?lahf z@etBpWH6fdg7>+yu?pG1OD5G~rICH+&&8){T+}PxVMZ5t_;diB&DcYaZnv?!dE}v1 zMZL6)|DBhRJVOZOuG_HN?cyIh}C{#hO=U6>*NZEyPfyQjrOO24w1|EopXP|yfT zJ^Y)4YF@J-&w_8<4y{qLG16b>sJQ8Sg87FkM8VdM0|(dy@x+EDWPD@^pkaeUS6;2D zX0Rbagrs;dtmW=L&E!VV>2V~_qY-d!Cm0`WFi{qOh83%6rIQqGa>r14=Gfh-aDx&$ zhN*_$MW|mKQihj#2KvZH;{TCsf*0uI8hlF{#B@`$zOZQB8lV-v|jhO zh%xdwnw<&qw*X%7hZ~!)?}2JR>)3(zz6++wXp<4tMxO&Q_-di!LY;wjMqqD$?np3fQ$Ji^wZdUkDO?{!9 z+OxKYQJ^#{kr#EAX0&Q%mg>V|l4Ta_CG9o!5hi_i^V>*(Va_MuM}0RRYcd3;e#MEn zT9kjIjlEQ^^#~AWevocV^b@$a?73PdXt~Buu?#9&sgI?xzFr$#*0e} zVVV}d;+c2dD4r*F`>^*BV|8D{jK8nbUF7`kb7p=X>2`#{|X+?+U3Ie7cVK#X-A3p^I z&KZeHoQZ`DGR>Pc*edb%dRit$>^G;9g&7D4K9o4pP!%fN3s8S*Jj6(iy?j%`eUi!J z8_rtsrxYe1P&j35=EJ3~Rz;M7Ov$j9Wfm4hzl)`TAeWf6#Zea1Mw4}Kq)IVTLeQ7f z8myxM;qgPP1KU#S*pa)_7O!!S6NB~B@(NAqN~*=!>XWI!kG|I43IgR)8zN}=0J&S0 zV&7pgrHRSq;m=M1B2GrOtngr<^J18{cV+cT5`RS}P4u;X>Pp$fxXJGZ6hYnb!Deb)=gIXKUV3CWdUU_K7Qak-~vxC&cSOmz^(V-W~mRc%Dnk*W$OcT zZ?pLn4Ce)@m?-k}5-iuzjSM}rvY=5amE-yP^IdaNX}MED5%~wKDYY~|XgJkz&ZA&8 z5spwtU3Tr7TC&GeR!kyFV7oPPTno*E@F&d^dK?WCiXFTwmoL-WzMIXiKdEUD6~s1G zl~y;^Bwy#qx`Zb+CjRFllv!L|R#*me?Xb z#HVND2YpY<<68H%C>TBGcM8O~Y#rvTQx1w}ZkWQmna%4h>?`7%-7fquj_%}doc3WX zt+SAPA@-rc>2I7f{3WKfF&)w^tAXnC^b*X|Rb|1)tqs1W3i1y*9(N8(9j5jb`xH>OV6aTss+hmeP$@3;G zbS1f;QB;Ocwy@NQ8>nydgip0WH0*~0;r=fxsYH0@z~D+P)DK_m2B?C-6)ghah7c{5 zU8*-vnZVM?g>*PKD)hEom~idu%8*&#_MOgknuLm)3?7Z!LI7BXiq%O#W91VbdDcl->uVhB)?LmJqDYnRcaf^{jP-Tts*WZbC*S<-Gb4^i z7COxSI<6BVz*wfe&>a?0D~nnqk$KGt%bw#7a)w}4fR2O7MG_5MP>Lo_ps>h=l2(J2 zQ5SXXDskmUjhY#q21S(*bvdk>VRiRs{YEIs0j8D|%1{5iHJ#5r#Wr>B+f)dZw+(u- zN^hr`TrBhScZ9?g<|iX>SyoitvZxSc69rZ74&fHny=PzOs=;4e*cPrTX)Dq|_%E!h z*VUPTn;{#>i^l`4vFKd!Yg>uF8QWzAloNf+v)MeTPAh3F%JlJuwWxQ0MEIBoCRs^> z<#rk$4+}#)&(ZH`8Ci|-v8T3prrEpjr#Zrssf&4%w)$*@e&eaZd zx`c{Ke?1s$_0)7kv+4TS4?1Wk)cO!!up&H=64JmpE4^kHDiTyEwtQqFss>l9st1dtq$%^IIw+@T0_||HHnR!)w6+z535SxQ zDgb_khnenSrc6&9dol3GluP-l9UUX!{qG|DXA8D(n!A@OaCrb<+s=vnNXKMWw)d?2 z4LU2W{~xvRSO-tK?M0})$Vrzu6jCcUbNCU47X$<@>4=JKiUsC=?%iNEwPuLKXC;gIBa5ad`p0VDI7}5I*s@@$Zug~17P}=vdZ4mG$@b}bi zvMJK34z-iT_p~47ygs544LP6@t@?9U)28#|cBOjS;fhYD4YGvm;v)@GE+`7^6P0tg zr$aoN@^1J3>D}(PP1El2m8LVor^H&|tmEt=&2J=KbmvIl_wwz~?&s5V_`E-6{-I|r zgImqy%y8Pao~=u~?G#S1+91-nM|kraK(Vie!Cd40Eck>W=D=#4_M`+EV<*b4C}DpT zYc()=CAK?6kYZBT$GMdsa=3E2tYPK^T~gnFRV@266S+Batph@a1VFu|aNgm^EHn&R zTjqkGwO>@-3N6p7+t&wgXS-TX10;%kT5Uk^R{Y-R{xHt1;B~VBhh-fWacFoRoO&c< zw4v}kkLSZW6?I*O_k?fD#1@}t=fDHyh{#~EJ5{_1(4u>DdRpWklB7Ar7Ug4Bq@3RS z3V6MzHW-ZA_-{<5_z7{MY(By6Q8;w#NdQ&gb^Ott|}Sy!9*fT z(F`#?1_5*c8lj1cI&SyIXJ)gM9FG8fOEK=lk?#26e-H%b?_%Nl@toe;ZZ8yP@iaxJ4 zjHS2Do^p#mh<`X%c`u4tmWF^D>;%)qJ5J! z<#@f=wFwZKJEgM5zB_&Gc4>HlCZDMzgGr6Z5x0-M03yn67NLg<<3R}lJ2x1XL!K$#=dwmD`cd<=HHdbzF zBh#-ww&hVlo-nwDh`nTf<&q(i4*{s)X<;NGvjemTvd-t_2T@M_)Z_b5RI)sV`1yqO zMfZvNY23TzzJsSZ{|ZXHY-DOK!q%RKIX{zs6HKi=<>^9iaBKx1O-XEe(x!KvC$Yg% zmB{utC!YLm8g!5g+H2 zX+$hN{#0`o6m?*IrPtLId#T5t_V*JaQM3O>VyZYSZE^CI8}1r5-G93#>ZNLrsc*LHXYaCV2ur9B zRSIkv!xGA`v7Lu~it*-PG`G3S+X|dPMW0UZhK|x%4J&9Y&D7>AOwY)4RdBGse{iA2 zh|z$3=9r^tK0d=is;SDsnWMiw&oOy-9=1}^+wn!_ee;JK2e;C9e70y*H+90wAge+r z+d`kl%wsz_U)97x?AU;tG+|}vL(c!x&1tbAH4H&IM+aubbxWOTrDoj4xb*D7wqlZw zu3~a_H7cwyC8a4O86&8ZFzxBizs;@B=vK_wB6Px!qtbZ3!bY$6=k?n z=5&4(DKGKaTpy~QiysnSU0Np`WUTugJm>_R4kI|)TNm1b+85fcIu>d^w0x{FFloG| zM?9|TK1y6VX5<`xks|&c@K!pGK=@6(9@>!)bIfWsof!}RhN+dDu8P9AIG!2l{<5gi zRuN787p|dw-m=d4GQnD+#j0S_k#8$}@J7E7cIf%5f!jDMzrsV@&4GzP*+NnhWL}|7 zz^<{LRtcwG9)Tx3z~Z39=BN;0OC{dfc^(Y=#y`bh){0(B7tzB=V1|H2gRs=_1#0QU7kKx%))K^%!(p$O+#BKS= z;8vnX)+)JeHQ5W!jhcSXY<^Y0B|mJ-e9iGwyxxql|Thm!S?XP4ec z8Lci|x@8{~D;KBkS}K>kDAPY;x*-*$q^0{bbphaaJi|||mkv%1(*55D}zLO`ofS}F3eXh#&PjG`5@Y9cf_KD|7#ioa#R1a~+Al`sJ2(ir% z_0O`&VSX2i;Q(KY-BTuWd^=F)_rC&OxDc82zFwk>t{qtO1qBkK=Bm9e)>Wc=~U>p&$Lce z(1niDC5F|nd?vr}Lw>fvNh(2pkc?d^puUHhO4-(WI+g|FCO33a@h?GuSNNmFFLu>U zpYXBVa0BrnT8Jp1D0+pZ0`NftoLR~b`cTUCU#i9fxYpvaFv7NuiT!@{-=`@%CKNBJ zz?_8#_|d1LZu%vt+V=E$m1fDtpP(_42MgGb&B~A23Y2FC%%^2ys63W{cRw2%0*pn) zqFrYV#{&NpYDpNG9De)~$e&_&6f_W!>_buPR5ec$Q&(0JV~nIxnU`dWl(;^;B38%5 zt#&8aO`Sd%k~GFg1@jLokdG{-Q8UiS_Kj>?6YZ=9)=FCZIXcC@DJ;OTQeZ3D!pu@k z#*r~1NXN6JOjgsUDSizscoo&8!FNxbc(uv%oPs;Q>YY2se+{P5lcBHsQ573Rr4kcV zDteGn(=WJK$u3#ZpbZdW9P{P11jYUbYoP*cuNbGflEF%kr@Y-Cn2VpNdS_R15~;yN zP=4j+b~#fOb}*L8Sr_N(S}9{=P2ZB4ok?cEK9!UxVRmG!Ay}mNOk*8jqJgT5t1N{7 z$GZ3aq40#+$uHLMQP%Acwp3L5rZt?>nZdIH>0l6;rmC$@e#(4pNX&5Hmws2>66cvW z#Fumb_k!h{mUQM7;~QQ{cE)4@rzS(?UH+>lTdWbP}u!*!rOf7ByPeUq3c8|AB8i zjTypzs4+Bp`TG5ywcfpxPtvzrf9Vb#rBxva+ffLD$2V`K)7^E#)*-_0@690@L#=}$ zn)XXU;AZpCPLR41aJW&$(!(jJI{b3nTbBv`ysx`kEope2a89R6B!WuJFvO^xp~?8J zXLZ75H(z$~^)NUPrj@r94EZzOw}I*dlh3&o7mZk>?Y;ra?ZoVh^Uafm2a@H-Qad4r zBjmoWwh3&2YaeEOv6@lF9H}dx-C|9gfzm)wzeip$l2j z4(`^=%Fv$~NLq;iZb1*_^PE*z7h7@O^ecZ1w}6G>%edU3-ja9T=SLdEBzj)u$v~qJ zZL|dxjGp|a&u#07~4dj648(pd7EVq8X(x&-Y zQ-lQI;fZ`*d#Ck5qhXFqUVrSDeY)>Qi3ol!+3K{qr@NOMbFop{y9?zsgF#~`XWS(y zN~5wj+0AM64w>yzH-)nTgV6}+g2&9-TEr#@hkk`1Z;`)H!I2Tl2prk&R%xU5#(e%wNoK>t)c2dR*B|>E_}&$2u3(JG)!j@9-mr{GVWn1f31ju-rBc2$RBq>Kl1?&c z`;pQY*|zrzkUF4UyVYsT%tFV7RA-@6?)YRKQCv<0w8(KZF2;F_Jly325K3(Lz6*4|r z5*s4H93;US9x3u_AXZ#;)VW>7W-HP}UB8E2)%5r>tz{jexe8Z^I z)uqBls+Qk7iIC>yctxR5n+|on66Ry!0*SSbm!`_wK)DvyC#zc$o`3y7+|V_ z#3VZDQ2}PQcp)sNpPXI3oGli=_KHhT+ojQj`7NKO%f)T$)s`rHB3ytnx4mCPc+%z~ zL7i|G^FOw}I;drn25p8Vc z>a@o0%7=$@krsS)Ctapao9~gC`CALt5?>brG#uIi;j* zLuC+MUF-vAyZ4z-1|~Y4Zqti`#Ot!1I4k(QZtA@f85Zi_%F{bQtoKytw-}m-J6qWI z91D@;3C@K(o6agXS=-HD{~`^i9ScvHwZzkR9#~WyiMx&7z5SGMR_JCQ{}J_t<*C=7 zAF2(Dszb`*tOIn#c62ST$;%1r*zF3=No5=IK0BpFR|IR|Ci(}bC23CGI3Qz#xpU9V zR@jSl*fX_@r)iHV_H-ajNq29~6N=^d*R6HdsdhSEiUc^6J2&gBSIg<7O>U-+B*R9Y zP3ha5&Dyu+rF-SS`R0|jVE0<(9f|SOXmIiVcyf=wbLF)E`)Ght7rb{bL#iCfKKj8a z;0>$&K#H*rv0={Bm#3O==D$^2QyGeL$ytdz44f658dhMqpBjUS!VrC;+PwIv+Y2TI z%9}=Wp<444uTTSai6{@MmHl$Z`aQ^qi85SiOI_RJ&LMG(x`a1*rha{!^U9CX-vdUy z1_f15R}RZTh#0poRFT20jd!_ujL$jtOV(dq4+m|i-uwB-R&(xnMsvhJedV)d6*Qo{ zDP4#JC8WQ2Bhx{kEhy>}O;PszRd6A)HZii#*HxW2In$67>>P?+n^i`^lC^g(PN1&( z-1fxVF0jn{r{**={(x$Ll_aza+Y$Jj~Kh z^WvvKNKllq0(g_A~TZVOjU(#mY8Df64HtI1I5oV#f}zHO;5@*>36;hl&N^;ytC_Sm%VCNlna0I>guZZ z)sX|~ug{DO&m^mMecwjEOo})3bB%sU!*AH3Gp2BJFx4sPHN0o_$)pFk5)s}@v|eTY zO-)T>PqtQ;TL~Eba6cgLk({3VyZdomn?I-O{93~5;!E72Gvh>~{&bbR65DvPT3EV_ z#pjx;6JGi9w4H^;-2HOW&iA_%Q!AnQFRo0^C9PT+SwSt+I4iLMJ@n1|P0}CqZXrec zLATgJ&+R%ls(w?o{cgO4DeKq87N1CkmY(}0drsWNvdvx;`eAD;ZnAD}No*279hp34 z7?=(FBSdRlOJhD&3auBy0Rx6 zT{dp?{l(V1%*ECwghab2JOKp$l|V18U_EAw(qI=lRZ60}mhboM*cE39Z&Ykpa6J@$ z`PG<%-7e((BL6+r&;xaI+ z51{qZ(I?BeBl%;gaqdUlQJ`kM@rBkn$$6;*!;T>-%a`{r55CyGbjg3OvM8dJv{3GS z8E>%nd;lt{S+72=Q?CHiYK)myuSzm~@n_INU~ITe*mA|q(4y_q6<9m%}@;#Kdk zpGTc}hVZO*fKA=8Po24i;B3O@G69YACwO?{6X&FRx z1PnsqmhZTHk(NbS)ta(qunZ?;-!8^J83XC~Hr9)-vb;n7yD#_FvQ?kP;t#8x{M zUyY=)8Fl~t#dKY3f&+`g{<%hKRJw7~yYgEXvoZCZtC*^!`@3QfG3{xG%AJNO7*)xr z25+V0Xnmu<9$ek{eA3^dQp4DPt4O$WNy*`$2>F?|fhlEUWXCT+r)i_(%qiNdDf?{f zE-y(qP1w(+PH`u>Z{+>$n?36*P4;-IG1S(8zei+Ku4b*W&N@G7zM+hCd7%4{YF+*p zr`beaWS*{!%+>d)Mx8mA{3(j5dZuw1wJB?ZdH<;*^M+e4!C67fPamXBR<0$Lr|-YZ zGO=wbSzDI+Pg}K_ja0IIN9bTc-2_Ax&I;TXRovPAevmM!fAe|%Y)0mO?jXZ&^T?zl zqUDUBaA#d@Wv1uOAE-Tkq`K&LbcT|G+*Tf>++;)W6TG(KLA1`ImKNxi9wFtC5x*qG z>%qB<(k^tO2W&oJZBf+ietvbJIdJ%oMkyqH%}#yFL4M@Iv8x!%-NGt!MmwWZs5smc zb012llq3wOt2Uh`71@0_MH$As<-d0}M^9>lgeHfXz?0f^$KPMH-0@1*^ge!7u`$%7 z6MxjC^G7viGRLyl(a&!-X7aCbjAL8N@IV^UIWciK5mdDEusRZD94vk1$YIg2Y{+mwiGk0Ko?qxCCTdmnRZa(Iib*(+= z_~ondI=lzxSZHz`{9eMGT=Wy|b`0(IVv(1C0;7O}GiDvhYaPjZ)yg;S8&nQ@8SD`r z{eW79hxg*pNNP2@(`rvL#FS?>@QSO<7r;79vqvfv8-tsCdf^o_EQ!WP>WRhzL_;fS z4F?Fg6NqTY>Z8mvzn?LT=f!&|pI1JD9eNXd2V+1-aeGB)D=IS1lRA&B_bkwAAMz+3 zpXI!#VM1tJ9%Oy<3Dur#lZ8yuCiUPi1dmE;ayp!Mu6>JsRkbs+LaUaMUx~I!9;T{9 zKlzJP8`HbtPd5GSUYOP)yQw;8Uf^h7;hA~Dv6ab=={L?Rp4N$$qb{DmKh2B@BNmw> zQP;`*(2HBptDWWi1h?Rcc8+6jcF=pJ1mB->_Rz7coHb^{Bwb)3He!DENY;MvEj^Wg z3-f8sQI&~I<@V02>j;a=blV8g(YT%zVZTp46=vsu^xH01x2BFN)uwJc%DwM7>vwB) z>@+rJ*pfejXN{SzUf+O|1EoxoUk3}%F=_X+f!>3UL(kP-U!Q$MPIq1$ud!5uPpj7U zr2KSufbHCVK}`$!pKr{wo%=hge>X8vQ3?h(Eu0)XwFTs?mCSli&&+yr3feX;2p9{# zZ(2x*%W-Zd)9J67^(GPYY+Bg0Idp2{W@&yf+Nk`y_C{r-{zmyv{JVGZ%D)=}Ivz~J zis3cvbP^-}4< z=~C5k>C7I~HQLyj=g1!@4bPjdyD;*ooX$u(MO!6MHSae;_&a10_pEPE{IvbopLy}^ zC2D+dzIgSw$cB9+U{pFUaeyTHmOoHngjLVD+1O4JvQ@Nt9mxH*m2sIqXx?jM%{*~W z1_rU(!;OQbM*JN! zIR~>7i|5d53VS0e{=o%O@~7EUU1m%AS65h+j5qT)l(UN-2P3t1Z!%6jhy0?EmkY58 z)@EJcqjQD;-StMx=-a9~w52=~g7Ro?;O6$ggwJA9TyFxk*W_IpseWYn@Enfo`1c;Wt565%?-U1!2$cI|&k-uQ) zY{@FfFU~scLPP$+f^*lwd{?#!(nnLCZF^Us%DD~;<7Os{S+9%WT;A!6%fIcOoBjS27oTFgmE?YyM5$Bb zdJ4YYAtqidl(nqldgQAC835#tTZ{omUwo!5)v%q>3i2{XW=>UJcuF2%;R#ke-miOMy29Zy<$IwVXBP%l5~}n7I?FSA5L^|PT<%_ zx=HxPne#ngBm?gdNWL<2rVV7jG;F>pLGm>WgV67r+l5B2gT(*HWOeojo7Me&ShZ*w zJMGe-CwMX-p|IO#ub^Fb< zPp9t!-*uipA=#{W-PSwhg8nn*G-KsB1y`JN^jH_I-1%~O;3Dk+ns%Ljdw-B<@!g|k z0~T-M^lO8!X{(v9=?ZD$Gz4jy`S9sZ^d2*YM(suf)l6#AG~>_svBKlnM82Vu`>*+s zKBj*3hA)2)mDAH2EPe4;t;>0=<2Vh4KAWS+kD3p-zF{9rzj%6=`TBbEH>A~kq^+oK z^7dBxM6154eDk#K%nxsCX=FcfYq5m;O5zBa5}fj9Egy8(f*xL2ynP3TRnhJWQkn@_ zsG+MGs!f~4k%HM4;&&<+11d|L-s0Td@Y^ETEY0{K=ka?tnUNozCEtFfSIyaLG?=zn zb^NhtnA+esbv&{9d48YOlYgKi&FlZSs$yI~Qsv>(H+CAYoNLzC_@1)5ye>m)r-u!; zZ-!T<6Dhw&y?LA2A}0uOke`{l4tr8p6zS-+81_|jG)EM2LB(G z1_(6IvFZ3|XJE*At?gtt-Ms7d&iAf*;?jG|ULCZTBcby*QCbG*TLJ>}v=H5R5-;)? z#rjn@ z$#0x^xv|V|&-@Rtycq9Jrpb2tQdqmWa8~(J{6|m~BrY)u)77t24OCQ?4R-#>Nk&ij59pul-r&2h)9JK$pD}-*@>1$d zlGhvkfY&<*ww@hit;Fm2b23!VCy)gQ#f;|>7Ns0)le?%8`N7i=G?KM=R-b!ujlJ`& z`mgEN4}SS)d&ZLcw`tz)Ubx(N4hm+d%d32H2BkAd9H}BKD zt}tDvWe4re<3k%J9VI$P@tJm;akssF=;tFME<|RBKUTu<{|U#!&n>J!9PCPuChQ)z z(nxyO?Tzo6@ER*sXS**PO`{@je}B$M#gnh54Ot}jg6B(kcA6cxb{0r5?^TONxg8$54C!TbjMynMQY+QTstl_s;79CQnP}Sbb zU4L-aqPji>JZkiL(abL1!s7df_UchP5gM%Z#|K3ZcOJK;R7{r&$x{nIGDXP#6FTX? zbhzev`RN`2rPod7O1Egkbc2r6s8Ub~KCAN9Vt&9)yZ>T`^yjW=)s zhDd)9Cn4jI=sc}SHjBZjHeyz8T@L5paP{6Yf%){CN^qSz5h0&(V>69A#uraX5$2fC z(p1;fW~I+cKH2sk3bx5z@`x|YSCpM31-}{+pbR2uifcixdvA=Mt zF;}!rLIgM?SI>}Q9^AzUQYa#h2!JyFQObN;f~nhum+=NSV3J}@&nW4cg=hW;{X2SQ zN`K4+%fWm~B8NH&)3t@G2(1;lLH(*7tfB(duZI9-ipVG(h?*Iu#Tp>-zSV}zgqm6S zwaGt^5z#I3;xh?!uk#iAgaTLnYPBk6C`Q?1D&mL)lMDi=H6C<3%7TzKlnT`wyTl3l+bvLZ<=mEz`8`)TvS?7%j9Gj@k>i3V2TouZy4g0ikqZh`5X? z9&CCnu7$(QqF1jsKCP#}co)hjilW`QSNigWdiURaYWaBK2&hC3^Re!W_$HZ`G0C|| zV_f#Tk)D9Q<7@PQS~>P8HLxJFsEE)Ww_xb0$EDy9eS3ET=rWd+keuG>-`f=cNL%)O znNN#xBPfY%q{_lEDbd6A;-2qWxKIaK`;D0w=`WO73IEVHj@2nw)I0@v&gc(4jL3U# z?;e7%bpJPt;Q7EM32zt4#E*u!D6>!rI?~U>5QZ05!-Vo4Y|vS3U3L}nENSqBb( zFH^!1yLw@|SoR89itmeS3*uFtHEvj^&*-h5CLr8A_RzId&TBsPVPoO{Qcq#{$CDwk z5i*w@jDbH(n~YXRD($^6s-KtGUw7KRobK2YUh3ekZ@lvOm|N@21@Z7&8?8r`K6mut zX`{iSnH8hVYs^r(y8dU^P6=kWcO&P=#Q^A!jeqJu%txj}!Vv_W_2G&4J?HOFGifGw zFAWO|Oyp26uytjHDTt&mVqbdSP4n)pe8?~ za!+6KVyI+ld9`#Q1vaLA?V8DWv9B+AU0E`<-Pk+jiI#U1d*75RW>rXf$>9kn`2O!JXeM;u zmzF3Vwwl6{dJ#!Uq&3-wsZ$CLh-?hBZhaBtT>c{1ru+qcwUJOqd%qz3*@VW<=Ic3% zl!|*%sHDszv;Prr=F?y=IOw8wFY_dNPp`yBn8^@>yyRk6gSpu;J?-Fwt5oIc%7z@H zbd!zClJu)%{UQ2h!~8>2r>!E|H+`R4r@VbJ65#qjZ0p$V1t*c`ZMwy9{x{jO{4dmU zWdSb@GI1l`yX&h@;Rb#4Kobu=YBoiF#za~8iDcnVsWFNFxaF7#vTXa?F0v$qrSHFY zor{SGwx; z7{b(=CFypQ$tai|WriW1%At<1Ew-Z3*|6i?H5Nb*&ErJF0ggZV!9k85c*;`SP zXWiCy(t%wf*V`LR>n7?Z8S_a$!BkOBl5c0&A3tIi{vZ0v%8|ol7mhB1tZDF|O7$`| zteTqc`FroY+ieFjMkSIE^U-Qyh$sw`2EGA&6M)KMdx|p#^q%VY+2%XD}gkB^IPwieR zXE7pOCjuSW38lql?Vq>&n;6da|Hm!F@)y6yzUUG_%`nD*#%UhH6c8_GZ~cD@%Ra?T zqavEQq1N0GX@45%C}q{uI36HR@G)bO;Mcz;h3h#bY^ti|g7>@YspKo+lORz^nMNmS zBCmxbo3lE9FF2cvmA<%=d^Yiamp>t6^J``p0+Z2^E$jRujG8;lL;SBczH+o2{)rpG zbe2w|1~DT4t5GmOvP}}E8&BjcB1eu1iG8bn@*>DDS`isf8zDkh-<=ir#ikTBcNC5j zfuH^F|2SjLj_IRU3HQN;N>h<%efg5gKxE?`=pkocPc(#Es8Nv#XqatLn$jfyYxv(4 z+%qD=jyXWszYlOv)?P`@eiR?mPsEn5;R#o<(B$day`1S`pJqe`{&aV&I_MLn4N=C9 zAeMy>H-BZLBB$?*z%L@9pRsvyn17Fkx9_U5-lLB0vLNT}jA{mA9QI51MmRHem;d?G zGk)}zR%0|5!45PD{t8LDUIRGL-wFIh`@YSZzvK9Q8d-~@1)zN9Z*2c?K5cv$6Vdbt zBxnC0JTf-k)awcDO(cQm5N2GIFt=4@lMesJ6s>HLJt^mdpFVec%}A${jX&BL+ZwX> zlY1d}tbesPmUgaCDb{JW&Zg<@uc*EJhHM785=ozZ)5oGNIcHnraG9H3p__}Yd$Xl+ z5A+E5-YFcPw2nm~Y6b{KTbeXE&9XRG8aED_LvFnSmLq9*bA1+T(|C>c5q^+$xzyY0 z&g;RxI6CVO9cSr$rY(on?PxL!$ARQ0+O)qu0-He)^eESd|XCwH@hsrW*2;rdpzubCuk-5*EN=*(q|I}-oHpiXK;X0mIoadiy}YX8BNYjlp8P} z&U=n)c~8DHnx!!^T~2Ra^#AS=Je0wYe3^2WSh90}cW}QO4wR`88j%{WtE<~Rf`gD8 zY*|VUV8i!iTsY$4U)Ed z_pYVx@~>m{tsS>>wsBuer=F9>sGf?x|? z(`K)#&82w_zQ!?nBII6uGvt;$?8f2a*oc`^;3@x;0phQpkZ zK^KiHy|E@37BbB%`ktG+shEXj#q2zsBYw~I*;15>L(?^le|=?G@?hTfUCL^H;IWz= z?F+}L2J;U8+3T|%AFgapojfPbT+ig8a1H*B39gj;Q&5u5z8TEZ!Ev^(B({G)4!oN} z{K#w`a({bopLY*;R< zqO?7w3S;Z$e+2yyHF&u7^6JBZ+Z^M`(Sa{!o~Sf6k@Ia7P36T`nj?%4wd(gW=tG5~!oP1Io_{EzUHh<|-Du9d=euY5*Q>1-L1!-=7u#E3R=gfPqjdTn zkh_}iw?QX~KKx}Co-i1o!jf7y*%=g&!9T;Db_l*zNhG-7xK9+{ctpF7q=R7S6O99* z|AkQnt|5pn0jk4z;ff>285j3({{@)W`ARIm@!9qyBl&2}b=w^mSnSo&3X6ZT(%u$zqo}34>7P+EB;cIav$a9D67=wy=Q8k;=Pn& zPn)D1L5Pd+8&#rh?IXB`9rZnS{*(0rqHG2k5LaAM11{;%9)amtPRaikDv^{{Ge+tb zDtmr6X!7_BCJVuCbe?N!JYFA~Yn(RE{xD5(aZc6Il5uZ6MwC=#0lA%wZ~ns% z>yx>6>eR>yLS>xzDxY>0QM^v*z{sXqF=+v|Cx>>xT_qGg2FEz|^ev@YFP~t*?-8XNI@WIu9_!^_DGM?(Y^Xw0uZlg+tuwW5! z31y?Zzq@cUR43=&6)AVOOj(GUB*i|ukMZtap3B;$_1TrO@uQC#ck7}I?=Y-yw``1h zz-*^Ko1htdtf24vDq>ToDagsqgj{{G&~7)wPPIvTOwQl-PuBY2bpk-_sz1n&V>dLg zlm%^vQMi1o)-6mTX%<(upmmCXqoyB0;!F#N4KAo<$HKM=HVakEY``yI`9PPgkb(*eLGKB*Db^I%EdH{&ckk_=H^j zR}A=c<0L-7We9i_*C~~(oIfICmNRrRP8htFq+-hdfK;6RVjlFPsmUv`rR!8e>0{@x znu{v@Bztpav4+i4{`#=(GIdRGb4StX)6E7!{O+pgZo(JtUq{F$myQ}oE6 z>V!Z1`J;?meH`MOBQs~(p((E8|268t&BS~b_0sRVY$Jh?LE=_Idsa%~Kw^0k5?PWA zo!<#QdI+P8*N$@bymIy$1kmjmkmPh$VjL?}($QNgYN6bKlh?GRCKe@dBXBh$*?AcZ zh}p;H5NN;J$adLfE>MrXp7$8>GHY|XdG!JiFz4Jn8%b-9D*Vtq?;eZu1HFHCHf_;H z1TKypAo8RTQrnIfU7Q(&8noDRV>H{OixjT|>o=8&IN_z=WyRdxioOnSR_8x$=ehOK zRZZTbiV|VO9x8VsPrFmxQsIm~IoTaU9=n*^zG^4glT(r@hmD*7bA%h zT>A)UcnrGIXy6lfeywI6vFbkzyA5ej~(e?=i?YhH>p(~@r>Cf#aX|H$Bz~S zsV0m%#k5c57bh!Crj_20jgK#!SU>Lkp}79TPZ&33w;35cw-|I`R_aj|8;?DA2Rvj) z)++7)Ijg1h9Pm3DTpy9=S~yDOWTtK_381*O^m*X%!+gs-&gh#YHgt{7CiK*uFAo?1 z*{y|}%Fvv`8w1XFx9FL2H0X-w0n~u(`#GkFWV`wNqo0~HF*pw|IQ2FCRcWu+#XF8lC1Ie_prCd=VRNKg&Xe6g&7)6cP7w;jB3o%JL2E4D zTCHCh^rpB^-16l!E$xZVaUQudU4`tWloH;Bv9KR0e+V7{E#86Cmg1gB%4y`zXRGv{Ow zcvPJE!PgE(QOz`@>{@Z44Rh02_m9&day^wXY`G zq_q%gCir0Je$;n~9@h(D6#OCG5_GNwyFTCBp=Y?d?PbBB0&GlTQ-P_4UB3FjR!o=8 zU1s+w3TvI_G5f*{yUasL_}wogq!d2{Q6+01Yvi10T>W~PEl*QX{%k<|A^~BqPsvR0 z1$Xog+%dw1W~D|bT4Q`@OenBu^ED=_G#so%MMIDzz~e{Eo+d^XWMVzbb;z0H8Wu~a zzqQmrCrVI|_Vmq|7MGEw@;s#B^XL6zUi>WnsLpOB_;b5ld~iA z5V+}cJiyuZCX7kn-fhM6GTzZ(Mq7NHdd@CCXkJ{*U6%L|DtI#e<3|$NScpQjWU_PS z6CuSd4pwKN%w>V&pA#p~jHLoP)jWpU5`9iaMNp;yX%5J1LT_K9;Z%*5DpVDmz)e;t zOelt*yW;E0uJ|_8-cw;MY=;SgK61&~Y_ffO@_0C>fyuQSYnbkKR_k*fZ%`&I( z%kQuLl%xc5I*U1-ZnH!_6r+)Wt-cOQ-3q z6*{S4&=7~;af^0K({zFIu&H&UIeg$AjPw*LprD2!ULIl3ts?&r2ESfEsmJT-PaN2* zxh35oVbX|C1y2hCU<+o-R1)NlnJ{Iw;p-F5=G2cyW zha&+rv$M0$Zj15S-ewaA1XK^MwA#NbvOcC;xIXTdkid!P_yCv)fuPw)tqXvk*!cT( zJ~Xe<2B(=5<(H;%?`Gd1$ouvk0PalJ9D7n=|6Wn&9a36cGBMhYfPf|XdD;a59YF3V z0Ph>-RMtf+WhOeo=K2mXo0AuFX0oj;%tcrmK^bGq!*i+syOkX zYZ7tpaq$AB;U{WBHaNNZB1D9vhkr-S8}7ADZ;+Z^4DzuP4ArXk*z#8{fet|EQ#_2= zC<+Ugq%luusmlusb(WZqOvsb}Wguh}FtfneL)P*>+CEaVioHsTpVTu4NjIZL!58x$ zRq|i4bzDLP-2j9?-dHYCOR(~G(~&XS$*;>#iw-k3M9(aIrQ8k8C9K1nj?F)k$Uo=9j9 zCRX`fkA*N~k`;r9(Riw4l{>9chz7&ybd#3mgVt5oKQh@z6S3_0HNxc;DNwOlN{L(4ckff>1G)Txg}pe zq=5|z-b*B%jp9+)}U<%gGfH-1;p*eZX78n|zie2&j>#&J(p?@ll*K zf)cARMW(AF)_8@oW)D^k6!ne60<1B1|LCJMz;Z_T!jggeN|QRt&SoydM z=k^%s_W3d8o&CqPvUOJWq-xKLx zt8#Tl-MH((4vuP56$(-t02VX(iTlep2=41rtb}}KeXU^qJ}yuyDRXun%^<2CDbz;SR^_w%Y}G4xK2I28q{1rJs6sV9gKw_} z)1@yS#9e;6PPs_yUxLZA$rn{!RQAjd8yL>M{Ftv!&>7zaQ z)o_sg^QA+#`H%;GnvvUZ@g#7LiUMKVF<-ziUKJKMI4K4xHeytzsQ>A&tMe{t+0W%Z zc+~r~Y9wE^#CcuK?OhHvVlw7#_l<4bLpc!1)|1%a2zSvFi&1baTBa$sV zW-Rdp&ILtoKXX~!S&YqxzpsH4ZvUm3WKiU$*1$3&s!`{$S>q-1?jtUi#M?(kr)2$O zLx2Lx-i0YpQ)J#Kg*0XGZ$=6Hz)`wu0^CbB%9vX{+pWeQ=ApLq`Ncp+0qvAcmV*#= zKzvsV=qIR9C9oC*Jb)XzI|tI-y)`KaP2jQ!;Tsu}-inv|cqfkjqFa!8YDIe~9;~8D zwN7P*eZJUyEH%SQ%IDN4x-CW!v^>tm+5Kf&+J^FZ-`yeTQubc&^Pbjk=-XlO?&oq3 z0x2%!MN$9(EN68t)!VE>g^KmsAPz`@fE3sdLr2!c0N7m zYj`Dg4O)4Y?ciQh`Vc{s;Om-JcYBb=mB!%z40Y8?;71s-QWIEm zu0o7YmV5N7n@JY?lHKQJvK=bilM0F#SVO?W&P=YN!=yjj!zL_CqetEy-;YD~S5gJo zIm5O(oor#&Bjf?9(!#|?>EtbID5*8`(uk&US??v^f5NuP2-t5e4c9Kbl@cnr#dzWN zlB141OYaDm-UP8fnCo@%n|eoBvMh_Ii5Ih{o6ePg@w`KOaHt?^G}Sos}iY_tnrFpS5xj0ChaUr zcQ@dJdi$lL2NPyYJlv2OP6?LV;=~3@u7Znbi8!0UM-ROK-b#!yd%l84mv)k#StHX?G$DGrlZ!`v@@ z3b;^(;JP0c2lJ|2-+sA~dqKO$C`)&6Em;H=W8(zC4Rx1AlS+!D3SS*rWtt+1L#Ft& z@!`t2{CDsml=lgF7W(DGeVy;XGHixuGCkj*3l8gCsR(^Jy`)uybo;s;zGsR7kssmN zNG%&jI9uUO&d-Dtyf7>lV$lR#RG}m(0N}a8r^7taMIWOs-8EGWdKL1l+_(I-RK$v= zYemS1VC(UI0^?gTY1l1Ej6XSxTw*(3Xg~SkwaUG#>pV^i`%i+)HBn`fB?XXSjUo~H zX)q9~*qhAj?G)uAgnXhb`lU;R6rV?pIkg|SFm(h5?|`JSG!&*7>pAVD^S zH-%3vfise$ob<|szi7ORcj5!|^G4Zhh(mD0Lhw$r9&j1`T%m#M{h7eKy!0Nll@?iR5md5YaVgWVbXR*6a8A%fyf&)3i}^xYwED#Ww*s2lrA zeS%W#s{o!X$Nh4~VYcvt!`a|RigN3@Ql}kKC@w$2R}Au@4xrI^i^R8zC`#~N5vD)Z zk|94H495?VbHX=Sze4>vZc<~<@rNte2NL$4qiM)vDwh@1bOM_s&!|Y{!OEg{cX}a- zfCuq@c|Z$LBJ5c5j79nhE=j-1ZcaCjp6Z|z16TC7@$aahc!)^V&=IaVSM?k{l0N^7 zVisLO3i3#CLXBXARBCk^U@*LV_ki<` zk2w(Pi9A%n!(!007t44?m_v`irM{f@?qP!(>Qajt*UtHW+`0!wj71Wm0Tzb#igf5W z4dz(&{9D5>VzRbr*Ii-}lyA>R=%)!>)naK%e_Smd6_Owel|Ei|e2ocQg5BY5;)UX0 z0GMwh9`9MkFp}`UM~7H7qsPaI(UVR53HtmzW^w zNDyqc4COysl| zGFWCX#G3gL_Ez13eu*D8o(?W?wurNCw4ds$RsbOKpwuZ&Q z=TDMI?#kGuA_Vujn27M?w`2;(;u0f|Gv#?xVx|?!dX92FA4l{PgX6OzF&`)i6eaO)5+HF+9&TC!`^N>80*ltap#XmN{`< zA%!q88u@aD?^kcSgA%EF<6 z#ez10AR0RFD-|}VB1a3pUc=hOvEC0?XXLF)1fHZulrE15EZU(4i`CE{4~s;B;M1<& z6@u%>VyLcVqTN^Q1RrtQ)XgJRu50X=0gWm-+*o%INJ05RGG37t$}r?gHTJ2JCDmd~ zj+XCSF_M7Xz(N0OGE!rA9Iv>ji}A{eGEL@}Fjsy~xXck4mA8Y#DC-_f9-{+o=P>Gl zuv4nDQ{)=phmsW#GXjznm2Y47pqZ&9S>ms5lkkxpyKvapki0dH#SiI|fJrh$xJ*A4 zx-6gJwQe4#ihMI36tANq?