From afe7e98f06a5f68af0a47aa6998f9417ae423f4a Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 15 Sep 2021 14:21:50 -0500 Subject: [PATCH 1/8] Added DevSecOps demo playbook --- playbooks/GSuite_DevSecOps.json | 4034 +++++++++++++++++++++++++++++++ playbooks/GSuite_DevSecOps.py | 212 ++ playbooks/GSuite_DevSecOps.yml | 17 + 3 files changed, 4263 insertions(+) create mode 100644 playbooks/GSuite_DevSecOps.json create mode 100644 playbooks/GSuite_DevSecOps.py create mode 100644 playbooks/GSuite_DevSecOps.yml diff --git a/playbooks/GSuite_DevSecOps.json b/playbooks/GSuite_DevSecOps.json new file mode 100644 index 0000000000..aa38b85ccc --- /dev/null +++ b/playbooks/GSuite_DevSecOps.json @@ -0,0 +1,4034 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Threat Response", + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "", + "hash": "9baa524d3151f8162cf7926657f49e8f2fe828de", + "joint": { + "cells": [ + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'Get_File_from_GDrive' block\n Get_File_from_GDrive(container=container)\n\n # call 'ip_reputation_1' block\n ip_reputation_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "83148d28-f8c8-4ec6-a672-e8ac3cb413e0", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 18, + "line_start": 7, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 100, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 1 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "VT Lookup, Prompt for Upload, VT Upload", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 212, + "line_start": 199, + "name": "", + "notes": "", + "number": 0, + "order": 10, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1460, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 2 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c299574c-5abf-4f75-8bc9-fefe61917ee7", + "router": { + "name": "metro" + }, + "source": { + "id": "83148d28-f8c8-4ec6-a672-e8ac3cb413e0", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "98529e71-c430-4ef1-98b8-8f111235014c", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 3 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8f059d5a-cfda-4bc3-bfb1-dc6fca5078ee", + "router": { + "name": "metro" + }, + "source": { + "id": "98529e71-c430-4ef1-98b8-8f111235014c", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "91ce9fe3-376f-4448-9584-c2ba0a74cedc", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 6 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "Get_File_from_GDrive:action_result.summary.vault_id" + }, + "angle": 0, + "app": "VirusTotal", + "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", + "approver": "", + "assets": [ + { + "action": "get file", + "actions": [ + "detonate file", + "test connectivity", + "file reputation", + "url reputation", + "domain reputation", + "ip reputation", + "get file", + "get report", + "detonate url" + ], + "active": true, + "app_name": "VirusTotal", + "app_version": "2.1.2", + "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", + "asset_name": "virustotal", + "config_type": "asset", + "count": 0, + "fields": { + "hash": "Get_File_from_GDrive:action_result.summary.vault_id" + }, + "has_app": true, + "id": 7, + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "column_name": "Hash", + "column_order": 1, + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "BDB97B8DE2D22B86B3BDB4B43B4C50BF" + ] + }, + { + "data_path": "action_result.data.*.file_type", + "data_type": "string" + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "BDB97B8DE2D22B86B3BDB4B43B4C50BF" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "1052507b5c178307bf333e48237af2530c365d73" + ] + }, + { + "column_name": "File Type", + "column_order": 2, + "data_path": "action_result.summary.file_type", + "data_type": "string" + }, + { + "column_name": "File Name", + "column_order": 0, + "contains": [ + "md5" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "BDB97B8DE2D22B86B3BDB4B43B4C50BF" + ] + }, + { + "column_name": "Vault ID", + "column_order": 3, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "1052507b5c178307bf333e48237af2530c365d73" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File successfully retrieved and added to vault" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 0 + ] + } + ], + "parameters": { + "hash": { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_type": "string", + "default": null, + "description": "Hash of file to get", + "key": "hash", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "targets": "7", + "type": "reputation" + } + ], + "attrs": { + ".action": { + "text": "VT Lookup" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + } + }, + "block_code": "def VT_Lookup(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('VT_Lookup() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'VT_Lookup' call\n results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'VT_Lookup' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'hash': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['virustotal'], callback=VT_Lookup_Error_Handling, name=\"VT_Lookup\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "", + "connected_to_start": true, + "connection_name": "Get File from GDrive", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "VT Lookup", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "91ce9fe3-376f-4448-9584-c2ba0a74cedc", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 67, + "line_start": 44, + "message": "Configuring now", + "name": "get file", + "notes": "Uses vault_id (hash of file) to check if VirusTotal has a report for this file", + "number": 4, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 520, + "y": 80 + }, + "previous_function": "", + "previous_name": "VT_Lookup", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 100, + "width": 180 + }, + "state": "app_action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 14 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d0f3ceb4-0e03-4ed2-af2f-3ff462bbd248", + "router": { + "name": "metro" + }, + "source": { + "id": "91ce9fe3-376f-4448-9584-c2ba0a74cedc", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "3443bcb9-197b-40ff-b430-a228726bd34c", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 15 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fe020871-0f2c-4a1c-a0d1-eaaf9b4abf56", + "router": { + "name": "metro" + }, + "source": { + "id": "3443bcb9-197b-40ff-b430-a228726bd34c", + "port": "out-1", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a83e5122-6184-4296-8a39-c22d30ba0da1", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 17 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0cce17fb-4fce-429d-8893-1ebe7f435fc9", + "router": { + "name": "metro" + }, + "source": { + "id": "3443bcb9-197b-40ff-b430-a228726bd34c", + "port": "out-2", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 23 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d0296916-3c70-480b-970d-95332f16309b", + "router": { + "name": "metro" + }, + "source": { + "id": "a83e5122-6184-4296-8a39-c22d30ba0da1", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 24 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b9a9b71a-6935-4d3f-80e4-bed71f434e63", + "router": { + "name": "metro" + }, + "source": { + "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", + "port": "out-1", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0a14803d-bba5-44ad-8192-c21795f0be7d", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 33 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "297e8201-25f9-4dad-bb8a-9ac804c8c765", + "router": { + "name": "metro" + }, + "source": { + "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", + "port": "out-2", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 36 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "5ed13a85-9142-402b-9e58-d9bfc0172064", + "router": { + "name": "metro" + }, + "source": { + "id": "83148d28-f8c8-4ec6-a672-e8ac3cb413e0", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "d709a2f0-7ec6-45d3-b716-79fdc105d9ff", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 37 + }, + { + "action": "detonate file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "vault_id": "Get_File_from_GDrive:action_result.summary.vault_id" + }, + "angle": 0, + "app": "VirusTotal", + "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", + "approver": "", + "assets": [ + { + "action": "detonate file", + "actions": [ + "detonate file", + "test connectivity", + "file reputation", + "url reputation", + "domain reputation", + "ip reputation", + "get file", + "get report", + "detonate url" + ], + "active": true, + "app_name": "VirusTotal", + "app_version": "2.1.2", + "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", + "asset_name": "virustotal", + "config_type": "asset", + "count": 0, + "fields": { + "vault_id": "Get_File_from_GDrive:action_result.summary.vault_id" + }, + "has_app": true, + "id": 7, + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "column_name": "Positives", + "column_order": 1, + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.summary.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "column_name": "Total Scans", + "column_order": 0, + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Scan id: 27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 0 + ] + } + ], + "parameters": { + "vault_id": { + "contains": [ + "vault id", + "sha1" + ], + "data_type": "string", + "default": null, + "description": "The Vault ID of the file to scan", + "key": "vault_id", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "targets": "7", + "type": "reputation" + } + ], + "attrs": { + ".action": { + "text": "VT Upload" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + } + }, + "block_code": "def VT_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('VT_Upload() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'VT_Upload' call\n results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'VT_Upload' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'vault_id': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['virustotal'], name=\"VT_Upload\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "", + "connected_to_start": true, + "connection_name": "Prompt for Upload", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "VT Upload", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0a14803d-bba5-44ad-8192-c21795f0be7d", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 155, + "line_start": 132, + "message": "Configuring now", + "name": "detonate file", + "notes": "", + "number": 1, + "order": 7, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1240, + "y": -60 + }, + "previous_function": "", + "previous_name": "VT_Upload", + "required_params": { + "vault_id": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 100, + "width": 180 + }, + "state": "app_action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 41 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f93d1a7a-fc94-42f5-ab59-d145b9505f79", + "router": { + "name": "metro" + }, + "source": { + "id": "0a14803d-bba5-44ad-8192-c21795f0be7d", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 42 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#637282", + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "block" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def Prompt_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('Prompt_Handling() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"Prompt_for_Upload:action_result.summary.responses.0\", \"==\", \"Yes\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n VT_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "Prompt for Upload", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "Prompt Handling", + "description": "", + "hasElse": true, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 132, + "line_start": 112, + "name": "decision", + "notes": "", + "number": 3, + "order": 6, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "Prompt_for_Upload:action_result.summary.responses.0", + "value": "Yes" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "", + "value": "" + } + ], + "display": "Else", + "logic": "and", + "type": "else" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1060, + "y": 0 + }, + "previous_function": "", + "previous_name": "Prompt_Handling", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "decision", + "status": "", + "type": "coa.Decision", + "warn": "", + "z": 46 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "download_file": "True", + "email": "", + "file_name": "", + "id": "artifact:*.cef.doc_id", + "mime_type": "" + }, + "angle": 0, + "app": "G Suite for Drive", + "appid": "f091ded1-3d9e-4402-aaa2-1f92fae51e96", + "approver": "", + "assets": [ + { + "action": "get file", + "actions": [ + "test connectivity", + "list users", + "delete file", + "create folder", + "upload file", + "get file", + "list files" + ], + "active": true, + "app_name": "G Suite for Drive", + "app_version": "2.0.19", + "appid": "f091ded1-3d9e-4402-aaa2-1f92fae51e96", + "asset_name": "google-gdrive", + "config_type": "asset", + "count": 0, + "fields": { + "download_file": "True", + "email": "", + "file_name": "", + "id": "artifact:*.cef.doc_id", + "mime_type": "", + "ph": "" + }, + "has_app": true, + "id": 6, + "loaded": false, + "missing": false, + "name": "google-gdrive", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.download_file", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.email", + "data_type": "string", + "example_values": [ + "abc@gmail.com" + ] + }, + { + "data_path": "action_result.parameter.file_name", + "data_type": "string", + "example_values": [ + "file.pdf" + ] + }, + { + "contains": [ + "drive file id" + ], + "data_path": "action_result.parameter.id", + "data_type": "string", + "example_values": [ + "12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA", + "1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps", + "1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z" + ] + }, + { + "contains": [ + "mime type" + ], + "data_path": "action_result.parameter.mime_type", + "data_type": "string", + "example_values": [ + "application/pdf" + ] + }, + { + "data_path": "action_result.data.*.capabilities.canAddChildren", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canAddMyDriveParent", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canChangeCopyRequiresWriterPermission", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canChangeViewersCanCopyContent", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canComment", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canCopy", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canDelete", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canDownload", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canEdit", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canListChildren", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canModifyContent", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canMoveChildrenWithinDrive", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canMoveItemIntoTeamDrive", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canMoveItemOutOfDrive", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canMoveItemWithinDrive", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canReadRevisions", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canRemoveChildren", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canRemoveMyDriveParent", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canRename", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canShare", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canTrash", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.capabilities.canUntrash", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.createdTime", + "data_type": "string", + "example_values": [ + "2018-01-10T01:17:40.409Z", + "2018-12-21T07:26:11.898Z", + "2018-12-21T07:26:16.188Z" + ] + }, + { + "data_path": "action_result.data.*.explicitlyTrashed", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.fileExtension", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.fullFileExtension", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hasThumbnail", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.headRevisionId", + "data_type": "string", + "example_values": [ + "0B3SKAcU2T6x2ZlNyRm40eHNlS245VWZiTnp3QXh4OFFZRSt3PQ" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.iconLink", + "data_type": "string", + "example_values": [ + "https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.spreadsheet", + "https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document", + "https://drive-thirdparty.googleusercontent.com/16/type/text/plain" + ] + }, + { + "column_name": "ID", + "column_order": 0, + "contains": [ + "drive file id" + ], + "data_path": "action_result.data.*.id", + "data_type": "string", + "example_values": [ + "12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA", + "1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps", + "1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z" + ] + }, + { + "data_path": "action_result.data.*.isAppAuthorized", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.kind", + "data_type": "string", + "example_values": [ + "drive#file" + ] + }, + { + "data_path": "action_result.data.*.lastModifyingUser.displayName", + "data_type": "string", + "example_values": [ + "test Edwards" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.data.*.lastModifyingUser.emailAddress", + "data_type": "string", + "example_values": [ + "test@phantom.us", + "admin@testcorp.biz" + ] + }, + { + "data_path": "action_result.data.*.lastModifyingUser.kind", + "data_type": "string", + "example_values": [ + "drive#user" + ] + }, + { + "data_path": "action_result.data.*.lastModifyingUser.me", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.lastModifyingUser.permissionId", + "data_type": "string", + "example_values": [ + "03385014771683713179" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.md5Checksum", + "data_type": "string", + "example_values": [ + "ccdf997e20b103b9215082dcd07a86fc" + ] + }, + { + "contains": [ + "mime type" + ], + "data_path": "action_result.data.*.mimeType", + "data_type": "string", + "example_values": [ + "application/vnd.google-apps.spreadsheet", + "application/vnd.google-apps.document", + "text/plain" + ] + }, + { + "data_path": "action_result.data.*.modifiedByMe", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.modifiedByMeTime", + "data_type": "string", + "example_values": [ + "2018-01-10T01:17:41.700Z", + "2018-12-21T07:26:14.638Z", + "2018-12-21T07:26:16.188Z" + ] + }, + { + "column_name": "Last Modified", + "column_order": 2, + "data_path": "action_result.data.