-PUH_7LeE{v5N!2&SPJ_W@Tn3J;P{{j0h5zB&rAmZ(S` z%1NnV7TOi3BT^K|p&~y@L+S%wP7;)jV3hqz@TvXnBV)`Ajrtqk5#kZD7RqRj&+;P= zM;@GFg%>*qm@N&E4_=O-@6hD9NCUY=1E4OaUa%Ut=@Ea5=bQn@5pn`+PGbm(XRr)| zXyceDpq|U2a0CeP6fruZP!{Edc}u&2*>l3mQP7lJ!jN3zT^?(JN9A&ec>3*%Fy?Ju z9g)MK+;PUllP59qP^+Jc!9v{S&x4FOhi|K+bisMlaK+U4SGLEPDT?y|afXHbP~Dtn zjOJcH;JkMlc>v%7f6oyR@oc{F@mZO`G~e4_>6c%>CAniPYY4geGqU^jkQ0b|;c!y@ z>PUCLZ8fk#-0vy-lKgsvb&+6E^4u#=Diuwo-(OUQS+3P_CB;Y7Kmf&QIxLtZEM0dMNwhmJFbXAwn8%D;$$zyUlGy#OizP;J@eD#vStXi+|5N} z*CG6Z^{5NGW{B3qxkN7ttj^5-3Wp@aBaYFEtt)~&(!pZFY|1bW_5jn13GNGnP+< zWzT(Nxz4o}Naxo4lG!FvIrxwDYS;FCcf&V}mQ$qOg}eU_MicoT#*3WB1Aives@odrY5^P?MOs{-ML4rxYU_norok`^HQC|?3 zo9?R;w`}Aw`71y(s@4+iLI(JKjU8(?uKuHqRH^olO8{Bz%wjp&cUgh&d}A;JKPzFJ zi;Ozq;Ve%FqhG>7LNS&Is)EwFdL?%qSx3#q*@Mw?$N9Tu{5`)@8a?KYofw8-jD(Qen_{u z$h3ubU8ay;qA`9Q0~cOAA%S+h8=GMZHP?fjFy&CF`;m}!P-=pU4UDU-f;c9EGHs=O zO+XQ&1jq()u%4?xzqb8?ROhJ2awQVT?Ptt0>aeU!VCv(>R(`Qiwf0;smvPs0k2ZB0 zV?Ds>)kGcT$Mv*6AxW|v0|tIp?t55h;fb>F3x9@odex1qLW+CM#c%o1;HX**OTOIn zw%Y^atLDJ3r1%${0f0&;h5)&dm002sWm*>NwGi9B4QyTjIYPlOdIuX*nH0>?2ALI2 zlhDqnlG#^VM-jBAaO_5^k9A%CO&mWv@GKDszaxo>(BE=jz>wJ~)zPZRa2M5$)BI7F zhxtA#;@xye-ff$r-!s|xw>UE)BLqAO-68#?HS5bsRcP?_o-f#s1W>3!iCB?AVb$QI zV^I~pnGuDoh2DEhQP?5d0PN4#aB{6<6{qdleI+eb@o5;Fv`)j1zRoahTI<~1Mj2|) zyp!tkCPw-8XMGEpyb%$#{oURppV*s{{3(2xSBs@vc1t<=RB&qRu zN7?9}a~miYJ&KVn`7MruLzD<5Hx@fTzBR!}0`17snO5q6QALQ@`5tFQZ<}1uub)2F z8?;0v^DJ}pRD&J;z&y|rGi(jnAG+8Ajwc;7IqqRc))a&;S=j3&0vvwW0@Q|!zRac?z+k9p7UVeOY+bdijSw@DvROl{13b2uD@VT!xlCU{EnwQrrC zb*XY~6>ItvDs5h>GN-nmP$-Py947JO$#KaYUq~SkW#veYZ!C512Ie6H2Xq(Jk30 zb8;+ey5><^hV-k*mpi#ebmK-6{6D(h0xHVzYxf?yTclG7Nu?zQ7+P8oq(M|bkd|&~ z1f)a|28Iw&x;sP|LYV=S?i?D18u~n(Z+++dec$&iU9QDiu3?`0xntkg-q&yIaiEEP zT-ibh)z}ilsRh{w`re^0uu~9Pd~fq~uW4Bn@WXJlpc*>}SguE476&b-jCCv#<( zP)Y682j$+0B1%#Lsps49ZsK!v zH;y_};JlQPHrt zlM3-6P+$LC}mJyc=Id zH#jl_pZ+@2{|p^caUc7`+`%k{pHW~X-Q}axpbOUE1eF7qX4Z1A&>* zjvu^1+Idj$Ildl_jF?XePM^{UVI#*(+&bEJJB5dPxEM5Z^@X)j;zZeZ;%;;v&H%`- za2g2YV&5(bGpK$dg^`|dZfa!i8?X*lncXN2*bvlx z9o8r&AW&F(_@J|PLN?r8o4GVNNs{~nWZQ1${2=Lr=rZFqt@gFb?sVp7zfvzyAXAeM4P6(U?L8mAQUW+D^n;R1B5 zalI1_QBM*jQMd1s?B#fnJywe3%4`C;F#FXCt=@afz|?4U;k|lIO-&DWeBP&SdR;u; zJRab*RN(932{`o{zm!7zbcgpbP(4~8b=BUjFUafe$B70#>O}D~qce`4Hhq-H`hLTC zx3gz&f(8-hT$KpKgUT}K)F%nG$;POhcYB|gm%TJ_q;s)5hkPR6D)O#&>q^6%ki1yP z#vFuXv&I9aPL<1=Km}e}{CW-FI0~8ED)q-d@B_Nv6BAE>NUH?5Ly8>&Ncob;L19lu zgZ1ITfw9%vjKfihz0`6mb7GL_rSmF#SzwRG{E{Q!fx?#2-&W#EzRuHPmSdD-G>+DZxWVSC+^0} zZ!=||2@f5}Jfw;e2E-!K^sQtHj5;*i-_~q`;!HbeRWd=g$?503*?{;ZT?&%!BLpWk z7klGgTM$P5Qd&%_-y1}Lyx$RBnHP+vY+;wz;19wHL8rX3M`EIxSEJBTE=!gZ0_*uX zD<-G?h)}XTf&mC{dJQm;v6ZW|rOC>$`sbED{rXv%~T-V1ADspYee^82hu3kTAqvj)Nj zcX=yP`N#SRoRZFQFDB-2ODrh5AhBx#&uxuo&Z^Q}M0$yhS*=TezKMi8d3$j0{+)zG zkQg-`(Qnq;iE4a->JLFA0{Mv`!;yuv$3_+70^e_D#ANClfC{&492i*hLBWS<*o&Vq z9G%)e2OBDrClc<=@^~!pC#Ra1$BK8@v$%9Z#{z?9S3Dc2i3=8MEmsa z1gd2o(a0_MnC{A^=b%DyaKu7Ah~*LLcuI^&Ea@kaObPiflu(>6yhO@eIb{i(d8YJ` zMf3H~%$w+jpob+Z{oV?p>TH5gAd}xb%AMeJ)3o@)Y#<$U+#JKNx3TsxF5Hta<0D z1z`x1*tb(IVRpD7i{OHktN!^FRd^@U2`MvW;4wVK$a+ei=asF0Ma`m501g!=pFfmB z##a6$9Ewa5w)M1d4@9$M_rj-b4z8_WcAwM{q30?PrXR{#uTA}$7KB1 z$oybk0W!yJN(*;VKlZREej46rjNMJoeNenQ*sI?I-HM{f(FW(&$fHk4oIq2IOLQ#Iz^F4f2I|)iMgOdXYRgI@*^K^@wBp=L?4=cG0}<0&P}VOl%?{v&%}A zEJuodNUHHC&=or2X%t<{&nV2n%(eHx-Lt(NX-ngeMv-C|;fY7)KQH85(JVc2sc=28(n57^zlGA|`L5yvNPW2;{?|N)` zvqEsv+y*nlI`z^fTY=aw4~HRx!jLU^u=KY~5YY?a`VVw;Chx%{xH;I!Igc_+#H7*s zWQNh{Mv0e}t|E#@h7Qu!?9eq55exc+_gI8jsN<|Ez90X$grHM-k`-3Zh6lyaI@E3A zpyTXfPyMu~+(BsAPUgxV@EWdo=Q;Dwx)BzR#CEXz83)eY)OlX%PhaH2Z&J>IQk7Qy z^5<*DFoQGwaxAQyu4o^|P^lq2r>nTdjGvz|0@ zj}PkJn2&eprrE{jG?dwOTRxsk)JR~9E4v6-X!K#!kl#RW99T)l&!3(Nlixa4?E8jP7Yso?fQ7R$jk|~>3G#9E$+lR!oFBcs_hgzd#x|ah8ww3P8n1B z+2O)o)l(7SDU4nS)Se?W{eIJh4AnIwhU%wu5w+5~mv7YMFY?7LT=S76faQ zUb6z)U&TQ2G+v3f?BdeW=*GL?vAHPV!ClxJRbYl}oC~37wa*IK$zh%*>!-AJ9m1=N z1HsBTt;wXAm%M~j2J%gZiRSm1nZ!PpVzJkLZ(imXW91?Yw50TF$;(why>gBW$h0(P zizkZjjcDG*oC^z7`(Y!S<<|MnA0swpMU6qy({I3!M&E$Xzt;tA^7tR*gJ3stYxvknpCi8>n zOY;{&R$5cyIp@Lh&yR^e8o$cee_>zhEb2%bxRu?3FWfc&ISUdq7i z6pRh`x*O8VA?D(q{2tldMrV?32~fR($$VHkX5djeMpILIZYv73nKvj~rI9zyp}+~h zre&!8Zh=Gi%84ImE(29n)^E`7KmaKzpzQq;G48Parip2UMrvJ&YV4^f zMwdUrcC4h*jo<;s6h5G zeFKt=HV#qpjuCvDe?Pqn1>A5@_2Rfl?sn)3d+muwT{JH=~1 z+!S$I%JF&OTBf$#O*h}h625+lF=_=TW^A_Z^0&UQQxiWu1sWafd(m;jM84-_9BDb- zGi@u2c^4c!@Pp+#9Vik&MH!VZx+4ovY<#{QB@p zmFM9AY2Vx5q*pnHmOjO~p*MW1hQab@02y;B}LG-T2)^uuIv#V zY|YEwwk^botp9#Cu*oW-^b}FuVMs^YBqSkZ)Sc@*!0t(!8r@V91)^bq;+OuBM?H(% zynsv|oK$9e*TL&&c1l@4j{L;oUZlExW!rzXWL=6cyoU2rn{wEF1W%rY(DDV>St2}3 zzOdwct>7-?0?%iB<+ZoDiTyf2AzXWp)s!8S%@3lDKKcAAYF>1dyv?zh#p~jwV?gl# z!(OQZaS5IuSSPLh^W^k~9Fp(Sw-pGBja*YiDTN^kaABvvX+nmoy7!=Oqh=qE^38&0 z`DUdj8BZv~+iCts%ONGvJIZq?yJrZk^ophCBGW-8@KxPl%8*&d%q+le{$uqoOYqOD zFyzJEiAA}!5|W?<7Qb~TER>ea%Gici-|rN`btqfu=`>)D9R6?SNCHUB1qo#DZnzha zsJaJwWo}Ojq1da^o82SXu54MGf_Z~-Yqmd5znVJ26&FmFQ0Mi37*V?4p{_eetJ*`Ed7yOzZVIfpwRr`Lh00DRo<`q+kFwZxLz z4Y9LD&rh=DO)Dgo?u$MDZ*EvGP8dU=!0LjTV4*DKH)FuK8UG$IfrcQJ_RQ_mcAr}l z%u5^Z6NL;>hYZ!aOKLTsXSvPBSYpHR3CaGu`&aLN>f}K~o8#(ePD5&}BtLZ~X|A%; z)z5-rP4Mc%G+u7QZy*yw8!%LlmK>@@17ym{-O@Oiq)@g4sa3epVb0v?M29cdSq`3@Xft1-|i7Y{5M!&=P!%c#p1_B zA8&A?wm0vSX?!5lF7esI#wun%TJtr!{`xo;c#i6E-3Ae$Y0ab~kJhHynW;KQJD|$9UhW)~FX1>=+Oc$Zk?}u&p(4&rBff0-C(U3}O20NH z3dY3nHEo@dQh+D0>SAfV>YVBF%H{KSAX7@BKr@ur9I(b|1+yr}sQ!4<4Mq zz5yJhN9B5_JD6%o!AcRyUkxL(>!ur9>x2q+L<)8jp~kv3I2D+l&G|d*M->CVD>|;H zbmWc=WiSix%N)nc>j7I@$L7eQ^uLcKqm4rjaS7}m7z@@)Nj~Zys!s2H-6P6<=nP|cH@kvUwTY#Rde2ZTG)lbf@c_i`6g@@zy`h~R76 zoAdDwC!iL+_a!T5WPk7n*ii?K_6qa$Wl+%Jx?7p=;o78d$K?ya`sX?>fJ)pFuxy?9 zs+IAgi{Uh- zPYa)T^>d|9-1;%U8&_P<9%TKxj-laccGQ8&PQH!m_;-)A(7%09-`Rmb{u6<6H1=fY;4I-C}*`ew;Xd&D*_A>ItP zcIL}OS#-1o;H)?q;IFvUS(m@Y!0GR|XS?*dJBv|l_0!HRzq1MY z0Q=XVP~!r&%<>1(?H?qcCwuer@zY1S zgT5hea=-vIjA7mvaBsC}sLi%`H=NG-BS41NAcI|kkg;#i2KkIi?K3hmymp(`rvP`6 z<6i5bj znndcHZBNQgMKM1W8W5wRy`&=Q9dJag5i8hDhXRdSDk#G(!GFmq!^fHyqq4DK%0gED zJK~PW+|a^;0x6`{HIwM;4=jEtm{%tj!31CpweeUVdKY!;WcdVz?w;U8t!H^804A@# zZ-ymHpvvb}FO1p)d|QC0vPd1hp?Vttn8r$VvZamcolL%))O`J0tlvG5#&37LHQqpH z>C>fRht-oIYBvQ8w;fOt|L%0rd&Cq5!Q;1VZN!1Qw4e1VF2mV^oo;zOah z_Id%121x%Myy$Ef^S<0HR|s>4trv>=8ym^ZUi&h=#AvhHs#NE6Zzsdp z?q(T5xQ&&fohjy~=RI!WeI-N&O#5ma@#cn>cU!Ly*Ad=uN)uqRq@@X2Okr8oy#8(O znQYHHtlvrAH`w1_HJq=uZkc}SjqUega{Et73K^^H1lAJZ^>Hc6a*y?I;Mw4OqFI~l z4{EtJ0=1B13*dY*Uj|&Gp0g-Y9C|VPj~2eGX`iyQcNA)04So_5M97_HQ4Ql6#jK5e zH%4?lm_44!Q5V|4e}QGoSz{G&&?66JTa5g76!08?IJK>mm9WgesMpV{3Q|Z*w0f1R zrNfuvqu=%^Vh|MwV}($(dcpE?4|hVouRSl}w*z{iy$0G;7END=A(ON5V6%6K0*`ap zXo$Dlj>pW%*#RG~)%Xtdl7Mim++vzsX8R#QEGuNA9`GR7#mQp7#~~oEeYZ8%WP*yj zD_G4c=l8ts&0nXAwv*~-@x@Lk8-$!eg+J=BD~2AGx3PJE}JH!-D_UX!nO8*VM4 z?N=ve1Ya)!SFh>TbVJ4eb{(nspYF0eQT&Hv(J7RV#R*HFm+g8o-ey5LH5pF?Fohzp z^fkT#5)mgXW*37~Zed+m4&?`B3xcv=akUUbTC^Ijq)8ycXL}LIwclS_gj` z!+o?lOFa)o=V;WGRX@-#<`uN6L!;M>tpZnb|0eEyu)>itZ*nih(Y;1JA-FGpwn9UY zbXywe&q71Fc>^4k1d>B{koWl**@*Wi?Q)u&eK;FFgmO*wAAi-&+2vLr)}C*4v!&~5 z1AN|I4EZEPx0kE``^S~iZ*QU@G&X z^gCNkZ{g)i(#uQqgzwcLz|N(&Hqfo!6zqZkBT-*fxpk~^&umeSje-=N>ih)hfp5kY z&RkDYUH7no3#%T<9UR!qxSI2$St1(lMi^eJQmVbc>>dx)Cy$0(Y&cL?60Af+Z%TRn zpW9g&z85XouZ)HPp^gJCev6B{+EUG8x4;DLS1*#|!k^&gJ9xrL6lNQiH7)SMhX&sx zg~E_Sz(al2;5N}#L>aX3hGRQ>>aUNp>~W-4<^A$WyrE(M;7IpVcRjB^?{`aSac2Co zp0o;5pOiR_>qG$16IQ5sIMK$xG3C!r43^rT@B9G#nH%t51mcI@GwgO5|(m z5zX&cQrOtx^$w%GSPyIsx~=}5Rpoi1gb=vthN&b8gn@z)aH_I|f6|FW^5elQ){B{f zKIP>Cye9vC!|96Ap$NU#VK~;xv<&c!OM-BbdJi+o<~DU+%1q|Pm*zaS5Z^NDiZ|Gv za)u&zJ%0v6Amt-qd@GF1Xn5rkMQ> zjs775O%?Lv)*aSn`yU1uh^d?0YT1u^%h>+}H;Z~}6$4?P8-NZ;Z*^}^YkdK2Uc3!S z0L_y0T@MN5FALDf+sfsO+GhaN1$tWJ46R8$BPE^{Io3+~y=arkuH_1ThkfOF7z zgqr)>b_rc=weC~ta}z%zLiOEC^c+@a7rTz-ZtlTS4M`~9S&7jI5K5`~qQLu*a9>0y zb=SMshx*{9zypPWMnwJFY3YT6FWI|3;MIQIdnb>AQtbIG(5){@0Ir6!zyk*zD2r}w zO8WYt3>-*Cx&?Qp80$R3PwUrE*dUXfS?~l+RI~Yf{Q}j{Z{Rm*5NafsMZd)^^WflC1_NTNke+0)j=}1QVfqy?jay|BJzI}P zGA1hB|ddjNvfO)o*IW- zoZQ>{CR&zDLq!rXLFlL6*O*?JdB59bHftwzCAoSf9xC^`>oCs`OtuO4tiEqbL`dzn z`d4!%k?_HIjCYxbFkr8-i7kFGzLXil4yRTDVqxRA-H~KXsy}7ae7nFFs8+rCB1z|0 zo?SE>D*>IEgu2el zt-yg*8a6_!d#Cn!QARzYXY}nJ$=509x=vN#Q1;8e6_`0FYsVq`AO0kJu9^{F#Y_1E z_-DOcg3h(m>hoYuvPIT^i3&j z_Wpa-nAOLj3MYRG;C7yPx3Z_Y!Q2Q}na~k`S*#k(U%VIzN`LeElFMT!WT>X>hq!3j zCd;V6;jq;X3T#k1`!Qy0wQ$er$4?NfC0{YZ?q3$=1QppYXoD6_3O*sE!Yc_0=(jQB zVjG3W4!|UMF1j3wKY~?qNUGJE9%{Y$kOdO1E7rPmhO%^{G^Fb-gI81m;?0*5l zWKwY!bN|ao1NGoC?f${qTGZyOo>ko3J(kZY!ap7A-->Djn~k=XId)}M*^a-hps(WL zS`Cr+zM7s?S_#_r-5I2p>Q7)ow~=9_KM>85?L3fm|3Ay_mhjj~?$D_MX*sQ_7B8=b zgdzWk43lil4sOy=nl_pn^FL+P@PylSh>chG{;L0_FDe-LlT?#U;`d0@<(rN7xOrDR zlSJ=3jPHvnpvYGhqQ?w6R*oW8CLmG9g8?Won%iOh`rn2XF1{~AsNI^^A6g6&t0NU%p=w?Q_)g;Pz$5F4 zd19Of|9=vg2~N>-048}~5tU0xG<#r9sP>;*DlXafYers5$e=1EV_Tkvt0!NT#_bQ0w7))8wVW1MoT9@mW+8K?>K&)JScMTx&(ygmW&4xaI*ghbb*Y5 z8`&M%NBzOg2DAGCj~*Os42cCcix&2v&c3we(h@I#u#9ZHK&|R4$piXsvi@Z}0q)rv!W3{|J@;W-dGQr zYin(ejXyD_31T7VqosAC`L;n5XSrZ%pu4nOrGBcSJhK79)-_lekFfSJJ<%GqC@i78qQ7$9Q zN5`GcwX0IU^%$e|-a@aJ4QFA<^feVqX$g5kve|=RDY_p-{~m5F8TiEEdH`#$W9G@) zQS|^_kZqmIb8EG4{O#MXMsZ=wYi85wYo<&?+syiJd5#@zvsTU3(9I)!n3fhJQMhW& za-uusd7S0&(R<5bv2_X_?yP@#pp;^j{b&rN>StN~d8g3~BWK>+`{D znw_Jr`AOvd4raDD`Uijl`~NVu+s%v^KtrwB;ub1!Y8X?%g$V3huIC%116A}<#opxuMcFzG;b4RfETRzcUdB-t@Dd)5g)W>i81K_+}*5Knh zZ-<`UpFgj*tZu5$4%b`U8_WFcfC@+5S?SG$;I09~j)9Y5k_`&EtGC|+e|vs+KQ`na z*9ZBn(HULVQoQXjn6J5-ZnNdm4H|uVyFxhK(1saynCcpcnlzVCIPzDPS&y2@#!H#zU3kj zp!m6J1+UJhJ}@xP1oSl(9NFZXkhxpp69D{h^9RD<>jATyaf`TEpI@IJd0ick%WMG3 zQyXw45b6j9ln*LHDBXNiAIn6kQKG66Ak3!t}}gPoFQ4a~*qw5^#L% z6AALn1bKcF-;?jjJkEZ(a}n&K)J~d&yrI2Egs7^+kM_Z0Nw*4W!YaVK0z}jP@>cYd zt*N>#D@O4G_l>c#FW=dSoa)RD8%zAyv_Fc;$2Vu4*Yl;9Yqpy&AYt2pN-#Fp+iLN`t$S}@HAl>8U z#gZ7_aWdsNlwbvjrr7z-3TJYsGq&mG?lCrM!E1@Cv{VwD-&zLP(r$ncabS`5th^PJ zBa0F}_ntTuz?5D>!`aY z&UC#nBtMC@?m$}1nF~S%6)98cfsR6GtQt~{y4Ov<+jx}rESQYFK$1E>a{b@qyd&9@ z+4^u;XXDf&1ZlzPuf%yxPNtP5HT*aXUYZ0EbV)b)mCEsqKb#ykIH&p-otw{qPSJZVV3SRx@_)?->Cg*Gbqv#I=9p_W|!`g00Wt} zvZ1Sc2)VaYVz9{E|CcNjU)!L~9aWeI%UqV$py~ zdXUb8Cugljs&aNuUuhvGa-e0ey=735my9QXZPnZO5(na-jGc!Ixi-FD`(@=Y%XWdR zZV7T$v%HRD8Sza9i811sYV9{!wMhOYyNOJ@6YxoTQCwyr+*q)1wbFO&MW2%+*#4_H z)5Gq}k1}4w`|H+v1$NYQS#A3z=@F9;m#{eWJgt;sEut5GSt@K=+vkd+ z4|DN-L0Jo>_fV1K-jZ@lSY$j{mb$ApRK=_|PHw?%o)UNb1AZ0XiR zJG3z>4(W*_U(&}qiZHnMBD0h(PtI@x^}!$DU%8-|3Hrr-!068?CjENMm39pL zs#)Q|wqvVJP&Ar6=RhL>{O>j(gix07K9 ztuiVzZ9>u4_Z~NKYqG5_eg-t-3-2Vo?POKr(*a!sxa^V~dG}@9f#-o1>Z4sW1&ty> z0fjw2WFyi}ris**!V}-H!DW8#j0&1!hecdv`)P)NEu8h>!GZh`&(485^=hoxnJ4WX ztYve~vQAbqf!*%o$MPNM*m7TTbbRdvT6YrSg6R$m$%v+d>jgDPwv%TAIf<#`pncMr z6n_tSXar2+4{g7aQ02R!LUXS1$5{wbH}Dzakz4RDxyonvJ8T}gWiQ_wlHL*^$V#Oe z={`G3r6gjJ@ha8iS9%-L8P;2qY>5s~^MqWxYgfqB2WEGJp-~q-JMXVdA(8M&^`0?UR{7Z zTk5?xw>#DU&c2#r0V>PWMvN(Jq*#(XQorV*m|ZYYuR#PuBkaDGzTHX`(O$s0`6XHz zPiAoUkVG|C7oFE87$e8{SL&UsH}n9=K|i@a@{M+SB2f}6``T6F?+>jI%P zDu@)U;z36k8d;E}7!H7vIJGf?~xt#fNo*6e-Wo z%5h*Xafjl^q}(x%xws7Xof6DV$94iOAaah3dJdoeavni4xd!-0~_5H9>1d@rlJpmA9czRj{uBe z7)GQo*%s=vL}aYPn~#bZ_;_J(9dNebjV7EvqVAtgRxP>o1eJl3bI9( zw!kApfqjy@i(4FQPM}Nr#1BGMj}ov(Fo$P90^4TuarS8X_ax^7MmN&V=^LMEe;35z@j7Em%H5r$k-0wCI5 z9%UPVc36+Kiu?+AHCpnW9HV0coH3^*j13GCMl#7 z=12u|n5cxs$y(>$c`*{doY(0dY#r&J62$yqqhLXw(sh6Ckvns9ei)7puXO>xJWu5E z&(M$HEGj*1uJx9O4S4xd*8s1y>FDY6rn^9mZJ!kd4{9fzM#nV)H)=1N{G5XgWqEjh zK&1&Kn$`1hBga#D)5Pj`Kc|ZSNTKI8Zf|}RHbLeZk>3mBn84rYd7Nj3#-Us=cUq_& z)$vH<30{#KS_NRY-U}f^CB??Re_f<03I(wa) zP1fh54rj*-j@RmO2-$%dn(d4*`Xd1uqnPV35t_P9ue=ItK$jVEHDSZ(iJ?1!NUKxO ziavb8h28qXz_TUE?lNJ)AI-11A}$f9yWm^0-A6J2gl?87PgQWTgi}JFpmf1vhAcEg zMCOV> zD|85D%atOl0P5>DH$ZZcGzh9R2{|jyPjLScSSi0roR^&Xc!0KffpsSC@+b5%T>NOD zX@cujbgSwfrW7Dbw_JQoOr`VufEW;#*1a~6@bS9jZ2m##CUA@Z;N3ezMRO3KJpLkt z{<@Dqeva-Ybf`)tfMEU3O3LFXk--|@=$~^)s$ZusK+VN~EO_X2 zD#eg%OLDsfxC}dMT!jU5x1~z%zE7ys97((`p(sx8Hy*gBR9s1c zj$JRhUZ%eUttQNWH!9n_q!|~Eru895Cm*@%qUnRX+a4%kutyMb#RgRrBWfAlUL`L3 z3@dbAgJ%=;*Q{m&_I(7eVrz#NI*am{hE^F8WOk*D_YO<{$W7n|CC~5gpwdJlvUi>= zmsMrs4N6W4UIkZWT7YYoirQWL9nr(>JRQy#-!IzkgZyTE`2XIeimq40g=rJ~uHnX6 zH_Z>KDb=567~7B7_%!PO?UlS_Pc;;3&vSG=gdbFY$O*e6z$}nPL`xE>rb)5NBg0q^ ztV9xqi1$CDABoMA?ecSE(WimO6^jYo=%s9#Da$Cb2-2h?2D}SxW$zeeVMSmm{gish zZHk#8_=j!4k@nUru7?cTlG zPW&N8f)AoYF1(7&*u|Z^#i&H}yR?!+2@rM3h&@#fwg-Qt@Q$>N6M_RtL7_peukZM9 zdUVo|<3%aAzx{pz?AUEm9!IN(iB}-Jkb!soy4E;-Y6OOPQr_E1MuMm8!cunwlep2L zM+dToudknJFh^aT**|pPY4fal!8V8QYvc)GtmI;TKub+4E}g%$?CTa@fYZ`>-KM?p z$8|F(SR}+P5KUS{Ouw*lUpDo#{buq|eera$+0v)b*E3uRguP%7DbBUEe?nUl8!4+1gg zBq~2X2$W^oLWTBXy^4yYhp(QRZx{W-acS2~UGI6_=bqvf?`lcQgFP3MrWg z6@W&pBPzbn$WeaSgwKT(Z6T=x?1kLl+#$#(jkWhoeJtekMHdPJPB`GQs1kXwoT3 zwa>BF7!>plbWtoEYLiPdzY-{VdZN^;E)1rCN!9>;D#*o}guFC@suOLDz#W9(MSq*5 z%ihTm_RcjT=A;I<3+&AjJ0BrNXN<+Bo2Mr9#f6yG@L^82SYz1&@&@5@nEtks>HM-( zLt}5+ax-XNZFcXX=Uu2O8iB%t5Z|%l4&aa%81%J? zd_|;C<9Gcg1ECJhvWFjE&fy0%A6gEF|9BL{j$7HKcvmbGXCW86o4%y+(dOGWod~Vo zj}EV%me`7cV%Vl5II!Ltav#W>s!0iEQR$?{PRaNMGvjOdJx!j}P8iu!2G|F%E zG-2e4*(0KPxgs(=^{addxz58z52<*EaBz`S;H zKNm4Vk(innM~37D?_=W*i5YF-fo|Iccv0^~C&&0zLbURpn}4zE-WXjf&|9hnNfUF7 zFJ=VVeC1RalSN8+^2WbLnJVQf?c$^fj_^6oL zk@FK8lO^eHXLWg<_r!OzQ*zF(u&B&a2H31Qejkj9*7wzbWDKcMz1^(C-nj&Uw!!_U zAau!ogCuvVM@kNk1v+4Y!T}T#-G{?H0ov&N#3cS^#hQ%rutJj0euhc9$AOxw@K>$} zAE&2s1Ss|C-6efrPgRvraFsBh($Jwk1ET|&Q2~5t28g5C3Hx}2USV=idx&dowxs9KNK{)`wz- zym1qfV2(L)s1>6+(|Rt`O_ZRG%Qla2BmNeOayHj&J59{?{WZlj*4KUi6@mq&ZnkV| z$q7<0)|b_DJeAyH3Xl@?_cYn~a`Q^Y>D$Z5_wCCOb zaB$G295~E?pqbZgR%ffnI?_KmNJoWl<kB_*e#r zzoYUCVe=~NXad?W?|96c79P&kw$Yvmxc%^%zQG(Aji@N#LErWgDR99*)I5cMXuwIJ z3YXZH9Cx?OvYizERlPkYDp)fvHt6I0P29&Xwov|{rY>+-X6vSZC@%bIW1njlE&~>F zRkAYsLvG~~rns`WF=k*<@9?|NLsnv*-uI%5thJSW=JR3sNPYSgGbZ}G3##9tKVn1) zEK@@1qB*n@ITk})>D&Kqk`Vxa@=%IBP&DgDAwE{V0Aen|0Ad`3&a2o^cnh5d$vOy! z)jgD*Jxu5hF*9D;50az(U!6EZ^zVzXe^UsRsB1_H$}PMz+q01v$6pIVtuDR z>0kF4^J$+%=-wGs;zcNnL8DcIT#3|E5DIu(QY2`u4*4t*FXJZnR|L8!_BmQ@v6#bt zQTEVQxKSk)G%hxz7f<4++|vG%)o`sGp-OrXCPepM{fA|>26FOv@S!$}0ywVCZu4be`QLlMDqP{=ty25s``KM$# zp=cQ1_8boO=?!b{!lHMY>A)uFFrW;7L1L&d1CYnI@(F^4`HVpzIcu3tvih)VUYFGA z70>-v!_UetOGwqAT&DTPuUY7*9DunfR)4J4qXX^@q#5Q!Gh6R3zq~4S@&u|PCS<@7 z?i)-qVne=`34-?S)DHJ3mMU%_E~waQ+?Q@(ByQgU9PAmcv%GAs!P6e9niy>5*yeYf zmD8mPK<^`<{S9HggTw0hp7wvvAH}9B$}{&QX0J(YXF0-cK8uY^bnWgJ1+}vJ4!#Re zVhCAiDvpyaJ=~rXrp1LZD=~DX(@d^V%mRCs*(I$uDjOXctnAWhvolp^Vf(37k&UqV zCwvr%*b`=eXbAg#=;qqUW2WXPEZtYL05-AmRx<1EBSY7A1Wf>bduRZB{;7@zO>>MI zQ56LeW9jaUad*YsNUSqt=_n^A(y9l>aj%o)TXDu>{r;i9sjv*>C^Owc_{t zfnutCGUzOO!Pby6z4d)3OuCO!q8&%a(y^OJcrxNo2{`A5&3_%sQstoTV8%ZMIif@% zegx#6o@KJLC>u5(akic2amL1y^@MQ}^LcG(7m{#zR-Vq?%%9D9pXfY)0ZIC(Hxvjx zocZ#ltwq!hF?4w%Ct7oIBOo*FG+i#T#^B-{T&;C--jd0F^oLG<(BgFGV}Ql@6M#>D zKaVST|s+_BXJf={F%6!8A5$jx;t|a*!M!?QUYa`zh-u zG|8#v=*8$=$cD8<*!H$>RaIzSbywV@lH+qH(=cxvQhF~vQhEvVlc97v(!cm~h3N7y z@AX!i>H$U>FA1U6Wjme>dI(WkD~Vn1fsfast#>yZw5Fm-xU_dBi4zyPYy>e8`m$C% zz|O=j(YP%&vG@pcCS%#@L^{z|9a>|XjJhXrbjc#j*b?kzc*zoss6JSFeeVbU?;+V0 zm7n;(+Qyi+bo#1s3d^1*VO~^`-9NP<7@Ur=G&D;#2%MoKbHOKk-nxJa4vWUS`-4{a zX&3_&mlxwU{X|Li;&L|6sHtqap~0-44mM!#?s@ z7JeCxxmIM9mI`+|t&P(a9bw_-z=S(n+&BEeMI#j-^Yi#ub+JxMlg;5ze{je!Lmj=Z z&gAP2!gX3^hI=5q)4WitQy&Eq*zP+Bf&jMrMRY7e@_%vl)p1dEUE4DZF-UipG!jzM zFbpUu455NbNUL-XJ-`5>gfu8M(g>1*G?F3;BOu+~-T58g=X>wx_Whmn_c=RO?0v1Z zuJvexoDe0S**$3|7G0Z;XUjAYX#l4PN|K7jwdh2LBC5wDC2M5w2D&^cvY!x{PrN}p zZkS;ipa!j?ii&$r?y3mo-Wa*_=4x&?E*RI;%U*4iPSkV7vOc5u3E`q-_xfn7@OsOg z#Ldf7_Jrls;m~w)TaJXyC_LEN>*dJJ_bho|M`pg*RO>}bouTh#?)d09Qi_bfFjbLf z^DDpPX0LS$L*B1U=Pn-K7DDeiJ#jMaX}J0#;%kb$q+m6+J!=8lz_bXFiwYzCjhe@h zv)&lpjSc7Od{6qA63+RqMoRp1D)`E20%8xc-hIiPh-c;P9p%Qf6;s|upFQ{ePJ{#f zIII&o|Jy%mbX`~mYJJ{u1n^b49FsH{=Q|+N<_d=wh_eqtZ&kow~sVnh~ z6$+4DLxQop(f3{@_WN5vo`$9z_n^Nkat?{1P({Yk(?{6ajBSp-+P`T7`F1bLyyZ=p zh$j+FP{>%^;^%S(o3`9Jy(J#Qt)6WxN_Bde01EM;pM`mwq0JPZfTTHZf z?x0_IhE#-4Xy`0IX-^NhIY^1K8QJnCNY^)`Kw!s@Qp^sQXegG2 zi^)f>DQ0}%ucB?Pwx;DJ_g$AALh1MZJ*_$G+&-qN-)) z`QK&5(%b89dm>4_lee1~EYe0bG$LOnB`%{DE9ONA^O<>nSn^8Ui@qU|Nag8cKe#~& z+i*Tn;CR<;y{wipORqAXTHbUZx&HO6OeF{2NnaJfl~qy9+ypb9H&KlF+WTJWvEdX_ z<*UD_;%KVD=4W=T={+y`@C|o{%!B4hr9QR?Pyxl_H|geTEd|%#mG(hrOK2W=S&q%%otsrL=c4g5(vhkiyd6yHQUe`}$OB z9R_l{g_yYV+az0W^$Z}=h~XXztJr0Dn3emyEC>iL<1nI4I*>x*CsPk(CG z{W9*7^;wKaHAh4u!nDnvh|v7bdE3bRbc1q*%d@Uu6*1*f6!ORN%?B(>`|r5<3>w{4 z_(~Nrm^y2p5azy8b}U^eS>TCS8jhYuj0AJ+0SXN@|p%Niu-17zvX?*^1*?Fv-EJW z_e4^U?H+UbsXg*GKYOH{;W$+7+xP-tix0aJc33Uq8E zee+r&ub{#j%{!33S0+xuu{cn6ZrDa_s^28H z@)6Iv@bjIt9sJDQRa4o%=+z}Oi78z}9(@lrCG^?Fj|vyF15V4(?-ZpTNpE(OPVn3P ze~M2L5;V|mes1%`+Ps=zfCxO>xL8%Hma_lIkX%gVbh44+*C|_SywwE<_q43Pb_h`* z?UPX!*+o9`Iz^vQ*auiyvU~_5Alfm1`Fm78khklT8tNLz3*ytm%PYfT6 z*~Y2QLO+Bu!3izpr949!*Xf2Lx<0Ri#|fh%346d7B&B4&S1EY&QFuL_VqC}SHr03K zd7Sn}@+w%1rPe#wQIReC_pe25Ms3O!=5|*CJDJDjjw&6m_a4`%oW|kYt>$P57~R@q zwDeV1Dras0&z7H9)Q-~LPAabZai`O@r=vJNL-XP}soTQAalhrBTwJLTsA^Ypgb1aB zDgYxIq`3UfN;o*&KjRwu%@BhQ5)z*H;edRIK|Y4x1z#oWyOC)XrV`}*YMtC0>8yI6 zl8^@R{#6dX|6<8lzq!0}YU3JNetU%hB;Vbj4$!GjoG6*PH@q6*+qdAL-fLaB+xO;o ziB%b-DvBNwdTs@Abv@*|?IX7=b&jy>UbT{YqswSlHj>4*{@{?^=b+=tVFL=eIB zec-RZS}CVTPs*~(i*Cns;HR^&%YpCQK2TV<9ll>#i5dN7%vM36BW$f6IG~10dKR?Y zSJWjRNJ~2c61#(xA0HuK8-?yI1vgoRci^Y6G=w(h&xgt7zAxV7J+p6n36PetvaF4lD z8}E`A9Xi2><)Yt76KB3UY#pJ6ibQE!1=ymu)LV(Uz(8PO#!<@ts=Tv#3K(&}f$*<&L+>?!DKVv`+3{ z*oH!f*)DtQxbi!9WM{nrt9XQM9O4W@gWCLSIfkMMxd(R{&Ap-Z2P{3yteq_wX?r$f z9vgn-CkEXu!uJv5Y^HA}crCw~${j!~Q=K!Av94#Y1D1BZE8Fg*2F#GuHQs^#YG9pQ z4nAM-YTyx~F9(XZGh!C9UNtQk1yqL@ON}eZ;ipRxZrMX)`sl6YTKXdS&(g|!jcigG zk|zjCKjw_NUxh6PJK$b+HhW)rPffHnj^LMX6xW-W_Ly>Rs2~IQn?`;x_5g-hr;OP1 zzHw)&$$IMM$8%Zp`Yzcq8n%tvc~7+Sx>{0bncet{q4?$WvghM3>#N23==y3{wqm7O zk(&e4^1MgP`wiv7o+ZxJYLQ-!ZCCGy<$BaJE1l*fbwHjUYwSaijiUGB>xMQD+ea*j zD@8ar_8JDrs#%9JBmK|f$FZ3gEaPKuHuFUW$?^xUNzghzPxfl?QFr`EtMxxHHbO`I zC^Eqqk}Nb2egFO;7_+#oL;_Oaw%$_Uu%=}V!SONF{P`xCvXV?If`Lsd1h0Pa*Wsf~ z%6F7HmTF%+(IlCPHJeltP&s1Psb3TzY$HOQmlwhuZIi#u9Bo;OweW9Niau-Wj#j7@ zHRPXNCfW=kp}O1@=I!aZ7ww_hz=+dqTT4iA0J&7jEN`->pU@4$u*EZyJ?~LP<~ac! z-ngZir&?Qu{~Vd|Jg7D44YBsRWhqG2SMU2! zDW-e6%wD2ZbHhfv6YHD9YSCn7KIdlnrbF=Y{pqpAGRonQ>G9omPr>qW;0E8v zz5Z=Ibg^ofXuX3p@p}IFpvHvgcW3^C^wTG2gGoP4r6Tcs0|+Gro#uX%tvt#gxaw2X z<1WnYu%9%tsSm)^7t0T$@qAe-1&iO0Cwr>n#B{7rpY`f|m~&wWxnNuO7hOLab#XfY z_w?QAn*2J-q{MW-T;H^!`vl)~e}b&kw)Gy_(e)U`GO4_aOcpXfQIB#& z``N&Rlud)O#l4W3kE=gEwl2;`;K!0msayV>2-@o zo={y2^DMKKTfU^H87ItpW7bc|rexMrzO&=CGu>K< z!P>Q&P9U!WZxi>aqmSuLMshd?-OmV8Wdgz1A@C?=ypnJiOc_e-I2|9A5!e4l2Ly{z z0V@b_FSl#$riSO9R6+Cur-Y5GuT(V?ci)Z1nD|CMk6qaMU~gUULsZCJQt|7|JC`rC zh6-7%UpVApd>>@BLnU^_bkPh&Er!0mH5HvCvwS5vJ~NE_EwKjE-6d3034TJE@jGXI znpPpp;LHGM37KRSt1|UNG66dil-*=9SJt3He(qqafxhb%A-~M=mxMHbY7nEy-F&vB z4+f;_lQJmmv6DP>F`bV)AeycgE5=6)kAGJZ7}fEX_7N};1ldyxGQ@*9BZWNbR7cw) zrCloq0XTDyHn-vUz%5rs_x!b>TT4NeX z&eOT+QQIG8Ke7c%M@ENPJ`xN<)`C8cK(x1AwK*#9F_WbYVsVQyncsYO*&WL;?cgcgD>~T=Sd`E4%)$pFfCNR)nnQd)3ngbgitvH`*`3Go z=3PWo67lc(Y`emEab9@ARko=Ugjjfc~Xt5a)O*rpf+rr_fvJ<3vXaO!H1}Se(;Hsj2_BTud{c@ z|8eU}1tAJl-z!;!>Prax&-)AXq3qQ=3HZv70e!nOetzjgT+l%Zb&5JPD%sDgOXEru zh2^hb#MDs3OXGmV;Qv45|NOxDxA%-0xuzsFtuYb#<8@;gui-C%)WQf!LJyP3!X6Ch zn}6r;R$4_bWI7w}#VFl8?ds5)5_O658Uz>kPpKm)=%8$Y)kA$Razx}e z&!#@KQB$XkR^@*L{C^e~eAx1P1q`<%dmmkTN^QRXydXn@K$R1kA(`O;fUbHDp}6fj zvVb2W1Str6cd7Uj3 z^oWdE=CI`8%eiFtxRnfSUxOYtNZ%RW+WOJ5m2zglND|JMfc2x&(U{uhP^z8^}TqHikdh3HOW{}M*l|#?mxVJ}TpFSy9Y6 zhr3J*)eAdG7@yz=M%W;T@9NV<0`5XB6S?ftpC7eHN(;z@b!Z)7!nx1QVJqygm6VS} z@Ydbclsz|hf`Vvo4 zwAlT?wL$*T8mG)Od2juzlld6*+nIqF>F9*%OQ4{__3Yre400!H=XB@7Y>w{t5RjOz z@$_k$w>xuSkJy*v?&*t*{k~Q;A6K(!zx|&w^|Oj6a$DEyrOkJ`7Nj4ZpY3+B{d6K@ zmS)ccveIRApUgRZ*>2Y*c{WxTr@f#Yro>9XcjpuAQn^MFn-7T;Fp>;5SOYz?plm~ewhq5IKN5Wbal2~ z0hH3DN;zf71HC(!yhIug^jql-i^^?#(?q9#rpXup$>zekN|#j|)6HhkHb06RKy&B^ zm4S*x-T*;_>&1!7{&6_N|wmCT<&jx*5lr=3)A1Zm$Q}p2D z56?`$y@;SmxveiMtN>L8Bz0mNsEQJ1^FN3k4Fio~R0tSk-3x-|hE08c!Z6Jf6f zF$vGF0a65c<*3GfaQ^vUMhEuC9pXVt2wIA(h+8xuk*)Asa0YJV!xmd3^;2s~{VfW@ zZ+A8#typ{*K{uc*NNq7PX@OstbKHBq(h+s@mi*#=kKV!fzzzp1zxr#O%pfU8ccE5{ z?^`+(>isEjr-9NnZ=hQ|vGY)=nc3rNdw#VTR>}8~Oj5ldo|;OLqC_BzU!u^fl`Bxr zq8&O~>$WV@WjU6C?WUGZ)GW%x)hNOkK6sAq>Ce@AUtWa154WpvoQxEEX{P;a8XzF* zoLHQ>mZ?HH{}e4@HiaD~2i9{W6nephdb-Oqne$+;fM)iYdZt3o>x+L*dH>%DqI}pT z72bj{9?3G~k9R37F*N2h;7nXyCBLu)eGA}p_g}qYaE^=y6 zod82O8_m8G1NyUQ#e_rmKnb4iuV?KCRCb*MjQ*20x~&Q zk;{7TSyd_>zo}eLJ+k?p-Zk%37+m)(`rNiI{ky<);hjArsY&wRb`97#&BPCQmpKSH?p7wVumlgLkE#r_2PqC>o%2`VAB7LharC?FN((;v30% ztXXBHzbN#b(|>`V#j5pRrys;L03k(xik(1XZ;+{+;-V>G&llOiC`IBnIgkV{=w0Cf zgz{}F$Y+>8f)xq>K)@V+;|6pS0&Scm!>E8UFAbDfbX#s}Q;tAi9d(FiX{#7qa+Xot zu>FzpEbDFMQfjZF-$@zxJCK8#+UMsYM#Yh^>U&;6{{51Iw$PsPp^W%c6BL6x3l!KH zn<8gJ(GpiBHB&DV)NyWi1&Jm0^$ALurNQn(KL_s12^2Hee;3V)P<8=mFYsk+MFcQt z&7vwtkgYdiJ#*<=fXlCd=y2}Hy=!L8ERnywN#SA;CvS7?7N=S4ga?`yG8527R zznbqiQAieqNGWjf<5<$uQRyg-YwF;%ndH}x+GI=5ypIr0RO)h||@kiwK!Vl+Y z66>`zDijoBNK5E#NL$G0iZ832pmpm(vC*%{6rvIO(wId`nB(RG(baXyHV!cZ*H(MFK9s@^w`p#h1*qy0x?t>u}$|<+zggPSfGtISI71F0So78u@7b>(%}`^D8Dn%H+BZ-%RW)mL(Zl7}$bP`c2Dl2Ybtc#9?{HRT4h z7OnFM?>ij^&{+=~d%m6y%Uy9A&FJNYH{!>qNIfsv^l9ea$6?zll!seN@$=R$1|LD6^ zG{GDgGYQ2=#=a2Q2enW=B%LwF4@@@2IgH<_rS~kg;v>D~8H1~OCo{oy#@`_HZgGF@)OOyUp8-~RUgJP@Y|46=1ImHd(G^Ik3g{J z2KT^(_F}!+g+k5j^@Q{HP3fz+^SO4OU^d&jaSx#5q@(Uk&bw~wOzFJ%uFr3NS4M6% zQ-yOpcoZzS-eH{|r+;hH;$T84D1P3I@OSZhlj4kKZfUm&zJO|~j4wjTVK;x&(akrz z2osbP{&RsFgcL4=@HQjmC?)NjfbBw-oh%f$(jQ27-~Nj`cUsd^wo zh4S~0TG0z(3xN~gN(1+6O-1vDy0ITVKaqIJ8&c$hFx9+Mt16y8`9*aSr@q ze|+KfSHLqg@yUD?N+RaQAX~-yQv#&cmT|HJZ1}`<`{~{Zt={NOK;4Gf@o^m7fv<=X zZW2N_U5vy$6}UJ|K$uGqMr4|v{QGXcp^6Mq=F7LPg}l*(zeN+TIT#Ol|8)qPxXpSS zXxEmzP}~}!re2f$)M_Sv&GsG+-)!Z#ry6F+=o}Ggt$vymVKAm96CaJE>LdrIIiLp} zys}!O6=A4r*U0NdVVk6)DSg^hUqAc<9{uCZVK;nGBw}?;BIPX5SNNCW>(U6awSD`07HQ_$#?b2AwxI#IAdL4pc5JES(Tk>J}k;3ke z{x#+T0!MnXG$IU0x5f5e^rfII9sXfF=&@ZGZkJB{%tbu6Ns|U8dH;E&)tZN<*pWOx zLp=mu&k{?F!XBj0ajA4&>Q|8^AVRTBJg=%g{Pkhs-;mud40`G=w>w7yB4;wzr_bD; z^amL0jt9;vH{hZNy%XNXh1r$rat)NAu&lhd8CL%+M$WdMQNM>g*Qy-z+nZi<{C96) zl6{2TegBeJsYn85sK1V@;X5)=M|*Z_B_^OZi5LMBCx^ubOM%`6#^FL>A^VXK^wbUR zs%8Fe?4~p*f!qfG7s#MdZtMr7aJw;~hkq5|*`~mxF+DB~Z8}BhU*$SxoQ> z`p+_?pd}_FudQw8hTR*;0f3J-(bqQK}QT=bDN2~>e&wVpWy3TS6NqaQkk*%B6O)6OMgDPR~5Z&iRKr zoUeZuAFitz2FQbs8YWnl{N1dL68e)qx5R_qELPQjf3`((1xx^cq<*xQf@kI|Fykg* zhyd9IX`rwX^blE6&zhVb63|Z>{a`oZcvR$MpSd6(dlgXvf(TOsf{&{ZK7cmjx53^N z|5w(4lcR@%IlDVMN5V^##fGh*O$!jZlmy+Nkst%RSLO8J0pBwWt|UuB5#wS%<%6<# zxlHmc5y}{}=d0wI_w!sP^$`7(RpbM>!Ljz*uYUnO00ybT%8vGA*r~F*)n%Q+qd`6+ zF0I7FzQ`1=p-zgzr-E6ADdRP21y@eqg(`5af-$SaXx8L|KV$9EB4?NQG8qtxeaQ!^ zD)>v-0GGJi)tn%FnXFY^@sz+l828zQt+Q$5^^cGP-z_~5mI5CZ;!2#9We?$&?g0_1 zPcKS-d1%``PD3c<{Vf+?fjb|{yBciF)IsPmEnGt6a0$8!W%uoaNVaw zhr?q3y5s)Q@0_4Ng8Z~1;T=~HLMddA{gM<#Om(hI!I>JJYBr z1=_Q0Uip%I>>h^%NpCi*{@-%22*?2&1g-NH)?$lrjJ!U8*g5OqtiW<+&sFdmRT}h6 zxY!#KaS?d;rwKiYI?>f#?KwvX_;`nw`IAUOhsNnr^b6Umcdv1UivOCq;Q{QTTqMVB zT8&$)+XaQCpoD@*f^itr_Js?w=ppYK*$lCAT(^trk*(vJFgrJZGcaDgqfHhBmt$5D zxO#>ASwS$!fmFl!qrd*jP>cji=4)O(vfO_Q+|1*B5J#0krgdCy`y>eajPe_`JV-*C zpc7@Y9aEm=rHNR|m?Lr82HDwB5kj}z9|wam%9}Bk_bxH&4LIu_Xz1+|yw148*r!;86p!fbgowKnHhr?|M?|8r|AO-;rE`tq9S= zV=Um5>{TQQ2sq!st|6QTZm>$d_Uvy7_GNvgbXM!$G|$of)IH|}lodn|VI;+)f4#hCd{VJZIy2LE5A50Hb` zfD4|w%CZs`gZqu*r)a2u9X*HReSUu8iBNj~_1!DFCBo;#(8fi1^4FpmAb6BT{!SoY zm+Zq|%Q$ub!$H%s3Ml4HKf{M*`$mX-fMiwHf^~5UV%RmIBzr1$w>#1JH7c@ALWu}o z7Pi3`rDlW*E)G7bS|$Jf5^%=uP=G-<2hYLX`tN+O*sn+RsBjx-yG+uP>#69P_OI;2|g_(_vz@%VEwN@2K2T? zaxLg2J5wWnd@K0}9)X7W(p1W;L82Z}4?I-0=Zv@kCu+HtcE-UC-rx}ZrslWa?j$bA zfk7l=DV!_ov}?|xNzI}@umCW!_~`#*WM3cwtnHjj>uV4teN^g>-efz|EE|C)=;t67 zRvZGnh$S1#rZjY7~_Qq#R-0+{{UK?to>_5%&cJ!-Ds?S9nr&sKFr>7(^@*-j| z|6Y`t$ABjM(#npv-3 zNQCg}XJ7ab|MgwKt6?F#Y9LIF@Y@wXg>q6mt!xw}ObC4j%0MFsQ~{H+usG0vuxL<5 z)qk;=-M_bpe17=-+4IV!vMS$G)Wp?yVejXe@D)jVvd30`eY$WCIH@WuYZzwqf^>iQ zkrl>BDnCOW+k7ylIk11Mm~~;0pWAAXpEI{drT_d?wD7>H!7$*aPLYrjmt@8W@8&~4 zu3L(-sRA_EkbiXcKeF=lkDl#CxNnFWe6SePfOVcxzQsf%#fI?whW5v6$=8TF+H)*= zdezI-bXude%EMzc%5&9nq&q`t&3x1~70b*R758H0t4$KIFGZNE+W+zw`dyIln6%g@ zb-J zcWX2zLbHD1m(UGNq1%l^zP~>FNr8-6(N)uN^^WOHSMz&*K1Ep`kvMBGzClDmwvJ{7 zXsv;Ox}HpP#XmoHrI9yxMWHKa-7ucGk!-ya8blG|s-SspknhGNH1*t*^n1mwfAj?Nqs zA#B8kuww1s-3MXZbk%1^yK=C_oceY=?Cv&c)EQUhgXzsrl1g+hBQ&lF*5t2#I=Nnl z4ODnu5APjcQ>%!GvbwwdUy&ig#LB!oO+*mDSS)2Ts1l@w4>p1i!J$ijI4ANXa)c-H z!g#jKu{Z-{S{qd=`p)0Mg$iED@(qfIi3qXfrR-^~Lp-)_K0%hl7`R;#ZtVX#66N}| z!0o8}cQc4TgVJ?mr{D$IVX~IWRIKC1=1U9_=>d#bZ~YtE3Osmu%&{Z`F+{E%=l1wjD!PwmZ{hg=f< z9ygSyD<%7;bQrnt-u3aGjw1gl4{N+1RkV75(bR4@_w*Ntz9l~UL3&jX_LwY?mpgC! zZO|<;ULs83)xOfG&jo>T)4ZEEazB4>>8sP?o6IY1XPK^eN4ec>`Oj3>(|d*T$G_YvIms9_u2gUeHBlQo6ZkK_K#;p0%Oy80~6>x{rO`Y&b6oB zTw3<6v9%rr9=#cz&VHg4Po{gx6^JReZMs%5ow!Uq1&TJ!x(l}h zu7{hB{Ld=oFTc`NSk3cR;B2#{U+D#0uLly2r=MPVjp8OsZ@n?IA_)_4{?clzB<*oE zThkm#_T^d)G3_{oiG4@z@Aj;21Riz^?)QDYqKAkdD;ci&WyM?P3jK ziIumU<33K2?v`7!EL8NUkv|yvO^7kOzMz9`X))BEz0%Y26}~od46w?a*q?fSN|<#b zmE|-ayKUY7vTHHgmQ-V#h9GyHioj|`YuEMUjoE!Zav0mhK|~~S^;LOOA8VXfR?8NS zs_QxCBWceMDcx^hB)f8ijwWY+UG5RL?5MSv>X$kNTp8TM$k)hMn=OH-!sm@PS*Jv5 z6#Ug`OO+g2oHxcS`&q0@%6B+ZPlpIk=em@Be1g9D2r9U^-7IZMoQjGV(#`UEDSYdLtCwl6z(C zk&*EeoQg?B@t!^XQl*N}MG5Yr%&0Q-pdV}`wlpAK96>|yDKb8ZY(sQMgWQDVvkSN3 zj}U~CQs|9ZzjIrC?_w=2gOi3>TsrQoNL2hIiXfGdke#qaNqSzH3CQntjX35GQDQ zIxFroz-9+)p znd98uOWy^Di|cW-Yg&QU(v5S?cOSNNvm7(CK80r`kP;Y8A7D)*LO%3#oBka-ecR8f z&I<3#TS#B-q*7(lWVh{FruTpB8Y#;!bB{HgC7zixT0MFe2wj#*cZ*sz8!{iq%I|bW zBnYqL9jo!lnaO6LWM)pK`Q=`Q7egBSqp2^XnlJDY_uN)@7r?3KNBpOUeb)?!Z+qnZ zL$5P&ob@}3aiF;sr<)>yoGe%2;Ng46+wkufU1;MIr!Ifq#pR8JC!ll!u$!MtcR{ZD z>7&$ROtI3QNu0+CGx^xw*GB#8DU*ujNJtT`sz7#meD!xRKFrZw*wPi@fYOJ^fgzUU zxq<2)H@1LOM6{BNHjYPBDBE{~k?7J~gd?Y#L&EC1&UZ2pqDco%m^-JHn_PIdy?glx zVNIt@^Qm@)(|f5+WFc9Jh5LcoU*1Z;AHYVYgeXSen`_(M=fixa;^9rz&@d{V(u1du z?%pH(d1o)uipfR4f>cg;G>jGE$C_xbLaLQiPpVNJbe?-LSr5Vh8DES9)|EnoU$xur zz(^*AN?6Bii+RjT+7BFfKI@=3LBb)fBTKXX_rBU!Sj8*^Y04~wB6Gf8C(MHe%0d0H z>Ota-PG(N9!(u!nQ}axDn~NEN{j}mb4=!#MILaJ_RH1G>rho02 zeeU)CtUBoC6W3192!)UXq!Nk|`cwWO(u%=V zQ;bXzydzI4Cy+|Onp6M|=W=U?=zAVG8sl^beKw=hhs)Shc7*tHUALErG4gNmm$D^C zAaJ^#HE;*Lgd}_y!30d5Up-$v7y)N{>eHmX-W2G)goTyJ-bBkq=Po$e7PpOP52JbD zc9XuI-GY$>9x8lYZ-$I^Fb!U;Q0rRRxs+*m>f)Q{fp9zj$az1Kq7whjJ(U$I`kT%d z@25qN#C7UaI;Y>uj*h^9^)oJO7wf*u0*4igqfkF-(3G<9p%}qEndJZ`P-Z<>3 zgKu72Jjj{i1!>EOr;7-qrs*|j&G|5ymT9~k?qV~E&Sx?SdO$_b5E$Ltfe)GyHlqKpbcdk9y_Qh+1ft(^ngv8~PW-f_S6BI5AEq@TR@|Ppo-@bp z$jx(aL`xGkU!oG2tF>rL?=wOD>DE|>39T6~A(6veRW60ulePh!R%y*YzVzL2^LjVB z<6?I8LVt`v>H4>}{u#|YTkRmF!3>p|oK2GXoU1yS(fV-=Y< zxhbY5|Ev^Dd&_czx64>x@3Tm>5>cF}GYItYN<&rIP)Nx)Kb1UTa9teb0O89hi6!MV z+PlkLMPO6+2zU~|mpF7DGHtl$5Fo^mmSJH;fwopPZZ zd)Z9Qb`d*Kv!q(&8*l%4afM8usE1zk@Q3m0X7XlNO1HnwDn_WQSxUT5CcAMIQg6+r zzbF1ywi%*DbssFf7l_*`s;)+5p$4~J5IoE15p4&FV*#h<+&#Km8QWz0eJnjXkYM$Q zHpRRO)Ocw`pF(hf4Pz2h9O~ogpXM?QO+t(|P_g2$3_da+VhRR!&#z z8w)R&!M0@?XI$Z<2CD{19kC;6_742bIN#x%Cd%(_oe}V-0?%n|V%?NI8532D5}pRX z%F_J&R*Si08j1$KeS~!NjJ5fA371f_;w%pVf z$P3S+?Ns(&m_9n>=HYbctlmW!UAz1D4a$QD(?581(a|MNd(IJLPmE3LedKa>-FwUA zF7q;w&d?+&RwO!P5q^+%a3DcD9OyTmzbB}_a}f04LG5HjX`qzmhAsWTnyE)bm!*km zNG7!C>C%;%TU_t8>kS$)G zbbn8Ij)a))V%v}+9n%bch_B;gu8Z_pp46aw@H1pu*})sr51sk6UtU&AE?SC<<|qAZV}DG0{l8IKi@+xPBRLTXfX8%Pi$*_RDZRrMZGO$uxIAJFvAXmb{&6>?P(qX zVVP?OZr76+<+#RBe?5)^vA(FQ zr~lnF;O^UJC~QkKFD3v7?i55h1|}b4CHL9q*saDxS5I<= zI-bL5`O&5|%Gopq|IK#*FsoWtX%TdoG&y4m2ou1a09spje(JXw(;5wek-aGu0+2oS zDoOULVIA1YZjaFWE7O0E0@!ZZLzupngeVQ09cWNd>ZIDGbjch z_JoZ__ajh{x|${GgoEBn8rec)Er$zxsviGiMgJ4zN?s2_=FQj3tRn00@$qu&;c=tz zLuF#tLo+^qpzmrX>Wt9t_WX1Z|v%&u;!J+sC=_Po#{HoDn$X zqh&#i)Y0zph6poNx14#W;2UFmuW+kgg(%}WkV5~wb&ve+D*-vArrCGb|3akML*?IQ zp*tnC=*eF2a?2E++)H7YR`m;jlDxLpfQH@}6Jxc6VbF|F1@>(g0C1EcJQ_9PdzKj0id@)D*_1ZqNGwUb>w1tL|?(e@fQQ_O(4{D=h`> z?sxAK*>}T+_~_$MWx^_|t88 zR)6ka!baAR zyZ=X?a^+`WE7IL*M5{<`%{>5_vvokoaW>J=7TF3kCE{8?Cxbeu(*QDYrv>Nm9^qt^ z1OOG10zIZ_BO1Nq^X3iKh*tytn$^>AR%s%P(2o=Z8{6;aU1$qtJMvkoCA_zJeWMR< zYQ?C@Hi46Di^yoISV2`&te_R)-N92B&Wp|4nsz})C@jtHFs8mr^RJ~Jgz*1C$h%bj ztV%fL7&-s(y9Ee1J^|;K~@2 z17pTJZ2NbafUwTo#){(K zyt^f@4A|QXG(&=&p(0gT7n*QNfn@J2}~tsqY(>t8oa zcqQ)kzTNse;_I;z#HpqWf%B@nXFQy{D=#%>rB~-YdmYz&ziU4clT|e{xV;- zuoYFSj*CUrAs_mg{CHg&W#}hVO!k;)_2k`n#}mu=_G%Lmq6}FLq`2w?y(z^Tk*jr)mpQ1(dvTWgCYO8 z+5u0Poe3Yt<2HXGAR)BuRZ9eAER+b#kI0Ws2^S^P$qX?Yi9m|-!+?ufx&2RhidcFq z{g(;)6CjgW^}c_WsPn3*bM0`(mFf6)LUhn{;Q0f^6X(pTZLx=9%MOM3vGb&BHsPwtQ zru#TW4zy06Nf7Yq_|cfn_{_j7qCAkYhf~qQ7$#64!jJ*gd)liFnbh-1@kYgFqOYj%o&E3i}{u5#To zqO~q-78gtVlDlYBE3S5x2!#L@5C|0H^VoD)3KkGh#TB4^iX17}60jo=5pcE#+y|Ny zGAoLQ(T0|=f1a7gG2qkYW-ul^M=LW_zhN<3e}*;^+_8{-QL`17W>T$bIDX7^kvGiU z(7_mCU#Z#m4HI;y%M zk()xzp16#V|9z5KA=k%!Y!%no=e2IFO!`X?%PeC|;%d&-;#jESZjLtzJrgp;^ZS%k zz$2n=m~G4L)unM9Rq>h6sE=n@`thtHNVk z+K;7QyMf+BYs^G9prMp&p*PkF8}$4Vr}5BDc+km@RPho!RlC3bwM$s~lSjn#P=&L^ z0{|gRSZUO#@I;bTP7iA!D**zbRRO-NJ}vibnz-7pu1Y9H9^*AdPg=ObZxH79+vw8Q zhsq>qM+EdYY@qYrKO6FAYi1fmVbICI1)^02-;dNQM|o(=BVQn0vY}fOwBp8dnNj;S z9v>z??5iy{Y|NATQeiF}yOu%&5Ks%O(C)I+WP&h44+#GsS#KQ`RoC|q4?Tc{AOg}c zbci%Vj!MT!s33wel!QnR9S$H;N{7TqBaMPIQX`Etg4EF64f8ub&wB3bzTS5o*5drN zIh?)E-rxAd=pILsqT&O;JjLPvJo9%k3+3yx=f@oZA_{pWN%AaaiG!V@noqGS+@JTz z!tG8aT4;Akm&9HFSkX{`qDs#`JQzn(Q=709p4zdsFw>0~bZB&t7@CNhG=ZXynTA0q6 znn`;b+@4=-xS0`3*$(UJAQKXh3HdtjtwFvP8^doGkh*mXWj;f=o{_RG9T3xZ)F%vj zW}%u2H4Ds;-t(_+*#6hW%}B7X1Y6}Da-9AWyOXy>6YiY(OTE#ilwemIu7sBf8eA;` z4GNrS7%ur#JctW`>4VrM0BY5FH5=??brVS;@96u_6aKxsrUP(EROuhL5#xbOY;iy3 zsF+TBO*d4+i%3t4D+t$DEW(St*+7S8;iYad4~$F}gW)*~1O>qs`uZU2P7*_J^M-_5 zFn80Rxl!bg0t%b|8U1xJ1F%TNzCZ%1!XPv;TiSsG>u^QVtiXYS?!bZW2=1Z<{0U!W zK7&1@y#n3wVj$PcZ>?YWa+=sK6+rM8=5rKWS0TcuFzem)cWeFMOGJctF(9B@kq@n) zS{8e$ljZ-|T~&Dq^f7&q!m|i-BrQAY2Uy9ZG=>dDEj4b-ni`1Jnrq=b8U^d>V_E zM=(9DlaGQB^R^C}pm?ZoEHNnRu+2tdWMH+j3NK3>Qq&8$M>QtLFP22^Wzk8uju9x& z(gHv@wuC`zGPD53{1bDTzrNBxi((on_JaLzj(<&YLAL7&n}BU@h`;NtLG_}{r4?m7 zqCkAb>>lkTA**~^pvw9>luQ#8Le}lp04tc8Ut`Jm*MZ#fupKCd`l;@Zg^+3PN-XEh za^YouRK5B{2_ixzeq#R^Li{ov-b`kvzXy60O>)FZx5JN<8rpMuVKKA;WE1abvpoH! zXVNn>ToqRSZzH`!prnP5qU1%1#J?%XxLN*lKX72b3X~;&2~Z-0B{f?2XZhDYr-ERD zh>z!*01V)!9bdvA*$xAUg74(^(B8%kRR1qAv^Q@Kd+C4en^|HX9^BwoUM;7KE$hb* zzuTQ}ekHU5vRxh;=GIyZr(vCX63m(Qp4She45U6-5+GUr^udy2#K51W6D5FJe;z%v zX7^v;mF*2~7NBL35x;#uGqynz9cYo|<`}uP3wdXW5gIV@-7QcvT zae^{FmKW&9>6|OnwIe~cN+4VEJgT1C5$X?_>frD-dyj?!fO*n=BiJJ67J_K;`{u&oO@k^Ct=fcxs}^CkAY$ z&0@+eV^F*QM5-;{ZUY69MmDyjZGt3?>uy>|<=k_)@-qTOK`tUHqWB%uqk=5fNFw(e z)axbXH#dSZ{4`@RfY~ytv|fPya9}pz=I{?K z=?Y?0niGvUNuNHZ7ic^4_iV!EK1dfGI|;9G9Y3?^pXxZ@_gy*jy-+V@P4bzxJia*d z+&>#vQeMJ6yuQZLpKaY!J_HPfXn>b=#7vMhC1yU*^s8>|+W-*t+AlU=E56jW#pTA< z^iuO>IkxwF^{Lwj!TGWnnTbZ;-fE!VU85-E&-h@18l(VLbR^L?>hn4z8nvuP06F9> z$ZS?QyIdJCUz)I)?LzFZCC%&YBwg!m#^LF0#|0tTetOzpPNiPd=Tz&gOKV(>v9>kt z7T_MY(Z<~AlHh8l^ITH?MFJBo;3lYhAWHFai8>PFK{q-=L_Ci zR~HT?$c&o4*qf$g&7vDC5sXO#c_qvZ$_yr-)j!)%8V9Sw9bV9gwlfe8WHf zv*S>b{&y!poKiedKgMUt3dEOt+XE#ZIuN(%K-{CDgX0%Sf2~HsHmG6gh7I&R;$A>8 zHi_DV7y;9wg^kNmpYN&_*6H%$#i#FXW6irx=_xgT+}wa&O4q0NfxV;5zV-U@K+nJo_zXKbL3DjP&A6F%d6h%hc$iVJ z(1R+2Yhay~o+V?yxt5r&nDmc0#suK5JY9!7l6l{m^-9L-PtDEmRod*RyqbNL{J`=H z1xProBFj*vFi?(sSe#rF2oI z^k&@k)Pxf5(p4u}xU31fqO-N&tNg-hMf2gBMLgV$3-!2l<7g3Uza%&AlK0xDmx1>b z(53n;C7h|B<<)dW4fEWQ<&*ZjBXD!_in^O|kAXlFbYuxYguz3*9E5|!3*`2;9Jj== zJxy_USr5&rQ{S(hDgl{y)AhBQ@$rmUIOBd30eUlw4mL_M?sLQK8E;VI%!lI$rFh4% z=D<7WX~u~{h2)tmcSqShI-9T0zx*vH)RzM4Bcu#pMd(SA>Gx@aLZ|K?GoEbP4vh2v zcFvkk6eu#|;&){gamzTwz1pxb<82UOIH6AyQzundAVdZ_Z@OOG;vcU?$6(3)cb$Sf`#>;Ue z$+~XdzvhLTX_MH$95v(eeqDN5`-sh)MKSO0k82J|gMAwgHyQR@uRNlOmJa6c_v=2` zhv6NCj1UCEh$w2PO(+Fy^{KnveDA2N<^$}RvQDi?SV8M#6yd5r*ipu(zM=7?mAbp% zh~seG_VC+*PU8Up=k;zH``#qw=QpZi3#1v*1Vn+}_X~n)U`*lC4Pxw)jF(wM z{tauitG4Z{Xi^;}hy)%iB^o0mtAp8igJObF00A=xk(}aTuviwgw`1@}e8=_lny+E- z-e~EKU?31QkM6SJ;T)x>0*%-k4tAFFpnxoaw)3qC*sqTY{RL7zZ!ys6?7`g~GL;Y%%>84CvQB@w64kpPG z@Ph#k1~?C?fjf3WTB$JGq?>_op++E>Q|~Y!Itq2Zr|;JwjZz_^a3Z7oT1%)}{RRl0 zAS3qi@Mscu{XJHgEk7@d(zD^c@fyx9NO^zFjoXQoWUH;Ym2Qn=g5Cyi2$Tza{V|sGFK2OAnX;dRqWhKDNzA!N(I!(|MPav%jacKwaZ zE--I_sXe1d<@w8*B@7D6GlsvIB$a0V+V5W#;0g6KE-r7{Q7=VrK>T)U++rsZ3?0i5 zV1=+v(|{b+mGV1``_g$>77?9;tntYTN7o6JEc5e9g)(llcaU>8D`VM1OGy+v$Clw%7#)# zOuffeY@^Rfs(s8wy~(;q(}DGdpKxY`MA%?5Pk&t&Gr1l6NP1|Ez^cwdgu{}uEy!>X zggeh-l`kERSW1bcN&OH#TZn*_ar@>RH{n5pl0k7KFO2;c9v8|vrWvN!=?Lil7O3Eo zQkQGx$<()EO*$tYE1Bj%n9B&Ag*mC8Zod}@F5HUwvV_Fp!AOmsT*#p}KY%Hnot^gq zkCv|fbZDQCuWv&TOmQBo>7grsy@$nE^`%Pg1G3PJ<%>Oky7o_nFua+*7S(|FXsG;d z3&H+c{!;<+X1%rjinrOn=yw_p01sqEid7)=NlXxYlG=Zv=^k8s5l+jy7|xsVq2yUj zYPEvoYvOCc5$@|hqxk4Uu7OFwS<`a1$&V+`YsO<|#?c~u<4IhShl~r`B$<*)?+idc4nx~|M8jS4Hj9KcGCbh-`$`JfS&&oaJG5fpVFvU z_O-cmTVM+GT`+MUTkqb!CBQel`-x&8Ts`Qcc3X`EXg$h72fXw@ zeHD4z!ts}sDB^e|BXu3w+NqH`Mi6BtJxD|((Z=GWh4o_lNwAZVC|Tbe`>nn?ew59R zqipkBpVc4t^=qSN4eHPfqw#}aa2x5+ThVwl>{=Y66)jX1AT0=Ky<{yR7MaUADzr>^|wHSlrvk^;BQl0ig%OJna-t zzzx^M@T1Z_1Zv97NJ?=#mDG*t3TdJRy4cop-yeybYg+Q}pyEY23utF5wd;EcvXnwDd~Y$Vjp4BdvQ zU2u#j-5x2(x`w3OKvmy;g=7Pb&`)+!0q106?l_*Jc~~PEom&(e%$yL_l*~hIH?$`Q zRkY&3$Y)+kzVaIonRGjadYxdMa;AnF_36lL6G)%sbhJ_}{i3k3T-n>n#m4?wsHdCa zl2n@Oim_U$*vTau86pHPox)kTQY%+ht(vNiQID!w%KD+IU@`t>&0N-kMICycs<@Apofxj(BXR5`_MK{cD_$lU%F)5eg|gt&0lYQ`uS=ow%L^H6*(Hg zeea1l>D*vYP{PiCiw~aKKLCS7V=rq#Jdz3F{ zgUXLfbo0_wKzqinGve6mGSDF$rz@bhcb{)$Fw4wI(+%f|PKIgl78eP4pE9%I%lGu#ZUGVcJ-&#O+qs{G|Z-qADNIPPE+I?{kY08R8 zZ1Z29Jv{i8t)?@1#-P+B z_S%;6i=AXw}kuW zBdbLUHl>4Pp*WU+UKyK7V-X)eXQrYS)Z_C+XInr#7`MD*{P_F>`zwRX>Hfq_?03gV zUJp*hqsY!LF0mKb*#G1CQd)z`@i^PM8G`B{{#yUZ^FP78r(7AD; zaH`I?Krv{(OQn!B=hHhvWWyE!g8!XSW;tj;!U7r2bdheO0DW5XZsxB+q{Zl7vtMNe zdV^FwPdUDFqQ735bluxkVElfGU_3MZWXT!`X_EPRu5o)bE1R z^7o!CAOIllyzn6Ib(&JZH2?_l5ZauW*n1RWA)6-g%Az{|b4TZ=z&*esFAY&)sy*5a zNaw656aI*|ssrx&$_ch3?6P$*l@9X633}T$`-@%HKEYxqn7RtAH{iLQ^Q6pd`Sh=C zDBj3?TNo2^d8b4ad`o+&N}k!e1v@0oZ1>_vD9hY4r$(#efq1c+rP>!Hx=Z;FBW@GJ zwvyqmp`P2*C=Qw@8#2GXqTuJ5@Mg;{nzfO_VcGXbvJbGhwoYm6yEk12?S=}7q;-C5 z=*ngnZ)W^oX%GR!0`}+i9+GV^F#qGTs`v5(q?k;X-g_!B-B)uz-uBh<=IkM-d7WM} zn4|awwx&H=0`c}2B1BVVu>PcR%o(jR^?)0x4sqb#Poza+@C7!a0`O74XYhLa?NrIr ziUnq5<&mXB6rema?Ir~X>jcV`ap@i+SO7;q*%V3p#7X+F)m=}Ne4-~{f7$tznDWuf z$bFtftEFTeGfeNTzt-dGoZ7g|);8@W3-K&0=-MY`sn@?TO6C7DEt(8LZ9-rM@vyagV6K z!e#UOgvxlK0mkjY=IZ3ln=s?CwAXcAZiYfiF&OV*`p3Bo6@|%_pNcbe$Z5Gtf;(SQ z8?JvB-4JCx09n;Iy)c2^!G) z&ZxCmP7^%eM}$D_w#v-c8aH}>nj%m-~Eq18k}1Z9uT6EUv=-5JJMm4H2&hD2o4Fs@j1 z;|G(zwHkP8I%6qUbd9_kdR)Wrj!nv={=M`%y!#KnCIECiv&>P?o3G$DxYZeiuk5Ev zv<0dU`Jdihg+v@4JV36gU5n-^XB3Cqu1`Nh`$%Ze#vam8aK4A`nNq?Dl|NUAszsiU z1=y;wLfc?WWvBZ%8)-+!ESq{T2_$e5G$jtUNUO(DXuXpq0spu@z)sv$SF+Dz)%14lv`r_VqmZ0z>th-u5tQ{+&16CRZ@yT9O z4Et-aGN;uM=g#$$hQ~`-oM(+b?by1$CGCEvaLmJ_AwMi|s>~RQ7SdEvyzEYIUhyQf zJ&zp6Z$|v_dW+deuINvy_noFMvmXm766|Sb5(Omh-{KG~GVQ?^5V!sF1y6a;X;F0S zIB8G!mN7}NSebJt$O(U<^QIIdRYUFKPGRD{Nj|K5BVAfhUTKojv%2|P~Xh!^^a0tfT!nz^< zRBJ(;I#r4`?yw@A|AvP@lV+w>Q;E=#?*iHWKoJePX`#~r%SI2$#M3GSRnelLH2OwaVI$o_sb_DshnX=D@m zTJ0U=UB$s-gq5`ypeOXi!%c|kq)#_BodL>|r(2i|H{y6&Db9r|Z+qDt)6ybmpuw5* zoBpb8|L*g3R@(0V7nWvK7)r|1IyjTm#KYnyI(%yH4&o1~OgIKQb#Gq=h3Mo!C%@^V=ZKd!ZD7pd z{7H|ODy`DsRcTE0%xQ-3_q@1}pi?E1KodZauS7TxI6h?~|0F~|1@b{8F~E#V zgX7GfTbT^alzLfrJETJ2baN1RAj!)#1hOvs|5Q__deQbC%58K3);bhHvnA#Gc?p;o zXWs*YmBIwxKws;DR|FxYjbDQY6@0Kce&fzG31QR#iZejUH=a$o&ypKtdngRZkkG{E zigVm5JRMT+AOOy2@3Y?1*gyca_=*y!vgI)^PPkn@<6WZ2!3yfOa%Wo(@1+5H;-+*? zW3*f6b7r!alLM9Wb2acs%?W9@{kicR?|Sv6cQ-TS>ea~N&Kf8=MuH2N3MMpY@+Puq z$0pzglH3v%aTeau-E0`0%C{DnHr0f5S(WH=OLLT*MSxBfZ;-|*YLxTm~s3bTTD>hfN;RTMoPti zeabku`7~94*6P<5EoCd~z!t5n>Xx6LV{iYOT6v-1GpoO9UW2VtR>`GNE=&Rg4V0UT zv|qlF{)ncMcQO^P0R%Afgc?