*.modifiedTime", + "data_type": "string", + "example_values": [ + "2018-01-10T01:17:41.700Z", + "2018-12-21T07:26:14.638Z", + "2018-12-21T07:26:16.188Z" + ] + }, + { + "column_name": "Name", + "column_order": 1, + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "Untitled.xlsx", + "New Google Document", + "New Plain Text" + ] + }, + { + "data_path": "action_result.data.*.originalFilename", + "data_type": "string", + "example_values": [ + "New Plain Text" + ] + }, + { + "data_path": "action_result.data.*.ownedByMe", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.owners.*.displayName", + "data_type": "string", + "example_values": [ + "test Edwards" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.data.*.owners.*.emailAddress", + "data_type": "string", + "example_values": [ + "test@phantom.us", + "admin@testcorp.biz" + ] + }, + { + "data_path": "action_result.data.*.owners.*.kind", + "data_type": "string", + "example_values": [ + "drive#user" + ] + }, + { + "data_path": "action_result.data.*.owners.*.me", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.owners.*.permissionId", + "data_type": "string", + "example_values": [ + "03385014771683713179" + ] + }, + { + "data_path": "action_result.data.*.parents", + "data_type": "string", + "example_values": [ + "0AHSKAcU2T6x2Uk9PVA", + "1GR9Ww4_AFxqmRRRSDi_EP5sPp8PLX7Te" + ] + }, + { + "data_path": "action_result.data.*.permissionIds", + "data_type": "string", + "example_values": [ + "03385014771683713179" + ] + }, + { + "data_path": "action_result.data.*.permissions.*.deleted", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.permissions.*.displayName", + "data_type": "string", + "example_values": [ + "test Edwards" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.data.*.permissions.*.emailAddress", + "data_type": "string", + "example_values": [ + "test@phantom.us", + "admin@testcorp.biz" + ] + }, + { + "data_path": "action_result.data.*.permissions.*.id", + "data_type": "string", + "example_values": [ + "03385014771683713179" + ] + }, + { + "data_path": "action_result.data.*.permissions.*.kind", + "data_type": "string", + "example_values": [ + "drive#permission" + ] + }, + { + "data_path": "action_result.data.*.permissions.*.role", + "data_type": "string", + "example_values": [ + "owner" + ] + }, + { + "data_path": "action_result.data.*.permissions.*.type", + "data_type": "string", + "example_values": [ + "user" + ] + }, + { + "data_path": "action_result.data.*.quotaBytesUsed", + "data_type": "string", + "example_values": [ + "0", + "48" + ] + }, + { + "data_path": "action_result.data.*.shared", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.size", + "data_type": "string", + "example_values": [ + "48" + ] + }, + { + "data_path": "action_result.data.*.spaces", + "data_type": "string", + "example_values": [ + "drive" + ] + }, + { + "data_path": "action_result.data.*.starred", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.thumbnailLink", + "data_type": "string", + "example_values": [ + "https://drive.google.com/a/acme.com/&v=1&s=AMedNnoAAAAAWlWZqdpxKYbzlZb-ko4BLBo5QZYPyz8c&sz=s220?ddrp=1#", + "https://docs.google.com/a/testcorp.biz/feeds/vt?gd=true&id=1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps&v=1&s=AMedNnoAAAAAXByxw2buVBlu4JyZ3PAtCNKDXRCoXvkM&sz=s220", + "https://lh3.googleusercontent.com/FhnFtKecgZ1fCEMgJASrrS9nh2eKWlONj_QGbuGkeFSbiLYmnJVspaw-sKkstgJpLnmo8SYDjd4=s220" + ] + }, + { + "data_path": "action_result.data.*.thumbnailVersion", + "data_type": "string", + "example_values": [ + "1" + ] + }, + { + "data_path": "action_result.data.*.trashed", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.version", + "data_type": "string", + "example_values": [ + "6", + "5", + "3" + ] + }, + { + "data_path": "action_result.data.*.viewedByMe", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.viewedByMeTime", + "data_type": "string", + "example_values": [ + "2018-01-10T01:17:48.669Z", + "2018-12-21T07:26:14.638Z", + "2018-12-21T07:26:20.302Z" + ] + }, + { + "data_path": "action_result.data.*.viewersCanCopyContent", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.webContentLink", + "data_type": "string", + "example_values": [ + "https://drive.google.com/a/acme.com/uc?id=12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA&export=download", + "https://drive.google.com/a/testcorp.biz/uc?id=1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z&export=download" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.webViewLink", + "data_type": "string", + "example_values": [ + "https://docs.google.com/a/acme.com/spreadsheets/d/12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA/edit?usp=drivesdk", + "https://docs.google.com/document/d/1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps/edit?usp=drivesdk", + "https://drive.google.com/a/testcorp.biz/file/d/1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z/view?usp=drivesdk" + ] + }, + { + "data_path": "action_result.data.*.writersCanShare", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "column_name": "Vault ID", + "column_order": 3, + "contains": [ + "sha1", + "vault id" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "2fd639e7bdeffe563d13770c2519f99a19bbeef3", + "88cc2571feeaafc30d8c5c11c1d512d3be7b25fa" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Failed to get file. Error string: ''", + "Successfully retrieved file and added to vault", + "Successfully retrieved file information and added to vault", + "Successfully retrieved file information" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1, + 3 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 0, + 1, + 3 + ] + } + ], + "parameters": { + "download_file": { + "data_type": "boolean", + "default": false, + "description": "Download the file to the Vault", + "key": "download_file", + "order": 2, + "required": false + }, + "email": { + "contains": [ + "email" + ], + "data_type": "string", + "default": null, + "description": "Email (use this drive)", + "key": "email", + "order": 0, + "primary": true, + "required": false + }, + "file_name": { + "data_type": "string", + "default": null, + "description": "Set a new name for the file before adding it to the vault", + "key": "file_name", + "order": 5, + "required": false + }, + "id": { + "contains": [ + "drive file id" + ], + "data_type": "string", + "default": null, + "description": "File ID", + "key": "id", + "order": 1, + "primary": true, + "required": true + }, + "mime_type": { + "contains": [ + "mime type" + ], + "data_type": "string", + "default": null, + "description": "MIME Type for exported file. This will only have an effect if the original document is file type that needs to be exported (i.e. Google Docs / Sheets / Slides files)", + "key": "mime_type", + "order": 4, + "primary": true, + "required": false + }, + "ph": { + "data_type": "ph", + "default": null, + "key": "ph", + "order": 3, + "required": false + } + }, + "product_name": "Google Drive", + "product_vendor": "Google", + "targets": "6", + "type": "devops" + } + ], + "attrs": { + ".action": { + "text": "Get File from GDrive" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + } + }, + "block_code": "def Get_File_from_GDrive(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('Get_File_from_GDrive() called')\n\n # collect data for 'Get_File_from_GDrive' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.doc_id', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'Get_File_from_GDrive' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'id': container_item[0],\n 'ph': \"\",\n 'email': \"\",\n 'file_name': \"\",\n 'mime_type': \"\",\n 'download_file': True,\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['google-gdrive'], callback=VT_Lookup, name=\"Get_File_from_GDrive\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "Get File from GDrive", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "98529e71-c430-4ef1-98b8-8f111235014c", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 44, + "line_start": 18, + "message": "Configuring now", + "name": "get file", + "notes": "Gets file from Google Drive", + "number": 2, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 260, + "y": 80 + }, + "previous_function": "", + "previous_name": "Get_File_from_GDrive", + "required_params": { + "id": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 100, + "width": 180 + }, + "state": "app_action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 47 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#637282", + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def VT_Lookup_Error_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('VT_Lookup_Error_Handling() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"VT_Lookup:action_result.status\", \"==\", \"failed\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n Prompt_for_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "VT Lookup", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "VT Lookup Error Handling", + "description": "", + "hasElse": true, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "3443bcb9-197b-40ff-b430-a228726bd34c", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 87, + "line_start": 67, + "name": "decision", + "notes": "If Virus Total does not have results, should we upload file?", + "number": 2, + "order": 4, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "VT_Lookup:action_result.status", + "value": "failed" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "", + "value": "" + } + ], + "display": "Else", + "logic": "and", + "type": "else" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 40 + }, + "previous_function": "", + "previous_name": "VT_Lookup_Error_Handling", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "decision", + "status": "", + "type": "coa.Decision", + "warn": "", + "z": 48 + }, + { + "active": false, + "angle": 0, + "approver": "Administrator", + "approver_display": "Administrator", + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def Prompt_for_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('Prompt_for_Upload() called')\n \n # set user and message variables for phantom.prompt call\n user = \"Administrator\"\n message = \"\"\"Should this file be uploaded to VirusTotal?\"\"\"\n\n #responses:\n response_types = [\n {\n \"prompt\": \"\",\n \"options\": {\n \"type\": \"list\",\n \"choices\": [\n \"Yes\",\n \"No\",\n ]\n },\n },\n ]\n\n phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"Prompt_for_Upload\", separator=\", \", response_types=response_types, callback=Prompt_Handling)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "connected_to_start": true, + "connection_name": "VT Lookup", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "Prompt for Upload", + "delimiter": ", ", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a83e5122-6184-4296-8a39-c22d30ba0da1", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 112, + "line_start": 87, + "message": "Should this file be uploaded to VirusTotal?", + "name": "prompt", + "notes": "Ask Admin if file can be uploaded to virustotal", + "number": 1, + "order": 5, + "outPorts": [ + "out" + ], + "parameters": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 920, + "y": 40 + }, + "previous_function": "", + "previous_name": "Prompt_for_Upload", + "respond_in": "30", + "response_key": "Message", + "response_options": [], + "response_type": "list", + "responses": [ + { + "response_key": "Yes/No", + "response_options": [ + "Yes", + "No" + ], + "response_prompt": "", + "response_type": "list" + } + ], + "show_number": true, + "size": { + "height": 80, + "width": 80 + }, + "state": "prompt", + "status": "", + "type": "coa.Prompt", + "warn": false, + "z": 49 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "108ec0ac-b84e-4df4-9ae2-d7200403238f", + "router": { + "name": "metro" + }, + "source": { + "id": "d709a2f0-7ec6-45d3-b716-79fdc105d9ff", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "ad2c97ef-664b-4275-8667-7ce0ffe822bf", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 51 + }, + { + "action": "geolocate ip", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "ip_reputation_1:artifact:*.cef.src_ip" + }, + "angle": 0, + "app": "MaxMind", + "appid": "c566e153-3118-4033-abda-14dd9748c91a", + "approver": "", + "assets": [ + { + "action": "geolocate ip", + "actions": [ + "geolocate ip", + "test connectivity" + ], + "active": true, + "app_name": "MaxMind", + "app_version": "2.0.23", + "appid": "c566e153-3118-4033-abda-14dd9748c91a", + "asset_name": "maxmind", + "config_type": "asset", + "count": 0, + "fields": { + "ip": "ip_reputation_1:artifact:*.cef.src_ip" + }, + "has_app": true, + "id": 2, + "loaded": false, + "missing": false, + "name": "maxmind", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.data.*.continent_name", + "data_type": "string", + "example_values": [ + "Asia" + ] + }, + { + "data_path": "action_result.data.*.country_iso_code", + "data_type": "string", + "example_values": [ + "IN" + ] + }, + { + "data_path": "action_result.data.*.country_name", + "data_type": "string", + "example_values": [ + "India" + ], + "map_info": "Country" + }, + { + "data_path": "action_result.data.*.latitude", + "data_type": "numeric", + "example_values": [ + 23.0333 + ], + "map_info": "latitude" + }, + { + "data_path": "action_result.data.*.longitude", + "data_type": "numeric", + "example_values": [ + 72.6167 + ], + "map_info": "longitude" + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string", + "example_values": [ + "203.88.139.34" + ], + "map_info": "IP Address" + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string", + "example_values": [ + "203.88.139.34" + ], + "map_info": "name" + }, + { + "data_path": "action_result.data.*.city_name", + "data_type": "string", + "example_values": [ + "Ahmedabad" + ], + "map_info": "City" + }, + { + "data_path": "action_result.data.*.postal_code", + "data_type": "string", + "example_values": [ + "380007" + ], + "map_info": "Postal Code" + }, + { + "data_path": "action_result.data.*.as_org", + "data_type": "string", + "map_info": "Organization" + }, + { + "data_path": "action_result.data.*.state_iso_code", + "data_type": "string", + "example_values": [ + "GJ" + ] + }, + { + "data_path": "action_result.data.*.state_name", + "data_type": "string", + "example_values": [ + "Gujarat" + ], + "map_info": "State/Province" + }, + { + "data_path": "action_result.data.*.time_zone", + "data_type": "string", + "example_values": [ + "Asia/Kolkata" + ] + }, + { + "data_path": "action_result.summary.city", + "data_type": "string", + "example_values": [ + "Ahmedabad" + ] + }, + { + "data_path": "action_result.summary.state", + "data_type": "string", + "example_values": [ + "GJ" + ] + }, + { + "data_path": "action_result.summary.country", + "data_type": "string", + "example_values": [ + "India" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "City: Ahmedabad, State: GJ, Country: India" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "ip": { + "allow_list": true, + "contains": [ + "ip" + ], + "data_type": "string", + "default": null, + "description": "IP to geolocate", + "key": "ip", + "primary": true, + "required": true + } + }, + "product_name": "GeoIP2", + "product_vendor": "MaxMind", + "targets": "2", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "geolocate ip" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def geolocate_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('geolocate_ip_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'geolocate_ip_1' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['ip_reputation_1:artifact:*.cef.src_ip', 'ip_reputation_1:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'geolocate_ip_1' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'ip': inputs_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"geolocate ip\", parameters=parameters, assets=['maxmind'], name=\"geolocate_ip_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "", + "connected_to_start": true, + "connection_name": "ip reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "ad2c97ef-664b-4275-8667-7ce0ffe822bf", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 199, + "line_start": 176, + "message": "Configuring now", + "name": "geolocate ip", + "notes": "", + "number": 1, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 520, + "y": 240 + }, + "previous_function": "", + "previous_name": "geolocate_ip_1", + "required_params": { + "ip": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 100, + "width": 180 + }, + "state": "app_action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": "", + "z": 53 + }, + { + "action": "ip reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "artifact:*.cef.src_ip" + }, + "angle": 0, + "app": "VirusTotal", + "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", + "approver": "", + "assets": [ + { + "action": "ip reputation", + "actions": [ + "detonate file", + "test connectivity", + "file reputation", + "url reputation", + "domain reputation", + "ip reputation", + "get file", + "get report", + "detonate url" + ], + "active": true, + "app_name": "VirusTotal", + "app_version": "2.1.2", + "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", + "asset_name": "virustotal", + "config_type": "asset", + "count": 0, + "fields": { + "ip": "artifact:*.cef.src_ip" + }, + "has_app": true, + "id": 7, + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "column_name": "IP", + "column_order": 0, + "contains": [ + "ip", + "ipv6" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string", + "example_values": [ + "8.8.8.8" + ] + }, + { + "column_name": "As Owner", + "column_order": 1, + "data_path": "action_result.data.*.as_owner", + "data_type": "string", + "example_values": [ + "Test Inc." + ] + }, + { + "column_name": "ASN", + "column_order": 2, + "data_path": "action_result.data.*.asn", + "data_type": "numeric", + "example_values": [ + 15169 + ] + }, + { + "data_path": "action_result.data.*.continent", + "data_type": "string", + "example_values": [ + "NA" + ] + }, + { + "column_name": "Country", + "column_order": 3, + "data_path": "action_result.data.*.country", + "data_type": "string", + "example_values": [ + "US" + ] + }, + { + "data_path": "action_result.data.*.detected_communicating_samples.*.date", + "data_type": "string", + "example_values": [ + "2019-02-01 08:27:02" + ] + }, + { + "data_path": "action_result.data.*.detected_communicating_samples.*.positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.detected_communicating_samples.