$oyez#)!#(bC_w*mEv!?Z3!Pjyu05cpz`7#~WOlgkl z(gtfrQSDz6-H>v1RBHvziI6%IBc2kGgd=|Mh{q5v^N(ldKtK-)%) zqN6|h)f*3!O?UzIqulI!u-rfv5h$t0{w141s^J|V_f^C^ev~`!KhZ@q1`gXs7&v~m z1H87Zc$I&0S?(hVRilqA$v&nl#PqoQdMc9F?&aHh59;R;zd4bzzAUx*VS=>kE#xOn za7w9b^TZ=sGMUSk{^*sx>0R~HEIsgz&7a@(f(4kQch$$VC z>VnuB?MVLg^(I1oYNkfZ<}=gI_UI@4(oWqy!j=FRFx(83@sHAco1WZ4oRZEmAK(4n$0AlZ z=6P^$d2WbXtzdtI7*&5)Jm3WJz}&pe7>2u!m7E zbl9i~3tqTbfaz$aCil~+wL_9)3%Mq44!5XBFa<~!>b7V6 z;8Q-d>yRetsGDzhi%#pNr^sVm-AEfkCUdg00zLa8^n!Hl?583@W|g@DPucx7U+WDU z{Sf18kn z)Lw+3t&0%F3WX+Pzf6Fh<;JFyByi!gKtV-R%we7MP@6nJL~!OZ8kb#p|4mM6iw4&w z_XLm>()}0}&^FWuf9X=;GZOT$BSc6o_}+AwOrgG2tCSc7g7JN0kq#p%zd@)x7Bf|z z&2g7TePX`6e=~5EMAsXMjgr1`<1R#ZG!$q>MjtJmLOtFcGM#knfW@?HDzQ1gVaZu# zGSMH>*+*Y^3=w+4KsDL157}*sVm@>mj{*jD#{j01iQBe(2FM56iv`hLr4h;c=@y#X zyuutK{rD>sbi-AIenn=7Tn06VVorfbE*0vfS{q-3=PPeWXB_sJcX=Y4^B1h0kVs*8 zLSE4T1Mh=Lj$4m^U~8A77@X`1Tn>^W`Gc9u@G_pws8cJ;-cJ|nL}DeCL(<1%8jTmc zcu+$HGL@#0_MNwl6zT`%5ee=K?p^0%+emFQr|rp$+b~j;p`9^ReI?P4$fK1Hx5=$N zYWcTg0=r4W4)Lm}P%_rw&2PHpi-R}K-rk0#@XvcRm~A07VGxys>v_qJB%cO>0V2PF z%8GuJ_v?X;r29PJu4xh{H!p?V>HXiic0CB{7O&T9_GShR*H3k$nQCZ%J+&SSUqeE# z6PD&skZK(d3!XCBu?Y9dCXZR9X}@G#HMN||=YwwqC@GRa3sv8*;*8+}wlA!6=EW!_ z__UsYY^g}Q#{g&-SzN54#EsYSIK1psQ+bvA6$$#hJtsZ{-pa?r zdG;c=(@_dkcOXMtiD+2CWL^rf&57Hz(=$~)YG4-acFsA~$tOAf={ltpM}v@NvXc0` z1HET$^{L?-PH?T!Artj-lIM8`I}uOpb2Vx^BjutSn}=YNO}-R;9?M4$ISVFJCN||K zyKd@|>Kdxpq6F);$$x~WhZuQIlus==7UYxo3(3Z;Fe9yvHlZ~%sem4Z;XRK7t1$jDwJ4nCa%%PDf^sRima*TTInKI#3DMV<~ zdSf8yxnUaCz*yv*Z*Q@rXN}t6yyg`tTB>wQb_uW%MIxKLN@d!EqzMj7p1Wl@cQcU) z^hL5|P<2AEfnWIEWXhXs_t9=|-m_{5szk^M&xv_>^&>No%)u-#-;1>$*Z{F%JW?pb zDLU8kcevIAr)1<6O+Wa>v8wo9G8~^toHEjr zJd6;*`u3tyI_QvNie#quWR?9@tyEDSkZ9%!J5{2CJuYl?dmvn zLjX&NIN?_J5m(7PP))i3iWdgwA%$K{B>c{eIl?GiLR7V9Vb-;TyiFS~$kvmz-~UTa z&o3rG1Mdi=%mTR;r}N%`2m&Z&1_ch{A3a&9NQd@@;|^lXTeI#R-9I)w! z;(Y$}W{HaXM=ai{G{fIJd`nGF{p(Mwb!PQRExf>I)AYmd4D&b7qYjmRd|ESltu`9T0zGM~oXW>O<>P4h zZI!usV>N!2+Q6F)XgL+fDC|i6=|9kAJDApQTt3UPu&IGu?q2SizF~Sjz(gM$n?8p? zysP+OAF|S>K>i0vb-8-)iZBpNM@!!(ip8Mvf~`s_n4R&apAsyR@Wi5ua*llZZD-d*+XS1nfO0Krs_09$o|aSVv*~e(ns0jCu6o;*nU2P*0Y#sSX%o~hMg(7D?1Ps8 zqd{8oVIk4x{8{72*D>Q?{N~;Y)5kbvezlD0sSbBvksOeDabq{#G2-IpkG~6w1;q-m z=Kz&SN(SFwxEFYH- zSYucWXa#u(4w4wK!Q8|1ZUv?u^r`Y{yI9E$+}~P!fxI0|%XZ+a zl{Mk`XX-mI2X|@AGpl(gM-uB31bwE*_<#WGw#%ekZA=HQJ|+oi?t#8qTwlou*-_+a z_GH5ZNBbzP96Zu=i%qJE0h+>b?}f=fy;l0|U3ax*HiOAPoH+fV{Yi7dUmGrYoO~(l zv|He>Z=|zs)dK_P(x^-RQe;zbo*eLOSnNmFmr9lXsYsTorolASiySj(bXe<;$6R=8 zhm90w#%);1tuh_M@!in%i5`K)ZG)ZoSx1VA#W(p5Sqp zW88OB4M$J0si!UF{_3W@7bgLKp6L7Q_-db=sdqc^PcoW?`#l$?PL(Nj?9CAEkA>3z zMFmy_NhwZaDvLOc6rwX1zw44e*uFAu`7AKN%j3)!1{HKx{N6Ble@05{T7{~iy5 z$3%!_3`}r`)~F`yKp@6RP7U&OMZ+DkEb}sF@@M#AcOW3SePDv_DgPtNi?~+D^Sv? zNC%;PrQ|{Jz;h%6K4yUU=`E~sN+?zI8rPc3k>}7J9^}Jg;pmjT4q$uIE}$33Dm;8* zQE|Sq+nyuAOe>eH1**+(ES-znpUYNk^!7bxW1Rvh*z?53(2|WFH8S*yQl|Ea>m~ajhXXQa{_TfQD$c;=O`@X%%D7Of{!zW5 zC02DXQJ{<8;KI|t33a6AssJfF>UO~GDr_cZ6UjpBZIokA$56)lqJd@wmH;Wr0gV8B+nUpeWEPx!Ckh|7p}ft>(F^!j7`a#J^WHoxV zc9e2k>;*^s#+BK2WeWX;PccO>#)AfCqrM!h&=I!MO7fSiIz}LgRd%)D)GuuU@aeX! zAln&qtm5n&7(i5LR`&yRHVIJoSTa?q&nL%cds@e%)hVGohCmzi&;-@3B`nS^v07b| zvo_7LKjSYXbG>qw$>PM8pHCb2HCrnpTBIb}tB|@odZP46%44fB?7C!Xsu*CDx{+HM z^Zn_&hUu+-*s74St!Q>IG4M3-=&2Vq_la`xf6ww|t?g6dp(vAXoT=i&0CGzYP}-F* zAc+|9k>T$Gmi`_bwvks#bB=Lp{^_Z7$vxnp$RDCw?3vL%Ob~%S$$38iP23%~j+KbO zYxg{n=B8zh_>J3ZbeUTm-SV3Uyrq9rtX6)GHMS5l)PL@a zU^r9K?Zkdw>Baw4hIKRNG7aXdg)~VlODvZrF_eq-+oPyN=QvN3$dl+VE~=>Io>kr= zM7likjwGOf-BJ8mkVQDCqW*(G`G7(klq!Z}5J3AH@@CKj074X8TpU=;i?Vxk&p)nH zpZAC=^{}n_o-kkN{}!1LSaa&&Jb!*ko?Acub!5P1{KU}Q^rC4sG>p*A$LM_&^4Vht znNar&|HN7UtEC1CF!ZHj%3JpCLvovXGtsERvHL&Rop0Q20&F}rBz!d~ISybf++{cG z8_l@x7>wK3TZE-f*rW7f7ly}0mhaRKO1f3xFxiqHqLqT(E}6SbS3O7<4L)WC6T3>u z^Kd%z_?|bsed!O1V&P&WkIbg2>wE;Gcqa#1e<+}swObW9m~X%WGoDxS4~xItqS~LB zBFSA}eZpNZEDm}kulbc}?A{hJpAo=j&=VUxq9fhBY*?&4@LD@)QJwTWbUnL>nH8D% zQ5iIkz z{p}6!y{NJKWv-opjjEg3QB-V-4)KHJ&)N9TZ~$$@U4;EmH)o+R_#VYhF-fZ8$%`%! zs4qDHWr-gcdW)HtBZS8UAUU`0HXuu>{{A;5@o>2iyVWw=7rK7O-{jAhS!*5Vne=TA zBlJB6$@nL6Yg#q_r#kw_=EqCtI^oxPq$N4Cp9WU=GldCi*1~36MGP}(t{p|c{yDqe z*=%!KiJvupT;n9t#aoOUUYU?xQvYgh5PgvBV@_YXW87?xoZ^n&*jIB|s$9~r!$Ed0 z7B5p5k42PfaRUr|0psFB9_u~#E^13E-EkUj@k(ZJqHj@QM&1*$2VOnC#I6?DgZ5V% zS38=1Nxw1m`bUFT*U*fiR^CX*8QZ<|Zl&Q3`l+D(uCoi@=5OPqP7V6v zbOZLkV5`E7%NmKTevl7wA89~<)4(=|`j40ok)T2Ckj@`Gnt82p07G}zIbFSj~9>|rJ`&zPifBgA{J=R} zu3Lc9(9rH6VSpSG1p-ka%I#A8>E~C^ib`lxzgISYzJGmiGP}5=6p$2feg6FVWSq@z z{q2STF~fKO$JO#Bps^z`%BfLNqPnbRLbvc7$hY^+ zO9fAy7I8u-5keH@2loEZ8mzMHO@5CYOTIZ^OX8Q%fW6m^8?>lm1{8MU+tu97{HX21 zGrIYL41ockcLw79#1UsDO(9ozMtA;?+mu8LkTFkKLTKvLD{nI`$|s6bS+}j+zr%`E zrU(SKYo4O4hj}1n8_lQTwd$A)w$U~I_e%h5uM|ad&Ky5zb60GQUt8PcW1i;flFY+^ zFZ2ojX80vU;i-`lp^lr>D(TqpK^-!1eA~@81)14+nb?t|C(8%&Ed1ru53G6* zyJIGIiB$0v#VEht<>91D5df$F3$EM^i}<9X?q%7iJJiD6Zt|UP|F#ZStKhKA$Kb}F zT^!ywOF1U_>l-ok7+DZ=^wP!6+DB9}vCb1%@U( zWq+Bw9anyjiW*j-uD~wAK}SUg#1g*B===^6h~e;FVZgm3eEm%O|Kj|a3Id1q*I||u ztz-RcJhV*`f{b5Y0~Vp11RTrYTZ4D`vR>x0eJFRK5@!L#!X?C6554$4--bPTpq8_9F4;}L+pvG8#0||36%81HMw&tQ}hPU=%K1VKnfHMr6Z;Edosd~6ZqEiXQ!#50mjT@;iT74`2gi^u}d z2ag-FnsezgvT8!T;qgtm;Km2tAq7PhoTDBXdf~rcwGeutq>o?acGC&TL;@pt-vGjH zB1L{376V;XYP}!%Stvz3h+C}y+8b}3sNmmhSIZkeaaa64O2jBi6OP)VKY}Tm2(fcA zfa|UPr=Sv<(IKlwrsuoU&(L?$l_f~7-v~hGxqyBRDVo6uU~YkpLLOv z@D~OW;HbPxlg<*59l0^+z0SZBh4-H;NGlu=L($Vns?SI;9Tg)joF;f0y7nj%&ky#w zNIn?j*8kB>%=4Y-=Mp3U-{W+;tv4b}Ge;13o`pKUq+W-h7G7!K0pMXcAagHCEefG_ ze-=gm&*)5o0D&7dI6P#vtJ!5_Ux+gD{rN~mP${wkJq&r?5AC3z(QH6Vb5Q6(4sR>l zssVX^AY8Qbt#<|dZ*c5#fAzMXMXcs-YUuw@;ovC%Pz2c92K3!FxmFBRfC_n{ghsII zVeq*I(N{_RUFkMCd>9n?IUC*!gzLSudE5|&Rnd`Sr8WU;+LrKsjGir~E>g*-i22v# zD#udS?aaMeQ`~&m^^AU)4xr|v@3dSti;AzW9} zqz#xC)g!*J*PuvG8A zJ{e^MdkVu`dyXH;fcm&f55&F@t^RFR2oEjX!8ArZH`(8d;tez*8X*B4S#2-t!$<)& zt&e|+Wgv8Nay-@AY08OHqPhPWpellWqJZap^WQvafXv(;_;a?BWFXopU_(B(E9zS(0Q2o=4)pmxSSEHTC|vqBdc$v*l2>RZ$~ykEA}&d64jor!Bvk zOX>174puGbzVET<&QUN!pXY?|>-gT(qrk@Y%ExC}%?n z-9db!+vO0+}lsAIk;pHWw_j*uN^PHn6<4n2fYMbP2qipsT?1)nRUz0IM9D`Ss zg}c1UXO33l_tf)#;6lGOFQm#gL%DWR1yCjM15=%|{!j#--#fua&8R}+#j&#dU4WW( zOEX*ngCYh1itUO5lL8`fW^H5LY8Sd)0KpLdVl?t*V@8+RM&8PkfBil7HHOnA`u#bl zeXdaZQslL8;jcIEEPKa(fC|EBKNbX92*a}jRqx|Psgfzy!6Wmfw67BGlVJDo{AA>FF?d$Pl%#)4!Oj?@EDZ>LJO=nG$3+dc-XW0v9-(5k5 z51{T7cc<5J&%Cu0iYuOjG6~@}oUs6SokWx97HFLdI8FMznZ~FZSv)YtU4(2~5`N4ZMo-GouZa zIh%6Y9XAiSEKaS1=7_PSq<9B!U=+R5`PV^qE-eU=(MTy>fZ>yJRQA4m+ z2?-)Xl;}M~St5vDqC|AT>fipqnRmtvGq`*2J@0wXdCv1&Il2^dHA!8oE8oLRLmy^; z>iUGR8yh?y=r}d=nq@;0Q$Itn@1i9;wLfK7{l!ebws+P?v`MWVeLdC~&SMj~PUm&K*4`;(uU5z*F}SRn zgFCy3cyG&}{%pK|n>*=*%ZTf`sLR74lE-elxOw_`C=yc&k+RaHxh5@F5FESfJ$JUl z7_Pe=>ZX+H>IpUC+a-P%`Nx&`C-Rr-+0d}}_u#7?tS+we&5Gjm?{mv&QJ!l-H}Cg* z=Lr}@t<_+VT*TdF-e;emZBz9_Vo5wxy5O=)G4^|%peLC>K9oci#%8xxYW7@bL|@p0 z;0}FrlWyS_qy*yG+G6>BPgumL-UlgFF{yOae`kMIpTKUFs;=X5SHCTv;eW`O?G8-6 zxPJQm;I`5}PrQ6T@I`mP#{Ep@^7(Jl^YPsM-B{}aW8dNUmlvUFNeclRhy4rew-@?u z+s$%8lJP5+jlWhHbp67n-6u>H4t_;y5i?xstUrz9NU-)sbj#mr5f@)-$;)HQ;$vEB z3{vMgdkR-Md$Q}z=sG*W{iElfaSub$PhZKpwjBpwuyir@U-t-RHKiYS)C)4mt~N~^ z2fn-}T)A{tSiXo%ese$Fewco}IL-0MUn=%11C;T+2>Qzg_h}eWpX^`Af}V26dA;S` zMF-lA@T{>37h$UY%xdQ6ixn0BrZc@N$#BwyuZ$<=KJpsqNB#;sBF$Dck$0P1f0?cX zcp`rtT13R$2kc+#5ch|(42_4eamnASrA3~nGF<fUGs#g z%U-53$X|Y0LDL3A#~(V~AZ`nf(rEgEr3g1<_rJZb+muSvl|BE}?DOx3=jONkhM|p! zjiYO+!Un0r>K0ootwsHL>c@Sp3NML-$6B6_tSby$%*bacCnyL9{Qgbtb8_mr`J0*> zcR9V3;h1}9P0xCUsj^G0!}MHm^XORc_mS}YHm9h)zybFNyel<-W0eMfXk!JTVG(8! zfU{!t?Wy*njhk=UahvZxY>@|fjDAXMYH99)PK~5*@YmQaI_tftO1E|V`v&c+6t3H$ zuinM@^k06Yxojx$jXct7+_fsO_x|$I!iq8aaFL3d1kp`gWP7CjWbEwL20iSVaP+hx zQudJR;V=Btiy_=!kA{XnE_nwj>`6uh(B3y+XRHvvTu8UUy=h`P+@ANi(cQQ>KON{? zxaHilO_v*&|8+L`sG&>lI(7&zfk8V%rW>4qxPM0Hp`=VD)g*p{NXVg}G zqvc{IhRq{y4p*AMUG?W;@(QW$HF6xc2|scXu6?=MT`Dt7kt8(9`!|CVj{BNn0X6q1 zt`wpYBJW?;VRw0Q#r=Vf&3_eWuIZy~iG$5>2+ct;g7FH1;Wm&%OOA(3K~_|qU#+$} zLZDRbtyTxY7x2*+fzWrg^2|S;GiLBiFl69=C;8SgMDp#8J+9q!AFkc+DTv6+VGwP= zJ&5)*O~49>HtaBhHf$oI)s@VxCxRA>Udj_eSoq*=2X)iX96Y~qNyK{a@tnGd_17;X z_TAGY444KJj?OY@;W32MJ;pr;^spK2-az=~({TMUz0F^;i^K2T$MnAsLYuzJ)g5FF z{3ZF;-c0hXKTm&ao8(*2T>rLwZqmehIQA}t{(c%n`zjoBti-L$yoK+Ah7U7nS$LJQ>)SN0!&(4FV1Lafv5eXp^${pLK{5#e??70!C{5ytaM4TMN929z$p%c1Wq7!;jq7%Mu zn;+fs=439yHj8PAD=W9>(XR&!Y!7X+9t~diwb`#Lx25O??Xc16nO`AO;&daz^7x^J z0>QT#{ED;(J=cYK!F$Sy9m*oXmx}oC?KR(?Q!P7t_AYz5&B%0hJhpY{d|Xypm-AkGIcuP9FIQcXAv0mN zkNRlHE!%daKv~55j3xi;u5JF^jpg*Ua{kFq0Ols?n6)c%F11;5E}s_bnEd;wV}fo< zu{vr>d3#T_r%Nk)K}0LN?N2LvEzWRZG~`e_AUyl+4Q(BI-=0>qsL5a$IHAA z4;J__AJTy`;bQaTTz}~8nXtc^VAesf73bp+lJk!`7HHzVeUx}E26{28E0RLow|o$s@!o5{KayS| zZme!#H-=97gp1=TPhi>R_IAdz+vI-xI7q=2auf_S9U@}S=*2)Q*F=cxrA>yimF~95 zbG;lETc+IC4P@6B9yx7!Va&FbSAe=DYnIn#+EtMcw|WibKTfo5df6p!k3E zgovwJh2^3{hc_3Xh>h*L7{_(bdH$|n6Aj+P&c3MGDX)+5<1u4_zrg?UAJ|9@_0=x% zLDcxq7jAqg7DBqy*hN+Pwnb09@2lPu-&T(& zMpp6p?2r1Xtp!I`HLGm|zpoDe`{gR)cJ;ME;*9dfp_P!KUd7{3^7*`fKKoC4qSxSx z5DX4+JWN3rXL`u=$bq4X2}5%OFekPAP;Kj6*^FphxC4e>z0ali>l))227l@BB+n5X z8v-DU!5DNCu2PX-dlU-%{Ro5K`)$tK3D)LlM8{-SEE){!M`7X&C{N%u!{%XvK>Si* z+9rQwU4M3$x=*i9c1(^{>;-nv1--(Lk@37j`)%6qHg28wMTqU*Et>D9gPs+R8>jqp zI>V+R?|w@SIjpw*A%7MUU(bNvn-iOx#`OxKXGWi>Z3H!RzT{+9@1BxB+oYW% z7&blT8BV=8DVqHzaN&`Cpy!@5lkWDKu1fim$Gm*^cdY>@q3AYYD3xvBi{6R zR!a5N`#uS6>FL_h7ghAT&p+H#@kGf`wfVlHP?dYN93N8pG0t;|H7>;Mb@Y<;i)M|e z$5n#6g?qv-P6A=6S_7lo|G&H&#!if?=BIXb^Zw-UOJH*{t2F8@UIjPRre8( zBPl4kOI`7+A-i2|j`!5iiJ9eiCx4@lIiYPvTR9C%ewjrR$$!9R`Wc&U-RdN689lKh z*fsH?$I-}{kHay?kwd+rvcfCN$RHBkHWhJ9u}!?7&8)wV2qw?kj++)R)ov{R5Hq@8b|t%GCWYbVdZSJZMw zY0<3aHal|z3tRAD`RVSUZZ-i zVB28G(59)i(Vo52Wtwbrk1g9F5NuwTvpDv=M}0!;K%NWI317eJwh>}lQ6U7FTpy=5*Xf`Shxm(WCWBz zJX+j@AA5I+t=^wX^`LoEm77FZ^k;MP420-XKAaP}lmH*=N(zq+RGLtzDwaoz?{0PdxJ` z7&$4SaKB8+c52W{ZVpvUZi+A_XtrQcEl?mbPdicgW705GVIn$R`KL^1=8p}})NdA^ zsi5~1s!PdYomR$S|C;+L+NZw8~HVjvPO2IUdFcqy5DN> z>70Sb#I=c{O8kMuvzM+@4jOJm^L|OS^13gpbqB5uhpqfY+z8yr-AZkZI5j#)HaM&* zyg$`v&dx2NpQxP})9g3vXExtx3_tV0B0Lk6wK&OTbl}(f#gbV$YCZhm`?Iab!!NEL z4?hbj`OPB^%vhad@A0*2|BG7U3D#P);Sa1|{Y@%lpI2>o__>uJmBi|gh zyO;W~X-Q0fe^cI@8_a91H6G?}UCZIPY@EsFsogG_^`@QZ*z&p0?~g3fK1Ojy@kW`2 zt$b^;+o!F@`aUQ3bK~y9t<@Sj#UIcwD7)5ti(RCM`I+RmD~>%G*aVxBYLjFdGr&J_ zG?S=EG)x=QH$&T5>_ahBkr%UCljg?SHvMWn5_}cb)s7V?-3bk3t`oi4<2+V@;#j#f z6GaPDfq=4`)UkfcutAqxVj#_WxmOv-r|Sx@zU#3su&SPLgQ~lZ#MDqyk_R>qQYb&f zNGZBe)X13=uy7KvQW4A)a>lvnfzK_bFr=P$`LlG8gb&W2rj4iAf`iLM8jQQ z;r%GNF_)n})tYF$z7U&k)uMZ1kPdn1>c(GL&xu~7i1$_GgHK?iTd}W9%(UlpKN)|T z*~wbCBHI2URHK1AZ1j(6*r-Od<^kb$m()5kh@@XvZ`f$vnC9g>_Lr3u>s5YM{brH< zE5Pvc^T)%_J*s~5Dd?O$r{THeON(C;xFq{gZ^Ws|zup1$N0$t`p+U2{0_gX|Va6nP zZY>nEtYK-c^1!~49k4AIc~kjQSaj=IjQLLC&Io*9_|vIh@^do zRauj#^M1C)G$!NDX=}dF@%Q8zwghgUgM4&+_}jiDk!OTs2+vq{Wox3#a=(V8b5kW| zOrT9|Hsftv3pDN50)L(GH9qOD56cilrf0+XBSaDEi9>TONfad0+?DY=l*`ODC7&&y}1KjD_c+25hsL{nPqeaub^(G-j-*^K)HN z-DvfvFY5wl$!M*QRG!0m{m;U3f?joTca{pSMiKEHb1!TUB)k=4@|bFG(L5b|NwhS_ z)&KV1yZ=rEKP8+HeqAb7aND`q=+-c;#F(tJ#NDdqnK}3RZTZoWu7TYS#!`HibC@J! zWP$pu)wisFu~X6Ke4hJPs7I#Tl7uGJwBXlM&ZONIO;%72nY*NxREY?oKauJSWiz*I zoiRx*wV7u8-B&V|%0)kr<2`4v*{@ZO?(MS?&%v%8Y*FINxy)u~%^aWTb}g~}D~&>w z!zkBc2#yqk(ZH4f?&)>!bE-S;TY|6?pXf=+PIAGdi9`Ag#7n{C<{d3GzI-nMy%>}6 zucP(jF8RedGsL8){L_F@j8IZ~oyX06R%1+)zI?o0*T8$8lSj-U3!}Hy_aTPst-iGg zTt8emUUtpuUv1ysYXWUY#Mm9STYg^oZ25Wlrr6Ho`lCv7gn6lFh<2%2JIm`atE_Jh zb($(aX4%{SnBjYVR_mqj;ztra*LI4@vli6iG>H!p)QGGAyNFDItSw1Lvw=-|_`{gL!@UZ#28Hy}=))_HnsrwE>Q68wFWchx zqZY%4KDl<>61r2=`TRX`oGj+z`rrpC>K18P-C=>R1P`5#H)(k~E!g_sK5#dF+-NF2 z$!V`Ho6YDBlW3Iwg&L$$rq7~u*PtpN7O`!o8qK1e_1%&cs-~O`{I~CvhkB%fl!Ifd z*c5erGatK;@vcd+Kgc<9N!Rq-rzFRIP*-oER4vbmG|JU9$x&x-KVc)+zhr4w;3mt- z)leC@<|yrbiJu@uh9k^cbEAYG1CUvI6vrxC;|Yo`n9yLwp)y6Sf3TPL8{+e5zGcnV z(vhHwe!HMEz@@3SxZ}Vt(bMk8n|#5#VY9)myoTv(D-MZJL{l=b(GsMHu^(LoQQ;42M+Ez7(WA&HJj!i!DCBK|l@t~(lf1j`+zaTPoz7%Jm z3evSrQq?(X=Glb$)rB4J_p45 zs}=ey?)l@+E%E;GS?2s>dyw(3^;#qT$t`>Ma#SYEiuIh(FsZD82ynh)2$k|5cY2X~$+okMltW zN9BPTp1sVn<}mK>$hj&cD40owONaDJQ$Gl05kWc@r#27g=8tb8Rl`#)b0;Kf7Vh2Q zAMz<7o3K%wCaI7H5Yq2JP#bAHJ4Vag>Wj*G4ImI#N)NAA1%?z5J29}90j)A5*Mk{$fSGa#gQpZ<{yR9b!Tm@ zT_6Lm?gtI<0j=~X4HM3=@&3T;d{ok*NGU`FM`K{c!#5)4)?TSqN#6l*0st{)a)1u| z9`pnv(l=|mdY>pvZt2o#xO?$=8quohGVzO*=s0LjO+(VSs7-SOOfUk?;gz9T4H)7a z4*$zJ4EibhfMSBXs%WiNQroF|3}_h3eE*AccrGZ*&Z&hA)u_T` zNiu@;zN4vREBn90Q9svta7YCRzMUwH_Pk1v z4$2o;O*M-EQ|@c_UyB@r)O;n)1yWxdxSY*Ny!Th282w|;KD%VjK{aA&Q&k*?+@*|N z&nHQ?ES87!PxCk)j=@m^nYG(g!{8iI-#h{GpU$sT0v1`x_M0_K7RJbD;?EY@^UX?& z1z>v9;>uaNnUBtNXRTwf8amG;HDDcQ^Htr5`8p)= znzsWVPxY3sd!!F{b2a938WY|o#!)r7a+(eui$fD<)qeDfI>MW<#N(zx>xt@W8LJ>L zjsG`-Mm1nSoA0Pbc=kCvHYUgwlaMVwY#BZqkiL}6T)YmQ|b`QZ~RroINIOmVa`3Sgw|#- zJ%_?ec^9#9X=|yFZrRMTi)#1*HM{Q*E>Ow0Cq}0HEIV*zz?o%-K_t6??T_|&?!N&C z4KK|8y`Z`Nswgptfn=4DZ@E42mE?sJe4G1t5X0aqE^K+^OA595h1#-HHP6DHb)jlx z8uZ$CP@^YL4PZ@<|0_-44iO+n(f+!wQ3asRz|Ru!&gh5&-kTsTRu=_6vM|8(fMkP)6lo#hCBSKL z{TZkbfSC-w%(BU1SJrQ*9*~v!Nf^hq8XjFf6dK~!_~$`dmLK+D??C{603ow4gpYz&hokoZ>?!2av{l20~Fv6wz%3A3E#)P zE@?-B@!qFz-fQqG1u3PNzI*r3kdqcyBY6vtB1Gn=}wLXstf-<`e9?D#1& zJhg70xq04O1_Q^hs=G_WHV zfv1|X>cBw(&?QUZ^FV@n$4v0nIj{gaB|t#@p`;@m*01w!{YPPtVvQZIjJ}fBGxF%S znHfrD99X};l0uC&_N?)T6<|syXE~@a0M#C-;q=iX^YK^dZqf+xBhwKQ1iG*|@&|yV z#jD)(vixsf14_gor8(BbL39t0Mlm24WtVk^*=REPzpIRr4{gps2%=jIKP6hq8OIfb z*MaYq@HWe7vE0t%RSOsnCXV?Gy7?T~HwFu&0mQZfG!cKFnlM3~A~n*vc9aKlc73xlXI z9E+FPf8in?-lxA8HB2e9B~9)Ic8Fhuh1WrPfs6q%4{N48?iNvC6T*f#E z(hypdf1F09l%H8izMFuVLb*_Ok{A01*C$z)yL<#kdXI-P(V0TI1t#Ryg>itfR2=%P zVIpy{o-O3-Sl)tAVmd84O8t5Muz(cA`^*p@eT=yCYU}~?nG)sMR$*qWBJG$o8Sfvg zLP<{@KagbnaDUV%wh3hilU`lm;J44b|0?^A2I^&X%Va zUNzyH+~t;V=V&DY3|P!)S~*9oU@PHS1PSRGSSLJU!%+~(aj6ondbhlzIEQnHUU=X? z{lGta3se|_Obi)ov&ARiq0slVv%>PS5_3bR1Trl`pV{?Fyfvt}*R@_KDT+;$e#qV1+y@*j-d zGtSj^2LQ~qjgoiGxC&`r5)W2;3!b9$#7Xpsrz5Dw)u@J4e4^@Zlwl@frZc4EWw92k zBG2w2fMJ132S;kNN~Y>GNhv0w@H~?4O^6dVRSc*xOx0M6nTQvme*u)rbC;?ueNW&R z^(y*}Jtvl*K7FvUP%#c!D4!d3&ve`i;E{5m2OO&@6y*qresR{vG+}%uz#J4u{<6D% z3lhT-e!pO=`vGzD^;SPCoNRds|7;vD*fncW&C$^7T6=)sUN&J-mH))!u4I%7#|Z^nZ)Q} z!i6AQ-wL13P#-;nOL{h`084??(kkea#er19!x+5ySLK*wiU{~B{1AcV%Zs%Jj+4eb zqVBJLtM1ATS6(^;Yl8+A6349 zW67cBP<;10917GdGNO~$1`B2)#Vj^Wg3K?8C0B|0Ta%rVYMFi0+{uwMqo_wxKx>AXLk_BbLNC$Npd;;O*X(*T`9DD8o)d{fxc|@)<|(hVLov++6wvSMeZ(h!;g2-zF}ccpC8_CK zzUs<9&#j8Ya~$wWJ$emH_8e-T%UUH|wP}53R;4wx%P_6ST@q~FI)rAy)Q~WLknp26w2BLt4ujH`0Gx~)8BJ?g zLP3}pMnw+L*Aw$ldN{3D4PTc7?{bxhktVxbvHs9+QU^vRH0_GEZ-6Tb__{az)D{M1 z%E9AClI1YvYE+fH&dJqcH_S~;HdJDy6ayuuKmh#K!(>{X4JRFqR;h&PA zg2S5;uAh3gm`mcNKy_ESWWI-z3|r9lEf>ghwJvn>2)nOjx=D6$PL2U3L{k;@Nh@Fzr>J)umAI&2<+lU{(5NMxOV7SW~Vy=IzT zxf0}sUl{is`i*e$$7eLB><_^i5dI-j`B2D{!;F;RE3LuyTWbirZD$)h+w^S;>{?Xu zmas>hEc)#i)XQfaHBxn47LFCGKR#=F={}Cz9i<<@UF)KS>3W~W{W>TXsyc#ggs;^e z6TgBMl0$X(u0Yw|?gmE@loXQI@=$Kik!T@eF+6QyZ_aiQY7e6C0OtN!Pjdu|CQnYw z;oa$Co-W_K{Sy@J1de4DP!*rXoS6g-QSBN-eNVzBl<_)dNsw5u=p9y|5>ooK;1N+! zCaH`pKHgd776=(TX@}uv!RVCn>^~F(yU;3er7GPCS<>C|ZAP}BuPoDb8DJ$jIBckd z7rk$RhaE<)gv=mU>d2p*6E*T=o(|RnU~ukx2~_?ZVXTO1WCWf#bQg?@RIY*)d9bCJ zv4vgr3dDjRAv31Ju)brFcF^E)Bu;tNkY@8RSTiPFDPM|F5dm>mf5t=}5s8i~2P`u{ zDMzB|A%)d%aMCqydFTP8Z24o(aIw&!w_-rQQDHri3pZf%+n8sX2|61}Z_oh$@^k?} zE@Wh`JSKB*f+#g>IX&n${ZX6we%Khwy*dirae#8y%y8m=1WCoP(pgY`aH8zSxZ`#c z0Fx*1PbYAFC2m8gnKch!f)6}D&U?r#MyiE?AhGz~I^e{LxMm!Bm%qu=?lg8S9|mI( zxzL>e%uV#V_k{fS)g!ANUb`4uyU?t742eB&B>l=rn*7y2)*pHc8#-$G@81I< zF(TF~+tXT&A2{-0DR7h@Oz{UB5u&!Q+90A|?R_fxgLr6Lc3=62IU941(5_nY z)cWSv`;siVCDAh~be*iz7LXFB3%rs6uQKk%Y1U1Hel4>8Y+@aH>{v%^a0}kV&ocPx!DLS3H$i|_pSw3DZ$1(|@;D$y7 z>6V*T3*y4%ZJ5OvNL>Jo)S;C4TB^q3;*m_4|IB3F=v~dagS$VsmSHx0$gS{a6m^aamA>=$kj!i-iMD%!Z z$#Lp*S57b}hF#T5Qlb$k1B_5SS!*C8{A0>pvYg@%D)IkMnOp9SQJ8hSC3ar%v$s|y z62bvEA<-pnuB;L+{8?4IEm7}r z@M;M#T6r~^KB8m=$_c+POb((#%hzIRLstxhP+@cqFr_{KF^)?8RBLHCbQW^?W${VML6!-(uSfBFWXG4&jn+N4f?}LgTlsvs!qE|v= z1<|pE_4a;PE8+dS><{BhVrkAEDnBoYh^H#k z(mA8?A~_Q+W&NnVs3C&Ql)U!f&nYxExz}VusF%w#ndWV*UfO-ROQZz$p^lPIaeTHE z5t9nurW8y^sg90vXIQv5d)==b1jbjq9iT*=)d^{hnJbc zACM%pl+!6h;-p#}(`jU9F-{(0bFIjDP8xXjhSEdA_xu>#m8~(p|1?Y;RH10vZK6*y zm>eSfbQ%O3dZIBFDx@}@^>E{(^)gM@vFP9{ncd0-Jmk!xt!mM6sm>2`qipApbm1y| zd>m5MkY(_W^dSHvnL2({zL83cF8@W*Q5GL!ZP|6)ATGE@fq7!5^%WS|vJLS42a^nl zYAiTY|Q9Az{1rZCXkcIrDpAN)EXY0g#1VvkT-w_~L!JC@Z?VY0@s8N} z92MYv@{Rbt$Pg%Y$`@(>e2L5jB?llC;eh#s(I~FN4UIT?flKo)-Z3hV90|R>?5`vTKeOLdMiSd>&i^a4JY55`mP-@nu*rom%fy?a2WpGku^_LNV zP1g-b49_w6V|i8LdR02Upa&ZNDig(>&|Badzr`WNj>Y*2eNhcjdJm@OphnBuS^7im0gfm^Od!pHKLG<9X2M-1?Zx@-;#|jV+D137#zoy=7@cE@Q{OO&S-oBe)G%};jOxbv`0ovz(vWr|>ig@EZ$RZV`a(~vgGi^2{v_+< zl)fm=+y^ds@0=x}C!id0=r%4Q{L62}MBD+JY6sC^ci(l{Hq-)s`l@Gqj?f37+ zjMEsT)7}s`$?%rMRcd@C-P#D>*(NoRVX|s=BO+HI7*)0*KV<lBbb5S1B7}3Am$Tw4! zd6Y%(OlzYv;0Om7WF$MvJOVKO|8aN-Luf6544r-R`yep)>cfrS(fGv!rLECE$K`6suQm z{HurU*5juhlL2Cxl(z)7E_Cx$A==vp3^-Vy$8kjIGFU#@F~+^paIbtmMM1j2p7e(?)QS_jpg5GXk6xBWOgiz z3@`2a4=)khzFDZraucx1sd`ta!ECfFV z3P1!bRzm*&Ed^v4XZ(bhLKrvz!o~(S9 z3n!m6=`JX?SiG4$gi1xO70LNqCeV$WB|9toi7<@12BZ{zLu{+U=*yhV6O5~bFD(Xk z@*yQ)_OIB~by?Oi@foG%a~VpKA>9=Zpi)U?O+GHY2kR?UX%1YE-Cypt=;LaoY7uB~ zBo@bE4D}u|Pxn^I%3(57oiW)znBQk}C)P0w--i2+zB)w!iYHZsJb0zhS&RO zESV2Ko2-ZVViz*5L~N3x&okiMT?@G3y-(pgsMv0o(x{nuwN zuMaX7n?Xu#huQo^fGb=Kf&>~-x$wp<+5e~93xEUAcx6r$`wlnuT^&AYEl5fhS4r6N zGZ@<$&h+cemh16BUE_*IrE^l#GSnl z1DxA#l;1c1gYd|^R{mzhJ!-#(D8xnpc((xQRn+gl%@0YxVwSSczxgO(Bom;d0Q~n; zY{Dh5YuAq`lmtfYDU0PlI{gx}GvFGc_Gum_hkX7>q_4-_^=DURqz;1oQ~*rU!97GN zqBdUI7=cP1q@qP7a+&Gun6q6zt&9|(#gTL#^-$xeNb7)@T~-Tu>-CdCNYyo_Dr6K5 zJze5)gBnPjw+d2L9JUk2+r?dR)ggEWMEFx3WPkn|k=$$9#FoKH?8>1ze$D8r0 zjTJLt%Lh7X|0-hFUPs5;_^3oJtmL?4!Q!QvG|r@D%lokkV|rvcT$%bQ)_F^b1{deW zo(x8X++t!o4el;aibO3lh(dB2<1xjvTE4~z_)i_B5hT;|L#q-n?Z~kQKpc4YyDTxE z7=O;!td*Qx?Ldu({Th_$($#6kO#4M#a%rD7JH|#3DKX{y+gIdE8Sl0HNHsJ+KP2ws zWz9#e`7k)euQTAv{NOI>!4{^)-w=if6aVAKRK#A#!7-6jG(j752B}JLMq^=ufEM1F zo{|<;5kAkQla5xuUG%@WcOX2J_fNm+iElC!kjEJg*zkBG!|~0=@4CYpyCQ2E#~l34{-WKk8xx!E{l-) zPvK;jK?`yDiP`0`VUFNTeds(fd>h zONC6;>%AGD(JOG=-}v?D`Ik9gpVygL8MihKy!c@3{&&i(R$EgfYgu8(_u%?6Y(kT> zs_we)w1A~4O4N62G_-j8H0+%w=~oeo%$vo$e=MU*Cv(`8a2I}TKp=xKh_EY`M&26= z!YIMaurOoOh{!zIl3-ReE4@{+%F%!+7|SCI~o)o#K06 zuZnV~Ee|omy0h>io`mH6&BwbCt;XvNdUs6=adO>@Xu^kjE9Bq$0Yw4Qs7Q{NIweJs zuDAzWz=sq4q7ikuYXG*W=b%8@B@17V;A}u#Vs}f;ri3B3YOs&m@3@)1)cihc&D^$? zKHVA}Hg2{e(sSC%I@RCiV9GQ|Np`}1=B2QK*J+y8X?8UH2t@;Bl;4av0i}`~q&h&c zOH__*aI(vhd{QOS$(dimOo&MfY8qiE}O%-P{exN5g>$zhGTP=AB&eljS9`Y-Vw6A2JQJR4bk?4KfqN za(Xy9eIGix_L)oU8U#_`QN9U@u_QZ+rI^%fLHekIo(Vn%As>Aof)+Gx%cbEe<&))P znk>K4wlo22@Cd{WhP`=6L?Bw4yn|ht{73ZbfIv>PEiWnN4n6WyDxfB+4{NFQQ(Iy* z%ChusA3AwB0(+@N&2eWQCxV|y1sLQp8t%w$TF`AD1e4&>^dNAe6t=MdpZqe1_!#IGQF z${8TiSOBLKKd5pCPvO8D&#XYUEpbx?f=@ChK4K|7XJ@_=CT1oLpaPmGXeeXP*Ww?8 zRj9!)z_m0g;u~*l(qzOsHAx-Xqx<|t3L5?jLU+1s@fbl$>P|B0D!zx0lBgDwJeZJ$ z{oV}g+t&$68wq9O^isutQIFF86ihme{49g+I5TH&%*#bTkRjg;jNfaFTYr*yW8$!5rjshklzy+}X;zS)2(7KOqgt2eNxf&B10- zD5@DS^(P@x zr+>tlmJ5j#B|!`ZW8KxsGJdhV)17YFd^k=o6904>?>=^^%39Lc90W_vqY0TlJ_5rJ z8Pk&0pQ^hzlMWx=itXM^wu!CXcfS=AumKEHt;e(^2%z~ZA6}Hx!T`TJVOBJ5;;JoB zG(IXW9A+k3@}m8btT&WVNz=*;Di=L;tFsn?<`G-htZ$D@Qx@WdZ(kLfm)dSlhmqF9B)UVjNs zUVRHBbADOd&@kF07i4>HT`EEj%)=qONBJ6LPe^%jr?oY~Fv?5-CdjTyT*AwauOxoY zgHB-!Dh(Wq+%i<6!-XwV@UXN(w8(f`5MqJeP*B*)b-4oB}7m7ng`Hb zocKUDqHal;d98VKaIo!%z>M@>BuS&}9*e0Q`bdj*yL!pROpS(o<)*Cwjf=f*0~(XB z^KVY7KDttSoYz-{|8>=;M*Zse+fZe@%|($ur&E6>x2QLN*s|`UfQ=Y9i&QD3&dw;9 z^?6#eS!e=5!&H3G?9qXMzrOLq#Lwc$DpMOnFA%a&koO~Ht|o6C$iPQ2&qdzMH?{xB zEs1;eA0;;{rIel+q`*-^NfA$}55j~ToJOgKxY^_ewzE0ikJ8&FB1b@}ltYKk zFE1Nq5k0qlM|NAjy|*cj3X~nxSS1CQ>=A*uh5$hj74D0CB>+Wu;F!B3_e1A65iO?; z;(dViym@~$M(4?We*YmD6)+Y_0If@Mk-Y#Av-MG{@ib6x=&w~67r>al;;lfd>HPcb z_4Au?+*u{2^jUHT=R6R)1rZY7v?H!nip(@_+9z1eQYzef9WM6!r66-0o_znIshZ|z zGZjJHMr_>aiOXS({aASm_MvD=@+#(zdO>}cQrd;yJ_52^-PGbg{1ebzdz-1me)u=v zMDdyUvt-3-5CxZ*<&W%wv5ZdTs&3KI_%!7z0<9J#&&y!yk4{=?JNcx$sufyzy7MQ| zDAI|_w!}?Yu0q&SAl}dUcbWvGbTbk~?}OyUipg|^v)+s*84vzLstV%OdZ|&4wSj}4 zMx)Bb4=0~|>|;k4I!#`uI8|?{coT3esc*dQV9s7QD4?CxA)gfGqFePd zhB4?zagoDu@QMgau6*AygYvtpv@aNyBB8_uN#HPt#HEIMkw;w{TN2(k0?A98Vc=6K z#Cx76ThF|s6IVo~e$ra}O@VMvAmlBarb`n@Xj;mCwkJ)@2WK*-HpU|O)!!l>B{d;v zk|a(YI!>fM9d&CoqSGdw&OxjD@njaC^_l&!@EEa`)Ool-F4U<2l5JF*7=nb(Q(5m@ zcu0brp-%fan9lR}T5Qw|U|;Qp{Tyt^2iuD`7R2oz2X|v3Un#R&5&0R(#)2(Q^CJs! zoz{+|W7ng39X=M^g~C^VI*nIErZy?aG3;L{^UU`v{Zl1L2P4ZS+e6jLu+>rfi(PRW zQvDMb>9B6H*fcPb4az;_r_194Q8NEXgUs&t_I3+a+!=uG5U06c3z3c-yKl5K?b3ks zp|abgyt5as>p>opJ~a%UUoe{jrU(`EXoiIXcaFu74L=$sME}+sAQCEm9mFq2UjTK= zH8stHQshZNoq&Hj;8Gvu?J4fcl=8pof4kp1Ve@@xdSaA3BPT(3wnPFKEkH#iZYX>^ zZ6yJgWRw3FYZa901IR5f-tm)RMlSg8j3rE^fHsv)2yK^q831(0KPe;q-2t???c)HT zTjhch#S1{sl>_=`+|T!;`auA6;7>sLJN%B1qNVI(UC&bf0salEkB>z2?*@ARYlJcq z?lU7E1%7w!MxOT-!1EHWeSLi3UdRV*0jNjtT(5iv6abwi0OcCx0LnQ%o$Vddxd!!; z$^f9L1VFpEo^&1ow2nvphu)7aetsm{@lrV&Vp0F{M>$>|i{cSJOx?~%!2ZvpuB+bX z&7639gXSln#r>fb%$sflZ?yGG9&ra$5xhH~6p;j=nVHO1RWPv&8po*tK!IF0i_xsiPcNKBFW1~MDODe+UpSdUDq=K z(715qr6YkSa9N>r4*2x7ODZ1myD1)}nTf3H+8H%1ITB49crogx?cPI4uoD2C%KheT ztV7cpG|r1WA4&?WUn*)n*9OiDcR=}ILIf`WZ2~}>96*^r1VRIRP6p5dPPxM;Gs7;e z?;;5(IE3<{1po~(ydYF-g*a~*Q7Leq1OWX7Qu*c{02Bw5RZKnu${HqjKv~7)^PkK; z)_3T`0rQ{v6_k!N`zaSxv!CHM?W>n2qIWMJNsVXBetP^~Svq3&vl!2P3PM@Cl#L5W zKL6>_JMgLa9rrV<@{s_P_+1609Ag2wxO`Nj@)7f&wH-eJK;?b{pUi*OYyPwM007GB zCF1vbR*cm%@7%y^pmCl6T%!m)Cd`i)a6b#<@w>)jcs}}HX8qZd{Qqv@yuHlVFQs%& z>fDUWM`8X`QVTx*CL{;Y2?sPw1Rqv0X&Jqm@Y)5c7JNJd+R5vxiw}8}kaDbt%k=~R ztph+ELaQ7=DN^msrhL+nKf?+A0SHw|smkX=Cz|q=ZTTu9`SF!a zMDvR0)2wbvjYo z+-6wm~g1wf_A5X%4dOc=%K6m-h*3=XL71Glb2{BB^ng*U!d z9;Y_I9tHTMbc9l|^O@EN1@M{a(DSERU*5cXxJ6a^fH8wF8lZf!`Ilct+n)YUH1yPH zwEd-0v<gwm&l( z?fPRm+Vo;6TJ-BuH2r7^2rWemkCcGWay0jrG7wshrXMIp-8YWL5IRabzC;`>2rU7j zB_Om6gqDC%9UFk{5IPzlG=}T|q5lR#zxfV?R*yqy?1D0eP#u@Dvg1yuVtF~i!3nL_ zZ0s`R5DJjuhGv$Ag3@;&)Il_HLK6rD(&dIKf}f3MzRJuXi^_lc8Ktuk+VEwTu#ZMF zafLg9zmA^+o;(g+HLi?3Cp*WLMcC)q$0BvFUe(Oa*C|^3z#Fq{f zS+rkZ!G2*Y5V}PG`Vs4xK5zhS5P+h(fp-CNN)hY}U9j)VXg%lA;G?Bz;PFzlXZ4?ARTUq^7cmD4fTkA60cETxo&l{AfU1ZDfCdK?sSPg( z1waFY#tvu?A8OmV$O4N?_PpVv8arPei_UwY9QE^9%;ewG!UvRQ+}MtT+JpOHG;RB< zMBA*ZVMn6gg!78vmp)DdUJ*PFs3LggN~>q%fYOA|uyZs$ofsac)m!jgBr*a})-X)~ zXab>X!N(408xCk|Si>{{p}3%ePF&9v#UquEs)~Ho9{-yf);%?xMNGO*v!ACZOTEJy zCPo|tplfit0MMq@f>61j0YY0SBRPQ5xK#|_oJ8=fVhTm11VAf5LUF2A?D$G1AQY%* zz}aea2|yDFO=ds^p>Yg9hY}L-SvOk}fTCH%@QDNJ@EIIXhtOWV8RE=%0V%ZLb1ESv zGoac78pCIemyf~>s30^HkYe|f_&qqEz^Cv36nv_v5f_l${nQ*C09s)Fv!I4C4k)W` z(v1M9;M1G$0#F=KhtI?T#r^d1k>Yn&`{d3+tO>&X)Lf?GcaPxR3FUsp9O(B$=mdaf z;^zA#0Hsl%atS_x*}8c+go6OwfoR(L7ozS9KZ<%U{b$s(`ycLpwq3wR3hm)#_ildU zo0N`TkBS4Yp;x080JK>Ex=sMfIYA4)i59#7RO^^rtF$kcwM^`cEw01?l~axid{}V^ z#WB|hF|F?^EK`F!flwlNZ^9$SQ}UcE4qL?U4xp5fR6xql7kpAenoA3w2);0f8PGYw z0nK-_M-$jf7dHT(XOB1E(+-|V35nTH2hapUaX=kH<$_kYpAMjMK-U4A8+fk_?q^2M zr@Nm3sN#2@|77;FIe|}_?{Ys|!|J6Fzwh?=JxBQ{NBg}-?x)H}ar|CK`@OdNCLB=8 zM~dGm()sEom5-QxZXgBF>ZLp%R`Xml@{8pZ>v7ZWPrVj#KAG2+11gx;{!ndYNENoZ z1Dc8*P+u9Q6=D)2B)(G2H#_M3)(0&d&{nzs0#Nqi#u0p$7JPL(sR7@H6jm|C0NSl4 ze2Cz4>@2SBy%PxK^~trXDn)@H#VQpCQN@e#vU>m4Bo{!+V(zM0?8%E^RNtT!TJmy1 zC0tP)(UdQ-50QL2nGubn`7k3Y#j(6M<)7rD{e-K^V|kU7ViC`$UBM9zuBf8_K4y-V$uf`zh;9Q!w~o+~2SSHVGbf2# zxDilWk5jl702PF;#vv4lt^`8e4F$%QGb4Ex5VjNuTN1mWMDo>g{cu9FK&U%@?(`{= zSK)@&j39KuYkV`$C((t^mZIG!0cpN6vX8IJoN?b+H1FPWwCJv}Xu;ufG>2oDZMF7e-Uo|^`eo7NQhETrc$pMsacWN90 zLWg1q9Rxr(upg9SQtyvHi&o-#4)FJH1VC5(is#@C9`}P|(bVe!{!71!8i?U*R=>+C zCT4sWzYKhGEn@~W4B7&!glY+a!$|X>tow^ELw2*r?H-@d(U5K69agB3saK-lzF&3?oZ=cPq2oG z2%ZQ$#~P%XdB>OmjU7+`G(!ZRRs=uE0hJ3n;ee)C!<1qds3Q3B8PH@8sIOp3V))nr zW$&jTRBmVn*EBbq0?-P8VZ)mapsj-fP=I3{aqHTXKn3onyPzS44=$+YK#5v$K$}!V z@>NWF6T|@>ceFIq7aT2*Q$2zgfW|JU0My-2M4Z?VNAO-oQUs6FBh@R0#|5n&htP^S zPylp%AE-lUSij_w1F8tVTM>NRf){{#0f{07E10wgRPgEhKjnTpeDa1X0M!mqk0Q?i zP&I|+7-@A)h5M;!Gs6y0cR#)P9=o3oplZM4j!{5T{GOtGl*%c77ksWlE5ht&j>Yr7 zdPxAvd}h3UX=0gtGV=+LRxFsGC?HipsM_unj*|G@S1#%IDvBqLu5Q~%x#gOuwI7p! zeV@IoE$iO(ImM$-SsV6I)Xayw0&C9-18)JHjAQ_yz8{u3&}IO%#o?3r;I(oM`Iw|(FQT$?kQWd}{2Q;i+iq|fA{H_Lkh~CwD7kK*YC-50u z&^UVc_#Fq-BX|Im_&ux0-Nh`gqIdRwW}5_`ir=@Puy{VWpJDb><)doNezNydlhiZYT+hgf7SA{ET4>}$Y9kvn!t5tsXtDHZ_6lq9 zyjG;~`s`;eS35v?UDfuo5vQ5RUFV}W;N$g6xb;c-C>^h0O8Yk<#VeTnyq^G2UqY`H zO!2oNO)R2U3@-saW=bzvYUb};H02E#jrChgO@H2iP#4iWdd8R!H6Ro{Ww@cnOsKK0 z$pBCn5X#RUMUS{rU5^+5iXM)2+;4%0>VIY@rloYh?XUr$F1{& z5Nhm(b@}t%^_Vp-e$F-={<{I8HuOZ<&U?OW7rs)qq36eJNcM?Ak=b$-x?5VxeZ@i&AP9w zX3f8>di9r9z3K}CLXDQZQBX1<)BrHU1vDVkh~q8W_h$n_ExYhtWA@R2Py<2@2<0{M zs=r36dS9{Hg(q#{)gRlAXG?bJ$^W%;UmUZ(UzcshePx?>v}}v+9TJ^aBq2ZWae-FogHd+=R`!bFl z5ycx(yk(Yrgg!9lLH)7FEPAg(f8udDWvpm2qIe#cx4DkI&GkZ$&1=@Q{*;}4>sPk< zssGr<$IG_#7{`5Q**b6Ln19ag{<3x5gl^#ePfOPElTmBGdf292`EQ$g`8U?K>nm&B z`K7g7{Dn1N__+a~)^z@-Ryglt!v(d%mcOEpEWi0fYdrS@Yuxm{F$3zV8#rY(>))~B z`5)SnLtop*2S;u2@sh25v}_A`KDuuyTl-C8*2dpg*!~Zz-N19af@|NB6Gju>QuDcP z&HWA6LatHL?8mwOaZQ@VHE0&+^9-&*GdRa*aIVkzCD%93|K3DgS9|^F zEPljrK#dttV;Q|M18VF7wd~BJ{Qi548BktFN4Or|VO1Tsxl-*C*OO^Cb8S0hETiZ3 z`Ezst?c+6j6S~o=TKBq`14TEW>(O;wd-iax*~2w%pXKI0Xbt@*tg!KIYaTjfEt|OA z@VXV(o-`tOZvSA-YhH1+tUiHWvgTDUT2udT4foTURz8QGHFkj-MI^%kwc_$84EW^u z9-YwAZ(X|2?@8Cp zb>V#S_epd3J7)6lSZKNS?bdYGQR~?Hmi6rV+`4z8U7uO|MSrtaUQ@*_?^%B69m@~C zWyQfat!dzOYu@-8I?4ILIkEot27DSVc=QtYIVTYCi8#ks{WhrodCvFe4Dd7@P#00W z5yA5sK+Aq(jH9@8&hUW+J!&|hR#$6FuK(M zP@{x|_FBICN~>-evZ}^&&@xLQ02D3bIXT->4d=L+0W~1h08ifkR&g7|;(8a(C(q-$ zp!|BYf%^k!5N!%74xw|=R?Y{W@8)fY=f9crpmhi5%tf3>J2{^&vFa(i(dEYKC99cs zmEnFG?RTT8ZnfRlTW!x?jth((puDH=;NN(WQ9?qy&~C#4jdi)Pf{FKg z&Tr25YR>!WHl6=_j21kviR;nNjBi3hH}QJeXEhzXmO2jd@8>nv#cQtXR$~s-ay^GR mjynwiwc6=-b1X;EefEFZVqzTLg1m140000 [!NOTE] + > [Resetting your device](/windows-hardware/service/desktop/resetting-the-pc) counts as a clean Windows install. + - North America or Europe + +## Smart App Control stages + +Smart App Control can be running in either *evaluation mode* or *enforcement mode*. + +In *evaluation mode*, Smart App Control is running in the background, observing activity on the device. During this time, Smart App Control is evaluating whether the device is a good fit for the protection it offers based the variety of apps installed and used on the device. + +In *enforcement mode*, Smart App Control is actively protecting your device. Apps cannot be run unless they are recognized by Microsoft's app intelligence services, or signed with a trusted certificate. + +## Frequently Asked Questions + +### Is Smart App Control installed on my device? + +![A settings window that contains an option to configure Smart App Control settings.](images/settings-smart-app-control.png) + +Go to **Settings** > **Windows Security** > **App and Browser Control**. If Smart App Control is installed on your system, you will see a section called **Smart App Control** + +### Is Smart App Control running in evaluation or enforcement mode? + +Go to **Settings** > **Windows Security** > **App and Browser Control**. + + - If **On** is selected, Smart App Control is running in enforcement mode. + - If **Evaluation** is selected, Smart App Control is running in evaluation mode. + - If **Off** is selected, Smart App Control is not running on this device. + +### Will I be notified when Smart App Control enters enforcement mode? + +Yes. You will receive a [Toast Notification](/windows/apps/design/shell/tiles-and-notifications/toast-notifications-overview) when Smart App Control enters enforcement mode. diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md new file mode 100644 index 0000000000..22b7ceedc5 --- /dev/null +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -0,0 +1,90 @@ +--- +title: Test your app's signature with Smart App Control +description: Enable Smart App Control and verify your app is signed correctly +ms.topic: article +ms.date: 09/20/2022 +--- + +# Test your app's signature with Smart App Control + +Before distributing your signed app to users, test your app's signature against Smart App Control. To match the configurations your app will be run in, test your app in a variety of Smart App Control configurations, including both evaluation and enforcement modes. + +## Enable or disable Smart App Control + +### Enable Smart App Control on your device + +Go to **Settings** > **Windows Security** > **App and Browser Control**. + +Set Smart App Control to either **On** (enforcement mode) or **Evaluation** (evaluation mode). + +If you cannot select either **On** or **Evaluation**, try [Resetting your device](/windows-hardware/service/desktop/resetting-the-pc). + +### Disable Smart App Control on your device + +To disable Smart App Control on your device, go to **Settings** > **Windows Security** > **App and Browser Control**. Select **Off**. + +> [!IMPORTANT] +> Disabling Smart App Control is a one-way operation. Once disabled, Smart App Control cannot be re-enabled without resetting your device. + +## Set Smart App Control's enforcement mode + +Smart App Control starts in evaluation mode. While Smart App Control is in evaluation mode, it will learn if it can help protect users without causing too much user friction. If Smart App Control determines the user can benefit from its enhanced security, it will automatically be turned on. Otherwise, it will automatically be turned off. While in evaluation mode, a user can manually turn on Smart App Control in the Windows Security App. + + +### Enforcement mode + +Go to **Settings** > **Windows Security** > **App and Browser Control**. Select **On** to put Smart App Control into enforcement mode mode. + +### Evaluation mode + +Once Smart App Control is in Enforcement mode, it cannot be reset to evaluation mode from the Settings app. To re-enter evaluation mode, execute the following steps: + +1. Open a command prompt with administrator priviliges and execute the command: `manage-bde -protectors c: -disable -rebootcount 2'. +2. Reboot into the boot menu by launching **Settings** and selecting Recovery > Recovery Options > Advanced Startup > Restart now. +3. At the advanced boot menu, select Troubleshoot > Advanced > Command Prompt. A recovery command prompt will open. + > [!NOTE] + > The recovery command prompt opens the recovery drive `X:` by default. This does not indicate your system drive has changed. Your system drive is still associated with its usual drive letter (usually `C:`). +4. Execute the following commands: + - `reg load HKLM\foo c:\windows\system32\config\system` + - `reg add hklm\foo\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 2 /f` + - `reg add hklm\foo\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d 2 /f` + - `reg unload hklm\foo` +9. Restart the computer. + +If you followed these steps correctly, Smart App Control will be in Evaluation Mode. + +### Verify Smart App Control's current mode + +You can verify Smart App Control's current mode by opening a command prompt and executing the following command: + +`citool.exe -lp` + +Smart App Control is in **evaluation mode** if the value of `Friendly Name` is `VerifiedAndReputableDesktopEvaluation` and the value of `Is Currently Enforced` is `true'. + +Smart App Control is in **enforcement mode** if the value of `Friendly Name` is `VerifiedAndReputableDesktop` and the value of `Is Currently Enforced` is `true'. + +## Test your app + +You should test your app in both evaluation mode and enforcement mode. + +> [!NOTE] +> WHY? + +### Testing in enforcement mode + +![A screenshot of a dialog indicating that Smart App Control has blocked an app from running](images/smart-app-control-block-toast.png) + +When Smart App Control runs in enforcement mode, it will display a [Toast Notification](/windows/apps/design/shell/tiles-and-notifications/toast-notifications-overview) whenever it prevents an app or binary from executing. This makes it easy to test your app; simply attempt to run the app and see if it runs or not. + +### Testing in evaluation mode + +Smart App Control is silent when running in evaluation mode. To see if your app would have been blocked if Smart App Control were running in enforcement mode, you must review the Smart App Control logs. Smart App Control logs can be found in the Windows Event Viewer, under **Application and Services Logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**. + +Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. + +> [!NOTE] +> The Word doc indicates there's a Partner Center toggle that must be completed before events will be logged. The link in the document did not work for me. Is that something a user will have to do? + +## Windows Defender and Smart App Control + +When Smart App Control is turned on or in evaluation mode, the Defender client goes into passive mode in the presence of another anti-virus. Passive mode supports Smart App Control’s reputation retrieval from Microsoft’s Application Intelligence service, but it does not cover active monitoring of the device. Third-party anti-virus is responsible for all active monitoring activities. The performance impact of passive mode on the device is minimal. diff --git a/hub/apps/toc.yml b/hub/apps/toc.yml index 55613bb208..2b82bf37df 100644 --- a/hub/apps/toc.yml +++ b/hub/apps/toc.yml @@ -398,6 +398,14 @@ items: href: develop/platform/csharp-winrt/create-winrt-component-winui-cswinrt.md - name: "Diagnose component errors" href: develop/platform/csharp-winrt/authoring-diagnostics.md + - name: Smart App Control + items: + - name: Smart App Control + href: develop/smart-app-control/overview.md + - name: Sign your app for Smart App Control compliance + href: develop/smart-app-control/code-signing-for-smart-app-control.md + - name: Test your app's signature with Smart App Control + href: develop/test-your-app-with-smart-app-control.md - name: Deploy items: - name: Deployment overview From e539499f86bd5d3e6cc10c9f6b23b129c446a98a Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Fri, 16 Sep 2022 17:36:52 -0700 Subject: [PATCH 02/10] Update two broken links --- hub/apps/develop/smart-app-control/overview.md | 2 +- hub/apps/toc.