*.sha256", + "data_type": "string", + "example_values": [ + "95aea1163cd742d895f048de9b7f7ae83149ba2515b174dc6d5cfd910cb07ee3" + ] + }, + { + "data_path": "action_result.data.*.detected_communicating_samples.*.total", + "data_type": "numeric", + "example_values": [ + 61 + ] + }, + { + "data_path": "action_result.data.*.detected_downloaded_samples.*.date", + "data_type": "string", + "example_values": [ + "2017-09-28 14:00:34" + ] + }, + { + "data_path": "action_result.data.*.detected_downloaded_samples.*.positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.detected_downloaded_samples.*.sha256", + "data_type": "string", + "example_values": [ + "2b977b6342a624097b669fd2347ffbcbdc8a814369b5f431835793dbaa2251c8" + ] + }, + { + "data_path": "action_result.data.*.detected_downloaded_samples.*.total", + "data_type": "numeric", + "example_values": [ + 57 + ] + }, + { + "data_path": "action_result.data.*.detected_referrer_samples.*.date", + "data_type": "string", + "example_values": [ + "2018-02-14 12:35:57" + ] + }, + { + "data_path": "action_result.data.*.detected_referrer_samples.*.positives", + "data_type": "numeric", + "example_values": [ + 25 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.detected_referrer_samples.*.sha256", + "data_type": "string", + "example_values": [ + "6c16bbddc9dcbf447c44afb11387115ac657852fcdf30cf068cf6e11e8786212" + ] + }, + { + "data_path": "action_result.data.*.detected_referrer_samples.*.total", + "data_type": "numeric", + "example_values": [ + 70 + ] + }, + { + "data_path": "action_result.data.*.detected_urls.*.positives", + "data_type": "numeric", + "example_values": [ + 9 + ] + }, + { + "data_path": "action_result.data.*.detected_urls.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-02-01 07:31:41" + ] + }, + { + "data_path": "action_result.data.*.detected_urls.*.total", + "data_type": "numeric", + "example_values": [ + 67 + ] + }, + { + "contains": [ + "url", + "file name" + ], + "data_path": "action_result.data.*.detected_urls.*.url", + "data_type": "string", + "example_values": [ + "http://vanmaulop10.com/now/index.php?mail=" + ] + }, + { + "data_path": "action_result.data.*.network", + "data_type": "string", + "example_values": [ + "8.8.8.0/24" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.resolutions.*.hostname", + "data_type": "string", + "example_values": [ + "*.o365answers.com" + ] + }, + { + "data_path": "action_result.data.*.resolutions.*.last_resolved", + "data_type": "string", + "example_values": [ + "2015-12-10 00:00:00" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.undetected_communicating_samples.*.date", + "data_type": "string", + "example_values": [ + "2019-02-01 09:03:52" + ] + }, + { + "data_path": "action_result.data.*.undetected_communicating_samples.*.positives", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.undetected_communicating_samples.*.sha256", + "data_type": "string", + "example_values": [ + "414296de0c223c28910d99797701d4fa192208f4e30c32b0dc07da7602d7a4fb" + ] + }, + { + "data_path": "action_result.data.*.undetected_communicating_samples.*.total", + "data_type": "numeric", + "example_values": [ + 57 + ] + }, + { + "data_path": "action_result.data.*.undetected_downloaded_samples.*.date", + "data_type": "string", + "example_values": [ + "2019-01-30 20:23:21" + ] + }, + { + "data_path": "action_result.data.*.undetected_downloaded_samples.*.positives", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.undetected_downloaded_samples.*.sha256", + "data_type": "string", + "example_values": [ + "23926e9185d8d43c02807a838ffb373cc1977726094a4e46807c66ada9dd7660" + ] + }, + { + "data_path": "action_result.data.*.undetected_downloaded_samples.*.total", + "data_type": "numeric", + "example_values": [ + 71 + ] + }, + { + "data_path": "action_result.data.*.undetected_referrer_samples.*.positives", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.undetected_referrer_samples.*.sha256", + "data_type": "string", + "example_values": [ + "01e110d94eec3ec8abed7c9bb34fd7bcc3bd06c397ec83676431fc193be3b68e" + ] + }, + { + "data_path": "action_result.data.*.undetected_referrer_samples.*.total", + "data_type": "numeric", + "example_values": [ + 55 + ] + }, + { + "data_path": "action_result.data.*.undetected_urls.*", + "data_type": "string", + "example_values": [ + "2018-10-01 03:53:53" + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "IP address in dataset" + ] + }, + { + "data_path": "action_result.summary.communicating_samples", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.summary.detected_urls", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.summary.downloaded_samples", + "data_type": "numeric", + "example_values": [ + 11 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Downloaded samples: 11, Detected urls: 100, Communicating samples: 100" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 0 + ] + } + ], + "parameters": { + "ip": { + "contains": [ + "ip", + "ipv6" + ], + "data_type": "string", + "default": null, + "description": "IP to query", + "key": "ip", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "targets": "7", + "type": "reputation" + } + ], + "attrs": { + ".action": { + "text": "ip reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + } + }, + "block_code": "def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('ip_reputation_1() called')\n\n # collect data for 'ip_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.src_ip', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'ip_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'ip': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"ip reputation\", parameters=parameters, assets=['virustotal'], callback=geolocate_ip_1, name=\"ip_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "d709a2f0-7ec6-45d3-b716-79fdc105d9ff", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 176, + "line_start": 155, + "message": "Configuring now", + "name": "ip reputation", + "notes": "", + "number": 1, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 260, + "y": 240 + }, + "previous_function": "", + "previous_name": "ip_reputation_1", + "required_params": { + "ip": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 100, + "width": 180 + }, + "state": "app_action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 54 + } + ] + }, + "notes": "" + }, + "python_version": "3", + "schema": 4, + "version": "4.10.6.61906" + }, + "create_time": "2021-09-14T21:01:12.409927+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [] +} \ No newline at end of file diff --git a/playbooks/GSuite_DevSecOps.py b/playbooks/GSuite_DevSecOps.py new file mode 100644 index 0000000000..f8dd829d32 --- /dev/null +++ b/playbooks/GSuite_DevSecOps.py @@ -0,0 +1,212 @@ +""" +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'Get_File_from_GDrive' block + Get_File_from_GDrive(container=container) + + # call 'ip_reputation_1' block + ip_reputation_1(container=container) + + return + +def Get_File_from_GDrive(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('Get_File_from_GDrive() called') + + # collect data for 'Get_File_from_GDrive' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.doc_id', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'Get_File_from_GDrive' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'id': container_item[0], + 'ph': "", + 'email': "", + 'file_name': "", + 'mime_type': "", + 'download_file': True, + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['google-gdrive'], callback=VT_Lookup, name="Get_File_from_GDrive") + + return + +def VT_Lookup(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('VT_Lookup() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'VT_Lookup' call + results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'VT_Lookup' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'hash': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['virustotal'], callback=VT_Lookup_Error_Handling, name="VT_Lookup", parent_action=action) + + return + +def VT_Lookup_Error_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('VT_Lookup_Error_Handling() called') + + # check for 'if' condition 1 + matched = phantom.decision( + container=container, + action_results=results, + conditions=[ + ["VT_Lookup:action_result.status", "==", "failed"], + ]) + + # call connected blocks if condition 1 matched + if matched: + Prompt_for_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + return + + # call connected blocks for 'else' condition 2 + + return + +def Prompt_for_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('Prompt_for_Upload() called') + + # set user and message variables for phantom.prompt call + user = "Administrator" + message = """Should this file be uploaded to VirusTotal?""" + + #responses: + response_types = [ + { + "prompt": "", + "options": { + "type": "list", + "choices": [ + "Yes", + "No", + ] + }, + }, + ] + + phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name="Prompt_for_Upload", separator=", ", response_types=response_types, callback=Prompt_Handling) + + return + +def Prompt_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('Prompt_Handling() called') + + # check for 'if' condition 1 + matched = phantom.decision( + container=container, + action_results=results, + conditions=[ + ["Prompt_for_Upload:action_result.summary.responses.0", "==", "Yes"], + ]) + + # call connected blocks if condition 1 matched + if matched: + VT_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + return + + # call connected blocks for 'else' condition 2 + + return + +def VT_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('VT_Upload() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'VT_Upload' call + results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'VT_Upload' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'vault_id': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="detonate file", parameters=parameters, assets=['virustotal'], name="VT_Upload") + + return + +def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('ip_reputation_1() called') + + # collect data for 'ip_reputation_1' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.src_ip', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'ip_reputation_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'ip': container_item[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + phantom.act(action="ip reputation", parameters=parameters, assets=['virustotal'], callback=geolocate_ip_1, name="ip_reputation_1") + + return + +def geolocate_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('geolocate_ip_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'geolocate_ip_1' call + inputs_data_1 = phantom.collect2(container=container, datapath=['ip_reputation_1:artifact:*.cef.src_ip', 'ip_reputation_1:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'geolocate_ip_1' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'ip': inputs_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="geolocate ip", parameters=parameters, assets=['maxmind'], name="geolocate_ip_1", parent_action=action) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/GSuite_DevSecOps.yml b/playbooks/GSuite_DevSecOps.yml new file mode 100644 index 0000000000..b280af69d6 --- /dev/null +++ b/playbooks/GSuite_DevSecOps.yml @@ -0,0 +1,17 @@ +name: GSuite_DevSecOps +id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 +version: 1 +date: '2021-09-15' +author: Lou Stella, Splunk +type: Info +description: This playbook investigates and enriches the "Gsuite Drive Share In External Email" detection. +playbook: gsuite_drive_share_in_external_email +how_to_implement: This playbook requires the Splunk SOAR apps for Google Drive and VirusTotal, in addition to the "Gsuite Drive Share in External Email" detection. +references: [] +tags: + analytic_story: + - DevSecOps + detections: + - Gsuite Drive Share In External Email + product: + - Splunk SOAR From c7c7583ec86c1a7ae7fc131b9c3be1088c7fa869 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 16 Sep 2021 10:21:27 -0500 Subject: [PATCH 2/8] Added demo playbook for development --- bin/generate.py | 1 + .../ransomware_investigate_and_contain.json | 6328 +++++++++++++++++ .../ransomware_investigate_and_contain.png | Bin 0 -> 274740 bytes .../ransomware_investigate_and_contain.py | 331 + .../ransomware_investigate_and_contain.yml | 18 + 5 files changed, 6678 insertions(+) create mode 100644 playbooks/ransomware_investigate_and_contain.json create mode 100644 playbooks/ransomware_investigate_and_contain.png create mode 100644 playbooks/ransomware_investigate_and_contain.py create mode 100644 playbooks/ransomware_investigate_and_contain.yml diff --git a/bin/generate.py b/bin/generate.py index b44b5a5ee2..d9bf78dae4 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -577,6 +577,7 @@ def import_objects(VERBOSE, REPO_PATH): "responses": load_objects("responses/*.yml", VERBOSE, REPO_PATH), "deployments": load_objects("deployments/*.yml", VERBOSE, REPO_PATH), "detections": load_objects("detections/*/*.yml", VERBOSE, REPO_PATH), + "playbooks": load_objects("playbooks/*.yml", VERBOSE, REPO_PATH), } objects["detections"].extend(load_objects("detections/*/*/*.yml", VERBOSE, REPO_PATH)) diff --git a/playbooks/ransomware_investigate_and_contain.json b/playbooks/ransomware_investigate_and_contain.json new file mode 100644 index 0000000000..5dc60e7e0c --- /dev/null +++ b/playbooks/ransomware_investigate_and_contain.json @@ -0,0 +1,6328 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "\"\"\"Ransomware detected on endpoint\"\"\"", + "description": "This playbook investigates and contains ransomware detected on endpoints.", + "hash": "bb5c36ed1c9fc4ba347b91fc72062d5a8cad3656", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "70271ae5-8109-4232-9d95-1255e3b79a41", + "router": { + "name": "metro" + }, + "source": { + "id": "76d35893-188b-4704-afcc-3579372422ae", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cd53b29e-78cd-408d-8c58-6480077729a9", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 9 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "7b710f64-b2aa-4c8e-8d27-653a72eeb169", + "router": { + "name": "metro" + }, + "source": { + "id": "cd53b29e-78cd-408d-8c58-6480077729a9", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7e9c56b6-7673-41ae-bb5c-97d0f5baa7a8", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 19 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "5dfd5413-40e0-4d8d-a089-4c72d489079e", + "router": { + "name": "metro" + }, + "source": { + "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0dc58914-d90c-4880-b7dd-f1bd9cb3db4a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "vertices": [ + { + "x": 1080, + "y": 360 + } + ], + "z": 160 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ee19c211-b021-44c6-ba1d-1d0654a5e1bd", + "router": { + "name": "metro" + }, + "source": { + "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "3e31ada0-f327-4dbb-8c60-772db5c2a2c7", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "vertices": [ + { + "x": 1080, + "y": 360 + } + ], + "z": 189 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f5a65f9b-e288-49f2-aa40-2381776611d8", + "router": { + "name": "metro" + }, + "source": { + "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cb84850e-e005-4824-b8ad-151543871132", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "vertices": [ + { + "x": 1080, + "y": 400 + } + ], + "z": 203 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f64d8c85-ea52-4e02-a7f2-797f75a93426", + "router": { + "name": "metro" + }, + "source": { + "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "789a9802-b9ec-407d-9d47-2d6070d77237", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "vertices": [], + "z": 249 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "e553b76c-2472-4d11-98db-bc1f664665ec", + "router": { + "name": "metro" + }, + "source": { + "id": "789a9802-b9ec-407d-9d47-2d6070d77237", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "c9908964-abaa-48e2-a066-02c55e38c29a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 261 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "2191982d-1721-46bd-9ba5-529e2a3eefe0", + "router": { + "name": "metro" + }, + "source": { + "id": "c9908964-abaa-48e2-a066-02c55e38c29a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "vertices": [ + { + "x": 1580, + "y": 360 + } + ], + "z": 308 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ef761a65-044c-40f0-b596-004370ea0d35", + "router": { + "name": "metro" + }, + "source": { + "id": "7e9c56b6-7673-41ae-bb5c-97d0f5baa7a8", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 409 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d9b269e5-2275-4f19-82dc-38b335505fbe", + "router": { + "name": "metro" + }, + "source": { + "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a06d3fab-dc42-4945-b319-d83bfdf9aa47", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 462 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "03857e15-ab4f-4f44-88ec-609d4e99f7ae", + "router": { + "name": "metro" + }, + "source": { + "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 567 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c03b9b7a-1d84-4f63-8c6e-91a2b7b265ca", + "router": { + "name": "metro" + }, + "source": { + "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "bc513210-e299-4e69-b151-cdd26e9696b4", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 579 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f82ffb8c-bdaa-47e8-90cb-3423223a00c8", + "router": { + "name": "metro" + }, + "source": { + "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "987c49d7-5934-4f18-ae1d-a5e2867eaf2c", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 652 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "452d5da9-7512-4503-afa4-ec08cbc97f32", + "router": { + "name": "metro" + }, + "source": { + "id": "0dc58914-d90c-4880-b7dd-f1bd9cb3db4a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "vertices": [], + "z": 927 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "77f09987-6349-4f40-aa94-51da05301b95", + "router": { + "name": "metro" + }, + "source": { + "id": "3e31ada0-f327-4dbb-8c60-772db5c2a2c7", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "vertices": [ + { + "x": 1340, + "y": 240 + } + ], + "z": 933 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9883e649-39db-4eb4-a1c9-d159c7f54500", + "router": { + "name": "metro" + }, + "source": { + "id": "cb84850e-e005-4824-b8ad-151543871132", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "vertices": [ + { + "x": 1340, + "y": 520 + }, + { + "x": 1580, + "y": 400 + } + ], + "z": 942 + }, + { + "action": "quarantine device", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "column_name": "Name/IP", + "column_order": 0, + "contains": [ + "host name", + "ip" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string", + "example_values": [ + "cb-lab" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Quarantine action succeeded. It might take some time for endpoint to get isolated." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "quarantine device" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def quarantine_device_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('quarantine_device_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'quarantine_device_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'quarantine_device_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"quarantine device\", parameters=parameters, assets=['carbonblack'], name=\"quarantine_device_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "3e31ada0-f327-4dbb-8c60-772db5c2a2c7", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 47, + "line_start": 24, + "message": "Configuring now", + "name": "quarantine device", + "notes": "", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1120, + "y": 200 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "quarantine_device_1", + "required_params": { + "ip_hostname": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1182 + }, + { + "action": "disable user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "username": "hunt_file_1:action_result.data.*.process.results.*.username" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "username": "hunt_file_1:action_result.data.*.process.results.*.username" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name", + "ldap distinguished name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string", + "example_values": [ + "test_user3" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "User state changed" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "directory service" + } + ], + "attrs": { + ".action": { + "text": "disable user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('disable_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'disable_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.username', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'disable_user_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'username': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"disable user\", parameters=parameters, assets=['domainctrl1'], name=\"disable_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cb84850e-e005-4824-b8ad-151543871132", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 70, + "line_start": 47, + "message": "Configuring now", + "name": "disable user", + "notes": "", + "number": 1, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1120, + "y": 480 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "disable_user_1", + "required_params": { + "username": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1184 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'get_file_1' block\n get_file_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "76d35893-188b-4704-afcc-3579372422ae", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 24, + "line_start": 16, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 100, + "y": 80 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 1220 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "block ip 2, terminate process, quarantine device, disable user", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 331, + "line_start": 318, + "name": "", + "notes": "", + "number": 0, + "order": 14, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1620, + "y": 80 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 1226 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"ransomware\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n block_hash_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 91, + "line_start": 70, + "name": "filter", + "notes": "", + "number": 1, + "order": 4, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "detonate_file_1:action_result.summary.malware", + "value": "ransomware" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 720, + "y": 60 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 1238 + }, + { + "action": "block ip", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "list_connections_1:action_result.data.*.ip_addr", + "vsys": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip": "list_connections_1:action_result.data.*.ip_addr", + "is_source_address": "", + "vsys": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "pan", + "output": [ + { + "column_name": "IP", + "column_order": 0, + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.vsys", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.is_source_address", + "data_type": "boolean" + }, + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 2, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "firewall" + } + ], + "attrs": { + ".action": { + "text": "block ip 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_ip_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_ip_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_ip_2' call\n results_data_1 = phantom.collect2(container=container, datapath=['list_connections_1:action_result.data.*.ip_addr', 'list_connections_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_ip_2' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'ip': results_item_1[0],\n 'vsys': \"\",\n 'is_source_address': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], name=\"block_ip_2\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "list connections", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "c9908964-abaa-48e2-a066-02c55e38c29a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 116, + "line_start": 91, + "message": "Configuring now", + "name": "block ip", + "notes": "", + "number": 2, + "order": 5, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1360, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_ip_2", + "required_params": { + "ip": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1250 + }, + { + "action": "list connections", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "carbonblack_process_id": "hunt_file_1:action_result.data.*.process.results.*.id", + "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname", + "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid", + "process_name": "hunt_file_1:action_result.data.*.process.results.*.process_name" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "carbonblack_process_id": "hunt_file_1:action_result.data.*.process.results.*.id", + "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname", + "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid", + "process_name": "hunt_file_1:action_result.data.*.process.results.*.process_name" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.parameter.carbonblack_process_id", + "data_type": "string", + "example_values": [ + "0000001b-0000-0g44-01d4-6c744b8174f6" + ] + }, + { + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string", + "example_values": [ + "UHM" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.parameter.pid", + "data_type": "numeric", + "example_values": [ + 948 + ] + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.parameter.process_name", + "data_type": "string", + "example_values": [ + "taskhostw.exe" + ] + }, + { + "column_name": "Carbon Black Process ID", + "column_order": 3, + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.carbonblack_process_id", + "data_type": "string", + "example_values": [ + "00000013-0000-03b4-01d2-ca4499a674e9" + ] + }, + { + "column_name": "Direction", + "column_order": 8, + "data_path": "action_result.data.*.direction", + "data_type": "string", + "example_values": [ + "outbound" + ] + }, + { + "column_name": "Domain", + "column_order": 7, + "contains": [ + "domain" + ], + "data_path": "action_result.data.*.domain", + "data_type": "string", + "example_values": [ + "fe2.update.microsoft.com" + ] + }, + { + "column_name": "Event Time", + "column_order": 9, + "data_path": "action_result.data.*.event_time", + "data_type": "string", + "example_values": [ + "2017-06-13 01:05:22.209" + ] + }, + { + "column_name": "Hostname", + "column_order": 0, + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.hostname", + "data_type": "string", + "example_values": [ + "dc1" + ] + }, + { + "column_name": "Ip", + "column_order": 4, + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.ip_addr", + "data_type": "string", + "example_values": [ + "134.170.53.30" + ] + }, + { + "column_name": "PID", + "column_order": 2, + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.pid", + "data_type": "numeric", + "example_values": [ + 948 + ] + }, + { + "column_name": "Port", + "column_order": 5, + "contains": [ + "port" + ], + "data_path": "action_result.data.*.port", + "data_type": "string", + "example_values": [ + "443" + ] + }, + { + "column_name": "Process Name", + "column_order": 1, + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.process_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "column_name": "Protocol", + "column_order": 6, + "data_path": "action_result.data.*.protocol", + "data_type": "string", + "example_values": [ + "TCP" + ] + }, + { + "data_path": "action_result.summary.total_connections", + "data_type": "numeric", + "example_values": [ + 16 + ] + }, + { + "data_path": "action_result.summary.total_processes", + "data_type": "numeric", + "example_values": [ + 2186 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Successfully retrieved connections for process" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 3 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "list connections" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def list_connections_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('list_connections_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'list_connections_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.process_pid', 'hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.data.*.process.results.*.process_name', 'hunt_file_1:action_result.data.*.process.results.*.id', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'list_connections_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'pid': results_item_1[0],\n 'ip_hostname': results_item_1[1],\n 'process_name': results_item_1[2],\n 'carbonblack_process_id': results_item_1[3],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[4]},\n })\n\n phantom.act(action=\"list connections\", parameters=parameters, assets=['carbonblack'], callback=block_ip_2, name=\"list_connections_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": false, + "connection_name": "hunt file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "789a9802-b9ec-407d-9d47-2d6070d77237", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 141, + "line_start": 116, + "message": "Configuring now", + "name": "list connections", + "notes": "", + "number": 1, + "order": 6, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1120, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "list_connections_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1251 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "scope": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_1:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_1_callback, name=\"hunt_file_1\")\n\n return", + "callback_code": "def hunt_file_1_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('hunt_file_1_callback() called')\n \n terminate_process_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n quarantine_device_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n list_connections_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return", + "callback_start": 166, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 176, + "line_start": 141, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 1, + "order": 7, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 860, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1258 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 4" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_4() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_4' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_1:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'block_hash_4' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], name=\"block_hash_4\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "bc513210-e299-4e69-b151-cdd26e9696b4", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 200, + "line_start": 176, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 4, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 860, + "y": 480 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_4", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1260 + }, + { + "action": "terminate process", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname", + "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid", + "sensor_id": "hunt_file_1:action_result.data.*.process.results.*.sensor_id" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname", + "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid", + "sensor_id": "hunt_file_1:action_result.data.*.process.results.*.sensor_id" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "column_name": "HostName/IP", + "column_order": 1, + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string", + "example_values": [ + "cb-lab" + ] + }, + { + "column_name": "PID", + "column_order": 2, + "contains": [ + "pid" + ], + "data_path": "action_result.parameter.pid", + "data_type": "numeric", + "example_values": [ + 7540, + 968 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.completion", + "data_type": "numeric", + "example_values": [ + 1522081992.466807, + 1530214295.224632 + ] + }, + { + "data_path": "action_result.data.*.create_time", + "data_type": "numeric", + "example_values": [ + 1522081992.447609, + 1530214295.197862 + ] + }, + { + "data_path": "action_result.data.*.id", + "data_type": "numeric", + "example_values": [ + 2, + 4 + ] + }, + { + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "kill" + ] + }, + { + "data_path": "action_result.data.*.object", + "data_type": "numeric", + "example_values": [ + 7540, + 968 + ] + }, + { + "data_path": "action_result.data.*.result_code", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.result_desc", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.result_type", + "data_type": "string", + "example_values": [ + "WinHresult" + ] + }, + { + "column_name": "sensor id", + "column_order": 0, + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 27, + 15 + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 71, + 37 + ] + }, + { + "column_name": "Status", + "column_order": 3, + "data_path": "action_result.data.*.status", + "data_type": "string", + "example_values": [ + "complete" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.username", + "data_type": "string", + "example_values": [ + "admin" + ] + }, + { + "data_path": "action_result.summary.status", + "data_type": "string", + "example_values": [ + "complete" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "", + "Status: complete" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "terminate process" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def terminate_process_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('terminate_process_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'terminate_process_2' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.process_pid', 'hunt_file_1:action_result.data.*.process.results.*.sensor_id', 'hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'terminate_process_2' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'pid': results_item_1[0],\n 'sensor_id': results_item_1[1],\n 'ip_hostname': results_item_1[2],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[3]},\n })\n\n phantom.act(action=\"terminate process\", parameters=parameters, assets=['carbonblack'], name=\"terminate_process_2\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0dc58914-d90c-4880-b7dd-f1bd9cb3db4a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 225, + "line_start": 200, + "message": "Configuring now", + "name": "terminate process", + "notes": "", + "number": 2, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1120, + "y": 60 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "terminate_process_2", + "required_params": { + "pid": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1268 + }, + { + "action": "block ip", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip", + "vsys": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip", + "is_source_address": "", + "vsys": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "pan", + "output": [ + { + "column_name": "IP", + "column_order": 0, + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.vsys", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.is_source_address", + "data_type": "boolean" + }, + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 2, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "firewall" + } + ], + "attrs": { + ".action": { + "text": "block ip 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_ip_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_ip_1' call\n passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip\", \"detonate_file_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n parameters = []\n \n # build parameters list for 'block_ip_1' call\n for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n if passed_filtered_results_item_1[0]:\n parameters.append({\n 'ip': passed_filtered_results_item_1[0],\n 'vsys': \"\",\n 'is_source_address': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': passed_filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], name=\"block_ip_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a06d3fab-dc42-4945-b319-d83bfdf9aa47", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 250, + "line_start": 225, + "message": "Configuring now", + "name": "block ip", + "notes": "", + "number": 1, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 860, + "y": 60 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_ip_1", + "required_params": { + "ip": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1269 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_3' call\n passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1\", \"detonate_file_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n parameters = []\n \n # build parameters list for 'block_hash_3' call\n for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n