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hub/apps/develop/smart-app-control/overview.md b/hub/apps/develop/smart-app-control/overview.md index 8b117b128c..0b2001d5cc 100644 --- a/hub/apps/develop/smart-app-control/overview.md +++ b/hub/apps/develop/smart-app-control/overview.md @@ -33,7 +33,7 @@ In *enforcement mode*, Smart App Control is actively protecting your device. App ### Is Smart App Control installed on my device? -![A settings window that contains an option to configure Smart App Control settings.](images/settings-smart-app-control.png) + Go to **Settings** > **Windows Security** > **App and Browser Control**. If Smart App Control is installed on your system, you will see a section called **Smart App Control** diff --git a/hub/apps/toc.yml b/hub/apps/toc.yml index 2b82bf37df..b59d3c4e29 100644 --- a/hub/apps/toc.yml +++ b/hub/apps/toc.yml @@ -405,7 +405,7 @@ items: - name: Sign your app for Smart App Control compliance href: develop/smart-app-control/code-signing-for-smart-app-control.md - name: Test your app's signature with Smart App Control - href: develop/test-your-app-with-smart-app-control.md + href: develop/smart-app-control/test-your-app-with-smart-app-control.md - name: Deploy items: - name: Deployment overview From c8ad56f4181b84b8fbd3e942147a90319d0dc1b9 Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Mon, 7 Nov 2022 15:33:24 -0800 Subject: [PATCH 03/10] Update testing doc with information about audit policies --- .../test-your-app-with-smart-app-control.md | 128 ++++++++++++------ 1 file changed, 87 insertions(+), 41 deletions(-) diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index 22b7ceedc5..8056a26760 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -7,84 +7,130 @@ ms.date: 09/20/2022 # Test your app's signature with Smart App Control -Before distributing your signed app to users, test your app's signature against Smart App Control. To match the configurations your app will be run in, test your app in a variety of Smart App Control configurations, including both evaluation and enforcement modes. +Before distributing your signed app to users, test your app's signature against Smart App Control. You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode directly. -## Enable or disable Smart App Control +## Configure Smart App Control for Testing -### Enable Smart App Control on your device +### Configure Smart App Control using Windows Settings -Go to **Settings** > **Windows Security** > **App and Browser Control**. +Go to **Settings** > **Privacy & Security** > **Windows Security** > **App and Browser Control** > **Smart App Control settings**. -Set Smart App Control to either **On** (enforcement mode) or **Evaluation** (evaluation mode). +> [!NOTE] +> Configuring Smart App Control to **Off** or **On** (enforcement) is a one-way operation. This means you cannot change modes using Windows Settings unless the current setting is **Evaluation**. For testing purposes, you can force Smart App Control into another setting [using the registry](#configure-smart-app-control-using-the-registry). -If you cannot select either **On** or **Evaluation**, try [Resetting your device](/windows-hardware/service/desktop/resetting-the-pc). +If Smart App Control is in Evaluation mode, Smart App Control will evaluate your app's signature, but will not block your app if its signature is invalid. In this mode, you can use [Audit Policies](#audit-policies) to view Smart App Control's output, including errors encountered while checking your app's signature. -### Disable Smart App Control on your device +Select **On** to put Smart App Control in enforcement mode. In this mode, Smart App Control will prevent your app from running if its signature is invalid. -To disable Smart App Control on your device, go to **Settings** > **Windows Security** > **App and Browser Control**. Select **Off**. +### Configure Smart App Control using the registry > [!IMPORTANT] -> Disabling Smart App Control is a one-way operation. Once disabled, Smart App Control cannot be re-enabled without resetting your device. +> Controlling Smart App Control can be manually controlled via the registry **for testing purposes only.** Smart App Control's protection may not be reliable..... -## Set Smart App Control's enforcement mode +Configuring Smart App Control using the Windows registry allows you to force any desired enforcement mode, even if you cannot select that mode using [Windows Settings](#configure-smart-app-control-using-windows-settings). However, modifying Smart App Control in this way may... -Smart App Control starts in evaluation mode. While Smart App Control is in evaluation mode, it will learn if it can help protect users without causing too much user friction. If Smart App Control determines the user can benefit from its enhanced security, it will automatically be turned on. Otherwise, it will automatically be turned off. While in evaluation mode, a user can manually turn on Smart App Control in the Windows Security App. +1. Open a command prompt with administrator privileges and execute the command: + `manage-bde -protectors c: -disable -rebootcount 2`. -### Enforcement mode +2. Reboot into the boot menu by launching Settings and selecting **Recovery** > **Recovery Options** > **Advanced Startup** > **Restart now**. -Go to **Settings** > **Windows Security** > **App and Browser Control**. Select **On** to put Smart App Control into enforcement mode mode. +3. From the advanced boot menu, select **Troubleshoot** > **Advanced** > **Command Prompt**. A recovery command prompt will open. -### Evaluation mode + > [!NOTE] + > The recovery command prompt opens the recovery drive X: by default. This does not indicate your system drive has changed. Your system drive is still associated with its usual drive letter (usually C:). -Once Smart App Control is in Enforcement mode, it cannot be reset to evaluation mode from the Settings app. To re-enter evaluation mode, execute the following steps: +4. Execute the following commands: -1. Open a command prompt with administrator priviliges and execute the command: `manage-bde -protectors c: -disable -rebootcount 2'. -2. Reboot into the boot menu by launching **Settings** and selecting Recovery > Recovery Options > Advanced Startup > Restart now. -3. At the advanced boot menu, select Troubleshoot > Advanced > Command Prompt. A recovery command prompt will open. > [!NOTE] - > The recovery command prompt opens the recovery drive `X:` by default. This does not indicate your system drive has changed. Your system drive is still associated with its usual drive letter (usually `C:`). -4. Execute the following commands: - - `reg load HKLM\foo c:\windows\system32\config\system` - - `reg add hklm\foo\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 2 /f` - - `reg add hklm\foo\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d 2 /f` - - `reg unload hklm\foo` -9. Restart the computer. + > In the following commands, replace {VALUE} with the value of the mode you want to set. + > + > | Value | Mode | + > |-------|------------------| + > | 0 | Off | + > | 1 | On (Enforcement) | + > | 2 | Evaluation | + + ```ps + reg load HKLM\foo c:\windows\system32\config\system + reg add hklm\foo\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d {VALUE} /f + reg add hklm\foo\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d {VALUE} /f + reg unload hklm\foo + ``` -If you followed these steps correctly, Smart App Control will be in Evaluation Mode. +5. Restart the computer. -### Verify Smart App Control's current mode +## Verify Smart App Control's current mode You can verify Smart App Control's current mode by opening a command prompt and executing the following command: `citool.exe -lp` -Smart App Control is in **evaluation mode** if the value of `Friendly Name` is `VerifiedAndReputableDesktopEvaluation` and the value of `Is Currently Enforced` is `true'. +Smart App Control is in evaluation mode if the value of Friendly Name is VerifiedAndReputableDesktopEvaluation and the value of Is Currently Enforced is `true'. + +Smart App Control is in enforcement mode if the value of Friendly Name is VerifiedAndReputableDesktop and the value of Is Currently Enforced is `true'. -Smart App Control is in **enforcement mode** if the value of `Friendly Name` is `VerifiedAndReputableDesktop` and the value of `Is Currently Enforced` is `true'. +## Configure Smart App Control's audit policy -## Test your app +The default Windows Defender Application Control (WDAC) policy used by Smart App Control in evaluation mode does not log audit events in the CodeIntegrity Operational log. This is to reduce the size of the log on typical consumer devices shipping with Smart App Control in evaluation mode. -You should test your app in both evaluation mode and enforcement mode. +For the purposes of evaluating applications against Smart App Control, a developer or system administrator may want to enable audit logs in evaluation mode to see what files would be blocked if the system were in enforcement mode. > [!NOTE] -> WHY? +> Audit policies only apply when Smart App Control is running in Evaluation mode. In Enforcement mode, Smart App Control will log events by default. + +A zip file containing two sample policies below can be downloaded [here](aka.ms/sacauditpolicies). + +### Smart App Control audit policy (SmartAppControlAudit.bin) + +This is the standard Smart App Control policy, with audit logs enabled in evaluation mode. All binaries and scripts allowed by signature and cloud reputation will pass the policy, just as they would if enforcement mode was enabled. Applications and binaries that would be blocked would log an audit event. + +Note that this policy only works with Smart App Control in evaluation mode. It’s still possible for the Smart App Control evaluation model to turn evaluation mode off with this policy is applied, so we recommend testing with one of the other methods below. + +When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAudit as the policy name. -### Testing in enforcement mode +### Smart App Control audit policy without ISG (SmartAppControlAuditNoISG.bin) -![A screenshot of a dialog indicating that Smart App Control has blocked an app from running](images/smart-app-control-block-toast.png) +This policy checks binaries and scripts against Smart App Control in evaluation mode, without checking the Intelligent Security Graph. This means that only apps that are properly signed by a trusted certificate will be allowed without audit events. This is useful for developers wanting to verify that their application is signed correctly, especially if publishing through the Windows Store, where a signature from a cert obtained from a trusted Certificate Authority is required. -When Smart App Control runs in enforcement mode, it will display a [Toast Notification](/windows/apps/design/shell/tiles-and-notifications/toast-notifications-overview) whenever it prevents an app or binary from executing. This makes it easy to test your app; simply attempt to run the app and see if it runs or not. +This policy can be applied even when Smart App Control is set to Off. When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAuditNoISG as the policy name. -### Testing in evaluation mode +### Apply an audit policy -Smart App Control is silent when running in evaluation mode. To see if your app would have been blocked if Smart App Control were running in enforcement mode, you must review the Smart App Control logs. Smart App Control logs can be found in the Windows Event Viewer, under **Application and Services Logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**. +[Ensure SAC is in evaluation mode](#configure-smart-app-control-for-testing). -Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. +Take ownership of the evaluation mode policy file C:\WINDOWS\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip using the following steps:  > [!NOTE] -> The Word doc indicates there's a Partner Center toggle that must be completed before events will be logged. The link in the document did not work for me. Is that something a user will have to do? +> Images for this section in .docx were not loading. + +1. Right click the file in explorer and select "Properties." +1. Go to the Security tab, and choose Advanced at the bottom. +1. Click "Change" in the dialog  +1. In the popup dialog, enter your user information (e.g. `\`) and click OK. +1. Click OK in the Advanced Security Settings dialog and confirm  +1. Reopen the file properties Security tab and click "Edit  +1. Under Administrators, choose all the checkboxes and click OK, and confirm again in the popup dialog  + +Now that you have ownership of the policy file, rename the audit policy file you want to apply to {1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip, and replace the original policy file with it. + +Run `citool.exe -r` from an admin command prompt to refresh the policy  + +### Enabling Smart App Control Audit policy without ISG  + +> [!NOTE] +> Why is this different from applying the other policy? + +This policy is for testing applications in evaluation mode against the signing requirement of Smart App Control exclusively, and will not allow any app binaries based on cloud intelligence from the Intelligent Security Graph. + +Ensure that Smart App Control is in evaluation mode or off  + +Run "mountvol S: /S" from an admin command prompt  + +copy SmartAppControlAuditNoISG.bin to S:\efi\microsoft\boot\cipolicies\active\{5283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip  + +Run "citool.exe -r" from admin command line to refresh the policy  -## Windows Defender and Smart App Control +### Checking Event Logs  -When Smart App Control is turned on or in evaluation mode, the Defender client goes into passive mode in the presence of another anti-virus. Passive mode supports Smart App Control’s reputation retrieval from Microsoft’s Application Intelligence service, but it does not cover active monitoring of the device. Third-party anti-virus is responsible for all active monitoring activities. The performance impact of passive mode on the device is minimal. +Smart App Control logs any executable that was (or would have been) blocked into the Code Integrity Event Logs.  You can find those logs by opening the Event Viewer, and then browsing to **Application and Services Logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**.  From a07425330ba42cc69b262da0e7e66703da3db7d1 Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Tue, 15 Nov 2022 13:47:13 -0800 Subject: [PATCH 04/10] Add smart app control docs --- .../develop/smart-app-control/overview.md | 12 ++++----- .../test-your-app-with-smart-app-control.md | 27 +++++++++---------- 2 files changed, 19 insertions(+), 20 deletions(-) diff --git a/hub/apps/develop/smart-app-control/overview.md b/hub/apps/develop/smart-app-control/overview.md index 0b2001d5cc..8b0289cb84 100644 --- a/hub/apps/develop/smart-app-control/overview.md +++ b/hub/apps/develop/smart-app-control/overview.md @@ -15,11 +15,11 @@ Malware, Potentially Unwanted Apps (PUA), and unknown, unsigned code are blocke Smart App Controlis designed to protect a device for its entire lifetime. As such, it can only be enabled on a clean install of a version of Windows that contains the Smart App Control feature. Additionally, Smart App Control is only enabled in certain regions. We hope to roll out additional regions soon. - - Windows 10 or Windows 11, version 22572 or higher. - - A clean Windows install +- Windows 11, version 22572 or higher. +- A clean Windows install > [!NOTE] > [Resetting your device](/windows-hardware/service/desktop/resetting-the-pc) counts as a clean Windows install. - - North America or Europe +- North America or Europe ## Smart App Control stages @@ -41,9 +41,9 @@ Go to **Settings** > **Windows Security** > **App and Browser Control**. If Smar Go to **Settings** > **Windows Security** > **App and Browser Control**. - - If **On** is selected, Smart App Control is running in enforcement mode. - - If **Evaluation** is selected, Smart App Control is running in evaluation mode. - - If **Off** is selected, Smart App Control is not running on this device. +- If **On** is selected, Smart App Control is running in enforcement mode. +- If **Evaluation** is selected, Smart App Control is running in evaluation mode. +- If **Off** is selected, Smart App Control is not running on this device. ### Will I be notified when Smart App Control enters enforcement mode? diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index 8056a26760..e02a88a56f 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -7,7 +7,7 @@ ms.date: 09/20/2022 # Test your app's signature with Smart App Control -Before distributing your signed app to users, test your app's signature against Smart App Control. You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode directly. +Before distributing your signed app to users, you should test your app's signature against Smart App Control. Because Smart App Control evaluates binaries as they're loaded, be sure to test all code paths and features of your app. This includes installing and uninstalling your app, testing all of your app's features, and testing any integrations with other apps that might load your binaries. You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode directly. ## Configure Smart App Control for Testing @@ -52,7 +52,7 @@ Configuring Smart App Control using the Windows registry allows you to force any > | 2 | Evaluation | ```ps - reg load HKLM\foo c:\windows\system32\config\system + reg load HKLM\sac c:\windows\system32\config\system reg add hklm\foo\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d {VALUE} /f reg add hklm\foo\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d {VALUE} /f reg unload hklm\foo @@ -89,13 +89,7 @@ Note that this policy only works with Smart App Control in evaluation mode. It When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAudit as the policy name. -### Smart App Control audit policy without ISG (SmartAppControlAuditNoISG.bin) - -This policy checks binaries and scripts against Smart App Control in evaluation mode, without checking the Intelligent Security Graph. This means that only apps that are properly signed by a trusted certificate will be allowed without audit events. This is useful for developers wanting to verify that their application is signed correctly, especially if publishing through the Windows Store, where a signature from a cert obtained from a trusted Certificate Authority is required. - -This policy can be applied even when Smart App Control is set to Off. When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAuditNoISG as the policy name. - -### Apply an audit policy +#### Apply the Smart App Control audit policy [Ensure SAC is in evaluation mode](#configure-smart-app-control-for-testing). @@ -112,14 +106,17 @@ Take ownership of the evaluation mode policy file C:\WINDOWS\System32\CodeIntegr 1. Reopen the file properties Security tab and click "Edit  1. Under Administrators, choose all the checkboxes and click OK, and confirm again in the popup dialog  -Now that you have ownership of the policy file, rename the audit policy file you want to apply to {1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip, and replace the original policy file with it. +Now that you have ownership of the policy file, rename it to `{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip.old`. Rename the audit policy file you want to apply to `{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip`, and copy it to the policy directory. -Run `citool.exe -r` from an admin command prompt to refresh the policy  +Run `citool.exe -r` from an admin command prompt to refresh the policy . -### Enabling Smart App Control Audit policy without ISG  +### Smart App Control audit policy without ISG (SmartAppControlAuditNoISG.bin) -> [!NOTE] -> Why is this different from applying the other policy? +This policy checks binaries and scripts against Smart App Control in evaluation mode, without checking the Intelligent Security Graph. This means that only apps that are properly signed by a trusted certificate will be allowed without audit events. This is useful for developers wanting to verify that their application is signed correctly, especially if publishing through the Windows Store, where a signature from a cert obtained from a trusted Certificate Authority is required. + +This policy can be applied even when Smart App Control is set to Off. When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAuditNoISG as the policy name. + +#### Apply the Smart App Control Audit policy without ISG  This policy is for testing applications in evaluation mode against the signing requirement of Smart App Control exclusively, and will not allow any app binaries based on cloud intelligence from the Intelligent Security Graph. @@ -134,3 +131,5 @@ Run "citool.exe -r" from admin command line to refresh the policy  ### Checking Event Logs  Smart App Control logs any executable that was (or would have been) blocked into the Code Integrity Event Logs.  You can find those logs by opening the Event Viewer, and then browsing to **Application and Services Logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**.  + +Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. From d259f00a98481843a5f26e423edbe51c75e8c0d1 Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Tue, 15 Nov 2022 13:51:36 -0800 Subject: [PATCH 05/10] Update in-page link to match updated bookmark --- .../smart-app-control/test-your-app-with-smart-app-control.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index e02a88a56f..7bdc04d995 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -18,7 +18,7 @@ Go to **Settings** > **Privacy & Security** > **Windows Security** > **App and B > [!NOTE] > Configuring Smart App Control to **Off** or **On** (enforcement) is a one-way operation. This means you cannot change modes using Windows Settings unless the current setting is **Evaluation**. For testing purposes, you can force Smart App Control into another setting [using the registry](#configure-smart-app-control-using-the-registry). -If Smart App Control is in Evaluation mode, Smart App Control will evaluate your app's signature, but will not block your app if its signature is invalid. In this mode, you can use [Audit Policies](#audit-policies) to view Smart App Control's output, including errors encountered while checking your app's signature. +If Smart App Control is in Evaluation mode, Smart App Control will evaluate your app's signature, but will not block your app if its signature is invalid. In this mode, you can use [Audit Policies](#configure-smart-app-controls-audit-policy) to view Smart App Control's output, including errors encountered while checking your app's signature. Select **On** to put Smart App Control in enforcement mode. In this mode, Smart App Control will prevent your app from running if its signature is invalid. From 3a551e2c994141b06c0f4e5e8e9321db89f129cc Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Tue, 15 Nov 2022 13:56:21 -0800 Subject: [PATCH 06/10] Update aka.ms link to the audit policies --- .../smart-app-control/test-your-app-with-smart-app-control.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index 7bdc04d995..fed6edf951 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -79,7 +79,7 @@ For the purposes of evaluating applications against Smart App Control, a develop > [!NOTE] > Audit policies only apply when Smart App Control is running in Evaluation mode. In Enforcement mode, Smart App Control will log events by default. -A zip file containing two sample policies below can be downloaded [here](aka.ms/sacauditpolicies). +A zip file containing two sample policies below can be downloaded [here](https://aka.ms/sacauditpolicies). ### Smart App Control audit policy (SmartAppControlAudit.bin) From e805881b737dc1dc7baca2708d0b67c0c606f1e9 Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Thu, 17 Nov 2022 13:05:52 -0800 Subject: [PATCH 07/10] Fix typo --- hub/apps/develop/smart-app-control/overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hub/apps/develop/smart-app-control/overview.md b/hub/apps/develop/smart-app-control/overview.md index 8b0289cb84..9b29f067c9 100644 --- a/hub/apps/develop/smart-app-control/overview.md +++ b/hub/apps/develop/smart-app-control/overview.md @@ -13,7 +13,7 @@ Malware, Potentially Unwanted Apps (PUA), and unknown, unsigned code are blocke ## Smart App Control requirements -Smart App Controlis designed to protect a device for its entire lifetime. As such, it can only be enabled on a clean install of a version of Windows that contains the Smart App Control feature. Additionally, Smart App Control is only enabled in certain regions. We hope to roll out additional regions soon. +Smart App Control is designed to protect a device for its entire lifetime. As such, it can only be enabled on a clean install of a version of Windows that contains the Smart App Control feature. Additionally, Smart App Control is only enabled in certain regions. We hope to roll out additional regions soon. - Windows 11, version 22572 or higher. - A clean Windows install From 34fbac2fab420b641b820cf74e0fe7438c957aa7 Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Fri, 2 Dec 2022 16:52:44 -0800 Subject: [PATCH 08/10] Updates and additional information for the Smart App Control docs --- .../code-signing-for-smart-app-control.md | 6 +-- .../develop/smart-app-control/overview.md | 30 +++++++---- .../test-your-app-with-smart-app-control.md | 53 ++++++++++--------- 3 files changed, 51 insertions(+), 38 deletions(-) diff --git a/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md b/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md index 92a85c0e5f..d20e48d87a 100644 --- a/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/code-signing-for-smart-app-control.md @@ -7,7 +7,7 @@ ms.date: 09/20/2022 # Sign your app for Smart App Control compliance -Code signing is a cryptographic operation that can be performed on an app in order to verify its contents and publisher. Smart App Control considers apps signed with a trusted digital certificate to be safe, and will allow them to run on a protected computer. +Code signing is a cryptographic operation that can be performed on an app in order to verify its contents and publisher. Smart App Control considers apps signed with a trusted digital certificate to be safe, and allows them to run on a protected computer. There are several ways to sign your app. @@ -17,8 +17,8 @@ Code can be signed with any certificate, but Smart App Control only considers ce ## Sign your app with Azure Code Signing -[Azure Code Signing](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-code-signing-democratizing-trust-for-developers-and/ba-p/3604669) is the preferred way to sign your app. Unfortunately, Azure Code Signing has not yet been released. You'll just have to wait. +[Azure Code Signing](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-code-signing-democratizing-trust-for-developers-and/ba-p/3604669) is the preferred way to sign your app. Azure Code Signing is currently in private preview. ## Sign your app with signtool.exe -Signtool is an app included with Visual Studio that can sign apps with a digital certificate. For instructions on how to sign your app with signtool.exe, see [How to sign an app package using SignTool](/windows/win32/appxpkg/how-to-sign-a-package-using-signtool) +Signtool.exe is an app included with Visual Studio that can sign apps with a digital certificate. For instructions on how to sign your app with signtool.exe, see [How to sign an app package using SignTool](/windows/win32/appxpkg/how-to-sign-a-package-using-signtool) diff --git a/hub/apps/develop/smart-app-control/overview.md b/hub/apps/develop/smart-app-control/overview.md index 9b29f067c9..acde41f99a 100644 --- a/hub/apps/develop/smart-app-control/overview.md +++ b/hub/apps/develop/smart-app-control/overview.md @@ -7,16 +7,16 @@ ms.date: 09/20/2022 # Smart App Control -Smart App Control is a new app execution control feature that combines Microsoft’s app intelligence services and Windows' code integrity features to protect users from untrusted or potentially dangerous code. Smart App Control selectively allows apps and binaries to run only if they're likely to be safe. Microsoft's app intelligence services provide safety predictions for many popular apps. If the app intelligence service is unable to make a prediction, then Smart App Control will still allow an app to run if it is signed with a certificate issued by a certificate authority (CA) within the Trusted Root Program. +Smart App Control is a new app execution control feature that combines Microsoft’s app intelligence services and Windows' code integrity features to protect users from untrusted or potentially dangerous code. Smart App Control selectively allows apps and binaries to run only if they're likely to be safe. Microsoft's app intelligence services provide safety predictions for many popular apps. If the app intelligence service is unable to make a prediction, then Smart App Control will still allow an app to run if it is signed with a certificate issued by a certificate authority (CA) within the Trusted Root Program. -Malware, Potentially Unwanted Apps (PUA), and unknown, unsigned code are blocked by default. +Malware, Potentially Unwanted Apps (PUA), and unknown, unsigned code are blocked by default. ## Smart App Control requirements Smart App Control is designed to protect a device for its entire lifetime. As such, it can only be enabled on a clean install of a version of Windows that contains the Smart App Control feature. Additionally, Smart App Control is only enabled in certain regions. We hope to roll out additional regions soon. -- Windows 11, version 22572 or higher. -- A clean Windows install +- Windows 11, version 22572 or higher, +- A clean Windows install, > [!NOTE] > [Resetting your device](/windows-hardware/service/desktop/resetting-the-pc) counts as a clean Windows install. - North America or Europe @@ -25,26 +25,34 @@ Smart App Control is designed to protect a device for its entire lifetime. As su Smart App Control can be running in either *evaluation mode* or *enforcement mode*. -In *evaluation mode*, Smart App Control is running in the background, observing activity on the device. During this time, Smart App Control is evaluating whether the device is a good fit for the protection it offers based the variety of apps installed and used on the device. +In *evaluation mode*, Smart App Control runs in the background, observing activity on the device. During this time, Smart App Control is evaluating whether the device is a good fit for the protection it offers based the variety of apps installed and used on the device. In *enforcement mode*, Smart App Control is actively protecting your device. Apps cannot be run unless they are recognized by Microsoft's app intelligence services, or signed with a trusted certificate. ## Frequently Asked Questions -### Is Smart App Control installed on my device? - - +### How can I tell if Smart App Control is installed my device? Go to **Settings** > **Windows Security** > **App and Browser Control**. If Smart App Control is installed on your system, you will see a section called **Smart App Control** -### Is Smart App Control running in evaluation or enforcement mode? +### How can I tell if Smart App Control running in evaluation or enforcement mode? -Go to **Settings** > **Windows Security** > **App and Browser Control**. +Go to **Settings** > **Windows Security** > **App and Browser Control**. -- If **On** is selected, Smart App Control is running in enforcement mode. +- If **On** is selected, Smart App Control is running in enforcement mode. - If **Evaluation** is selected, Smart App Control is running in evaluation mode. - If **Off** is selected, Smart App Control is not running on this device. ### Will I be notified when Smart App Control enters enforcement mode? Yes. You will receive a [Toast Notification](/windows/apps/design/shell/tiles-and-notifications/toast-notifications-overview) when Smart App Control enters enforcement mode. + +### What files will Smart App Control block while running in enforcement mode? + +Smart App Control allows apps and binaries to run only if they're likely to be safe. Smart App Control will block apps and binary files identified as unsafe by Microsoft’s app intelligence services unless those files are code signed with a certificate issued by a certificate authority (CA) within the Trusted Root Program. + +Note that some older Microsoft binaries are considered unsafe because attackers can potentially use them to gain unauthorized access. For a complete list of these files, please see [Application Control for Windows](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control#smart-app-control-enforced-blocks). + +## Further information + +- [What is Smart App Control?](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index fed6edf951..f5d05d80f1 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -7,10 +7,12 @@ ms.date: 09/20/2022 # Test your app's signature with Smart App Control -Before distributing your signed app to users, you should test your app's signature against Smart App Control. Because Smart App Control evaluates binaries as they're loaded, be sure to test all code paths and features of your app. This includes installing and uninstalling your app, testing all of your app's features, and testing any integrations with other apps that might load your binaries. You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode directly. +Before distributing your signed app to users, you should test your app's signature against Smart App Control. Because Smart App Control evaluates binaries as they're loaded, be sure to test all code paths and features of your app. This includes testing all of your app's install and uninstall binaries, all of your app's features, and all integrations with other apps that might load your binaries (for example, [Office add-ins](/office/dev/add-ins/overview/office-add-ins)). You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode directly. ## Configure Smart App Control for Testing +You can configure Smart App Control in the Windows Settings app, or by manually editing the Windows Registry. + ### Configure Smart App Control using Windows Settings Go to **Settings** > **Privacy & Security** > **Windows Security** > **App and Browser Control** > **Smart App Control settings**. @@ -22,12 +24,12 @@ If Smart App Control is in Evaluation mode, Smart App Control will evaluate your Select **On** to put Smart App Control in enforcement mode. In this mode, Smart App Control will prevent your app from running if its signature is invalid. -### Configure Smart App Control using the registry +### Configure Smart App Control using the Registry > [!IMPORTANT] -> Controlling Smart App Control can be manually controlled via the registry **for testing purposes only.