if passed_filtered_results_item_1[0]:\n parameters.append({\n 'hash': passed_filtered_results_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': passed_filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], name=\"block_hash_3\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "987c49d7-5934-4f18-ae1d-a5e2867eaf2c", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 274, + "line_start": 250, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 3, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 860, + "y": 200 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_3", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 1270 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "get file", + "actions": [ + "list zones", + "list policies", + "update zone", + "get file info", + "get file", + "block hash", + "unblock hash", + "get global list", + "hunt file", + "get system info", + "list threats", + "list endpoints", + "test connectivity" + ], + "active": true, + "app_name": "CylancePROTECT", + "app_version": "1.0.39", + "appid": "e297b2aa-e103-4cc3-8cd9-14ee75d60308", + "asset_name": "cylance_protect", + "config_type": "asset", + "count": 0, + "fields": { + "hash": "artifact:*.cef.fileHash" + }, + "has_app": true, + "id": 240, + "loaded": false, + "missing": false, + "name": "cylance_protect", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "EFD5A16B2AA99F36C7E457454011E7CA8DE232F4584BA5957880A7B2368ED111" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Successfully added file to vault" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "column_name": "Vault ID", + "column_order": 0, + "contains": [ + "sha1", + "vault id" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "dcf38e99bd2a70a1ea7232ab5e04aca63e535795" + ] + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "EFD5A16B2AA99F36C7E457454011E7CA8DE232F4584BA5957880A7B2368ED111" + ] + }, + { + "data_path": "action_result.summary.size", + "data_type": "numeric", + "example_values": [ + 2113536 + ] + } + ], + "parameters": { + "hash": { + "contains": [ + "sha256" + ], + "data_type": "string", + "default": null, + "description": "SHA256 hash of file to download", + "key": "hash", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "CylancePROTECT", + "product_vendor": "Cylance", + "targets": "240", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 0.7 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_1() called')\n\n # collect data for 'get_file_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'get_file_1' call\n for container_item in container_data:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['cylance_protect'], callback=detonate_file_1, name=\"get_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cd53b29e-78cd-408d-8c58-6480077729a9", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 318, + "line_start": 298, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 1, + "order": 13, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 240, + "y": 60 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1274 + }, + { + "action": "detonate file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "file_name": "", + "vault_id": "get_file_1:action_result.summary.vault_id" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_name": "", + "vault_id": "get_file_1:action_result.summary.vault_id" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "wildfire", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.parameter.file_name", + "data_type": "string" + }, + { + "contains": [ + "pe file", + "pdf", + "flash", + "apk", + "jar", + "doc", + "xls", + "ppt" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.filetype", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_info.md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country", + "data_type": "string" + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.platform", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.software", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.summary.malware", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "sandbox" + } + ], + "attrs": { + ".action": { + "text": "detonate file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['get_file_1:action_result.summary.vault_id', 'get_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'vault_id': results_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_1, name=\"detonate_file_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "get file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7e9c56b6-7673-41ae-bb5c-97d0f5baa7a8", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 298, + "line_start": 274, + "message": "Configuring now", + "name": "detonate file", + "notes": "", + "number": 1, + "order": 12, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 480, + "y": 60 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "detonate_file_1", + "required_params": { + "vault_id": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1275 + } + ] + }, + "notes": "" + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-25T18:47:58.409263+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [], + "misc": { + "apps_list": [ + "Carbon Black Response", + "LDAP", + "Palo Alto Networks Firewall", + "WildFire", + "Cylance" + ] + } +} \ No newline at end of file diff --git a/playbooks/ransomware_investigate_and_contain.png b/playbooks/ransomware_investigate_and_contain.png new file mode 100644 index 0000000000000000000000000000000000000000..e5b3cc18adea3c9ca36d15e692f9e2bbf7697b5e GIT binary patch literal 274740 zcmeFZWmFtZw=fC>Cpf`ju;8vi2bbXP5ZocSySqEV0>RxqKyV8l+}(ZfZ}Q4Hx#wH! z+~?f&+<#|Q_jFBl)voGYySDd)E67P8BjO`MKtLc%Ns20gF9Hw{FeLD>;F{^05>yC? zw?-BsA_`I>A|wh9cBU5ACJ+#k;mPW7I*AelU9QFn)lleh=(iXqn1bT)bOC-cLMp-- zlDI6C(C@gkNdhzIfI}e2qO*w$>ZfO+%F{=2BQG`*fnx= z^b=+H9T&$uaNxBJ7f}om5<-&l$AWNhF4`tG#JQ5cj2<)u3*n(n(Yv7;jkh)Ngs|`z z^c>@}>pPZN72Qj4)(My`Xk3tj-!ASibs(IUaHX_la>!z2@Y;x1ef~(w_fSTUQ>FY zc5+eSewiD(JLU8EYV>B_D;v(F!P+;m^D^q`T7|8B49aMIez;g41{0-DQ2Lw3$I+3++1E^~5q z%F?Z-z%+&g@n8#3%_yO}asHg1S~2b@4jrbno4uBfDurCk+zi|j!#e5@J1F}=$zdtH zZFHLc0hC=btY8Uqhk-@0DJ+}LU;LVi8u>1^vE?K}RAQB5jZv$3gnCGB=%^1DT*ymEJl_{cJ)?ULhgrooXY{<@%upgDV(d|Y;jFgjC z?Y?Qf?9043aT_!cgwpe-ha({3vsG<@%8M$!kw4<4geBYf3#-vGq{G9yfg74}=;#Mb zt~a*LT-UwbBDrRO;vLH^wY~8NE_W1@bFr}o7c5uAk9gt;g&(~6mFLCg&BDZVCz+1E zhI4opmoDeUS3Ns+71yENvgm6YMpg&@vN(oz!R8I%fWmemwCZ8}Br)q|j?9m*AriQX z0k=66%9r2^+OqO4r7QVd<#^`snoIOXEdN045V`*gSte=fc0{BGA?O`ijhj;UAUeIg zt2`>i%o^61)!}=`b!~s<3GX=uKTmGS#kDox?K;L?eh8peuTAAcxnuiVeYkUPFVkQ_ z8m77Z&o_Y(Yp@=lCDNg!KOtp(63_mQ10A4%2HEfD7Wa0ln?l2kMQ6f+8F>`yN(iqQ zVx$|tn%Ek4={sXJ4k1MJI{XJnAK1O__n(oMLyn3t`QGrabL@+t1qJ;?hc%4QAiWKv z+YGOc|3m>5E`|~BM1eFURuG1f9!xJt8<#xjVN9nK`Q%3^E=OV(kFt&J05}kS5nla@ z`%xrX0ci%3D7aP;1wWATE9Rt*6RlPNqiAZrsyT8ioQU+j4>zPR(K@;o|^?=R20ORyER{A{k5$w+8SYD}CHZWHsA zDw-zR&%1u>f$mMyk>Zo!6Z@i;n#Ze@T0}SVrA)hGDc4i;u7y}^LNE3!msFK#mC{-6 zs#u4ucSL8PfO<|9P@+rgwfY75S?^7Vf2dHqP+m7i;0ml6ayEX#TcWq*Z-YaSkel$b z*}Vq8<2Jr!6#1_4{nz-1zI}Ewd~W=UsLLqYs9XF7f*V`{d{2TRe0i=)P65kuLqi!j z%2>_sI{kd#+sD0tqlUOVkRR6YNv`)vyeYAEY!r-0t`x-49=jB7!6qd+d+E1!AiyHiMyK|FsACD^LPUgHh zV>oFz3ppRHPZyPJ78R@wuDWFO*~DHwzt5m=MEKzSlOMghBlqrR1|=&!DjoseRXa8NIAosdRRmx(}5^;_nX`zK!k zunW)^fsL>w0h-;K-P!@Fq;sTCaT#%Nd5w8JKZ)|>Ka6MbjT4VwG2bz}|H`Z8T822a zww3;XP5e%ec$L@yHy)!#U{kL^*4Wlq*H}JDerB{d#a!4)<~m}ZfDb9#PkrPFZ;Q+H zHmwm?OGat*Aq}pEvF7sEZq5EL79;iO4oouuRkT$U+(kP`^}-dC5c3=56MM`DMgyIj z=7DhH@Hz~6DwYIFsuMYnFN7)W^!F|i$`P!E9I8wlYz>?@vRZD7!|byl#VxZ~V2*7H zqmfMoW<3fUmIkTRlJ!d06jan^Cgan~xy!08x|?YBh0WSM$>pi- zgOTG)S$C8`0bes8Um>mTPGJWFwGD%kJa+v>&OV3XYZ@X}b5g&t*I^qsdCZ+2`d+|Kp0ZdP=8OTw|_#USE$p62J%Z zMpif7Hog70zsY~iRxgMtf!RRKSUR5J?j&joqM*U~Yv26}Bx(+(7s=`XuN>$Z9HI9lp z?Iy34(3{Ph`O@CfI~(S;YPa6Z=$`0Qu3+2JHS3xd!>dPz1O~1qaT}Xr`{I&i@nyC4 zlZ)G#lcFv&U;VaTYl*&?Sl&Wj)iw;*hS`VNxl_)yj&hU=gUrT8^O193^dMn2K z$3lJZ@2AJf=OjvF@d3InQ6APCH7{H52RyZn8CIwqEPFg|gA&!3`WqT@BDkG* z_Xcz1vv;!ud?@!v=jneHl)*25yp$xa^Eq6;`lTy*$d+=OXnZeNWo>&rmkx?scErlJ7>( zW}kMSmIRWk4)>qWA908&_?w><&d(Rf`@W)nK>|zz)CFohlpbfU4&o~ZE2X>SK^<4= z$C~=C3jkPOYq!(urvaeIYx_^O&Z4W}C$U$3X}yfj<@@1BRVzE;vyS=Ts>ju&E)MUu zBcjKZgFB0}oNL)f!3Tw#$$O)#qBMEe2c*YG6EAMxb!xxvklk&F^LaUl{R0SQ#_p?L z=&>($f@ov>&Jg~uK^%8IkQXqy#4d+hJWViu&(++cfy>n;v4=x>5I2|jmRgG2Ztj-N z=I8w)ZcA&gQ&12}Y!HB*=Vxz%$46ifFRcrbUrI?v+c&MSbK7b$?|GOeHQ6kqx?`Q-2;PyL0DPrh4jdt^AZaHL%qYVWJ^rDk}>?3ogS$Kttj~z<^7T;8OsS;6KXZ zkkk-w{!tGF0TF5e0sXHwa^UOlPaOFC-RGazHwhsSaNu7U;L|M^>ff!A1#;i~y9`4D zz6T+sEFvWZzA76zn3&i)n%gm+TXJjT5KqMg{;d3xHu8gj1jCKxY zOf1~o+)T`@OsuR7;1&#y?zT<_ZVa}Lhx}((RYwyC5jz`jPbYytu>Q}^f8PAB9se<==6{aK!p6e-=a_%o z`d3#zrr*#02QL1J=zr9LF)e_|$MheoCV=SA`X(8?kc1YZ@+#mfn9P2Epnek+^*^uR zGL+Wp7CN*W1cV@jl&Fx38|3j9xU_d-b0M)^ZKi#?EdGAmSzrB(!wn%sA>U{+`;&!n z)4^gf`;i4CC<;>02~kMI=NhBEO;b~Ja#o+~>cp3qU&-h+FlA(B^BRz7Z7Xfx++o+C^Si9zyr9scy9>mLwvYJbjtQkV3D{<{u(NW>gB@;C^Dzw0pOhQbms zX_4+hiU0e6Du8}?{(a9ZNiu?-drmW=i{TRXw;@u}uZL>&4TT`o-*srlKm^Nco+ea_ z{9O>iaIgd}i2pW{gv1zhfTs2uc1R5(BKy1O91B050ZqUQ>(Q*p%9>liu^y8{sO^zsg>J@H0A#Tx(C&Mqg5?6^2>WLTKz%b zUl9{w@BiHM4#eP%>#)kP6ZU8AUn~EcP~&>xi_gPja=4Fs96tO>WO>jZUXlBHME}R! zYY_eS#L-jZ1AjlYzY3JolZ;6>{~vJtv*i7**0Ow~xrP6z{VT-dZX*oFU}LXXh}?>nNl`D}73@RrGg-Up?NFwuvK{Xs8iAHi5rpqHWeE13AR zjX$A~Ur!OCJsvmwZ+uF=7aW*S!CwAT@(kXCmviiXK8^f;3jKo%f&$3tSkE&i>o=ui zTm<;}UL!D{5 zH|!j;&9il#d*^xQjehJH3SG+!mTIPVbb~L6e`r7jp%8mr2YG$9f6n4BmE$_#6+l>f z9*Q6=I0eqJO5L*7nMzIm{bxV35a`EcQvYMQ-%t3ASo``XyaQ736MC4}(Eq{c|CrBz zV=5RkfkjMW@{k3_tfi+i}@#L@PG$DEsKS#qy(4eSjMbu+@y{{K<-pRv+$Z=K@Q>Pm@5KL} zss=xRrRZk$zXr8VPq^K`TYDv^%61D-0BwICB5R8RC5bWqFgS%J0-~~gQu7@}FIK4u zh{EF_!*!j|_8iGa#eo}G9{K=TJNBV1%VYO&Cvs;-S+1rx6EtV+4yvJYI8>{Q=Gk?bQ0_R_yI7O^rm9||nk8!tp8UnaKv#ABIJZ#9-0GK1y;5`m;Ry)VP*xo-Mu%Ne~& z-4&5}DVZ0W&Kwu+?)U5mu4h+uEkX!KELhfHaDI7AXC=X4kTmk_Wi2~Qg;Qze&31b0 z56-W75j2^F!{<2Qed~I?^$da0`2d{9D?)lG4oRKSn;v+x`!Z6TxB7H{nbE48jTD8m z^>T8zwxyO{9wxt+?bw)Q&>zBJUDa}j@^tO^tv}d9j(z?@XU~K9!>7Zji}uGIU$)8q zPO0^WuN7I=PEVsl>ZwM&_|Vkj++H(7x92rul^n{Tq=qU&uxb1FKseH|^>nAv`9R3~ z*H%H$1O9tztMSEVUJ)VBb*NXXNtyLhr^w4)*K2SJ_j35wDk06y(QGnaovCyaF&E%; z7sc~gwM-=i>i%lvA(m?}<_j;T?OD{cd}@CxdxG!ltz9~|m0ZsrQFH*WzzRiCwns$0 zf_|TzW8D}c&E&?G&d$OX^Z>3PWT%4_RF%`y$D}fTTe(jqwf*=K3yoasmWT* zS*ZPgAiPOle;Nrqx{7+La@)B0AkJV|3fLr{$Xn8(crCZQW1!zKC#E z>07yPcT`KN9qF|`ve{fxl&CdCMB#DiJ=}J2t?U);1<})ZSuPgT@LjHZLv_ohF=%%R z!=m7m{VMIlxNfokF?l8+@UPURp?aWWp^^T|O?|akOtTYSpHcOlpg>E(ZE_@)P zAE0o%;F#!eyx$IlhvqMy~0knLU6z{#i z+DTL-*Go=#-_z$Woyw4E%WoGC@BxvEjOngkD!Ch+J6_&(Ju{5mpZ6V1brg-dpFOj? zYjSTqFH9H898B4_fwp3STHd`@g?%<1%f`Wnq%B`{ znXgAA!)>`~e#BiGUDyCpqw(JyuTC-$yMkxw^ZJuA$mHU!5wTs6wCy!jSEZYC5JC+UMcJV3c^BVQBr_{wE47{m)~L={980(r{+fjMm%&ijn0~41 zYE-mdK9u9$!NN2qtJ>y%^}2std$p~r7IbPm;%V(;ZHSemGRsbv#&2q-pTXfSLdePB zvLYkb!?R3Ju2j$@p_cx^S*gv?;+SI+Y^LkEoHR&7pC|>T;pcX9*>}4d3V+aXx0f#X z_Gmi@Q?6Poh^N770Xx^A*kiKq!1m;T3XpijQ{S}beZQk#Ykq;Th0`H5&NZRk`*2hK ztJI^SH2{KoVMqlO#A373$dG^JR+Q!Y;_mR`z6W!bB%8@K@_tN9Jc&021?(0A&5kSe z6qzf=Pkvi^n;zaSuj0T2DsO!)6r*uo3CZcn7593av z9iAgIMTpBXMWX>tI5sfzm4e0GF9-4mDx%XyqN9SZnbkT)SQiBgsPsS0w#j!D#}}x8 z3T&uEAa){MNRI8lvOK>$`a&6C21&Gxf6&cr(uVgVf$njy>?@mRI69NSq|4LUBUmIb zkUL$+YVwsF&0#w6hKo-Fd>K5`SIAqKBWMsK*BG@*XoJLkFe8&+G%fi}&K(AoVcFU)#fEA{J{}#jX zb!)H2rH@+=W63c%NLd1UOrq}f;rn#S`U z@Kq`?dlpj##D1N;aS1lOLR{{^EG8B1v_req^~Cy0pZKA#wwX`#6B`1v2Oghq|n@B8SHZ8od}p$>jgPJFPa`JlU%|S!PmCBJR{_& z-=4ce(h&1$8_FrYgu6I>FG~zqSwHy=%B-}y)RH1MthI_Yx5??+&4{!i8|@(F^pKhK zVesc|W^=iGB!7?%4+*IJ^|czs+;&I9wTb`74r-@em5 zJ?)sNKTPfau(|*50!a%r2D*SnBxZjnjWbgvL)X(~85WJEcp_T^KX$NuRr^zbj*A7- z{cYRXZ*#%^zJupl%wi$G#p~*%NvYFe(;szHZ4^ooLC`746Epvtc|Knj-*sQNL!SwQ z$R&BBoan>MTGV{7lMuyZLm&{Uj|nnJiBbKi){&ut@1 z=?&$6Cf5`U0aCs!KsW*yhwZ5wHsx+Ncg+tT*VR?&hqPDkGPOE6G)l%YgdDV%QiDY7 zJQ-NvT~xiz^dcYzl>d!c%{IN-Bcw|}iP&v_lHK_c0j&$Xsw~281tzRyeu$XVLP_kl zJ==m=UvG}ET<%bUZ;9Q8wIjORsE6R2#HQ_Q@ zWWNWqx*>PUW8=M;d1(gBV7r0wFKV9-d;3aJZI&A2FHJ@yYx2cl@_??Vi|>!PtdkHh z*AhfRQSOU=8I`Mjwy)4~d9Ca4-05(?IuQ`fwyCnT0T%f1eHIkpyphRa8IdCqp}WL5 znlGcfIn<%=i+qHAR9&hK9OoO>P-O1wLqJQ9ReL5DM6Y16OrBaG=T z-P5&YRR3HE-?>Y>8?PvbSd`>xh5B-hkZsO%Z!B}bCwHbyTjGV?Yt`K~+%UVGmQCH)q zsSpJLINPaAMrY|1UmNyyG=o>Y6SO(9uHni|+BH>vs@Ujc(Q@7cby$jN))IQ0Xi=BJ41e`aHXgM!veDY*-Ut;#23Nz~n;u&7(yhznGULh6$ep#< zmnMBa<$=>15wQnC^FrHBPj7jyyM<(R9mcUt&Xlh7J;cU|iJ= zp!tz4ny~ju%puRaz}Mn1>EgGR!et9BqsroQB`Cd@M%+cSn)5Nn+vuf3m!5D8d@Stc zP+yAeI;ylWQ}6o8xy=0|NXl+Ol_hSkwzp;i+oCd=NqtV|&Qz(l-0$LsYi;oH3VZOF z+tJ3`Y;W8KNUQiV&7gf;caVK_T6CAqpwwJF!!M*P_8 zaZ{kxK+DPZc)H?gyz+2!`z73y4!xJdX1O?TrdV(6i80$M`$GQsD*9p_)n}3(PiLvV zRq4fkH(hCAw2jn9DU-#jv0SU6pO}o$rQVDm?=I-EbNV)sg|i}38$%M+-+01zdYW@2 z;jg)$;sjmD;)pjepLQCpp9WE?1miI-2LQerzyjco{DSpUgW*C+Q8pP&wC`fo>x*h9 z2hwuy9WtlYgNnaCCfREFt6QM#<8j>tly81@nEW}5<;o!<_v_P@$xf+it?|JnyMRk0 z*%_c-xlB#AM71tN(|8S9Ck+Uk*^`qG)W`NB>f#6>zX1qojYwxorz;g2uSgtK$YXfv zOc|Z?Yqc}?0r3pe&0h$$ip0Y_Hg*gyfA|$~a2tBgX}%^&M*~#-pYBb@TAgc+hiZ$3 zpw^E9ty(Ouc5_ic?K;+8bL)0o6QKGQ*w>#K9HmkgY`gl=zBB#Nna1}K$=w_dBZdG0 zc6jT{@QZ<<9CLO$GcPHEnJTKVm%8&nvD=3MT2x@t>(gCVt=0T#?(iZ96KiMeO*GS? z?fp+s|MyU~QD!~n2e3Jg%6Mhi^^cNhjn`6=QnGV+8W+m>hep4-9Y zJIdyMt@|o>xchGtC+hwB*e_$uVUb$8J}n(^rkS}P2uAs{iZ|R_3KZXzS!kLr26vg2 zOX|46#=b6Hpx;@PH)6aKD7<^#X+n6d7B?k4rwTbcoZ1-?dG>w2T31(JS+08@fzxy* z1hTAR?rfR#>a@4pB96r#8m$7d4QPG@vD=NyTqV%sv1E&ibO(pKpC{PNHtLFcpF--@ zqG@lyO>(GjC(eRdu6S^s0UhWXS#S0W1?L zF+E;A&$!6Ge}oFP;*fbOol;g1>f)&!dpcD$adPV+YW(D!YY5qH=S^@s756>-vF)rg z)w1Dm5bkRC*HDcg3QoZGBw*DHWf6b*wC} z#S%mOs2%3GsOu?WPBfOu5szN=7Fmu)rM z{e6@xNu+pY4;DFmQ0sivnnp9fS+@7rrCu6YKm@fh%I)bgE!x}ep8Pjt9U_lb+Y68- zdCq6-SpzYde)LvutFZWt6_xGF5xVRvD?VVu#9@iZH6$W+*~ZY#F#CPuIFV`h@OJ>rsRx_1UXfMHDL?e11lf>>c46pj zg~>Sj4S}4A+C;y^nQgbU6pK3x{TOr$ak(*CFx#t}ZGE|j^&JdoVXN3znqFoQ-rnqN zIU47+z8wG3R^akHxQ1eEe4XuW`hCm6=5c0Cw8>^=fGxd9(18DKqr_JBY(E>19{-xR zc;baXzo%Pg`q>sLQs;(u@cnMwUJmjq722uJ^oB>5`L~!0xab3As!U+{JNOE?XWW}z z+?LloiTsz!byUac)ohA1&rrP6U{a<|>)=d-`=RxRzHFjP-`6`|gIPF>#G-ccrfWHO zN_Lj?JLtn1JNOD9p3!t`^LzhmG|Ag1E`FQ3zZ?)Srh+;^7ckH{Gy~^AhRMv)>l=nH zl^jLSozXA;nhk}3iXT#5izld**4%3%+bRW5MK52ZvO5%$PorOJ$7}S z=_@q4KN9@@vrS$ znl#vK|E5W=dv;~+W9$>C;q-V|w)hKX+dev9bGkouaByBPoG#8`qU+`xv4i}p&l~{F z$Dex)%v^hZsSYUY)@e=DR4g?%!9HLV*fo5wl7ah z18*i0=Qh_ret119EW4h_nvKry5=PMHnxu)rcP(}bdIJ+$p*m{jD2Hu5U9!f1O(2F8 zYS>x4v>JsBaPo$Xom2^P6i4sgrp3F7D(Gn|maE(sOl zeosW8X-%JC_IZ%2-$HF48@)@#$@Qn`fcwP`dftwMrC}`*P#5fHd48ORM-^D9RmEqQ zd*^1ZF((RIb$kun^@xd~E(P#O{xIHp^i79X-peLX><8lV`s9BSJ|Xx)puCoWcCoRM zI%(upu476`+$luJ>-oS7_0Ewm5Wc+cUBxtYlehiA1RN@2KBO3%%ulrO>;6++n8Xr| z+nKrv&Aghh`(* zM+yUT>-APPzrxX}lJKNioi>Q42ZkVt4pna4X{f_>52H0>r-AzF_TakE!Ui^zqf^ho zZyIE6?QQ9mT0#fZyq#>doRjKkd=M(w6KyMsuL2-12She6o$3B(xTQO-Y1qThCBq9kg3f9tvC|`XF7Df@$j|O_9HBhYXE8ZsPvUAEZH0a$ESv46TvBevG5+E;m|Ajp{PMi492neVk1`&bgMZ7FcDs?P(hDL# zybp)H{Rvwg_jJ->iyXw4acZ}b3I(Kx$HM2ZL61l7>SD2rsh3%gt?dc(LGvz^%oFa0 z>I}10X;hkpw@*OK0oz8cI`*2WuG1!~NwKGn@fKDGb`% zGs^OHlR0QGh_LqWg2XFNKu(D?t{;ofE#}&kVFD0wpXBE=t?c(>MU*NL_WdD zj20=TlkT9lUNeiGLk^cbrzo4*435hsyDq7FhaFKIf&PxE@|}0ZwAHR-!rSK?y*Fj5 zRR(d{3q-R-$B$2rLZ1>utwGhP$7F{Z<%BO;%*@?AhiEt51HRpG01B*h+W6ZTC%hXo z!iV9{-B7zVZx!3IJAnhMMh1~lZIC*jJJhRm>3pB=P)ig#b0kMKYBe~Ps`WNE%%;FFlc|PzrpGCMqZO&zUpidNOfZrSgjW7WWA&F>O-qR zJ}cMvxmV55cQFzD!Kn^%(kv@8ZV3PQZo&{DhxO`3xXos%zEKP98Yf?<{n6!Qm0T7cW7$NH4klKHxNsAG_I+EAu(`D@t6C`DC)s)Z`6hwRi}{{2zrMDtGLoc?RtCe zoje4GZ+B>(VwM*qay~t2h9X%A=aPORPf5llSV^swvTwaRk``{glIQsi8m40${N$hD&q?QXI_59+3yJr~T;UFe!Z&viqd6@j1YiLB_lc zprnOzHzUmEu5U&u2CBAHsLK9QZ{_nVXbz`8m%hJ#Nrw9T0#Zn#j*^mMPai$4o^i!c zCv5n->y?O=l$~HP7HLc*h+H%d>P;GNd=HBckQCYl`OFjEM#t(`K??#$Tc0e(^SV$z zkWqg<6k;-g(Y7eVriumZH|>EXvX`d$_yzMDSw z$aJpFWg_NbhDqHVOuBis+RLX~Z!pV>_lMtgo-2r)wo+MYtUE^gRX2o>2Zu3Pg3?ah zrJ4Bam!br?K*eW{p2Lvw3vSl-l>~in2bvo}8Y@pjR7zlD zoW@qT^bnC^Ff9CWSIsV8OW7GBz z0PNc+(`)Z?-|LSh3-H=wa5ECSsPgbDx`hrVn3V03pY^TMjS+LskF8&gMMz>q2;7)9 zVp%}FxG!lx!J0{!Ks(>Ds{3^~ZhQg0YVHzfIzVHjyt9{jYY-S_0SD}E0UVHg{uEfUps2U613c01ZCWY2|%BXIOIjL7t^^2^Q!+-aSK*vAxEOh}mE<=_^u-fl*| zLj9G03E1!=Jt+!R*+u*$O%i60v)m{gFLqVIjNn715x2zgZgG9ts_HDsbn-mDH&jY_ zs|@Z6=iPjmyp}!{CZ5Uo^4;~%haf-wosaKMnpu2qY>*Je7W|pvXl2WjcZ_#V_Bi2p&j5P{g4rrFG3DPm37hRv#40Spv^u`m^LM0C zs#MsXp`YQP>LzYa6WbndWVg;juF#)LUpwvwN@=Bc!A566r{7D@1uibMIM~5IaT%=7 znhiO>{CE(-sg9KI-3<=zJOiVOE2Sb+&^xPt7Sgkvy#>wnoZ-DRR(4l8t{x{*>q|$k z7geBx^-2yeI8w==wfCZ;4TqfYauSO_abOn&))ro~zcaB?qt#+cgObwka76QYqt>w^ z1A1|ACtBJ*aXIlctDRq6uYJj!uWAsM*TLbFUM~o7jTP7F_2lr)Gt4k)8Yn+U_=+0I zQ{Z%tabhyl@G^pRe>x&N@)+ZmacXOYFL5x0InW~IqCdf}79?*0kruQGACD_$j;$sT zUvCaoY>ycQGSSz%kR~(CHb2QW)}!pOYhxL7>EpsHna5EIzFCM(z+xvh8^F0TF7OS{ zN+jM;o*>|bnJj&J>BEZ|b6L`=bLp^0luIu#5e02WRAYprskWIq6U-tJfj#K)W$)U+ zamAhjJWLPQ%~FohFZY#6Y-MD{x=S^6V7I3~@gjo{#EL?3C)6+3jF7}<4x&o=D@azy z#U%K=5w;2BS_Aq9mJc;X7`eA&O=}(O>pw(Vacj>ZXuFPNao@qoas;iN*qriRMZcER{l+-}2fmvE2~= zwVrlT3Y;R`DkP~e&t6}ixy!q^C4vN?u&j#pP(JluC*@}cXwU$1CBJVME8S$ECvtiP z+30mqYHUF5L?qE;UUYBkTP1aCtg@GdH)ApuJOYxNVQ*v$SekU0Fj1O(yLc6s7ay;1 z25-K!9vXx+z1&;@wVu4#uX{#%x5FXh6|q)O8Imr}n(~-X8tE)aP(zX_mpzd!etWOq z(r$T%{vLSN6>f)mDoTKPV9HJMjpP(AtTm@({av zvY%;QljCjObE zg?;hc#SdzU1g4p(KMV5gqTM6mphlSgvXF)ML^UW^mMIYOlI%G@jiEXpqgJ2s1?L%6 z2qHgL|0Dhz{hezRWq^MJxHQyi*7GpIju9pX4!>wPrAho%{k8-e?Dy*C_Pwd?hR&?qJpdhZpO19%E0@v-nY*x}5N(5GCiK@_d7w)t%#(tO(_ zUo(S&0l4q`_$$Esa1{=#N1XRgN07(_2o3@Dy@$V-IYck|SEXf#p6n}<7bpfkTuwg3 z+Ncn4$=}UaYS6l0W--b0KW2f0`T3OEKoQ_3CYiATq%A!xYB%bWXs?X-;m;d@O zi9Q2%OQF`{|63mHUeTbxFwfUWRPc%_*fQSA-1PHooQ|L`je8T&PrN=te zC6`*$lh&}+9(A0T0JObXi#Rg5DC$or*9*=#QLe%A9jE(r@K2irKjgJXpTqX%P~)nN zH~46DniWR(KUD(0cCB};skLu`18}3AUBtfIqzB6v4{3@!D%&u=9MR1?4~SrYzJRbo ziIIPr=62<3 z>#OPJB5ojeBb3k_>di}%9u<#<2IsnbIzJ3d z3_M3Xa*i$+%fYW`PX@hJrBf-+rGF+#o@ho$JRU~Nh^>%Yu0g$d3Kshao!<-&3S$Q8 zsAfLC@E!arY$Jx%em`C)>>?Cyb-!eZ|=x1a8*~LFe=5+xul1uRb5Yom-q$+W6xl_%63pn-8ro zOy1UXlt{R?yk@@$VUSgAJi|NY=(mUFS7^;NC`-6sZ@>lcJe>~@ZAQR8?Qy4^AADZM ze7RF&9l(azMnRwuBw4sxgU&EU|7&R`;MY-7puy(QI)r|Up_ql26nV==tCfukK8RYC z!w@elXoj6O@$5CoOB8OQ&M5L`8uxru5D%=GdSt9n(t7m-Y#6+RF81Siy8L=T>k#{z zSX_mUUDuaCJvsW0rP;^+kQc__9eIZxDc7=8-_!@A^71cF37%aftRe+#3%f4x{Ta>FgK1p5`sagdNb->6BHJ6{RI8;XX~#qISRf4=s9*rB@;H)gmTKJO zv(K;IG(^2$l$LLkC@n|K`5cYv2B}Ws$9rFp7znQp-wZK1eYf^Xm+x5#`u6f()?{SP z2L0Y6cXC^2P2ruuy|6gHL{r$JlVbECdJioC0u8+2+6tqd2f|G`V`Yx>;T-G2P))!Xzb+CT+k8p+4GOuP=afK4)=rEV`M{3vdLM3eC5rhh*FA zw+6Kp5wAmvyLiozj-IpJNbPkgMfLiR*u?pe>*~1qnX^Om6}l~k0oANmk%c$Fs&e;SWFPiQ|G`(oGK!sNh zuHT#Gq*yIB)|jwJl__>)sMe4}#^<4tBHr!}&Tl7#ARh}r+l9>~>6K~k8KyJuMz6E` zPUY-3xKK3|zy0`{qW&$4wD_rts7X#e`7~8}!oK|ohiT2mDmc6`sF;;`*$z#=8CDU@ z>Y4QgLu1<~T&$4=ps>B0H7Z+fL)NbmjMkD`af-z6gt02CIu`-kZM>(B(fiD3(%%y< zmUFX>5pu2riJUjdn{zh`$pi{o8mEIS_;-?&t(DTwhZqQKfUEqGSK#amq7zTfMbOi= z+m>?4B=Ob^PdiGmvdv{jtXbz3&PmE-%GO%tF;fRHf$AI!u!K< zuL=lDUeLd!tOt!B20e~MRLPNiN@uFP(0Z|5v+h{U+p>~1z8vg} z#Eah}rhoaAeG@8LPb*pxP;ySAR)7zWL-NTl@1&Azl|JWW#VU5|`D>?8yPb%sf~lU*)ajpmFitxg!CA4JxX zmgx?Wuo&>u^h1fu&JhBd7I)pl`<=Tz>uf{|+A8v3!dMzQv z>RS@Awcx0{mN*;z94bI&o=YWI-auHUiP)Q~rSm)573tzaRo4q`u=J1HcpK+FlS^;{ zjJHTekF+A5Jq;8!_Jn&097bdNOV0XQ9PgG2yItY62b+a!b{WWsfqUc*# zq{2k6_)u(IeDx@N&hkEifiRppyno~RXQ1cl*u zky&q}`EmcByR-9psc-=Ix0;(N(xP5|L;r`pw~ni7>-NSKQMx1rX=wzMQjqR)6Vd`A z($WnZkZur>5b2O^q)R%ayGy!z)4#branJMK`<&<8=l#9E_kMn#^WS2z)|zw7Ickpa z9b>Cy-KBZk-iv$X=9!nORz!u9Lsn6rNdG?5tLC|hS^9F~rH=bU&2qERCV#WN6fw^| ziY9y;F+ABepVAc4-tc1CmeEgFQ6t{{MhjA>L8-&V$5yrlDZM&~eut+Wl>z$-T|aF3rv^R&>ljF*M`*c*x_%6R^A0 z^j-#HxP>NHn`=9gKKo0X$>jXc)L$w%8F)kd784|w$3D`OKX{J}$7tXhN9g}Ww4x*h zFTl3qrVyX@tIydSZk5k=faG5bOc19gSMlcRZo3RCnn0U#Lu`6wR+DlaY`3>DdS+11T^oV>MBfEj5Z_u0Rm{%qRe zD00$#o8kIw6icy6c*(yCj^$yBW(kxGa+pJ{0{Sz#u6nyh1lvjSvJ>@P$s5Av&Vv*pw&VlkniDWA^b=Es@k(?m;OtFve&I*B$qZ+2u* zojE*93HwCx1S6zjH7bD{l}d1)&qmH~gZhHRwZ6k&I_18RrKhM5L|;0Z;1D0JaE0~7 z_mS+AnHksfGyuI-(2$mD^*q7WI`vGCq4RmuXlQzH_SJa3#N$-B}^OgsU*eP1}thLtP+qr|9i11*Z7eH;r?_kJcXl10sgV(qrt9CA#tiYs> z*zq_FPG5fO<)a2+a{GwfMto`2v3YF%Zw&W(I_fG}ms2UB!tRaQ_pzhDK3-t3n>#rt z-Fm|ANtZW>k3@-qkoBoV39ns)c47p7J1LmSe1F64AZ3_P2KJ-usGEDXW5XgiNJZ{F zrUF5;dLfYgY?BllO2$ay3JKgy<9pLpdLk15KhfcFi-AfE6bcQ@Pts2A4cZAqz$ur! z&t-d^ZY#g8^SRZ)&#WQ_1p}k(@CxJIbW2qiVDj>kP>jzi!`+Hty) zNVlQFf|l*oep2VMT}){b?r#LaM%C3vkWCpfugfc!b)wVv!34lf+{!jGC;9c^EL?x3 zDX6)>|zt3c|2xRs~?hs%YfYCE~av$6m;wGLVk!ri@~7>IFuRz>c1 zCV>0`hNzu>3uGbNcK*G68h zq92$vvl#8EH;raXCO&-+<>sS`GP;vZ(Um=4GoPM~1O5bA%?{aGf30bs?4S&5 zbQt$r^ibUKwb}Bp%cjsMAGJP=@w~MvQvOYv%2FqGK0NMR=f@Q$Emszh8h?o2Ib7In zgF(!e3U2)6(&VBj|5|w(sG*b;bbbF@cCJZ8-d&Gb9J3yo=%UBo;=K8czY@o9N_?oT z1E0C_^w;v85Vg(8?$JxO`3ROC&2GezF;L*7!C`y;t8ez>@)YgI*>eUr8VO+-qVBhg z%931Is`uWta3SW{87I?^DVv^f-GVv;LJkLBSKxU+)*osEK`Lfp6#Bos)6sghX+BZHsJG-w@hkiV9T}=n~>F$F^p0ZpP)l2Y7}#YU1vz ztMdAe)-V;ciwr zfN?1RboO1mHohy6v%B4v5oaAZ?ckak-rx_pnKBgbh(P07nVvv-EEYg$z%23xLv+lt z8~+7}X5uXeZ;lkO8gXNsZ;M!#dP7!`-0tsDuMvwvumz00A9DB3LVV|>HV$t~OD2N+ zRH|(#*%uuBK>UZydHF^jTBef@n;$xq3|Et3N3=>XL=P-){vz~X=czG;LLYsxd8Pc9 zhLRu`Wp=%b)#@Xu;(vwLbzua#8Uux}VysV{K)%T~zHbpFkx_--!oB$l)N|22i)mtj z3e#a%9S=wA;2p}fJaAjt-Mf8M%d{;d8W*rAjwH6|Q=bRC{kc?mv%dF)OIe1AC4Or- ztrhi#Mc!l}L&ImWNsBf0xhmxbKg;<{zvg>PrSJ&WT}Fkn6p*BvMRixeTt9<~PrI%5 zQQp7fJB&v5D7<<=?;bus-{~0jz}}hZ;NS~+u4tYP^9~^TMC@ue?5z!OytO?`vy>)$yvs=hr0bR8F#cZA~JgzmI;Nu z@}u#}8Tm{$KNwy?_u(lQDfPc;cqOBDQK%67IVkR|TI)ebaDd(6`!Q2}9>CA?>|NNrj&y``nzpA?7~V#@{Roj3Zjh>f5~po+3n45YR#uiy$>( z9~64|F3&sixR2gzRolztIb(Qb4@VCi6<|HSo_IRYNXLrW{*x|%`{3M$=)2k>g@r^J@osbU8m5XWSl3}c@it}gCho?H*GOm0o! z%g_LH(7indPw9`hYLllor7R#(+75?brOvEv4k!n*Ow6y0UdOYo2+$i^Ev`Sk2OJ5k zybwvF@qK)A2hU3<8v|)$+_G-&lNKn455zFe$~RZL?nwy6TaZplQz|EOEB9J_gPKsP zsFUPvi);Z_o6Y2qQdB`WjS3%s{yz5tcIc%uI}>!D`o0jwAwcz}WXT_Noi8K>AF_tq zoSn#F(8Wp~=8F63;p3i4VdxPH=t{rX!xe>WiQYfK^DjnU!6%h%_U20T}6eEtK;)w-g(9@&-jtmkS^xQu>kFRUw=Ux1KB3?SN@DX ztD>;Ne(ZLTE*Ab8jG73=A*{&Pu2#tjsT50e3!@$jR`=)#{%JOk+Ja!-#dYtK&6{Wy zhmf5qX%%x`)P8{;DgW@ppc0F>pU5g}XRW_r4CBXfJwnVwnlzhqXb0T{rqf;t)b@rX z#GubdxEUG6?={|PyUS0rkszk?>nU1&QO?(2Of{>2W3|qOqkFol{wZ*(PiJxRCdz`G zd#hcoPWIaHFT%yPvQ2r~Kj?QIv30Ac-X1_d@p^pkhp(i<-% z_Q#nB94EQI98)AT4mY?jYPM641{U^JgvJX=k4mgkEt2C*ZoRyAzPQway2WNL+I&KQM<%mhc8E)rh zbzB_G@e%VHcoBC#i00X}Z7l6ckQJYhdOP()7eGkKU-(=3+i_G6ku(ck1^=mb*)!{d z-li}dZRR?mbYA_1Cm!u>oZf>rsiG~o{PR_zwo7q_uG)@7?MLD^e-m{d65 zu#=HfGA>S8EQ3BFS*EXvq=}U4SQz*~j7n;8E;5DUIQ7@RBY(r%m(RD)Gci7MO!J0- zT$kCza~!@TfrH?8ZzFX5uY^lqwC;Lk%3>@$inHl?TFKcFrBz~3`*td>Q@b~B-9OE; zG4|_*8OgT}1HVSP=+^mhNZDe>hBuiEEG>s~HS^g0^6QHNWmO8deL1>$Ndd)1x_Yb_ zdcLFPR7DE+D~hg=d@s@RM41pT7m~$QvTkfGln58jVAq{G*JC!mMxqmL8g`t-zCz#n z7JfuTP{tFYWorIJXH?-5lnt0wOxX1BPe!>|t+F{?bYxufFzKg~*T+8j<%FC8Lg5%i zIViwhDrdcvq99Uq`32J6&Tl+3Kh|39wzogc|1**Z0$?b@w?$Utxglg($_G@M_}ffV zI&}}#pFmIvS>8nKP2sa8+eVlLJmWTEzt>1Nv{>iPmh3zBAQl7&;9@!nYSu%K`9A0F zRqfmfo{rC182f5;K^b@nJvmOIZ%*g7eeSAy=N>rujy_Xw%<#on?}$+-K$1J1xAzJr z;&r^5NqB#TL~_FWV6*i0PInYMCB*E{%F3+qm_79Et%zSH7p3jB+hrbV|58@;Oz}wc^tEy+cxn$ zJ^0Q}Lp}NsXMQlr1JVU*7#Oi7NO^4ObI~3HyrI2<-Rw2UIoLMYk-lkI3`3=A|46SS zr}2^? zJUYSamt@*d!J`@8g;eD(;JWvIeLW06odrM%?O`KVgZ_#YS>6@&7)QDHW6yTsOrrJ56=goI@>sN1u{WIKFNbr602pp~e(& z&kN&?gp6|{G*S6emI}d6qN2#zFHub+K>W>s_#d>3oXC{-#21q2`k#5PLO}U|_hTl< zfht#zyP{A1mp^8T1)2O9{j3h29X#ulNjD0|^Rw9^7gZ-d{c)d~**aDJXOU_0SomFj zAtGNRrK0bKHx-na*vnoT#*uB5aya#mfzAhalm~F(sW+ZvV1I;a0v#%e8$T^vZjjK@ zTfP^V!b#L7zNq;K>sq_dBt4hfzgYfQ+rUYMyeonh>@Ifv?q7w`darNet8b zVw7cajITk9*TBpEP;VJ%Q@^}1;?Ulkxr@?Y2^!!iC$+`CGM?<1`bB{29xy_kFNc!{ za*c6a7!jRdncl?YcPNPwjq7Un&Mb|m=sAZh4!ZI`hK*#1U+#DLk;1d|wZM2*zK(Sy zw>2M+=XH?UIt%fnqy>WPbLR2xa;NTGd-u`$WPhDu1n10~0JWEtfJxM5UKm1fOfJbt&ESaTKkpDe~Q?u%*;;CF6ZNm=M)%|=}8YrSi zz`2vFG)ki1)tC(tEOR*yf&J}au@R|lE%24Sc`dzijTo`H}*?irp;_39dP*|N_Vbe0nVKQevE`Q7IXNNs0oYvK+G*~ zqDyV;x#nHWH_j5GDdc4BqO|oVxJ-rdmb<>*=}Im@CxjJe*K%)Y;X0-VLqUCpA{?O* zI#$JBww1p@PtGij<0OtJy-V>+%FE5wJbKb)+GHG$MS=E3Lkv7)QTw*&D8viv5i~#< zsl;lK)_CgK%f6$YN!)bjuXq9-F5B+%;&qRBh_*^QBGTZ+NCs1mYm?VA6qlBp_Z_tB zJl)Ac0|zxTW^w}(R{Z=1qd&XwcQ&l?;&>fUX;)Zg+W}3A+bo+C%}Ve@x|RK+@31P> z!ia4;zD47C1QZ6ega6?ID?XDp&*9C@2b1CZoCLLH8Nvafvse zBIo|d&&zK02!JD``r18`G3w4y6ZTd%(8VWM+IsMJ1rb8Lm(5Z6K-p-{O}>I!v>83* zrPpB-{+^V;^FHz1Fi!`$2b9n!nUPs)H1b2|3m7^TsVgt?6xDZyGRpuiIZL@0CyC={ zH-PMM6>oeq{W~Wo%q5L<4#oH!=JvpSmoQ&*_51v$#VCfOnn2E|*lOCOBmSIO6OUYx zklpQQYvk<1)ATl>8T`*l!rt{E$5tK}B{nMr$jl#f_q^rcrXFaD z-_F4<+0$)E42X`5JvL~iRSS=ujN6ka7!m|GL2RaI{(~3p_veojNQO?<`v~FvaD;}p z*U^Pi#sk{S`!6aLbB)%KsDxipnN}g0QOj4sQxV9^~X+R?}6sgg#AELcU-O%+Mi0IR2XlVJ@c$_GP`jH z@%8RQcHrx98eb4qR;b8rkXz^Mh1U~3t5rtOVLk?U*KW8Wv2npXl%N%H1yY&8VNt<`pGrscF(P1y4=eoet^1>R1=drT}XTH|0$7Zaw+~r(z-P>`$p0pk> z=Cn(;9vZxgE!&5eY<&|2rD4&aRAqSGtoc4O-X?0|`|)4F1#c_a6hyDGL7#7M1 zwaI89=>CVNs_@_!ztLeqJTTar&c|$MVcb#awC@6R3UrV{DW7RnzYd6Vm~lc#EbN(f z=>#pMB=F3}k`jWUTgprcd$(nGTS#;Xc>T1d=Xp+-qII_Ft`^T=FlLIm&%8FVD0K?W zXH`*;JU_D4)8;Ydm?_^{KnqMcQW6VtqaZ;1UaT86mFywz?)=q#?(+-j4-LCn-wV_;>(um>p(S=1 zJS^}xA{3Tomd4t{^Aw_>_a@GtPP0ngx*Yu4CbvJVdd|tT&K0|hLic9*aw%|yg3NTR z!l~KS+o~slfB5WBIMdncQsyoB-dilF^E(V!-$9i2W3#j1q#ein`EzvLq}ZKAds);( z3Nq&*QKH76XHi*}?O{*SSh-JL)~xQ{Z3{DDRv2hlL7McJ2i}Pt+&iuupp6}*$K65{ zXzfQ|$kui}oA}JH;eIrgO9gGL*rhJGXdvIj2}kSCeJR30DS9gPMGO?8`+FS+661Vi z;_!TDbbcIPMvhG&R$_D{&J=bCngH<;UNUNac_CW=9!aRLtp2RbVRohLnjYzV`Ljic zJd^Temfe`_0UYpR$Gy(gZ_|)39f>Nws_@AFiI4PGcXmTRrYVIx=zW;YhIPB>DcprR z#kT4AcFE8ffFBa4sf0tsWnaLCR*to;Gfs6dc4|h%A2`i5-2Ci)(gDYOc6^HZW*?$n zlmse_Jk#Dhl@n3Mva2PgnzgM+E>Wg8C03D*Vb{~ZmO?_vy6_1!E_>BjGVbl);(hxL z=XGBBNl_!^!xu%uPT#P~#TSK~LC~7e``wEmy6ryev8sBkPx$=F{M-Ymp}KC@@41dc zM$?5ZoyRb~C&rn!f+PTHYaZ9@A0+#8)M2+5=tL>LN%R%K+8iwnCVGdNMDMb;O6aqRSwPL zd0_@eT@Q-$UqaAYUV59aTD%C61n8o zZ)`YAONKTU>lP<8#&*NWM)Zf2XsnAXjO~0rc?tTfehX^c;ClPoZMNKW@Y}J`Oi2f^ zg>yo`S|i;_6X`o_hV6CCQ6#1simi#`txa<6!h$H-`H1T_s$3N-D=!&@WTuJc%O}uP z8KE>*b<>SS&doaoO~2pKer-!`{d120Jq`4%Piivxjt z&P&N@+>ZO7kK;knwKrVJ1(bF?{>w^^6eY7k|8UG|U}yUUxnFST?fwMp?mMq;1GBy64bsSpBZ0q}*(h#W2C?OMs+u z``L5KrjyUY6XAIL$+fk-<#*it_6QIpPC<@GBhj4M5_9C7|9UDgkz%BB&a-A@7H8?= z_BJjK|2$8=X62ChePPlHUrmg1I8;o0|7>zLRH9hxL4`s5oif+YudYynU};X&Ar^cW z)vrKR^Xto8Oj4dVQ0>4mNnOddg;Q)fUD^CBR()}ANEJn0y??D{eLYqvQ#6#qKlb+d zLJ+I|Xab*oz2!I04|Kh!_T&oP*)MIa=2!znVM>hxNGe&*-SRiT_Yop>;YWWh)lX7y zsC5U&B&ogEEpI>XLR#2SbYIvPAEG9{xFDiE_VP#BLH2i?(<^grd%mc59fC(MFSt*9 zRlzlPxQcrVQJ5(PWD>4j;!d$n7%%F$+^fW%KWcn1WxBi5;&j5lD=%6~wS=Bn0FsZR zb!~my<~GyyTy>XE2vfL-W@z9CEi1DkL4k{By8WJFW3nrWYCq$jecntxx59e)&t>Z- zuD{-E8Xs{W*)cB6(j~aCzlBy2WYRQi*4CqCUF>ws%2AhDL4chS4;|=G9IFv&gFr!~ z&qb9jMGpiSQ~fk{)^jw_yafuO;zmUlvn$6-HE&O)KbeVg>%vnG#(ZPzL6~;-8xvBU z9~tq7{4U0AX3IlM9QPzjLPvE-Vma5lA0@A0YjB!b2mE*}%)&WTU}hZ4gxObW7;-}f zL%8s<_=CC6tX%sCk)J=;b!4Jx8SG8i_qOo2zBou(H*TGa=Dpu`4~L#+AnavjkAH7r(3^V3_)Nb3zAiHAeXB|h&_e53KS`_>*s>pmk`%Zk=#hfshh zDM%=%h-G^0u3dkZM#0AM`9vN`tNwg2<~}@-1(WYDt3Tg%Io&?rxm}MTPhCww%TWbD zde%x|?R_bkde@`pG$-nY9hIO&kg`HBQ$@B>3ur6LuBv)N-OK*sNm(@|{VIo9exb2m zwm~fA?gP?OPEy>2N2%JQBGn-T$0a9b<;W`1mKfxuAWqxx*r$;8yKn7T?6Zq8Tp<1lkB<{?R?eTiA+}d$I)DdYU|LL#Ue6mVJT)=_XEo-}c z2Yt8yyp86s|Ml3Eezo6hH6lUc*5@!AeK&-zL{GiS$ODhjF}YcD=-$>Voc-H7y=AY7 z%?RrZomiP)W6j<_jeR*#=n=x>i7eJH>#BT_DW`D-&*^~vvd9E{qqfXZlX)u-i*3iP zPu=t1iy&c;uqiWx$BCm&U>X7-Wcc zW`UH|UdNR`#H`xRYJWr<*&J?Gzq@;Adp%HyHX8TZv_OOCsBRRN>_$x(g9U*yN_roFz(Paog&+ z%-wb(k2kz-01+!};VL9JhRi0l1#LR|_JDx=Zn~_|^RI7s4Sm?o8#4__{L5T0Nfa`0%p?I>5{>6HZ8 zgoHPPC~;?Q%gSV8$pVIKv%WYO4Bs8R{5#SYuSumWm2>Y+)Q~YD-1B5 zIzlSN2_#w!4>Dl|@c_;JNCA^@B2{!uS21Lm&3c8utAO!I>ydq;jSkG)6Q1S7I!mRr zv&tnn4tFixRzGC8w?=pmn`5!tyv*elQ#7@70dHeR$x#^N3` zp4Kc(Sp>lyi3aOUS%sm;ikL+~k{@Vu2mp%?Q_=~2RRWGFAXj-Q1pp(#d zuRxC-M(cHkj84!SXb?FqbahUI7=#-TQ6q{mK_lMcp0BSU#h~2|uUl1PM&(X#M5q>3 zD*5RfGEf;_S)>__jDyhG@QHMuMxySKhOG}$nn+<%4(A-KMW}Z?lAsVPi01Y5RYz+> zfZMOFyFNz5xjzzuI<+4p=U^uhrMwn2zVbXJcMULrH)xH%BVZ^pQ^jcX(U157;4IPu z)|2fxP2_dN!-$jptW9_Lja8KUWL04tW@qRDWhS@rW*ITx8RZznpJ|9S6Ffh|eqfZS z)enBg$0muAE_}P--CVQ}{mQT|tCSY|(?bmM0Dl6Xuq@W&P2}y{^@(ehBjzO2JPseK z&yEB9x6@9M*{e3LU zCEPN#$#H(L(gSbOGBz9%xTnFANgY!#zrT&5Ufl&D`7pI40xP%)I3R5^`oJl%AZ!RX3a?) z7nCzOHM7fCy~vu2_kQF-no_RSzid)@J##fsEM~*|0$*l9+hmZ(F4Eue{?vs-M(;;X z)6q&Pct}8+q$CBRW?Q9IeG;>>NqgGt%@eABc{XM4zJbj%#Tk5C;db?mV??e-ZEH8` zaYQ%%sPlfB71x4hpa1w?lMs1;3)Q%uOS=G!Q{qc7k{&VlRKi&cTyDwgo zfjXlNa5sLWgfy(`~?q`}7}CKVIHu!%Cs`NlHHO1w+xTTUiyXpOFyT^R)8$5v*doFj?P zUIvQ#C;cDzH{0YAd!t7(seF8FVCUzB$ETVa|oD0Xkq?E6S8mUwfph*E$z^3ZBVCUjeA#`0^8UV zflB#3ox2zV7v47nPdqXCH2Ph6Y$0PR3gu=b&p<^yA!mu3XpOi-8Fd-{S_}h-X%Eu; zO0N@8N;YdNxyPqVTpa9=c@x9N$Hz~*;|};%c>F${cE8Z3yR4?6wMEaB=$w_4tqLr# zb8}r&7T~tnG+tE8dUACn>J;H!8VhU_ZS{qxE+k>#(y2@3{|Sne!$3icD>Sn^3Y=D zOL558rUJKv&%5sRm(#B!jF28m1`*_!^i1e}&MW&q6G|9SdxsXfRLx+L*xt1gA;^v( zMs&@kWc~;d8Jj}z-Hn?F|K-K1frlgO^z8NF`KE5mZ1qC6W%Ekt_VPMC?@a_PdWyX) zG?KgyDjBHB-REPw$dXWEGD8=J=yxOnUBd|`5wsM04BZ8qDcoxAwU#Sk76k++RT~!Q ze)sJik6g;TOCRrLO|J8+IZZ~wIL7LjsRfgGZwI?qmrQ?*{bv(`&(&iaU(F>?)%T$1 zv|uy2o!zhpeZ%5ng3WMyYCG@!2V9E2NQAqIRmJ16jHS&PU&atIq8s+R!mzr+$aSWt zsUypIW00}cYQQWBcNRxy?)qEUKE0|~PI$0?ett#7QhgCPgTQ2Dwy2pyD;HbZPExzS zaCMQ-D-4~K<8MjJh`AWb8(ax}@=P|aLb0hO@v*)MY#}Ry`@ZVoJJ?7e)>e_GQcKNM z>u0pR)^A@>S^aN#Q~|O!z7$jalU4q813na&H9 z=e-Yh!dGORA8;94FoOBTeet)|RDwxc2wlu2wy?IuYi#jgB8Abq;|arA%QnbPwy72q z4p7d*lq?uyt3590duerSS}h8awnwVQWW|(w31lhxmhmS z>1L%zY5XXkxIOqq4l9v&dCc-MgnN{Q3j+TJL_H~g&K zf`Uz-1LyRK;&rj4^4l}DP1TJO{56JZHX)pi%>hh4;nWg7hKVj*&-PdK<_YUB5_g9W z>d2OR6K5wSO~Ak&WcX}XTm8POX8*PD{lmZ>3E1><3xi`tdW6P>>Lmsbi@zg)*FI`B zge2-)=pIr3Cd8TGqj|$@KMDI+^d!ARNSA^#s+MG8fZdNJ1S@x7PlfWEMyP@`z{<}j zWCMP`^JmIp2);1d3>#qkl4KC4VB<6x=`p|0;2{p%l^IHE$Zy~NvoB%Or@d>=5atRJ zhJVZHCbt`x1>J|=R6^1@V2$d6?vF9Q-T5;X5v&CqxE@(d1_-PY1&gIMARj38+Z%m% zZ!XS8u}vWVDf9nIgoiMyB$V+@2|eE5i}k152WQ;B7wi9ToaJ%R+Php%@w*(p6Ffn= zxU_IzuM=i^^jGBPCPEPYdswL&8Tj=TK_JBs`0aE)GyMLlU=^Z}~qzcsYryLZiWuK(t%H#{0qfDU{aL67}UmgZklbvNp@=6 z;ZbUI8Kx5}s8M>=#wthgP~&D#cVgPX<Gq(prUjJKYn%>Hoc@2glK(i% zf7~~*O?Mv<=;1YAW7AC!(ET3sNcVViTz4e+o{uzCv92_<_y0O0{5pM>*Vjy<3rae( ztJqd&;$c1BD?OiZ4Z7oSmV4qOXlGIYD|r1+V}<7SaNVIy1>GP1;h%OdZXYz&I2|;4 zo*oP~YvScWjo)AVeD6^rAr8zot!p)uD_u=PtkX0{D*?limVV z-8qu7F7ogBrAdh3ed#{`?Em=Wf9pekkN@}j|IL4Y%irJn=f9;ke}DLI{rk85`M+#` zfls==v4JKNLP`iSN;u2kohZM@^KySrkgzDHkL9dHEyc2mmp?x?2m{t>BLh1pE@i3YY*=q4|G-jmj&Q3xTqR~Jpx^t&^=sz zG+$|$h^a&i!5qwhVAyCoQp(kc^>;?!>G+@J{|}B?$@rl#$)W4D2BVZ1_F|S8e5Zf0 z5V42ffe!*(3U9)TE>4)KHk zVXQzc9*UkS9)e0O5&YeIg*AqJx%)FA!S}?(|CuK%h7e_r|0>AxpTk!F`Hns=2*i{T zD3kx2ffyQW@V=+`i`)O^`+txB_xk_Me}Bv0-}>i2>*l|5=WqS{f6)F&)AWsw5-zi< zVYh~A@*IY&qX9r3GTbw;S?NKsS^3VOtflPxuTm&O09up%Pf$x9p2)#k&TEB@-jT)E zdBtb3xJqL;ZY?BKbe7SJn_{LtVwqpjrGOd&lATg*H#;0P9g_a)5178vq!ndd9xW3oc zBtU+l8S_-nxtrMFUu9ba9pHJP?PDe9|H>VZrroW2ScYj@1NvTp_`2Qb+s=cCrXMQ_ z81<(u@wyX340dhm;s0tm@zezul)^P7#*wjC89Y#!o}(8yABpQma%$s5X_;5DS^sEH z$gb~%<1myE4pw@xK#@S+Gs^4!-G)ndOwg&oHY4zLJt?;3#nz1~E%;+pbFdr|Y$AvCSk>6mO*u)S{fXEW?Uqts4H6tK`%D|{tHIU)Fa25QxO&HeM+Ix#i(Cb>aIrk@Z} z4XWLYb2pOh%OgJB?}~aQduvmbHo*{*k9HSk*x%RT$^-kp`yj7S`F;2JYfY%8#nH%C zV--owmsx3cLs_iei}S4AA>1&ZwZSjmp9T%Qt-4quXvAxw-Cvum7o)M5YTrh>J?e$H zu}oQQgfvB6q+K5^TENiieLK!>|8VOmIMUnm0h>jN&sGOn=?$}J?d?`yc56lIJ`JD( zC`VpE^nmig;^#dfo2ZLeo32#Y(%o*?ebb(YVGGeR948$GPs^VL>ag@r(bX?c?bEwe zirOUpd@ykJ&yrpCUdExL9groN!IhuMt}2qVS}SC5`*5p^Efql*MQr{V;|nsUSL&2o=rs?Z6(YhXhrn$4heXxbY+tuN&w05kN^#$)4` zG__m2^{*0!zh?gSm}HSn>#VofoDXAmr%E7x3=wpGYl9iSPg!f;|HHAQYW310r@Wpi zw|b`4I1=yYa+u*bu6MLG>S6I=(?Xof_R}sHbX$XsTQlsWd9OxL^f}?;swUd7=YaE} ziV*J-mIDp4==}B};frhno}2XshOYS1vo)ZQe5V@P!>LO|GaoKari|>khw4^*NG#oX z->o!?b+P`M*qUZ#)HiMK7C4UZu)KoKLUD=6IV=dNL$C%eM1d$I#UlU)*&zOT^Uv~r zI;R(?;V=&SsR7+aY22omM|zE$<0VbG_t;S*K~G&{(!`%R)>W#L`T$&2jGb}2UX$D8 zZo5~T;^~g;gPyk!n67iK-uzU~6ZG;-9VOA7O0gl3!H-XC7X*pdkc23B&(V47A-bTgP<27UzO{UC!tnS5Ty)RG9JtK zI%Uq9OE;NFCEW(C*E-IHKX)* zdqPZ{gyvl^itdkpmLrbrg-0Y@T~kXwlmB^oud4lW2Sd|>gbUhjnu8Bry{cDT>4xXK z1y>M9v>j^Kd&r%4$>(QuuAhC+36?SJjn#*0M5IW)v zcRj6-7P|yy`U6UJe$O8W7|*_}uY|aDSGLfvjK-GZ0&uB^Jt|=4pF3y-?W>8G1gul4 z)BvN<8U<9n|JPJei?cu*ui85!ju$!V_rFAJhR_|XWc))an8o^f(m2eu5fxV@S4Dn7 zDY6kA&QOf(1!xe?W_rB z*nf{QU5XKcTfNT(G{f+Bn+)CPeBa+d13&3)x!Khqzu z$)=D3psDdR8urTjx>GI9u#F4{l(eV76gy8gA{s2gT4QCDxx%r+ZZ{Xt&+>A|oo_CB zjeMSf1MW2_UqSm&#U}pQOEoTNdx_Q7Nn)#%d*#gFglBf@qJF96|HsMW#X}COZ zJsg`};^trd#l&|qy@JZmlqs|S(b}W?0RZ8=d>IzFiB2`w*hN840H6O21eO}SB%BE~ z#I{+kg$a1X;x5=N++A<`$OcPVz9qI_M#KXn>g8nP-bB#H2A3jC_7$D zjCanqnn?c9f3gQ_Y?6_01~=}Hz=+Iu+8}Usk@OCYm9&}MSBv)w^H#AIki#St_=tVp zwqV4F1Z(=ABR+?;I6(vaIj!O{ z86bf)$Q8TAh!g^Ff<(aRw#aTV_8Tx>**<%aWcIjo`@TB~Vu`aV3LfPe15(7rM;RD% z5a4Zf4Mje{=AXgkxJGI9x*oJoYb(7J5%~~szR*tT*I1yqekU`D6a@Y!l1)AX!ZJk~ ze4=^Y=K^oi0~3rsaPv@iDt&Q>?e!!+m?bfsb#8QJYthK3rDfcIzOTeGUxE%4puUlq z9hhV={POMac2>lm&`D|Jhr1Mgn!pa!4$qhXdVVL)d&hMqueKf3+6y!X`E4Pk)v#0D3jc zc-QrzeWY7y9|4gGa3a4}5`$&?eb6L$IgLh^u_hqWNDvHjr!W^NMGsv(%XxjGBHlu# zwpq-iN%&T*10wTobua=Ve*hvCe-iomcJNMh<lGYKW*@@?CPNcP^Ko4XABr!e&3xJ(V`qYuIBk}ap&&4 ziz#J<>Gy{py`esN#H~l4S)Ou+!i2`J3cBb=AWD0n@ZV)tEi} zQUi7^5Rh9?YWrxz7%KlOV2p@-_13Se`3vv7rvlYjVi0EV*ImSyj#3S{@IB;01&k^_ zh46M_ulz035S@Xk&FQo2heaL}uw^9f! zCz4Q6rYT}4*g!p*pBoq?NY{2U`Sz%_a5%~WJtwc&dTjIS=QnRo1a@CJE_As2xwv2Z zS)PaOAcKOQ9Rlg42VfOtz#eFJ8tY-80{et)Usx+Pg^1FOKu@G$ zJ9$A8V6<Fdg0Y^e72!)|HXTI_}e>TKm9DvG>}=RT;`J^S zQ15e>jej+{RYmy^b3rZ@0!K9xc{4b!{s7k-Mz~pI8|tpv74jtf@73$)ZK&r0N!!x;B{Swpq0{i_<4u@6MOy+S?`ix#yOl zJJDM9pDf#jki27HL+yC82zC>nR=i=x@Y6>D(Bvo5GK3`wtw=3z3Ddznu#f!zd>>yu zVW}B%5owKxM9e&>vl6N}U%8Hur-tt=y&qV+C8M@vlX)2L$KWOSa^?cVX?VF+YvrLW ziN5Z`!!@%{6-di=fAL&x#W8d%jx~{Z#C4eG5_#KwH`x-h1f7V0@Z*1xOH8;V8y$D< zdU%${Z8mXexr);!>9(G+fCkJR0a#U=4T5@eFl7sBng@bO+`#xamrM`;L(O2`U107Q zr6%F_+zVl=ZujvJ#=Rh>WzNyr7gF!4EUj{2Az;DN34yRp$!)?kw~v*1L4}Yia57vb z^9f~UWKe`^UyN#RcIju@RJWZ}_A}6tjk11XpnVp9euO3rO+9<11U)~a!@6>;kAcl4 zUt(Uo@RyRO1$zsMvS4+a4_|Jc-6O}VcKsN7!(#>?Z2d0|$M0;2Tq+E_=kJhm>^Y21>&il69%&}>MyO%)VqCIuKm??j)yuf2)Wi~@K;rsbgNqv-i z_i@PzS+(z|d9i|;(^6zp@F(`hrm$xO`PK8wZs(Ujz9D(z)5&JGJ~Ur;QPn1i(lj40 zTy!bxRdHEO#PZv5+sPIaUWo80A77W#owgfAIauk&3gf#f=p?ChyXWRSIvtd&S^cU2 zYl}?#Ymdfwioo@f1to3C@betCL4c;sm+j78WCK2zrmy zozz`#$LhlD%0lvihds)Zt1_7pd(DS^K>>obYAY%yB$K9zg1l`fPFW6<`WZkL&R2Ar zwgjrE<20RYocT~>Z|N;gj)d{fe_St%{S>e=WIw6jR=7q>;ul>|r{TC=DK&nYol{W# zsM+SJmz-X-1|#&<%8AeD+ZtVhgQ5CF%)Od^4DL$`S+}cGH_DBA=jq*V(+(X`-LafZ zaaJR$=a*#ln^gy)x{D!P?NQgT(CWq^<3VDcS=;$?);x2YqhS>cq|Nj2^^*d(OHGgn z?ik)V{ho1ku&CRJ%JfEuweE+@e1996#rnnTXNg9jeDV^Z^<;~?%r6UEOo(eF%R`Mjx5WMF%Cn zy8Rr-?ww%Rd9uWP_8+*WNUfs>my@$R+_@#k8spiIoK`AupJRZ!P1%a0R;HYJtY@&^ z!W}w(^-D5COuiqu!=GudE)Ust%lQNd%DAkoxOo>(yoWqZ=W2L;x_q`rC zZ-lv7Y7w2jemo9>K22r3%u|rM{VVcG-p$&T?bFc~x7N=p$780~Zh)->^QPrD)Sf44 z0@Jt_6=jki7g`@$U$pY%itFTrI#7@o_=}TSrjvPhSC_m+w4dPQ1G^W+RGZI{_V*pR7w!gYd=t+Y@&4`oo>obSqJ$coPA{0g>G^}zw2TAr!9Ja3vXt$p15c*P<$a58|~ zvzcyv(~b`BYB%-Qjpc*A5Jl4(=n*AuV%yNH6)FZ$u0pgh6im6yl9xQlB66`?dZ~3aas+G59PD|DSjjOz{kApkdm;j~!m7-m$@ErKBn z4YY_g`2igat#+%>_@Zf1#mHQ8I550(i(K*jwLD}&>1BDsbzMjKTEq>HV{oi0?;VMX zW_|@NTs>l5^rF#me`(!YeCH-Y7I4M0JQx1KEuI8!oOAW%Z~{2gpq6elb~TW&0->oF znmyzwT<>nhnCf{oyCDaS<<}E;+&LE@dR+{OyCVbDaIaPMvvA!?ryIr0)!8BmS^oYB zcV=%}i@@n@tf}nG5dLM`Gh2D*O*5(TB}~PA%;iP zH9Vnx}`Ao z{vx!GNsX4eWYLiYVnRMUV0mDB&qg}LP#Ti7A|>Hh;x_VqsljP8K7ToLNt>mgrcdv5 zvDl9iS2~_O>kL2C)-T)+MvE;{?uYJ(njY7coNUj}+rFcu5?_f{3RGhCmXzpl#d=x> z#hQu;9rN2eAdC+#f%zLsyhmKBa1BLX%$`_I2nkU*Fxa>3E?AWs>I&!rp zGxm=fENt@IX1h_dUc-K&ZS-3XNE@qt&FY_$-NE^^t+4y1DL$ur zIIIYh=Pvzq^_g$K*DOQ!OiuG`8KIJg+L+%ng436o9d3M^tD#@0AvVpzApY4tU#4=ZKd z)X@rRw^x(S;ydCMa+nsGPK%7ALMYO}FVx%ll(eS6;Br1QhZ%|a4(A&Rw?}h^Y-X4pz6%idNEnaJ$$Uo0n=B(#wV2{Oa%oaG;$MN^!az)WRMW%gz$c4#0 zfXm**?@^QUuk!auud&{CxeHlAn!cwz^2R8p(tsFGeo_VfH#Y!$RSED=&k0R60Pc4K z+>AXAQLISK*ql1{jPH&@_vn3g@&Rib?H#oeb`we@uOO9j$DPE_0yf6GN(_B+}!J#K5;aZnMg zbE#Z!jc%aDB9{`)mwo2mV3u|~Ahy3<(4u|h#fFxJwoX`rtfm(?H*O|m|z z3SRVTNYzuC_DJT$4e7`>O3B|Z#!sF(a5&sT=i<@ZZ2`3ZC-6nTh#_Nu#h!TrEvdxO*Ll@7kaf9 zSI8OF-VeY;seF8bp7 z5~Kja*40?-oI@J!{=C;0jN#0j;3>j=Jf-NRYfF4QN6rKu92?PD(yqkSAWtE%<*$77 z-%2yT4~F0C0dys^P$NUp+~~od>gZ-czrDnOM3(L2#duhL0_|RegE5n?p>@_eX`Rq- z2VAu@?Bq9;^7^FJ+|Z}>3)7)N#NSncK?Q6|E`+aPCZ*AxXwjFChawxuvFrxPGK~0a z?EfnIF%h+Q+|LfHPQ_8HhO=nxwCO7w;p8KCpBqZ7nz;)@lPOuYg)Nuksm0C>ibKz4 zCwP8}jW_0_QvPz?t8?lP(A6b-aYir0S&o)lVnq{K2T>8wdlo-0M{`1pQk=V3DTc#Z z5t#NP4}rVtPSO(V<=)lvm5h1I^ZPRgsaroXqRbmQ{Qf+Ky;^8+$YT_d^OrHgM`rV@ z3|F90TqZY%m0;GQ+~>OFkkcQZh^#8x1%qXA(Or?N|@q%P}1T_+acR=LG1F_>`I@XP$KJRObkEM z7F0FWYt2nUH@ok*MKz|*fKK!PyH_jE=*=1KyT0ERn@5l}Vn%duvx8px z=$5bN@8g6MFxoVR$;?)Ir%jgw1g?VmT!pcy*GvMt4~4xxA#Xxg^-8nkU$H6!;zDA8 zT|GM?snnixX&$mGVdIL`7zQF}x8Yd{)QRWSOGk-c;n&q*h83^tH}U}ghUKZHcg6E> z?i4!Ah$mqV`^@uOLw0Ikge22fdF@X=?qFq}`PvgVesYcydvEV{?^jP>g##>% z^l=F6sEoayfma>fBq!nfyJhxdr}t7ZIPJxDJPK9KmjtrzI1JnOsaLdZuimAL^m(|b zZA#FBL*miIxaptE(F6)}(6e%LG#t$p)+9qI~1<3czL4Z^XBXSGZTnabBv}Z5F;nZ_lhRBBbnz9~B zRhanEkCx{BNxQ_;{TgNJ{^v?8jJ}vto0eZ$ab0mf+glmUK7JT25$QW<>p$hz;OhX- zk2@Snqa&adp*l{7ctrs*wOQG%{v43_ZJm5LA_*P4l>whJI8Es*7f0vruQne-SYRvg z*%z#)9xYw}s>H^jIIp?Rt+Xhn4?RfO#z8YUtEq3P?*S@t_9(F)9-=25?{ZVQ%x#4E zGkbp!Udn%-asSE74kR`d8rdMn1*nmzTK#oqzxHx+u+ncz|03 zYKMBXp1Drs3Ib$yX5QtJ$h@TPE<{!Bj?ba3F+3UYXUbo>Qb@q=P|)@`jdVIW0qr6f!1@8xo#a|dwsx%N|_<;G8cr{3W~F1ZNXGuRzr z-F#{|m}3yx2U?XJsHZO5&C~xUBva{s1)U!bMgzR&V+Z^-DE@P%Gms?ox}TzGUfMW3 zd)I_+f8+7?Az!u^4Ln=*%XPqu7)Kbn<`QE$RrT5Vnj2dY6(-*-su!AzEgR~#n#pGI z`G?+jK56~9z@V(TW~R!hV&z=4`2=27W*+lU4Z`1lwgUgM=1m0JPY zK%&%sh%Ti1&^T0kqh@JCKARMuY2)+uC5H+>rb0yJ&^wFQ!M4+HkfM}EU|fFus?c? z(Jg{?^%;$L`wB(v0QU8N71VFgO)95NOabb^BV4|pUx)vvHZzTXOuJ?hx=Kp5VulZ9 z1GjPW=8<^g7-LM7Bs%;3=M!2aR(M!=%OYZe>lekuN*T%p{2Dxf-?j@Cyx;!A=pDlSECB( zuLv?5hsGazfIzQ)=d0K9DH~QpHt@q1lY&Bx58a@U+0P|Cx(;3SOQEVl>}yB)0-bsc z+s;jI&Ofg?*t~A`Nq++{6x|ld0DNr5)NqMmDN-;Cn3}Dg$jF98?6F>r8JQTCuExhJ z&4t>1(CEwa?`izP0%xVtCmlV52Tye#^uw?ES~E62*` zobYQo^HQS5H>Ya?4`X-aDzqdKw0-<-t4k;(ORxB{4JaGikkZwYy|bxNC`QX;wVqp$ z5zeQ3lfV20(RN#0NifCA@{g?uMeMOfqks>GOsWEq-uT~?f5`^Q2;El(z^;GLfQU~x za;BC~%>pEhf3aNXKO=q@e^yM2&Fib6z0FOuQM;viEIgr){Cu*zfihvS$Dx@|XXa=f zX2cd!&wXXQ^U8QXN0M;Avn%?U(f#|MFti7FRzl|B-938hCapg=WJ!tB-oKFT%con< zgz4-HY&h9NjkHB@LQc2hY?{IOU}YHGX@hr*W#kde)d=1E2%DW-z4c2liD~n&tvIit zxkEhP!~uI3l6IH9Iow>&jA3EUfp z5Wb@N`u%0#r}zT#E{OB4=_{aX1BHbZZekeUfGz|MJ5uxul*DcJ@UQXe&FX80pUu~9 z+vP$6+#&%0|J55eDtj7&6{+L#s{brr{-1jrHYYrs7@x;z`crk|Fz+Nl?C?*G-!sIA zhAbX|N#Bm?=E3>6&4ZGp?&9wvu$|_3mXw|SDtnrG$92mcwZM!>37(T}y#|K6p#1Te zj*Slt<>Ob4={lGA81@~{#3-4sdkFB^i%P@qJ1-R!2sjzs423$Kdf|>ai)?_Bx(Ccz zC|c2W1nOWq!+*><2fC9%oLG*29xz6r-Z?4wpSib-9c%;BMh+b@iA$PHjbQENTArI+ zVGfF6TD7w`W?(|UXyK0-k-k*?mH7sBt3poCSMzSg{qk7IMe#A`*^nYQN(;SMzkIy`+5 zRa0~+o=f8;Sg*BU54o-!jf}6a7e%Y597o(+!uZsG#4SRXdg^O2eYsrB^p##ibmLV@ zEIyL!b*O*}Y0)H1`K=mX#)BZ4cznMwi(JpLl-Vyt9T2hzoF@~of3lyd?#+HPfbev0 zC!S6dQM>-h&hu8tcGWT{Jx{d3g6z1_?rcR5$BmRIFA~Zg(z4#!O;#!X(Liy;fK>HW zUQ~m64r)E+Npa}z>mk2h{y7NUB#I^!JEZMHwpFDx%HP%*}_lMevn3u2*`IuY%48TEpt0(#Xn}dKxYwm6STo&LU$&HRrJs5Zo zb6E;>InQdy?t_42Bt67+t0P~5`8Jvd>oI>nUWfWqTyc>*P-V%ulD#bUyptF}w+_{j zASl$iS~$6JtzDo(yL$U;_>oeT`GbF*z$w=i$TDg1xHf7w%G4I&3e5Uv&!3}C@B=~S%Z9`A`&y~ zFn{0lbxneT1*uCR=;Rqsy0~7QLc6cDB1l#+HFplJOL`YD5}(7&i4D1aV+FHPrL-bFsZE(FuS%^d4+KGCQ#E-=jlTC@(yS^W3G)J{M0C+1n-9rLbX-Z1n- zFiaKjoc<2vn%ip$&{_VkbS;yM*TM20fPv-!d+KXNWP<3`uN_RD`VELd3YV}>iLs}C z&SFPpAwjNV1~o^{`Jdnd*rji?I%@^7cA}8beN41E8G5y_YQ{y!)f6>-DEAz2=@FFE z(jVn*4Xp4qf>$(py?)I1)HlkM0yq5dIpUzM<~t0?M1?a`9|f7Ji(!Y2eG?1GpHE!2 z0*-^+8`ePnki7Z=d>z^KdY{fkJZF}6q!~Y$XhjV1b!t?RKZ+FJ@{bCl+^AQn+;r|! zy9AmiAANy-K9uA&SNeQ0)^t>mkheZy4SW;8C49!iixOhHAE1H8Ze9*_jDFsIy{zk1 z$tT@V`x^H5n`_$_TSjL zX$SI`F_^i*WR&s-Jg0U%Vdk`|$-VUGXRcJ1_LOd$45AI>;v0K`)(>BuALMbIy>wWC5+eg{Px}?ie zu(O6cHFis}?@f9z;)?J1t*1#kH8lcZ%6z^BM?^T7u&$p>aP8x)emO@OmuAGG_ z(k)Q+^xA{hFW(xKhzF#d2Zw{QX6sS&rg)wF*C_UGKi_fI+WBCx=dEF#!uX*GD!3%$ zav5R(0tC@%f5c#l^Qg7mW8XhZ7s5r$ZA-BEEo5bY{eInj_F3nUsc3a%t%#;Qf{`AJ zK{Nzna92Q+dO{G$oyQRp-!66_)&GcAI)E{U+5)xINzmx3sXJeje?t8_xVTQA67E{O zXQIZ2sThX@WmWZF!XZEBscr4Rg;^w2+W4`TS9y_I zYi1VtsHvdjR-@c3K`R*Im~WwJ ziT=l^n!>j4`L&x3sG|K>mE~ts;I%K=6 zB7CX?r}csn%F!b3#prj@Gh^4MWv~1UAH)TJ)v8Z>8CP4YHGj-pIVoaWH?-D<6JNd#I?zYU-utNiw0PBabu@bB@f{pujExERmB6_)!S9#LJX z#eKs;dNf?-i8dP?rfi?dV-Jink8xlYxP1Nfd<*DRYkVU#bNMX1`sI#YSIiyn(Vw@Q zUa*;Q)pu;yxz;eZC<_{Wqp7LtW1;`A3Gj8){9$Kbuyw4cY~3Ai-83vD41DVFw(Fl} z6)8W>w;a-Si^-^bu3>R}3(zYdfZoKue!u4V=q|%-5WR&Z=@W&VXQJ=n%zlh0p2&uX z#85CiBMAuMs+~2gof@yBp}{2UH5h_Tf?1qil%g2&X5ap%9EFV%%w#vX&I@#$LN zI*C=`9~Dk;%iw&P2-D}X`a7{UAp;p5fy*gA;;LUHAE?41_kViM2H_v9b=cc?2UtB> ztzcBfKomhHxwr6Qwlsu=B$`W#F1hu!jC@0@+pgm1?AZ(a&t6RzgWn`XUhG2DnHgztOE9!-|O(H zhxLK!hYkFs>4SiYd55WH*LYLy2iV^HThcvww;KBF>@)ZyfeOMhjIR1;${hi29GI`^ zcW|G|XGO8g@lV3-Ark$2MpPqEQk*k)kOJdifRkF86b zJvMR{BwF?5B1`}MJhRxbzS9G1J3eu>)cpqODL-VA`4t>s%ArvFSb0m&kFG@fIWShv zndON;$8Bd>lxw;q@{`yCs1 z-NB5?BY!H{F29t=`@bgF_oi#=>X1k5H4;Ac&YM4bdmU05&E^j-`UYItk`@_79`{iQ zo#RUN#Wfyz<2(#YaV3FUozh87q4!q;I(Rral|HmRkj2n4ZT{d0@jq%x{PINs=?kH= zvXv)bHL)H3oO6l9-@lL~=h(F9S0?ETTb+hS#g~tek8tNxv1|lHx*Y!4u{?g7`o&9? zC7iIwK}8Ez8U3YITD{khlezab=&1+@C9X7LX4DHAd|jI`Y$p?!IW7=Vy}L|wja6Pz zA|nob$Uj#q6&i*>aDcl>0yMl*KFr@Np_i5xl9&B_5_U=_Mg6R%>J4ZAHUK z#b3W9!N1w$iVSY;YIX^EAXd~ik>dPCLaLGngu4wQ4!_y-DBmQooug!vDAys_qSB#m z#IQ&cgGEu5a1y>p6^;vh)Z~3nc_S-J14=~@;CK_@Qgy|(F0y|uihwBKO5?HTvlA+b zJ47BhlJ{_(7jl?|H1n11$FytNp-g@8A4CZ+o!!iL;(pv8v(kv0N2Zg) z9K1wCY|riyt@zoErm`1M1PZeUqAW+P?nyVXC*1N!OZk%E@Bf(^(KVz|nemM*ZLl%Q zDj6x@)mcS?`L~WXLNWBjG6erzL^u5pb{aA4ZqJCfuve~0=eGxMb;@=BZdxOxs#W9g zzgV2>A(tYSBFOGQM0@ro7t&PRNShg>(r!bgwX!xbu}q@{Sm8v$Lpg0`5-VBa8GqXW zw+k}w`)}Q;kLnLrs(461d>cwI@7*o>v5@Q?I-oF-KK2|T70C-=v_Pl%w3UA>2G;%i zB4I83n2=oKGFTU7%M(Lhb`rRx@I{td7J{ZpZ6c4YgfP*C(D_5^ZB7|N{9VYz6C9Zu z->!6$$Jr!i%PWA_Y!wMki+ipM6ORNqauWBG_fp$g-RUQJOfi2ZWFqPxJ!zEPqMf9RD_Xg86fd_c`;x4xep2_-R7bc>In2168Xqu+|-NyGJx&d(Qbv zdi?dEt>5>rI{cvN*x^`E^C$8r0M0D{JmtH-?fg6Jn21_v7*!%ZXq>tWX=yX&|5MLI8l_+ZC`oZ%JO+YG3{La)^Pk<}Im|@t(}#v$Kug8>9c--sGJNQ2ihi z!p2x`N0J(19d`{GV%?JV3;g0rE`N00M&hr*tF4&E!JfCx0R$xScL+h0Riiar@v(=$ z0^Z#Mj{MHnty}v#iZ#yqk{lV)Z1lw>k1a0(Vh1hK-%U2WGatAjmsNfw5}ZGKlQ9S) z*V13@S5AxV5~!~df*@wVhq+BZoA$-#&ulUjPIOlDRH8DUUq+#QJ`2-^kpfdW0aHa) zb5>~w2|-GMjt;ZqeiJYl#9%2>(_<#JpsN#sXd|BdpED~ksPg_LPR<*B?z>^#o>PSc4R#_d|c0J-! zmg-h}d72@6_}XPv^Lnz1dZq94mYhJ3tzeB8hZ@6Aq)bn^dDHPQAR`Zwhz)8<5&YO! z*Z_Xf3~&m$WmoeomZ>@Z*~dzI2!>q0%1+kc?t7HnV^&WP@&5icAnk@eNPbN^Z?KynqfshK{NnA-{r40rm_tO0R%BhFl$L1=r_adANxExcVKG=b&$SYvff|T3t}$m$ z&&aSIsAbrmn3R@QKmGzaHT$HsRfY5jHJox}&N8l7m9k$&Eg{K zgB_zSctnf$Q6f%%tmw1AN_B!a^hTn^(AXA-Ca$Mfu3VcxerIK&O$`wHGT0K<;0TM1 z8vwC0+U0fdh^+t++vq+Q?|*C!3u)lc@u6#v5j7bc^Q&avRNQl}y5s2lJ(;rXh}F6( z(;eP!G~8EV$Tvj+`rhNS{pPq%yXR^}m3133-*w*aU=PvS4s~0fQlpeUin;l-wXa$Y7rNIoN7Fnql|HfV(R!6nA|!EzntG>@&B zJGWYzwtgI0iGO9EaO$HMI(+x*hISLRUZTLFJZ-Xc%1y}YO9kI}G#+rNr<&#InZkm_ z%Nqthiid}ZEv`Hzr1gH!i2DZf_*$}ZaK1sT*~=N-opdO?)PjyoEiElAckC4o3l05f zkE#`o^EIyiHCtToad?Qx(F$>U#WlUQ$0#!J0$L}d7y}hOca91D|I-d?1hVwt+rN=l zTO67lTq@tcL)Y;qUX3LJ<|730ZP)+q`BTs%Xs$*-alywj4e-#>p71UJ&3Ny}2LKDv z?5^+3H*Z0u!-LJ4$KGxmE>k-SwojR^@@U3{(ef*omO2dzuC6o8`K3e#wki*P(q=Qu z6Ddp>${91=j)~pHna#aSkTmDb9UDYso1~}sTzI0ZtD7Qhf!*bgrMmEhf<;``9Vz;A z7B>_Vs$HpS-BCBw_I;0WwM|cHplw)N3iaXp?CH%+j9NESGZ&?m9Qt?RjCi#2*v~86 zx%`mWqAv!acU`JIuCZjp4!0kKri*P8vA>*~k00N8 zcQyOZO(`kkcD<>igAKVB*6+}7Sw6><{Zf=C9ZtpdPgq88xBqe5VWuc-r;~m;&uF55CgiUt&?{d3` z@2MV|YnWx&cA1JPU0zK4F(|QTOIxagc*7B7&W*MmXeXD)>>>vo23>ou(~yOG?K3>0 z7c_C<)g0lCwHl;iDyAX-~ zgpm^$QG;b0K?a5TVUe9sjnYG&`4f%rB@S0O9N_8<@sfNY@uZ<^LF z@3o6*c*&2Ryc%YW7L<^PPC!Ud-smqqBB5^rlw79q7SRNn^~f|@Ch_y_BU75$8`gM$ zz7q=QYII|;(^ogz%J(oQ+N<=e4+^~2k!8{KOstS-tlLS1{$ACUKd+y|SpU$;;OjQF z-x9zRd@O^n)r0D+QPhNl9G|Ro@wDiwA))yhGr)g10pSZ$%(kz+`7BL%Op(ouW>`Gd zxI*(?DzC<#VFfp&K9xAmZIwFt>S*$yK$hlS!q|$eB>a=C?MP^$ELxhQi24`z?9h;4 z?UF7ga{&PyVbfFXREknk_O`YrYf2!LOFb#m_ib=q#*Z~2RJ}q^g7BxY0-9%a{;?Dr zN8SZ}m6~f9Q#z0#ONQz_F3vaQ(?OWWsrVJ1u!OCaxwADRpb#(kpOHd-Rh0RYj!hqz zos^?#J?*@gq=p>YS%S6OarW07f)qkYuUd6wGCd!zc>zgBq+DY!RQg7(%0p?R*UTmG zv)0r%MmM)NNlK+^kCpn#q03Fig&d!)SM(+-gfUbPHC&jIK?f)qYsqA8T$<7;^VTs? z=k9>h`CQd-M9#2l6qN!xLzl_yH^HnH#if(;_-*5(>5s(q;|#x5By|U4$G%+L#0MZ- z5=knK95K3GRG^UOo+TS=NS5C*rulTBi#EC8^ZU=P555#-GNqPBC$7$=U3KwAy^$oH z(CNRsomG|V5t=mJx2-)vL@_Dikjg_NT`KdqR`89nAKwg3iTk7XsEz6R9A-dD>Okgo zK<$&8Z`^?Zn!j*nT2RJf*zWkgJNw692BmxBci*w+9Uu~PKjMc?l-VF?A37N-MKRHh zCQ&>vaQ-t@7q2&di!_ZEk)`i*DQoMokofC$4C!^pgH!dz13gTPpeZClbmwANczDLb z0`=ZSM2>j^$z3SrN-dj@i|~oRK3uHAv)nh-Q#JjC%L&?yxDiA)w9cRvNXHR2>M*4m z6#;`ludn~M`w6B~;!58#f1$UmNe_ogw_p#zACy5g79W`?ps5R_mpqK7{B1t zvHvU{o0)j1|INJvK2U8PoJw9>L!F*a=Ymbtcq3>9tcP4UV4CupOxTk{+OF!?3X0|` znn}Jnflyodg^Vcaj1KJ1hueJ^XhS+H;`Da$VN^piSLAU!U!PVDqmf43kNIqYy7A7t zA#SHqfzUYX1piC;0t_}mk9sEQQ78a2o9!=0afK;dKYvR~_f>DgF`rtZPo!Y?Z zi+m)<*SFu|eqaYHN82Fxm!I(CGYAFHe_lTW+SL7f!nWD5n(~PH<&h>9l+; z|3sOyt0e&ig+nsLwCYa|bDlK4p{1d@IZY>kO;(Ixnco^S@z8?UF=e1CC`}ybO|-Oy zvuxpym3)1Et=wRj5+$atfu@?dI*gGL&PG$vik-Q+IjL2L--;jqr1sZmD}II35N?27 zp!&lLAXS+K^a7>>yxM7#O4>PQe3U`Xf?jza(TuUZ6LT?&sp*Jczr=XspM+x8yFY$( z3i=e?+aI(uTwJ^pYvv&5al*RXQkAuN9Ym&bAU`S}zaP0htcMV(${W%)1G zoiVkG-r_Zz_nwE|J}G!+T=*Dc4AP^oT`=`oVaEa@b1$c{#}rh>7!?Zi888^)jjijQ zD*Ru@X8X+-AcO3CTZ)|-6X%)T1Hsp{s`-jnC)Y4SzcG`^kdTHfHE-;@qV3#g)r$wH z=%!zVvStd(Ir<+l36yq{t1FAF6-`v`8l2EC%BHGGx8HKxtd7rVc|VT`Re(k}9Ld92 z!qfK{MTcJ8gvZYkU4gjP=JMBVHxJ!qR*xF0=t?v8qnwS_G2|?HEd!)d_* zguZ+4UanTuWRkpYSIfi|{pA}{Qpv#)*B*QCZ;qjRoVK%J0w6B}ZhQ1~OI$e&?wj4R z6T+Z<{nmV>Oxq@0bKrZ`Hxhs$WOp0^Qzal&q5hi!zkYd{1`xH%?#W#|>~6&ZzG52c zNnx5{ac-i_J9^olFp&F65xY+PA!8VS!U}ur@9>mrnLWm7nXImb^{-25{@-UT)tM2@ zMx&w0eMKur7w4?bqob4Mp~^-pq42?U<^JB!Mm+r4fm9L-;i(VOxuA1g96efm$Sm+j z%ic-kBSHHCXS2c}-f&beLD7DZp*o_h1=H9b5uS%fVkW#kRn)2R9KXV|i}A{xxxbjJ zP{aj$9UI3-s7221JLeKc%k$?}jOL)zRVdosU6%|lV62?Mr?=Z+td23e(UXizR8=-m zDJFscaspr5{_Z|*IulnWSg-C^jE#R!4TgxHM?`cPn5enIX(}KN0;R2m!|J_Ly^i4M?Oho zGXZ5?dS_bZb>GWxmvP&73e#sj(O1Ug`zK^C5mk$FjEagvq)ba_O;3#d5I%g4?e|k0 zj7+Wpe26}!3qfHsTCv}>w$^N;p&?$gL?d3mt5X*C&gFc-_Qp)=r=BT;u{T?!(zN)E zA>sNlL2QHm{k%a3&NjNo zj>aUbG}i}cET?k}Y0DVp zJyg=hlC^IlPmgj+ur4y47cAf6A^6UdTNm-al${euY3~>tImdy*5FIRk|BPY91Jww_ z^G{WaFKj)i@BH~|NRIW0Egn$8J|E#x@V!Ud-4}{FgugD?%Ju58iJ6qN%m{=+8@8?& zVlCBDb}K0URP5TKL!+!pvtj%1QMrz@vMw6>Wq(}P2oi)`@5XYQy#HI$x{vg?L$x?H z$M0sXwuVLzJM=%X+urtl)-Y-H>)b)t8YpKFrxz(!gUNz2&XR4K)%p1y(1$svwGr-q zhoyFw8>ab!$*Yg;I!w=RwcHVn5`MLNt)gmvBD!Ry6elTPH9gpUWoD#p;6;b^@81`h zX1pkELJ-v}!)eS;*B}->hq2h>*^X_);|{IE^4Xs1F^I>hfk)4xxH#&$c$Lq028D81 zf(6RaxVCpArvJs8ixgB4Paw164O&8b#)67bJ#VpN?iTNWo(z(hIzVA`0|6a`Cxn40 zC+~FmNmJ{RGMzwg8jX}w0PXD1R|P%MpH3Q2LYybnAJE|Vu%89z>8WeJ8jHbI-2em| z>}CpQGRz^~$J}&r+<&GlQL53&X$IOtN~&5J>G(K&b`4-Gxt#TQAV5{yq10z*FB$;A z)vvUEa_3)x7;uNvQ3-ctcPMIJH9z3v+6z3`no<=7LT}rG`twe*q-WCI*M+xTH+@}= zC2C5MGsZRCX=Vysvs#LZ!SB4^DaUk`5}BW$rP=v5dt|XYGgh@`g&sPzS!|@awD?l1%X(41XKGfQ(@!YRvrjpUN4xzT5groW zh~m?tewe@8NeFiAVCf-lP2yfF9-;ysae>YN#?;>slbLBBLy%{?ww&v-!xj6|IB7aO zCC~Ci(fn(rSeqKeJ&vv~k;hF%VtHW`rN-9GMW@o%-af8=LQ9&?wRn&&=*#<9;)R!% zq3UCy1_u5&VUN{IYnX8zmY&78Qk{Fn{9-6n>tY4CP($d7Vw(1YeLJJ!%Xmum^9Imr z4PF*TgR_lBt;u3Qa|tM?K_CQY2Q|65@GHk(GGbSr)L%>y_iS|}j2ZZALS*F-4TO2B zAN7hsR0vI)Tuqjg&~g#OtE3*v_ly1$ywA z*25q`i&)cew!}UcKTQl4Y4krlH zfv6$h-e|?#PaM|mQPG*lC+EYhc8^)RY#aii(yG`uyfK1Gh`yw($%~geqeUdD`QY}% zG)#a9`O%x~q(_w5NN3Ia)xMPFDNN41TQaYCy`oVi*XeNIL8CL9lBdeP_gj>~bL3qK z2^C4#vepNn=#O#@dmA}IdeQz2&t4Lj&r9z%)Qg@!GDUu2zkuIRd2v8_+i^t0r==o$ zGBZ&-^u-VFZyp;ZX7<+oG5(BTT|9Q|^>!M0pC!9n9+1v6bfwQ~fQE}HXDf85BpSo> zNgg`o2D55|j+;fU6U8E=oTPZ9zUxQ+dQ6gTB3O&cjtyI@01m?o^U= z;V`X(bjQX^`}YMrLd=2&;qjJ(9P~cW4`|pie|0M>fX}HMZ@m8%ydYmB`5&DoY2DK# zFyB4#!55n<+E7fn`++*X;8gu|dT3fpb$IKR?qH81vk7x!*xzFBC!8}Jm0B8^&LZg| ze@&cWsTyb9CC_V=Eu1Xo^y!HF`X5I>``acjKeD-g9Wy9^wh+Nq!v{xf|bFkLKEtxgpSlC$kiyP3+2OT+Ee@%Q77dM^u|xxygm zY$o5cVlkC=6Ynh%nl(_CJO$p#(s_F%(zy>J2)8 z@2(^0zXN!3#B2R}FMm_uz2)zPrRn#UULGd8D)U9ikM;fD0rt}{zyPV&pYI0V&%C?X zr2(tOq%6$#U&5D7(Aa$4=r=r(uQa4veXkgiz%d6M?#TfGm|v#^pb z7!vY&)N>w_*TmY!)zoyQowetkv#%sJO_rN8o-U&;wM&x(QR~QfmhXP=TwwccW2>kU z+$YgyL|?m~%W=*ItEJ5=j`9C;o;?M5FzdH z>GgJu9C_i?lj#5MO9rOkmh#W13LIsxMfztS@hpF`8mNV@!n$pEx93rS8PK5d= z!{rLzJj#ZrV>gs*V*a>)n^F*#JE84N=L)LOJ#i7rBVrD-mRruC=9VzDrQ#@nlvZ$A zA9kvshf<0S`xl+PV{Y5}xE)BM_Yc!9lKdMn_VIl^sfht&{yPvyrHj6QeZmXWRQ(x5 zqW^&y@BM2IoYluo31b*`4x04+P=abwv(e&(T3nGs<7Jku2R~`i5nI%4?QP0J+6?UW z%8v?GND^)}Z#99l@IsKa0L*;DY6O@6=}mmn`0C00HStH;@=t^itIynsp;sG*glkzD z)9P#68c1m}Rt(YS+G@QgIFPG_80n3xK1(8<)IHRW?D%&5lfN#MvK3k=%#6IQ)={NE zV_GA=P2YP(26QDjh&3LhiAjcMsiQ(E9&Kgz-V+y32%fq3?r8s;!EFq8>V7((?5wyu z)?v4S)bxi97jz`z#_a_0Q~D$QK%Ge6Dx_@Go&$iX0E`RftsFujyA!&?>hr;1)D ztMsdF%PE-x%nqL@ClbH!_R@qf+kg9ZQR;A|Ww0+cR7!7gNUi^t(#BiS{-80vPn3g2 zf{9WIPMv5U4YZH4?&yWDTGXW}JQy~z z0BNR5N#c9{`Sy#OD~*(R<{={!1*pfrQq*4u1A|aYr%BFRIt1qJ|0EzSD5mwoLyAqL z%Ef(DbR7I?R?leaudiCNZOU_u8NY0yOiTxvR4U9;FmAS{=uej2OJhSTRVEtt(<$@< zN6Ct($ZN%;gL;LUq4n647igc`VH8Y~@^3>Z+%u*2YKoICXL7SxTU)zq4>Kf4xkJ!L ze)%jQEm1)XDzadF^q`OLVQpIb7X4d?3|`6qj=jEtyFlU_jihHzaPCadrK{;jt~TA0 zZtD|jot-?{OZ1OJZO&lA!tK~^rZE{shr*PhESlrp!p)U?&*)#*A?dIuNL z5;ne~TYb+8)w@w{JlWHYmlWfr^_ZtJYHG)>_uN?|n=`)oQy-6Vy-onPUge&2rut(yS!Lg~EyU(0TS zzSZwYiW9uy|6YyKMD?|BXNnn;)Sn3rlVjeAMo>U)u=3XkTI`-rl2=_*i5tKM+= z?a0>trs_Xqi(*qfy+I9AOGQ6KCGxjaP5*|wE`~N`;mNC;Bv!1oinnVa-(a-KCQ_sC z=7JQi*Hf%lYo^dy#njI_@lGx&u>Jue3}p$`S#MnSuS~h-9i58XOJ*=TBfyz7V7%Z& zun~^cH@dWO>{KB^uL(QkoOqVtjixB5*uN#O?i8au_OdsvdA!5iV`g<7Wgc$T*ISr? zX`ep2340yy4a($D+<7@n>mrH#3Gsl|Ox$h50%F${U%sn+CbC`@79E3|zf4>N@~Aaj zY>O%oRy_Wn;^0h=tLdbfzZ|o1pfKZC28-yilF;%#N`A(l#nz#}S@1iz4l=d3cLl=4 z?mwZ}9RTycVH&^VzgY?WX8Im*xf5}hEurvbm~@zD5EPsJ)?<`C^-PFzo#6cN2`@yY zoC#4TpnwrpCiVpGi{HWq8w%zGABWZ_yYA0A{Gamo=eX?1^J?bDQ(k6=Z4=VHd4sPN ze*6^%eH^F(>%Av;8J`*6xe!_GHAoddpenV>7$Uo-caU?tE3z}QE&fQuw&|1oV2>xR zr*uCi_NG7eXbLx9^d)n6YMudTBqN+3TUupNL6RliTGhM)JXcBKW-sP*o_tI<;Yi|X zHK6Y`tx&vbJ4-`9$cjg)qaLFi$1C59%q8*+=dUxcy`5W?aWN97(MkTAu|xU-S}Lv! ze;S@5_AxUedgWI-V)tJ8N51w0kyonP=kc5QM!vBC?Q_cqc}Y|2FqyplqHl(r{Mjw& zgUVLkb|_=+ulItVoYW)>r%B;iT>f`$d~EUDIQ+YOr)Fj)X2C)Hoh38TU(i6<5%G`$ z&{+8k8bM&*FGK!A)qayrYx7#SrCWc>W4jx{W~t{SE@WMm8M*c~X*)h|SVN>e^JG~8vWm~Ei4yD`bJ z?B}8P%jmQS#kt7hUJHcA{e&xYc3Qp{w6YKLYDUa)C~LJ?6xMd#Gk8}fQgGOPMFezb zdz0FrE%4o$?Olve#>%gca*?m+Z-mHTPtLCdk22>R-FMBDqiY*X%h7dt|3^bxH7R<8 z%Not2d|1f0TzgB9*;MH`+of~u`8|3twJ@5RLxB%};sAex`Qt}N^;ZKeE^(8+rzC0) z`Ehn%AAys;`(dG!g>M9$U8`UciUHZM~zJ zTPuF}_UYLwR*8T9@vFHCrz^FR;sXI|?Elq_+Ullp-L~ zq=w#$^iHHn2kAZZUP6FCC`sOrd++znym@cNzZ^$RIA`y**IIj>*2Sl-d0rt=zv5=- zK8~1i6j~uEv`Rdccm&*q1xzZduV|S~dmi0;v?!956>?jOd89qU7l|2s4W8 z16)@M;ZEWR1_M5rIM~Z(20r74A8LTC5f{(x9yB;aO@h{V6x3n!PfHv${kb)p@|gqZ7+IV_Vs%*%lA9`W~^pTv?0`pRx^QU+^S2|q0#`tVuJ{JXH2Px36)RwGA#kA z`6Jfq96_=*j?5MqC7IU;qp1{&$Up?Lf+tQSG(4(3cr z65;|1SL~f{JEc95V90DDGpdVuDkS>5m+&Jf=N;97a&Gp2d2t_#C$$04O>k*L=*?^ftbN?c;Kx5+f>kq)P=Begu*?&ISQ~Uus=GUVaiJ|8e8CloA_0KO8 zN}~LKg(kYx$M2e_MJwb|YF&>yon|YYTK>@1Ei1lk!us{;;<8mI^FAOq(i&_VUl~1p zzJdEz@`JkHl6YBjnN6+`A}jYafL=jKDSum5`Hrz#6FY&ryzpmfYoOYcUM->W{X)&{ z@n#9jpOTbUg&c14+Um~#9t|1$eLvhR%jbYmne?82a9r9gR#U zX5W{aa<~jox-V94$IHbr`4EY->hp-5Fsc7X9f18;<`u#Kb$lkxW8qB)(>dv2np6Z9 zk@j{dy}pV)pmM!$q&}Kcz2yQ`80u-d9w{b}XOa_1FZ|b%^3T|)w4Vo$2LvKHh_ffo zW#`mHq%WjieFD5?ON=+GE*2M7d3|(m2+C5^NMt3Jet%i<)XDW={$ZmhR?@gN^<&sM zuRv=pq{T;iO|EpFu;CLZN!Z>%#!$HY$4y@N)95>K_DgIUQA@o_=s4SbZo|}>QB71q zyw)?H@^8>|za-&O%va%Z(|xv<-)Yyv4|1EXVtOoPb)az7b?u#+mzZQQ7_MIB@H04E zyTD>@NUPrJt$xo79>Dc3F_K$C5y!|;BGt7*qt9j?F=nLns9(3zRgBxc$he%Gn)huV*_W7SpeOh`KiQvo^+jvt+Gx{3HgC+r z{7rwx(RBfGGr;YCj3i~V#;Azai1gk0@0L523|m79JlUqvPpsOyM+OT|6U2I=rYfqO3(k(i;ZUG&z-2qf;a zL6w^-p+GB`o)3JWkJUk7YvAG|mr%sac!Y{CFPDVOmfbeikH<@=$8V_6fJP!2rp4Ur zTgRi#j%blL13hjvDbfOI0b_S;zeJ(`LSm29E&sHnNWU}RMwh?uW}=<^zjVyv(}`FEPo@lKZ&|(H zm)V?d@*u5o92@P;|IquR+V9xCk3ynDt5gr(ODY0fJ~;W4V%!4K$qjL5Nsfzm*whJG zv%WjAdsEORmw64+CpP;F3uZ-M^>e?JO^hx;*W5~*cXn`I^y!K`l6mDf{>~PxuiFW` z8$P6(+c!dAXf*B~p2z!awsk?mYBf3DRbabBEjd5}fGXjMTyO5B)Ex03*K(d$zaP}T z4RBf^gFgc95XCqTice_-Jr+@Kg`9^NS8_GJT(<_ht0-qvyl$X@av2b1P(^@`N(NN8 zEH`&7^3t*$y7DC?W)B54{+t1+df5w?q$-)}@vj&8!|zh2oHrki7CUEtn$sENN2-W= zp5*W;tmB&p|9pNb;&-EDC`+_cN*a$oPJ_ zFosI1_i2aeZa6sw~U)V#f*+>aIY#4)$OQH!9&lbpYOiwI?|U# zcS@8daA_MrT!%P4G*wmJ0N`lAlx_4r{dL76Cn+BrKFAANT>S7L2#;W;(6d)V7l&(c z4b#xnueXYfTE-HZlGK;YGM4d@UZowymu$ak1is)vxBk+)k$NQMhbOfMCwrP;4d)}V zKBzRTdTYEK_p-6d-?ZVUUK&j>*oN-9m^}&q{E*oMn4{t1?mPYfqG-XqdbqmimJ-Sj zGH&*ak-y6k)O^R7v#G18+36Ji&T>XRG@33_qX6RzHNfJ)9_qq*Uu~J zq{CL&Z2CRs?4!{}#=3!=9GMiT+v*_>t8s=CGcAW<&&r8*y%G!c1|Aks*L*u7?hSJ; zxo{!hpKesTbB{_Sd&s+;Q!S+n3}=u;rnz%ZkOSC^F#J~&7xzZ`oX7qfz>we(hhbTG zsqoB(ctq2W?R_slAnEF%sUDSr)`6qb7VGT(I+50zQ)FZr>Mbg9;q>)f$T1^H8U}!; zP4{|_ty?FJzieu3H}7|pD0=nP=vAzYSGZW(j8sw!S^fRaqg}>VT6y$EN#Ql0McY%0<`h(Oxy0WRzGQ2nT3yyZ>&%8ICrm79J?@wl+Q)Zbm|E^M;gu43Pee- z<<#{q^V3;PvS{q=S#Op=p}@vUdyZ^V1z38B0Rhg!v`-MFb=~PN~wC&u$}!Q_cwLh%cAJ zaMD+w^TP4`cpmr}-R>*jv=1t97CN(i;}tY<(r@j`%Arq3D(1EKgc0=X>yOUczUlWL zO?Epo6}Ib%1_l`aPZmIL90JQ*_1xB%FBqI|K#7&7xGs)T`-Vu|jD-p@6fX_;{70gR z!M~*uFx5Ic$=eyFuKiIKH_`eYL+-sCeA)$Uh_pb3=Lgs_09?unY5e7JlQC7S=NFsd zInK1~0}HcBHM0?wRlFl6;f^k%Xx`gN*#G?(+K?ywiXnH1tB;^HvWE%Es4}FZ2r8*+ zQ*-R&pjH3IoADMEh4TJ8%dt}hWMse{Cj56SU|w3kEr;737`VF}3oKW-aF@DuPsWDR z3aUvpxo7bk3KN!oTJP7*n6MS;x$<^Hu<@mpobfmkL7UryU$QJE0D69%XYsKw(g(xv|8QJO`> z#z^bJ9OIchz^H=GQ$T=2>j#N_bGux)MmLjh@KR}9HcRgeu`Bzrfq0^ELYCRlIX^_a z?%YSb@$jueBi6(UhpQRA5}o1(DjON-{E|di1U@zl0zYE%Y3HWw(f}H3IW*C7)%KhRg19(#a^sMAW_IA5t&#(O8w>L3^XwRtUN}fdOw>;w||x*ZJP zMaHHd7JiB`8?W|~cyo?&98MKiGZZ%3|H=Xx-TYvoD>b4i?|xG};ce{wkCW6{`BxY1 z`CAXdDR9Kc;D!m!p`jY7(_JFv*^8j6Y-W#HoPX&H>7j|RI3(bb^Skm4BFlA86Ccms z9IW=45}0lErQe@viI_ebFD{1>M}TFPqWNC_23$jc&UIiT>EBK0F)#Ivf=9b0S^Z!F z`G_!gI*b6^?BbK5kn@f7XY9h}G9HHi=R@Yb!JLR{85T4!&=RFKz*d8PyPOIT#0^WR zmB|J`d7r@>f}kF$ji(1-w=(-5oQKHluU2PKgVnl3=>jIAV4W1`>&p%6XHbUU!<
Ye-Nh?SH55qp4N zy^F|)h^d`8&UDgDmSlk6-^PMW1KWm+)>j2rDR_S$3!O?q0L;p>}}=eUWqbFr5137eLgaEGd;Z(^zf~u|71uwH3XX z=y~Vh5D;ks@Mr-vb^BkN(8YaPO!@QYfZfl_(}k92dF&M_X+Eu~-{2-e9MF@;iimFE z9RLED+i*9tsRyQ_4gvE%r{S6kEn2KmTy=Bv9sx#YIk5hUsr!Zn4|5gNW^In;1&3}3 zI5lHrg_8*SVvy>6op)CL-X52D`rD+_9Fe?&X@(KaYBK4!uBl`%yTV*b(8l3|4b4=b z{RjT{Eb=&J(o32)!)lM&90rRO%yr5&)c~N{8c&4=gNz-pPE$ESuRbw_SG0 zoQn<&NqYu{L6ZDZE-Clntuwt+e^V46GC$!Ab;QHepqZKXFqU6`vH&;-usKv{t3SS$ z@masaUP>-_EfVn3+9^Sa2)$5WN~tm&I9xZ`b~yv13n!W)<448t|TFr%Fxq* zmrsJ(Lv1Vo9mibug*&i~C-n$m{a@Jv(;NV@ zZ`_4{q4*2(yk+c}=7pr%M^~q3T2y_rKO^sAfL1;S`x_qXotDXoq{B zG$v6{P*_h6K&|I$ODiE2PEJ})?u_D2E23#2w?2y`TVu_XMmGejDna*XAGQAo42OO7 zP`6ApM9{PqFP_IZxk#%}mJ)3wT6+(BNvnpCT4FE1mRvG-bX$ zy3a5TrX2!Ib^Lfe!5&FpR@yLVl*kKCcp+x3m$KTa`1%3hwMi;_J(yZ!VSiRs_Z0ls*q^tHx+Pj+;ncipw-5}k zgAfggYQ*wEg!f$WXDYp7n+3EA$h1p!(#BV*P7eW=nZJZ_@ozK1!gyx3;wlvewfU?Y z(HZkl;3bRfwcgvhjJh!Qhx?DcxF5c{-`uxhDQruF++2^@=NZrx;C;2bY139 zNmZb?D?h2^2mkcddgK=Yko8?)fT)vvc(HUN0u1_n$4Omkgpzi9EgpY1=J9Lr)ALU0 z_(P@8^enxT&J|7?P?*0iKWN*~M;R_2A9Z!17-~zGx`#^VoK3}ewd&dXy#aI+^HBlg zMvd6KsW7q1_3D%8MJ0(SZN0nnSfZBe0U~vwR@qCxm3)1~{~co+aAWOgUZ z$jy)A<5D4N^r~=XNpFpGUe34))G$<9dZNTF@?@^U+$a59+Mb=`Drqc#8;vwqgG<6; zuG3EA%m_qjo1E6RmvpxvfQB|s4e}xUOY}50k4S_AVIP)OLlvyKYsEQLEv-@AtV_AtdEK^mVkBz3W7Xu>eWsU8eH`c4drZXo4d@r;OIswjsh0| zn@>Nno7;+RS(dsp2}1`*fe$6AC zU_F@Z)5BcYQ4MZgEZyGoH^hibd z?03~Is%Fuq`^@&v(7LOU3yILz9egKI5E_b_Gg)XNYMb=--j1KzYJ1JJr@-r?d@Wir39z}^Gh;-4L?==U?zmLC;XITslm zaWJi+k2GTMU4y|Z3%Ylp&z^@?PS0va0hPyyT+3|lX3^VEhUt9YDzEUDHJPf(mzR`J zT-jRi_Up%4bWh^I58V35LF7;uIq=)|(b&57{FX(xtZGVnw!p#*udLEfEW@6D1IqUCV9cGgZhHA!J}SfIgt?ypsJX^Kd80|`y< z*$w`t;l~i!Y&hhNh`lKTa8yHR+5=x&0cs+%1 z-#&!~BLm8hKMhPwoio#jM*1OO)gK38C&2T%BjD$LF)2LU_TvS9_N;cwY+d5s6XEOI z{;Sft4pQEIgCy~vAn;au`i1%I2nNz$L>pCtu)IJ5lA<6*@`;Q9j4N!>exV`p4y}MH z#sQ}7;GOgOg<1Mx6!z8@N<^OA5t1XNr;0&`Dp+-y_A{Eay+ib&VshEk65I z{?JKpzUkVza6fi;sx%jH*Yvn+wige}b>7x~{&6VAT&G6D^cb-*qVPp&xpgucfl1T# z-QCA!OAs#X7etHOWA96;4!H2p8x~>K9G3>`)*V&%ho%M&M--SQF~&9>E1+he%#gwN zzm5Xduwc%cx(Jd>56Aq5=dIb_?ry&M)lrqeB}Akb^fGqWP;+j`YbxmQ<8kccWxn15GQb_) zb6rNkmF&6p2ed~*Gec^u%)DbSwP?8GHLh?m6yp7Yk!)20s1Zd!TAfMG{`ds5An-wUHP_<&HPUaN?zr& z#YDb5)`m&abngwZ7zf^lhzE$REe<07G(ex@bC`guhz257(Ws}XmIiN}rf_*X(wAg=q%#$?G;kk|e#qoeCZm?}BKb9JSG8i3*UUpFfgfHuXg&#rE{+ zx<4bQ^@pFs&ejg{nyYvW2i8KMMyBgaq^EZLW2Vbv%+!Ykwd4YhJ_i^594xXxo(=Cds$}(yu!Ginv2)% zJF#q@eF-|yX^OaCS5zLMHZ;JuT19@1>y2vCeHV-)()-3v$8B@v^0%yNPjmDj6sr$g zqiBF|c0iut01gEAdOatw<}%%TM}Hm0bM_eIt-g9vk3wzftd zRXYsQHIUW3Uws@E(qp&mhW4x8PtGbZ&~;?e|L@jdAxcq;fGi< zzBm_!Y?0MaWIX~NpGBYar<#Uzh2)KzUGCSN{2(cta6*+CPrQBKy}IS1w7GUk>RA0t z$*$EE*-r4@IxEIJJ0M9KoJeAb8ayU?uVII&n4M z``n);Y733es7R_O%MBHTY{oO_glu~e$#(a`MUu4~XL|yum&Zy>{qo>-Co%i%r85yu zBhk{TP6J44XWA=uj+#BO)==PckcOAfG7r zFLm8~%0tqMt}A4~5Y8(hB70}ZPUaif-w)a(r5=|G=+)Xy7*vj9Z^zY(&H;`SLcnn{ zejA|4F7S<71no><$uz_LO;7Vsw!svEpWTS-DWr^*TNI&@zGLHoyDdz5CL- zW$q9(;Ft7thV+iEJLCEOIk7gg6tbl3-XT70_4Sq@PA$?YmG9Rnp=kR2;hMRLlJsp* zcaK>$-WXrk89menq)p#ANvG@Ga-;uT0{$d1<2XOepoeqC&9k6e2la!6(I4KEpOy1@ zue`EFa(~D6rC>cK=S{n0d-9GR9lxtsdVdb>Po+CPE`R)X%3&dQE)8=je$Ly@dAddr zv2RfKX|@G;jKK+KT5a{TVXM-zZb;3#e6cxA^ezH_xSgxkCWnE~9lM{~P5d z9B+}%sqtM5bzuZQn>7ngiGtIF`B5#EK~jRk)(b1*HHpoqKoJKD5>v!*y8i}u^3lQv zg+@N6%lA93Dr$@JhQrSObk`b&-tbEGCb(g2TI8sIK(`5fn! z7JZpY>{5=)0xS??e}s5D+p(!{B$}fb-u)KANwn=!nJ{gahS-$H-i`QtAO}Wur7EbF zEro@s*&(?VZpb~AJz?hq5mTE2c58B}iW|yIePWvjmD5^Qh&skKM=_Dl`{0;ot-75O z%0aET1FH+Gy$9<$=`+r%)WPuLp@V*$grBM)gJ62@AY}Ah0R;YLq+I z5e8MZ^9>{|)%Mul>R|rQH$uh+%vLF+@Cmj*Fr3lr;!f$R=xZuN!Es~xD($-bDEr*= zSpwxp`crvWlzl@0FOMrl-*u@y68g9&x-(Y}yE}wOS9{XAI6rK(pWa2)Q?-ZI z4phsO632Nu`wn*8?v~OBqOKJru&kdz|Efa!G0o#bQlRKL7?r2^xW?l>c6&f`2M~qB zT+M8CC8hgUnAevi^VD#1cYdDk&+%?rQcHsb^{xmfN)5qx@*3S*!|pSQE*)-E%mB}$ zD8)$B>0@Sv7!qUv%)_r;L{&Oh{bmDsQ7ov!TM%`(iy)%3mG(GwesUFeMjq*R$^Z2% z&t4*Iv(Ia+KLF$4QGZO3f4Lbx;cO13IdDVFxAiiMoC3^qK+7y;&2?yzaDX~YP%q`a zG9lg{iccKg;*fWOZ*T|C&7Y4cy}|em!2|B3kLy2Zxh^9UuK)L7bzaOL40h17y=HUV zZjqRLp#<0*jIrlnMCd7GB6W0_S-AO|4){BvyF5vHocJcMMvTpTow7jk+xe5>qAt_E z_HsM(5O7EYRp#KFdoRI#@7O^j0c=Lw3MX9b4KKvtsvGL;q1O_9M>#Fd_+6djoV>Ak zt!8S=#nLL#-b%aGvL*}4>Fw+5oQl_E|7{LMGKXOh5yR52VmW=&2z7G%;;pxjU>3My zY7oJwsn^BUFmtlLQ70iuC3>|1o_T_3wv|M57Bbi@kF7?7WS{3@ay-R`Zrz5pXo*x|?D^6TK9{NM+opI@?*0sL}nDTC>< zxbmKO6rlNW^RUAGL;l9%`pH3IyhtpsmYT*E6-SA*QX6FiH0K77E)hpNd*yn*tiM(qZhGck`-HFU0}1A^!f}gB(!;>YNw}9G5eOLW2Q>?RFToX|3hxT&F`t;c(ZtP zlvlSrw=KisH`bCpFEP zg)1ez5N~W(;`XwFGY#W0z=34InaXwwKA!Dfd7Ui%^>K~8@<{t7%Th9Vd`S$;NBaO~ zJwdU~TLDYgDSbwhI(nTCxL0pED1nbZ1q|Q{Lcn(MUrUd-82gMK8sZvs2I?&C*sAXY ziO|hfY<}+O8;15Lj2hoMP$!I;QZ^l;KO8U680lT42SDy|@Y#Le&nEsZR2A{iFDT~{ zEpZDT2XWWE*QVffHaTsfV)4XY)zew$0tEFkrK9^q*&7n;ds_R$Q+#ZePsNz|%N>Dq z={Pos87rmXl$q_@+0`>?U83E$Lb>t9r}hRmE$dQ-r)ys7AicdmSt1}$%3N#d;U7~B zx)pI8jLx`2wB71tn)47cy$O-S5kafO?7yiU-|!B;ROBAXvs1z_#q4`UyfC}z4oHan z3!}UWcmKc!F<+zmpA4o54VhbilWKI`mp4_tk`M3LnJn5+B&9tC0s;dtvs6OY$vTg3 z@-_?V#oh&0ApcMj)og{?b|N+*54b&l5Qj_4mq&L2TrA(eQw!;`=97XHD4~A?H81(6 zdO+3#Nc1Uc?)nrNU~EBoETfQJ!(%h|h9vBg-sN;BL2A7PV6E;9_pL66Ocz zE`tkAFdn3X#6|HM8=h#OsjPhGsVGeVYKL6*pJn=8pN?#t+sC}U`XU+-!K|s*j=%m% zCkfwqc3m;)rjatL+XYp&8-A$7>!~yKt(1CS>eFj+?P9IAilx8>M1x1cJOSz}0;Z|p z)M(P=#2YVQoSgpf9N)TwJ36W6JIHjvC*vJ(a z5kxY4Ml_{Z-x)yW_Pns)~wch79cwn;($*4^y$-Tg!+)I zel7d&K)#ls($Y#Hf_=7+rCs?lL0|vQWiQ4mZRtmksu=EX6h+y%Yx5>}h=~;Hb$qfo z*G@}p0{n9GBLU37I1FI^jha`GHrbP`oKS9E_5Qj*ay%!Dab^gaHiGv}vew{ks(Mt_4 z(g)xf%~1n2I9*%4{%RgFq6ApD@cH*vxMeT zRRqu&Mzp`b-npNyvw!;>ud~>*i+{e9uk)99Z<5iq z&bH{8o@<@d(es!^M&w$>Vud*0;{Dc)?!Ru9bgKUlk@R|p&r$&*a(B3W*Tv8;Bb$Ut zsM${OkS74YqRI_Kv|`sBX>&w4*u$aQyc;W+N4(~|Lor_-0&70sqok&!iS zX=U4c{8|$2JWg>g*R<<-pFgmcm{P=^pqVP==lTiX)g=@1;K7Su%>0HI3hCc{?la`o z*F$nlz7GcE4X3`DTKsF|x3(ND1;IC9P9nkrM8NA8|MpTL|NA;S{tNrfLnrdEOVEOt z)f0dl3pmwH2VIn3DeTD#mPoZqT-aYMDwr<_ugu;vEO1SFmSZBC30SRt=NEkr3#vcn z?q@H2{JDF62HWLgWsNy0vH0KHs4JWu0>)vM9yMm;Zp>C$il7j4-4>IQQ9c_DwAaJ0 zGp%0Y&E=bT!a%~?6jP+(lVxw7nKc<6?>7jeV(^Nup4|;Lk(=c0k7-0=*j#^Dvieat z(4J!Dxh3*Oay91)+%fXwD}SQAKBIa4`eN08ic3B_;^2X*j}(u>B%OciF7J``#BW){ zekx3-`BHXKm;ZR=;2fG7JgpR(k=5l}3#b?@;iWR$`aWi|V(s}SRZZJHf#j~+(=hkn zAA801-b2dy@F$0Stpf@@N;ek{;tBf7Udsf08@#qC0l_lkHJ>y1X$={BXmkiR2Gdp# zHAtY-$?ctvt(0squ8Y+(ju&VFkK?2$_EZ6*i4jA08&+CFS4BYbQC^(8mK8WcKCzIA zUqjz+Y(Te3R$#~-2@5j2kyy=*$8g}E|2=X1KNoS-zK=EJsgk^U|n zHw7K$)X-~%>ptIWo4*;X_Vd3?9KKWcH1k9UctdyfSRmv`nIUyw30TwfspYi+_W0j1;*m+|=ku%o=wUhBI!5%IJ#e!R z;`i3rwBM+Ci`WFN*hgMgd;Wik{_5cNVanq?X4hA3+~uH~TZ;4HIJu zgpQ*^|1_&+Zozioc1)-IYbR*jw~xn8jS+s5TGq_K#OGsm_3th#Yn3=mG{CU(_vnP3 zDJXn+AsRg6VYXUF!u zNDAJrJ{A|-mMElsvi0>dFVXaMMy*ecz0op0k482xwW^)mdH;BReO8#PGzACW1`$$I zUOYE{FCPeM;@aP`Y5eq#+af3374HTzmh!%rCQB>JJw|Mf?n=HQIjDg`YJa97K0)wY zJ2d4;v-e|1Fd0JUYgax)KlnT}7{$r$Nx{bD#Ojw`Rw~6|pZb~;>zP#fOkmyqLHz?| zmhn{|$1VvYYm3-)kjNPeoG5@)H;ct$U~hQZsDj1mVw~G%wxD&OJ5f6PFs#ey?TXky z_wuW+1=`0STiI8Mc8j7~f0-9o*v+)X=iX5G=peuX6h}f6mUraWXMBuI%AqO3X2NgvUaqxoANlw!N6PvKCat1IHYqUbl_|ko-_zhG|&Uqkrf?Iyn!DoP=C*JZFnKNlo zRfFo4$jmq(2hMtJY`9NMQ&(p*-W5HdQ{`#i$H)3<6Hx{ERl`+FheC%gzc9aevAr<} zeYvSUH$R>5*jGX>94ZRyPZaDQ6yChkuSW^HN(GWj+#=p)y(R|67w3j^8p5T!>q7`*1oS@I&wGjo0Aojdk{CM0XjHlGFk}j+wH@r^~W9 zbN%F-q2`ztS<20K|7{387#|$I1swHnKpwz#K<#bESH!?tP%B@vnpA!2{lP{twIS)i^(&(?I=9Pic{5#{c!kJhg|;sQ@tQGuz|U9o_z}hhEz5 zp@^MioUL)fKR#*eCjUDa64Rdla(6ZF=OKVHL&^RnWp;%j^(QdpMPNB3r#@){$0Jd9 z6ew>py>;+YblY%ex`BirYtOnM@!|VjI$+IP`eT)aJlso53?1ZdFgsCU4ZL`kn^+F~ z#WURNBNFud5QAE?cq4|`A3s#{!O+S6(O&zhp|q3VzOPc}0jpGuEI`X*48_Hn5z5dv z`rEWEMSPuLucuzTe&P7bv795Z$tI8)+d`|B0Ih0y5AM&-q3P3ol!m^2)KV3qfU*9$ zp||o3k|fRej60VJqmaf>_J*Bo2iYRH!e~*k9UC2;VXf&Or)3lti1#psH^S`fVByvN zT=hv(D;uQo(=r})57hKd6q+%|zL>^!t>-;-%tc$lblM)?8sX`59J<`Gm6-G#B5+Fq za5o6rh2rDMZ~*J2$a=%-eZZbCYAC?g#ZzPVU6j;2VCH7n>QG~xv>w&5k=o@$`i z_Ul=v+woNo%t7WZpsfhZq1IWfYw#60SRI zN;Z>d0|jM(yg)=gRJrC50qul?CcHsnd{Q2ev*Tr`W0E9D-g#ToJuUB}k<@?Lh389S z%1s#kG#`5?)q?tC>x#_6`r!EM;PS&QhZGz-%{GHS2`>Ekaj_St!3RUCQOhV}J2Ky@L)S{~p!_KkCV{=zlj{90VOz2!Rb3 zjem$nsT)Ccnb#{6KrmCj9aKhv=G&8MKE(kEys!mOo*AlIr*?oA#GOFrhsH{He_W#! zASvdAXtX>Ku%vA}nDQeTeSXNDYS_^@ zj)&yILBpk*L8WKRoO~*7j-tpEXOJwpZEHqO!5nZ08W(-Z=bkKPF5Yr}!RzIIaCN!p zX7+XJbrR=hDJU-b3`jYNz+xx(3Ed8)i#;Fuz^AGre|4SNXyPMf+jWXKCxdX@u z{+tYyXQ6vWy!b4B8j40zK9Bq=n+|(vN5-_BUsr_my^SeiW&yS0%WEMyJ3+Qw?Tz>Y4zdntSg!+p}dn5*F-0jB!DDn-TU+w=}Gjw zE#8R$6Gu#d#C4JRbM~iJuHz&BR$f`1I7g%Znfrys&Xk&idn@q-`g4-^KZRCddl#H8 zDl;YIRJ)Pu0M5m^a=KPz9fr+dDj*yco}5BL@gSx%R^Mk>e*ih7oB%{&oi?fqP%(QG z=eFf7Kpl2zHt2uTH^23$gDGdG>Z46;VnV~T>{Lw0*TVICZ;sK$j5fxahI%R&vCp18 zEAU>&-_Fe$K8}<`Z0%>pO%-@ej9T>lT?j&CruZzbOy7u@Yw)W21GqJYEGmvjWc;9W z7o&_ALiMWMvP2ju&C7ehin|UGIo173AW{E!t9?W=P*VZH;x#zaJUaDJ?8`Gl!cid< zotQQVwL)-l)lru^zXzf0xfGjRoI6i^-_mG(of7z=MffQHHQ?^b05AmhAR=0_^Ro!i z1BIos%QRXAZzE4e>Q|hJFgeR9|My0$-+v6_D+_yl@2m6I6iDq2vui!Hz6u^LO#G>} z!B}zov}wU230TCipR38gW;7E8jI(Biit4}Z_H~RAGV3D859IGa@k*l`jjm1Gp{oBB z*2P0KV=(YO%G#JCWK689F%aq;L^EupusZwA80hHyp zouVl0FIz2`Fb4;RmmzgN5CNGBf@7g+@Noe`B?C4FOcgEqhflB*vc68{B5!U=FzIDt^07 z118x8dxYX&S4Rm~V^RO~or$vL%D>rgufzi;XHt83b&R*`;KR`F?rutiWPkS!*5o5M zPX7OY%>?qYA@rbWOnGGl55i<7<3LEDt>to&)av)|CPjNB_g`$EChl^9RC*-Re$H!N zs9L5&zBA#`xz${e*#066Y(mHeNj^N+9nZEDoCUlDZrjspdHI-*re=rf$~3@ic2Ly? zGN_mC+#%(Gz2zvwZO>VJCJ^ZWP<# z&m*xkP|}#Rs3hAO+ca=OcmDT;PL?dH0>XGMSo$IO+R<^Q+ZUMVKV|>JuNAoK@5>E; z8Ywu2fQzRbSZEGZF-RZpov>~OC2tB4HIJ5J)PiWcR1hMIBf@#Zl99MTfGQ#*Mc5%D zeL-9WI^24d4A>fFE>HJ!-AfG%WF<_UMVb74g_kLNrN4VkEaSZ5=!9+fO5L6GPwub# z2pQ7a&;ClkJ6h&65B9U(%p)UhCHbo)2-7Z6z{qbI_AhZH!)Pp?mL ziHv$`D9fkeL(2j^u^H1z>vj)dE-<$)qJJkDuo3{1 zel?yS`rijOW*4E?M(B7M+B5#Fwf*N@`zJb@{ehjBN9q}NuXsk@kx`erNOZ07^3lBh zK+LF>AZn>`d{Utnc6+qq@nfAF>f)&$<8b4Bra$i!O3^7RD@S6)(0a0CT7kTaDdEF< zQE`9lmGjMz#w9z}Kz_MHAnT%Jwtv_55#Xz}Wszc8fjm&Fdt|g6R+RFp||QI*W6KKa*U83&-VZu z-+=M!%h&9VXBta*sCS==h`0aC%5O&A@$3i$)+98~h8P*n3k44tFK$%io~?FAkKB7h zFV+m;{k`+aIh+FE1=ans`jjVHyG6`s;_cwUoa5sWl3}URlzHZrg#vFBor8$d-^c=| z;6tTb_;oDrWPllsevFGlB{5ruRPym3zL6;WO*LGCJ0f&IPWwL53Y*^Qt)a0oNh6kH zX?I#ssZmP;1+NZ}2N;!kw#ZoOAnRqEWA*ka?1Ge9&_ot)D<}A|a#-_0d=NmZzxA?x zU%0atM#;07+JC(<2W-wIh_p0%WJc0YO0)y?h0|}GCBkHBzhLK8G%nUfO|d71ot=z= zMKO?=f|ZV4CN$8XNG@X5+kV2JbW)|FrgXB~zNVD@)k1 zPfB+wWbugciIj*~5o_$5>hFr zgpIa!jm_(Hrt~O0F-_H>#Gc*L1<8@vUgAZ&F_<>69DO4n@=jbW;D^Dg}5E$5#q%Fs(LytNf|W&S*MngP^NQ)Xyc=O)?$0l-s8~MIQ-{{U zn(9p0eF^JS7SlO%JT?W_md1F$9Y7=Nbl;tPE4El0CvfiD7K}-+*z9S4zi2ZZa1em1 z#a%L2zFS^jrX+x$&*5GrEO=uqcfjsM$*5_I6CN%<9aY5Tm<)cxs#fzb{56kQ2 zcm3aBq8;j6mme%lOmGzK?U>bg8(&_S#z4#U8L5q3DWKzHrQ@1q*=Z)to&G0$pV>JW(@He*>vXw74ElU>K3{E zFVCR&JYr5FE_Moa7ttG~&qV5z+~6vLaSKfz3SG;Bc#Issk#*Va#`Tr#()aQrIHmVz zFo9RA`G9*%COZG8qPGSE^VPIvAWi`cVMF#NJ~nfPm_nPgC0pHgMb?LpU;(zwB zN3s3_rkJBdIvw0fVk=uYuEw^*8pf3B137F9Fhx1)ajgS&F-#+v8pjD8zm}`n^48kr*}W{?7K7H)NdMS_^z=@A^c+Hu zFL5A+wk-QkE-FlSr&q1+_U4xfy>eJNcnJE`IEqn%CIPnPH9>0R9|YN>^amco#*9g0 zJ7mC)MIsFdxX)T0aN<7s^K2V)z>24Em{a>BOXl;~U#iQ&OTh0cVH6V#)Y53vBrJ7a zM8K%2-a*vcGBh~w$+(O^=j4y}&amQT{x)1hUOI17yV%evc>Anx4Eq+HCW+j_vw%o< z(*=~^ArZ`tXO@-=g8fOu!Mi*>GCs2AF@2anX7#KjNb6OcN|6B&l{VU13}+)%0da8V7kO z(=X>*TCC7o5Mc@am{> zynB}8hdil>r0+wTP3X0Q0Nn3v9xyrB7I)8%GgklQB$B|ka_ zNc@%S!W^8#QZ?!s{JGPd;=O=cl>TvcrM4;v5mvdQ(ZBm` zaN@%Mv;y3N61mFs<|QO$iW_W0d*iT}tUs|k&1v3+Pfvx)TX-PMm~!ov*v2sT^;@(^)T3 z?H_EL{zd8NoF8@xn7x3*`NU@$tHGtil8;uw5~adl&M$OfdY0V~FVq@NAq;FYpX=A7)G{tKiHa^EfxdG)o!JZ~R#Av%iWj*p%|#7n8UBIJ zsXd3EVSqSqPTaHk1iB#5c_(EXYGE_brT_W*NpI`~+p^fg6t2(q!(6Rp$M6VlNOX1J zun@dcsJHx6$kTZ|ffE`>-gefJ*u2J(nV*b3@W3X_V`4c*Y?c?ZHnsg3u6m{-OeH1e z<^BErf5A8dk*gptrc#1ZePw&rgVjuOTEcS zwV;r()WiTdtJs<&A(3KsWwj{4@Nsb-;343k%GngY$#c;cDf` z?#S1vo@oEW{jEp-DMU}Ows;+D8u(WKhqX5khq{0Jha)Pfh$JDhja?K%jEXE_vSl|V zOZF|Yj2TkdLU!3kw#i=B>?*r#A=zck7GoWT@q2%CeUJNl-S>SxzwdKA&p+339oIEJ z^M0Sp>paibd7huaWL}A@rKiJcwOAAQ=J@A*YmBhTWM%WK>#38p_HYGMUTVAUF?4WVxhYn zfV!;gl%#iI&I|gC7zSBW3t19+3+oWQ_zVelpuhIj^@%)2Px!2;+}J|P5*i7)rt3qi z*6ITXB;taetw-I%-q_VNVAh^)UoPAn?Q?3c8|7aZm|sMKUtM-fpHd=C-(HI;9Oo$X z85Mt+7Vb5vvwt^cvtZ)ZuBV7}ox~0SKjqSC0K<^o@8Gr38-Bc`{^Y2|x5ABF#s0#C z9He9@EFxE8HDr@n(PR}Xy8rdZ{o`_`+q2~@R;1s>4&>A5KrHbgTq_*1&x`JT3gi0qJLRdV`}| zu(2#Yr~&sm{=A;u9R7CbO-aYWi({{eMRBzXwX8QT>&nIyqgnEs9FTi)iO2Sxd^rM} zA`>MYBNgM2vG26Z?Jn6X%MQ-3BMDkUe!K|<4w3tN@bP%UQH6YvsO&Dh9AXe)JB3+Q z9(|wNw3%-TJe*rD+cmJ*s`K^A7+T3gJ5O~r+_ddC(xFoHh7yyyz^){JK&A6;(N5gC z(Nl|;eSL5Gxo>qH3z^@@n)~WgVZ6U9Ineg;>9+9BcHzhcl9Q@Eha(-OT1j2r+|RX? z1J6arT6Gd0OEM^P9OqdVd6THmCN3&{oDpN=y?>HzFC88W-)~V;l+~Tr)f3Fa_OGJ% zA0eK%-f%>HDWsUo(2ygOtGxeolzE)}V8t(r%Dr-qsy`~kVfS-KS|?VqkatIMpFOIw zsoZP168!Av!f}Rv%%+I;)+RBqE*xArYAH^{=sXWhk?LMgkqyh*;y|t3E0b$NyTtVX zw$qrvwfz;Ja>3g5y0q3HOn+2lpJyL$51*lOXfoPsJ8~i*b?~(0ko(p_h1DFY)pY+*j)|;4+B)#R64jVc_hAXInD(0q^9(TR`YNXso0EQg_ z-_*I5y`@*WSx4wYikJ95&N3uD!ffHVWEI&NNVaL1f-8)=w~vrfT%=I;vYD7TN}hSL zdiJzq%phY&?((|F>b3sDu?@*j;VP`})Th*oj!e~=GiJqd0uHaaVyWgeA(}(u3xdq7 zOp|N~t7*E(EXjm)OY{Eux&2Gj^j#9MInBZDe&H_#pKpcVzWcx16sg;b`Khu~YCG_f zQDtEcR-*^25~;DfNuVwm_D8Z-t<-wY$gj2+3s(pCHNSAtK1M9TT0H%`bPwDPPOzEaf749;03owEZ!#`a#aXlaH)4O3i znV}+vA!WMQthT@7|H-%V<3VQ<^^C>(TtKYAN*%Jy!H4HVi{cWUq|Rprx2WdN?ILjn z1r9rdU9kamLx!In1}VuqspFTh$%Qv41-azcv@c6I-WN;W$Y4K4hdmaV(q~17jedqH z6boZp$m)(e{>V`Ll8>OrGaDIG=|`@cw!4Ko<1!kF>&-Ktv){-{X4N5 zE@hTP;7F3$Ugtw$jZ--AIFg1t4Z%~tPXsetc$l~ zeNN8qdxSjf#E)NC)@(1ObN&Q(h4^eP@)I7s@&`)~yIFX}S`lX`KFObL1Jz0+=}Y*5 z{q1>>K!C~Aqs=suxB3O~t)bsEPXdFxEPs%PlXKa);JI>|tB>B7POq$rYAfTpd)ZfBfNXc}zVuhfk0L3Ry;R*F@{?OosU?W%j*+S)lSWKd z8;HYo`)*)Eb*k06+LphbP{?=sswypLv-{dTWaN^|OzmCO_KmmK@!hhD9@uSa4_h%p zPf5phJ2$-PN8*FEOKw!!EP-&?`sB3SC|gFrqDcUA%*^UmYEJa5_mLIzMh+G*Q)06 z*V@M^5Ul0fPrvQoZbx9Acmt;~r0ynxBTJh2HsGFc#>%G#9@%$2EB^iF5kCzE_W5jW zPDG6f{m0!+$5<&>q^ZF7f@GQLL?j6}WHnZD{=pt3Doe`87)u{}`{V}PInRseleER5 zC%Z|n)(pozs-|Sz0nygD8x^i8d-jImraq?b$@WIy!tQhwqNT9*w~f?$495PVBgne| z083l*$sS2QiCtD2Pu`&Z4NV&krpsnzN2(lV>_yy_69s> z-J2kBWt7<4Hi@&VM!qBi5p4SYc>;KC|&w-25r)wmeFnBD= zppl(P?i%?XMiTbXz+g-NqlZdkbBr6V z-CX$;l}ak#^wK^8ZdLC_M!#RY==M8f?d-Tlu!Ni95i%?=G@szuDhuwN*3lm&{BJ^m zLNC!_4HX-)o-FW@KwUk(I6>mz(Qn=vdZwFgln&>Dwb*@qb%ASaxw}rs&2TInb~Df z6gq*lSGt<)p3fWwdV3ch1%3-+plx$qw|yps`)QxtdR8fjeBb51iVJ}JcG1>$5jaQ- zab$H)q*@yFt^K8&t@%LbGM~6bSqQmYIh;|}M1UUeCd3ha96;U$+Eh$|`(5_h{xFeJ z01_C=U)cT7WLs|Ftfhe^!r}Sgvi#t(%}sF?EO1oNxfumug7m4F?;(U?^qkil)NIMn z9S7p>oJDh))xSCF2_OO?AOfScB}Os|)LHiV);ML&P7OK&7PG7O?W&!Ae%pah^HcME zk^2MCEquGC;J@n}S&i6ccSlI5)l%I%Aa|eku_t^{O5)F%(k<*4Scy1F+|KHY9uz)F z7$O;$Jo%v3Fwpq!9uLr+{Bu&pP`)qWzD#Z388V7JhE&X!q`Poz(lm@QUF@TpL{y57 zwKD1=3q2doX>V23CYp(iLi#3Tn{6ux-N?Yo@60u|8x?iYV`E=>lt@`8x=C8T@u9%c z_32VEWfWZwfD)tz+NeH3|6)nr4=PK|TWH-9_v;s#kp%C-s<{`S0@0>Gu^u=d_^3XR zeY0#!Tz@`bD5`=|eY;)y6Ok-;yED=A?Z)U&2SN%8Az=@MR0-G; zfgtg&r7XZ~6q-t3j*pIV7S9?B8c8@l-Z_Vpa-C~`uA*(;T!ypwQYrpWNGbG^fK^vK z1NuIdX7vc8Q~rL1$gCb!P$3eZR&s*9TMFP`f0#Hv-yN0BN`8VM0AifulCiK>=BF2UXI4n%GRM2-r( zWU)d)R*PL!94y7NZI3TD_Li5L*kWpTDhy45op4NPebGz)t+;+ZQ1yYTcVsVv9+LUH z-4{+<^X6hizzU;a<()o>GfU$FG_oH#M((I?zOgr`2QSKglNMP8tBpA&5OeDYc)MCR zT#r3aC`TS;G;xI*ILLbtqwUVtO;+*jwB{eFirmQ1`S@V|{xGlM#V|I-8GRb?nJeIq zd2{X86}!T>aC6N=km>UQ)7LJtgG?Xbb?ZQj=5GzU31Wq5iOEG^9W|zcKE}hDTXX5y zTnipNAGcV+wY^;pJ%$RBiUywl9ZWVGaG(RgNNlMz7F0B&y5i4kz;^h|ok*C168PNP z8$#^(&1+8Qn8_&kMId{jr60FxjvE4{NF9(Ssi`v{GHP%7PPDPAmllWd`zPrpzha+F z1r)F^f;dZV2|#VrmVRbDHUU{3%mr^$9ND+4+OH7M4vjoJZqpE92+VO42q%}ZclYAiaj(;3khp#WyQrcM z;g5Sh4U_3{6P;I4ar*R4!~5~JsT8`zD0&%kz~!?56}pDX5B#fC~5DzYxxEcX+x9c7m;uCInQA+gbdSM zy)jPko^tiP%dLnY!A|v(K~mC}cMtpm9Vz`)V`$}5>42hRPCV*Wr5(?@_7#fMc|cf3 zGb`_sqxN(hKANa|X`LLoXY62frBpJEEz5jR7=S`546@edf3nuUfLen>1ANBm&z`pBQ*4MEfzMIT*kgqXV%pr?hBfX6uEQ3OQ)U9 zvhug)6lP>nX&cIqK2u`=etZ|WgvgiJitYx%LaC9O`AWWpVF=bp3Ct2eKP&{8S3l(06raoNz_p3zI{eFe#`YQyeEodMUqUus2HCjtKiT*IfNmGrThTOrv%no49ilA4LZNF}1*usH zK1$zrdzm+CC>=rQ8yywGonpIu`{k*K+S>F_FLu#V=%x6i>&~AGG~RC)G1qF~a=)9r z|CP{fH#($SWIMN|hUS7>m=zV>tKJ{oE$wO--E^EHIKxOjyyxN$_A5@x$uoz*?hsS_+2l<(mjWYgR!cQ2O>ru^GGpiaig#O7&c8$6JfUT zu5?}oA~V~;8#zqZ{&wS}PJij-a`<}G4(GDj!IAo zap??VV%ExG;XfM#OyuL0{qao*- z@HIi!X{zDVKGA&Hzx`@qV)g?;9ewsO5_)y?fV1W}O>0lO(r1cypP3z|f`t!=y8TZo zPnN;K{i&>mWakYk)D# z`3mo;lZn*rcvu0@o{jh6hHg>#Y{Of_Z z&2$?faj&rLq%Te4zW|0$bgHSnq_`_4CFSAT=Yr%S$F56K9!_-|tg;EniVoWb=Gyr% zJ%+l+bIh_8)+@hF9#=dB=MCT~8WGyD+Y1(xqZ4rtr*o?m@*`1I%r0xG@7} z5#2``+w`N!H7JeiXuxHxRk)yy$tsL%33&f?+ftqmX2>IQAdlEHtaWN|%-bcE*Dm#K zy6Q4F9p5o)`vy{kBjo<{*bD!wGz)ehX}a{L7g_fEyjpR6`Jk4lkW*djEl~XbjtzdN6m*LlSn-KB5UtXS$;#3M#UU_?) zHJOl+a6h8+Dd}^rqJhH@;k})YjjIhc_dH)r%Pu)SY&&cPtsRzw;XK1FSFyLEN7+5I z);ML5dyS8Kx`isJpVaV#Gh^Ju^M*)+~n$~|v9$fXj95;6@B zRQnP#>G6$opt_@V()r5I=_jn z$^JL&)s$^8D-}Nb((XO==8_b%D>)^BItHr{y&9Uc!Ar%rfIT6nrR^GJjKdyVqzlpq^0}bCLw6*rdG44l=GekdPbt~tRum~y*h{A zKxRC<*Q&+ys>rDniYNN_g{pEh$yE?So=FKzj+k=vCXW<)@;M6)$^PT&%I$~1USLeVj(D!TPY_=QVrc)k9nfVI=7J2g8Kd?Kn* zpVDrUIq~hZW;WpNt03CZyPUW#q{+e0I)}jGjs_ST$;XLQ`?g{gLQ8peMetV9llR(| zfSn@umSFyi{=bdkdW}y#_vjokNe6eWoxVaMR;7as`kIwtjIefk{ zdo~b)j)pI(!sW94J6gOwM6ClZ>lMhOuD(rW_p8s7a-Cr)thRamLZB5UhrMa_Ln!s|G zHK-_*{+}y~s+`!78Bq1pVNnP#t>swi*nYx5J3jrQbH;fv_aY1O(3<#v%C?3a#pcc&mTSV|dmeM%E0Ju^GqG2!gTKC!furio=FR3; zR_^BYL&c{C9MnU3K2Dy!Gjw{EX$)j>Ls$mi;FV~?{TuZ7^_FzPYW4GJ0&z>y3=hU6k#o4o=+Ae?Ap({AOApsIeoUdikN%KU5kL zAYUxX?y5a|MWlY)RrXQbpPJ|{+kkua{?4yCn>U9wk?m=uTP=U9HL(nLSR!X)#plf4 zpqj1?R(b2iclYI~E(9U8JL82HvhQ_7rYGdLKan9XD22>m}t=R4SCGlBA62$c6v z_r9qjP`%IN!vTE%0C{@ZRHtb#rLh{i=nX+9CIiOcDXgDWj$w1lOlw%B}x zy+-!gVjsFyQ29;I8yW-^+Ma!T10X>?AeLQAjmZBSCn5cIx_}!#sEW$b`W9tVZu~y4 zsm?Tvtv`^n6y)R!fPq_VjCKxAVOvIYg_oWM^_4b|`=2W62Q4V-UrG}dQc(~o@rHPX zG)3~RxlmPIMzh>y0oQB4GpVg=ZtO_-6D?}Q@)~ny?q+PSzKy;pIt(Kl7{(%Eg=1p~ zl@}P=pn4(@)W%f|w0|$+3$#^#Ypq3vHsEr&WwYJeDcf!K7H0^Wq1UyjDQMrNKtfde z2O-K20!xk&>Lk&=he3AWJ#biZG9m{C+-vqLe$UzLC_}aJ;%Ut13_dZd->CUzS;5@c z(HJdeOCryN7jeC#w{(pTIlytt6RJ|kKr6wfoMO^wnV=;D@+dt(E{*?i(`q$QLG#Pt zvx8L-IioJ0iY^{_NuhN(!}>s^%YlkbM(rj(FLVi97XBT=Lp31T#7K)OVDDLgxwo(> z7NJ<8UfnkqIaUyU@bSP@q_&`N*^B5p+SR`nL5QYfLS7`Tp2e+|;G*?+uMfuo)+C?W zf~Qtk!B6Zkj{>CS@kAZ#llXkCYuVHQ-2fU@sP^Q!n;0vj`LE)$bHLGJ4v%*KKRsG3 zbTpM>Hj0t65N#uf`hx>WCMM7UasUo+K(x(YGk&T2Of#jm&XcyX6z8C*s(daLqhX%? zRbkTT%{{HNKv(g=1{=u@@e4mR(1so}{c8dPwV7Fapf0+(ySr-_jK_J;#RRU*uw}+I_dW98y#e2Xy*$rT8K+hosoE75DdEwYMx^mpL;Gr9Ddmb4K z{zD@ubOp|LpLrLyJPqq@&;!Sj?3_8^1z5h^` z543zUU{RHJ%w*e#ED>iD#4_f?ShnIhqwRM4uaKwzb#J&*}MX{kV0&m8dq%$ z6*mLuz61kp=n1B>>LllI!`)N?aHK)N0oVBtfg_#{00%_L*0Vvt(HM-!rm)#AQgs6w z&e$Ze0T0dJb*m=)1g85uFQFfKH7uWOD`}MCkxjbI1F?D zFU@<%uOBbFlieGcqC-FP%tD;>)@ASA9hPiL;FAa_L&*Av3?X$CfK@3(q)ik;Vb`pg z0DsB-UKz2i@nX@0H`7glom``ayxg* zc1;_`Bb&|B1_9^o{}ec7KmfJD@eJRp#~kYD_5XJr9oK6vpT=nbLQXvzN=E|P{yQEyxXC>8-Yd#pkrnIc30Q{=V~?oZ3xO9rYg(plr1r|$+=r@@e6cG(W-Hnnb(_60!C4v$PF)#upUo{TyW%{&H9c^aJ3rs0EuP@v;g zrYwjhb_c+&&;p<=sUv$(>y>swt9haZ zv3<5d3j*Rn;HefN#c=Qu4j|?8+_5)PT@Q~BDtvJK zuB^{>I3=R-U?&;$LqWf1B0-Y$G6~&eP}%|CAsnl)YQ^-+tv6xFG?sSQZrgxE_Jhb& zU}>Cgcy?U*SsnOlUnB6<4vqfbN)Yv>)3C@CjV6#W!-P=iX8f1AUz+Y9cojj3#*=?a zG&DiB7TosX5_vKwNHl8nT@PvirZF;3kcgA+1%)cWd7pP)x2>$+I_+q!Z$tcUW!{m% zur_kF>zdl!QSxQl>-%}d(~}{LEz#MqsFXhUxG}c?yTJ{88TU^TEN3SgQaJrmFF;aK z0}yyj>qB@$xfxleG*AK)Py!UWxK4bG+*A0b{RptDgTH<*!ot{U?}WK<`pWkMrEGG1 z{Rfi{KJj`(MZ$)3JU-I49_ImvbV(_j!=VQEbd$vM}7!l!bFZ?eXb z9w{AHw<0H3q^zuZsiN1_eKXf_a4%kPe?{h)y4ACB@}wW@GU#Y9P?7^8wDIVVoCMHW z`1jUKSfmyG`($w3-ihnZpIqJtg==3&6F|S^)e-V!(EQ6|wD^aF2?X8@T(y~CxcnSo z=Z)c8z@8mj&KFTR9r#GV#^XRra+|{2%WHaJA{&82$Z>x8CiqO=n=)m*;`Z;_b@=q^ z&o9fPSB#2<>w{$fFFC-yoG9K00y{w&xCW;ajDk@nsKhq>m-0YOQ$RhQgK8+{e`q%P z-2h-d(_>~pK?`64%{)Q!_PJel&)Ao^0`^NQd4dp3oLB9BT=4{N0f}%$UK5zQDEQL1 zwmueiDK2JvOz~TkTxOIJPTRyyMEl!4LL{H%hJj?a(Nn z-IIbp^N+x`s!y|0f*w~e)Z>z=ZzvzaXS#!8w-9(v-G}t)9m+OUG{=0ln;kIFq2~Y5 zOus&LP8L1{ILV2qYfI$0)=A4&KmdHRBzZB|A9XptBY#KQg z(BAXb4%FPOP%72)Pc?T3G^5D#1q|`G@B=~QX+e{5C!#sQ38XrgD8UIXaMcIZ+~iV& zGTbB(^4vL2HJ!YP3hgO+2u>h>7i32v;W4s|kM-8*RS-KD$r%OLJu51&HPh&E-mU;= z?1g~L@W?-iKpEtfd@3)j50mqiInPFYXrc{trYEBekY!=uFxMC+8cek>T0#}meekUO zHRf?Cyf|oKL5c1yaJ?5l^s{e~t4CqcE;zfw|&oFl>EuS4G`Tw^V}QUl^dhv9X}Brk`ai zf=1S(ZVBa3b%UNue)AMF4=fD(nnaSDUs#BwqKCDAq@p+PR1}Ew6kRERW6zjKL1#)}>1!94gUFZznl*%ZZLYNVBaxrQr zGm*dbGEH_n104Z_Lkn)u!UbY|P|yo$d3kQQiPw&iOrL-6X;xTOrNo03Rp&{PQ+!DS z*M&L;UNmfxV`I0A1PBcCtivg1FtXB5GgVC=LiB+9o&wlAQOm!y@8jb#Q9qU{7cetH zsu}C!4srk;1%Kv2FLP+v0*o4|ghWfI??)0o_VT=_<4v)`HHWcMJATz(4q+s(J@I1+ z>m#~Wkt8wIjvok*o%)8Cw7EJeD_gPJ=ka(Y#l(gE0yX|tJtJA-ezC}%=weq2%gz*m zbzz^(CvH!<(Z^++Cp}(Y5Whwtb=F+!bas2BwAaQvI}m{L^mnH^$prMZh4s%rceN8w zYz}{%*R&(vd{Hs)I{1Y}c9cRY7kH|xite>aW)NVjC5G9ij@JB$DV3P=FUlCCArB>& zAkH;Ku2O;6%?sqnkgl3c`yOJ^h@zWu!= zB@32=0rv}?)+`O&dLDzWxR~3}t5~;pG&5UP*jQZ34_cn5{fMVKHL7>C8BP0aLGvK5 z*=)Dss>MdU^NZH4m0?aJ><}0K*r*fB(RkK^@2?qNJa6f$djg zeqJdPTQqkEn)ZU=gIvrdW4bILfqsB=Ife?^G+-!Vb$=vT{~jHLUsTr*8_=xA^=xNJ z($>iFo{6kHwA7`M3;E~|eJ>bidPBhK@;ueA{ACwnv9lS1`?QJ6e9TY!lyBz!^j_6iA#2B8Uu&X5{|k zD%75CX*z1>5o$L&`%_c`ti58c<78LznY{~*K~8GYPkwbz6t?{Qay%0ZtCr3LHCqgX zv3?p4-Fe#gQXKVa<*?H&UWdQRW=}AlJRvVmv?T8ZfmJN|o? zo3;~rg%Jlex#*6_l>0(;pyJsUE?BWTRho+r4Myy61esy*0<&4)CyAcURgcw&kX)Ke zBIw4Ew9?fOuHb#Qo-WXQ)l6@0iN4x((!uvv#Ap>Z?kI7qHDZECDCWq_=k|a#b-712 zzsjw;gkk%Li{Ap|qOj02T z^zjO83}*?iq&{i$_kk53wo?v$i9)zn7jCX;vjlZ%013>op|%f{S3cc#+4yzVif-Fj zt~NWh66&={k;+I`EqJ|BEAQsW}xI#z}LH zN%KK{Z_+GH6f{D>+!hDVvI%|osW;{2872|YgvJ`0A8%_v%nJ}z|TI=bGS>MJ_9iJk;w3PjIbjrJF+y5dZ zJ?#}P@Lf#fbN*qVA2%%N;Ig(`m^-iydXV^=i(AbE@S1?d^Pi0=hG5X=*rv;8_HLq! z|JC4Bgc_VQ2Pliz8zs+)2-oL>jfC%v*fpq`6plm}KR#WHRibM=*zG2LtTO>TDp6f3 z3S`}Pel%k0G`QqKnIuiKC>dA!d)ZBYlxlA+4{{!-`5jlAt`uTe?k3xYYYt*Vdy#wD zR*jG*4^^6$a)efvl076(0HJK-)}zRMO!i=;?25tG1E=%>K+3A>y*AEB3A?iMb^d46 znMt=&xAj6*ugb?`&sL8ukZR=&oDu6VDMd-40T@>3m z_{L~=mhwQWoYaFE<2ml1sN(HSLs^$KKBrJ&B3H}D4u%w1uS<4|2$t$37jWI7JOP+4fF7a7Ld4BjoI^=b6tQ z#7C%ZmT)}Tl>cnLzto8mByicQaxIQu|J@U9Ax}&h*?5;{;KnvJmvq@(s1`q|UHehF zwu>;co`XzSncKYBIMz!Fu28i7$*6LU7=jcne=NkfpQMb^lFSarUeSDcn)$r(dpJi; zz!|9+g2GN3kMZBUc2ERu7EUeFDtbunAHrrVi3oJyKD$~!b3@t>z`Mf z#&?;9{b2_7r&1p4e$SPgS6MEGrVPc@;;$*D;kdJL;v3sET!vp0TtBGEJu>|0G1zKU z8HC8`2J>;89aegjll$wezuG*$C+hNFE#=UMH$V6O`tT?dMz|T8?xW<7lM$86-&XO)_K}QLQL6k{fgr`U z?_lB}obA<0)PeYwS}PQGL=0^ENkQr*$YI^U{Ey@KnusyH>*fVV%qyBm`~|iva>@=& zYKrwqhhsvo$A@NC=5i#WMKEfM1NDWb>6^s=nh0p$$K~(P&3z-$8HgboM6T*iJ`*P5 z_iu=rSMXG_Aa&2S#R(+&pKo%cRVkn%%uJqSbmzdUj0R>t!=;$LHC>3?=nq}$2_5^X z5OR=?@*)s^;$W%eW$nv<)ZqUpfAVQ-rryiuz{dsB5_Vw1V(A23Tv2VGsO6U8x<5=P z)LLIrHs~=(kxuujq3&%4f@!d_aj@gup%-MRjq5srY4qM~%e2v2wh-9KW(69c+iXQt zrHo%5E_cZ850yOekprMY-P1+A8U2F~>^s?#1o3?|EO>qmul{GoK#Fw6;TsEPJ4m2; z+?`8K@qnkltWW>(qITk!4}B9YS1HM={_2W*e1xLfTM*R@>+b03JtdUj3V#1~TKhmE ztp*`pAr@m2>JWbo7zq48O=@fHT!)X*rev{ALWzTawhnP}Z|K{x3r2GT7se%@`_V8k zfJy;|ZY0NclwYTQk z80UT%ye{7kcqw^{hE?p^H5v4zhm-dF;Yh(qcbgSJwXpw&YINLv=DMXmkCq0nS_bVF zl1eXosA_{&{I7v|9rER1@ACtN=f}*SwhEkYUH!>v)7!7EkQ*zK?IVG|!@9T5C7Uhw z73tv?zm%EsIFl4oXE&16Q_uj@Wdw`NV|j7Ph_3gm1MZ-FqATRUo_)^`l;*g_#IeS9hjvvQrJQ)SBh#aYlf<%eRzHGAVXICsyCkjo!{08FkJKW z3FJjeI~!(sdoObi7CNzFavcr{eWZeeRiva{z2)CE(^+^rYjQ6^22u)*16D1&;IAnp z{bn$QG-(BAO2SU>dfsn@aO{eH7=&Y=@}KdYh(FXG(1|OFz0Tmj4=B)$5M3p=v9mO` z_NN&qjRe#_gD~kE`G^iJ_1-LGZU4qGtqIQM!Xt*G{Dl68=R87?WF?il#v862`0UQW zawv6fKGA?!igEsF@hQ#rbE0W62aKE6!lazFy|F!UDWu21| zJYAPVci%;Ej8Vl)3xU%LLM)Ve&B%Vz#%}Tau3VbNaReb4tIboMoL*KH#9YI-s)x6I zI!a6n-&3roB4ge!re|1red|Y{7>Sv{`AdqGV0MaQ-aWVYNfYpPOP?Tyg>g; zHTaW3RDRp=QBdpJG6O3o8yF8RGweKIh?+z=OTC%#GlX`0`7d}8 zhoqbum{|m|z-v-i_gSgeF1O?zp0z7IkemixVg_Zwl-Bu)XPGlcO02gf!T@43jWgQU zzFG-s`;Zb&F0pIHmYfjt##t3|Ui%Vw)A3g{MWvme?uyD?u=^ana1yM-<>sn%(Ebtx z)UmX{Sl@ZFIMCkst#yqT>Mye2nxxMMB^K>_t_M>MDF{Z>g(xqbz;7vA8L_RAgy@Yv zoIC6(1L&r>1qwTvXBQgQjbAv&JNJ7_~UEUry1bA)av z0IGl=btR9Dy9++F9eRIw1I`TpK&TixcConGA|UN5k1z_Fgx@P$8@vu?Q9&TecROPm zjNgAipQWP*9%sxA)k!@iJ)lmyBF8&q!^C#(?^=Hh?Jo8BBLGER0Lt+8O-o0}2NFQ} zXnpG|R6d@f`f>dOWAcqI!%V2lun=>%Sa|IFjBv#hO{b`h_#uhnk<>(Pyo$XOX{L}0 z>rQKbqrEKMqL;J);KvQDGw_TwR!;EgR6WCKT6o4p>_tZt`oOzba1@BJmNjWG_`7jQ zPRA&^0e6wok>%X`9=J@)y+Mw_K#)uM%{JgA58%1)mixe#0seCffS=ra@N<5QF&9{C zlu^N4gvB&S*NVrX*@PJ?r%y#UY@@u3oc98o9vdt+?v&Tt{>z3Daoz7+Ds zV8QH7u+ew7sIs_gLVS2I@hR%k>B-0?B=>metv?ZzaRUQcQ3RdziBNyYHjXp#8*xD< zB-5RAoiux3#qg$o{DJ{|Ol5cy{A$-{=bI%gL5K(nj0q&{s$cSN0BLuFOjtkG%H9QW z=q1NFE{5u+6I{?jk&j7|Vju?{36$zT3qG!=gm~^8YNRkBs*9cR>R)To|T{0us)+EB{ z@ypk+hqytBCt1z(*aZYZX_)oW4f|iwKRMIF#ccZYr5wM%_&Jv`lTNvaeVvhIKUjTv zPb8s`_;f;