** Smart App Control's protection may not be reliable..... +> Controlling Smart App Control can be manually controlled via the Registry **for testing purposes only.** Editing Smart App Control settings in this way could compromise the protection it provides. -Configuring Smart App Control using the Windows registry allows you to force any desired enforcement mode, even if you cannot select that mode using [Windows Settings](#configure-smart-app-control-using-windows-settings). However, modifying Smart App Control in this way may... +Configuring Smart App Control using the Windows Registry allows you to force any desired enforcement mode, even if you cannot select that mode using [Windows Settings](#configure-smart-app-control-using-windows-settings). To configure Smart App Control: 1. Open a command prompt with administrator privileges and execute the command: @@ -53,9 +55,9 @@ Configuring Smart App Control using the Windows registry allows you to force any ```ps reg load HKLM\sac c:\windows\system32\config\system - reg add hklm\foo\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d {VALUE} /f - reg add hklm\foo\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d {VALUE} /f - reg unload hklm\foo + reg add hklm\sac\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d {VALUE} /f + reg add hklm\sac\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d {VALUE} /f + reg unload hklm\sac ``` 5. Restart the computer. @@ -66,9 +68,9 @@ You can verify Smart App Control's current mode by opening a command prompt and `citool.exe -lp` -Smart App Control is in evaluation mode if the value of Friendly Name is VerifiedAndReputableDesktopEvaluation and the value of Is Currently Enforced is `true'. +Smart App Control is in evaluation mode if the value of Friendly Name is `VerifiedAndReputableDesktopEvaluation` and the value of Is Currently Enforced is `true`. -Smart App Control is in enforcement mode if the value of Friendly Name is VerifiedAndReputableDesktop and the value of Is Currently Enforced is `true'. +Smart App Control is in enforcement mode if the value of Friendly Name is `VerifiedAndReputableDesktop` and the value of Is Currently Enforced is `true`. ## Configure Smart App Control's audit policy @@ -81,30 +83,33 @@ For the purposes of evaluating applications against Smart App Control, a develop A zip file containing two sample policies below can be downloaded [here](https://aka.ms/sacauditpolicies). +> [!NOTE] +> You can also create your own policies. See [Windows Defender Application Control (WDAC) example base policies](https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies) and [Create WDAC policy for lightly managed devices](/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices#create-a-custom-base-policy-using-an-example-wdac-base-policy) for more information. + ### Smart App Control audit policy (SmartAppControlAudit.bin) This is the standard Smart App Control policy, with audit logs enabled in evaluation mode. All binaries and scripts allowed by signature and cloud reputation will pass the policy, just as they would if enforcement mode was enabled. Applications and binaries that would be blocked would log an audit event. Note that this policy only works with Smart App Control in evaluation mode. It’s still possible for the Smart App Control evaluation model to turn evaluation mode off with this policy is applied, so we recommend testing with one of the other methods below. -When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAudit as the policy name. +When this policy is applied, the output for `citool.exe -lp` will show `VerifiedAndReputableDesktopEvaluationAudit` as the policy name. #### Apply the Smart App Control audit policy -[Ensure SAC is in evaluation mode](#configure-smart-app-control-for-testing). +First, [ensure SAC is in evaluation mode](#configure-smart-app-control-for-testing). -Take ownership of the evaluation mode policy file C:\WINDOWS\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip using the following steps:  +Take ownership of the evaluation mode policy file `C:\WINDOWS\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip` using [takeown.exe](/windows-server/administration/windows-commands/takeown). If you are unable to use takeown, then you can manually take ownership using the following steps:  -> [!NOTE] -> Images for this section in .docx were not loading. +> [!IMPORTANT] +> We strongly recommend using takeown, if possible. 1. Right click the file in explorer and select "Properties." 1. Go to the Security tab, and choose Advanced at the bottom. -1. Click "Change" in the dialog  +1. Click "Change" in the dialog . 1. In the popup dialog, enter your user information (e.g. `\`) and click OK. -1. Click OK in the Advanced Security Settings dialog and confirm  -1. Reopen the file properties Security tab and click "Edit  -1. Under Administrators, choose all the checkboxes and click OK, and confirm again in the popup dialog  +1. Click OK in the Advanced Security Settings dialog and confirm . +1. Reopen the file properties Security tab and click "Edit ." +1. Under Administrators, choose all the checkboxes and click OK, and confirm again in the popup dialog . Now that you have ownership of the policy file, rename it to `{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip.old`. Rename the audit policy file you want to apply to `{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip`, and copy it to the policy directory. @@ -114,22 +119,22 @@ Run `citool.exe -r` from an admin command prompt to refresh the policy . This policy checks binaries and scripts against Smart App Control in evaluation mode, without checking the Intelligent Security Graph. This means that only apps that are properly signed by a trusted certificate will be allowed without audit events. This is useful for developers wanting to verify that their application is signed correctly, especially if publishing through the Windows Store, where a signature from a cert obtained from a trusted Certificate Authority is required. -This policy can be applied even when Smart App Control is set to Off. When this policy is applied, the output for citool.exe -lp will show VerifiedAndReputableDesktopEvaluationAuditNoISG as the policy name. +This policy can be applied even when Smart App Control is set to Off. When this policy is applied, the output for `citool.exe -lp` will show `VerifiedAndReputableDesktopEvaluationAuditNoISG` as the policy name. #### Apply the Smart App Control Audit policy without ISG  -This policy is for testing applications in evaluation mode against the signing requirement of Smart App Control exclusively, and will not allow any app binaries based on cloud intelligence from the Intelligent Security Graph. +This policy is for testing applications in evaluation mode against the signing requirement of Smart App Control exclusively, and will not allow any app binaries based on cloud intelligence from the Intelligent Security Graph. Ensure that Smart App Control is in evaluation mode or off  -Run "mountvol S: /S" from an admin command prompt  +Run `mountvol S: /S` from an admin command prompt  -copy SmartAppControlAuditNoISG.bin to S:\efi\microsoft\boot\cipolicies\active\{5283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip  +copy SmartAppControlAuditNoISG.bin to `S:\efi\microsoft\boot\cipolicies\active\{5283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip `. -Run "citool.exe -r" from admin command line to refresh the policy  +Run `citool.exe -r` from admin command line to refresh the policy  ### Checking Event Logs  Smart App Control logs any executable that was (or would have been) blocked into the Code Integrity Event Logs.  You can find those logs by opening the Event Viewer, and then browsing to **Application and Services Logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**.  -Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. +Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. For more information about Smart App Control and Microsoft Defender event logging, please see [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide). From 780bab1e1b21e3b0f6ed22fc5c878130a76436ae Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Wed, 14 Dec 2022 15:01:01 -0800 Subject: [PATCH 09/10] Additional registry commands to configure SAC, grammar, more notes and clarifications --- .../test-your-app-with-smart-app-control.md | 25 ++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index f5d05d80f1..1bf3572d41 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -7,7 +7,7 @@ ms.date: 09/20/2022 # Test your app's signature with Smart App Control -Before distributing your signed app to users, you should test your app's signature against Smart App Control. Because Smart App Control evaluates binaries as they're loaded, be sure to test all code paths and features of your app. This includes testing all of your app's install and uninstall binaries, all of your app's features, and all integrations with other apps that might load your binaries (for example, [Office add-ins](/office/dev/add-ins/overview/office-add-ins)). You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode directly. +Before distributing your signed app to users, you should test your app's signature against Smart App Control. Because Smart App Control evaluates binaries as they're loaded, be sure to test all code paths and features of your app. This includes testing all of your app's install and uninstall binaries, all of your app's features, and all integrations with other apps that might load your binaries (for example, [Office add-ins](/office/dev/add-ins/overview/office-add-ins)). You can test Smart App Control using audit policies, which will create log entries without actually blocking your app from executing, or test directly against Smart App Control's enforcement mode. ## Configure Smart App Control for Testing @@ -27,13 +27,19 @@ Select **On** to put Smart App Control in enforcement mode. In this mode, Smart ### Configure Smart App Control using the Registry > [!IMPORTANT] -> Controlling Smart App Control can be manually controlled via the Registry **for testing purposes only.** Editing Smart App Control settings in this way could compromise the protection it provides. +> Smart App Control can be manually configured via the Registry **for testing purposes only.** Editing Smart App Control settings in this way could compromise the protection it provides. Configuring Smart App Control using the Windows Registry allows you to force any desired enforcement mode, even if you cannot select that mode using [Windows Settings](#configure-smart-app-control-using-windows-settings). To configure Smart App Control: -1. Open a command prompt with administrator privileges and execute the command: +1. Open a command prompt with administrator privileges and execute the following commands: - `manage-bde -protectors c: -disable -rebootcount 2`. + ```powershell + manage-bde -protectors c: -disable -rebootcount 2 + "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -DynamicSignatures + ``` + + > [!NOTE] + > You may have to update the second command if your system drive is not C:. 2. Reboot into the boot menu by launching Settings and selecting **Recovery** > **Recovery Options** > **Advanced Startup** > **Restart now**. @@ -58,6 +64,10 @@ Configuring Smart App Control using the Windows Registry allows you to force any reg add hklm\sac\controlset001\control\ci\policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d {VALUE} /f reg add hklm\sac\controlset001\control\ci\protected /v VerifiedAndReputablePolicyStateMinValueSeen /t REG_DWORD /d {VALUE} /f reg unload hklm\sac + + reg load HKLM\sac2 C:\windows\system32\config\SOFTWARE + reg add "hklm\sac2\Microsoft\Windows Defender" /v SacLearningModeSwitch /t REG_DWORD /d 0 + reg unload hklm\sac2 ``` 5. Restart the computer. @@ -90,7 +100,8 @@ A zip file containing two sample policies below can be downloaded [here](https:/ This is the standard Smart App Control policy, with audit logs enabled in evaluation mode. All binaries and scripts allowed by signature and cloud reputation will pass the policy, just as they would if enforcement mode was enabled. Applications and binaries that would be blocked would log an audit event. -Note that this policy only works with Smart App Control in evaluation mode. It’s still possible for the Smart App Control evaluation model to turn evaluation mode off with this policy is applied, so we recommend testing with one of the other methods below. +> [!NOTE] +> This policy only works with Smart App Control in evaluation mode. It is still possible for the Smart App Control evaluation model to turn evaluation mode off with this policy is applied, so we recommend testing with one of the other methods below. When this policy is applied, the output for `citool.exe -lp` will show `VerifiedAndReputableDesktopEvaluationAudit` as the policy name. @@ -117,7 +128,9 @@ Run `citool.exe -r` from an admin command prompt to refresh the policy . ### Smart App Control audit policy without ISG (SmartAppControlAuditNoISG.bin) -This policy checks binaries and scripts against Smart App Control in evaluation mode, without checking the Intelligent Security Graph. This means that only apps that are properly signed by a trusted certificate will be allowed without audit events. This is useful for developers wanting to verify that their application is signed correctly, especially if publishing through the Windows Store, where a signature from a cert obtained from a trusted Certificate Authority is required. +This is the recommended policy for testing your own apps as a developer. + +This policy checks binaries and scripts against Smart App Control in evaluation mode, without checking the Intelligent Security Graph, meaning that only apps that are properly signed by a trusted certificate will be allowed without audit events. Because reputation may not be available for newly published binaries, and can change over time, ensuring that all your binaries are correctly signed is the best way to make sure users don’t encounter issues using your app. This is also the requirement when publishing through the Windows Store, where a signature from a cert obtained from a trusted Certificate Authority is required. This policy can be applied even when Smart App Control is set to Off. When this policy is applied, the output for `citool.exe -lp` will show `VerifiedAndReputableDesktopEvaluationAuditNoISG` as the policy name. From 279b6b35b1127caecc024d93cec7643160bc234c Mon Sep 17 00:00:00 2001 From: Shawn Hickey Date: Wed, 14 Dec 2022 15:04:06 -0800 Subject: [PATCH 10/10] remove parameter from a link, and make a different absolute link relative --- .../smart-app-control/test-your-app-with-smart-app-control.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md index 1bf3572d41..2ede59ec08 100644 --- a/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md +++ b/hub/apps/develop/smart-app-control/test-your-app-with-smart-app-control.md @@ -94,7 +94,7 @@ For the purposes of evaluating applications against Smart App Control, a develop A zip file containing two sample policies below can be downloaded [here](https://aka.ms/sacauditpolicies). > [!NOTE] -> You can also create your own policies. See [Windows Defender Application Control (WDAC) example base policies](https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies) and [Create WDAC policy for lightly managed devices](/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices#create-a-custom-base-policy-using-an-example-wdac-base-policy) for more information. +> You can also create your own policies. See [Windows Defender Application Control (WDAC) example base policies](/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies) and [Create WDAC policy for lightly managed devices](/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices#create-a-custom-base-policy-using-an-example-wdac-base-policy) for more information. ### Smart App Control audit policy (SmartAppControlAudit.bin) @@ -150,4 +150,4 @@ Run `citool.exe -r` from admin command line to refresh the policy  Smart App Control logs any executable that was (or would have been) blocked into the Code Integrity Event Logs.  You can find those logs by opening the Event Viewer, and then browsing to **Application and Services Logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**.  -Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. For more information about Smart App Control and Microsoft Defender event logging, please see [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide). +Smart App Control logs evaluation mode events with event ID 3076, and enforcement mode events with event ID 3077. For more information about Smart App Control and Microsoft Defender event logging, please see [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus).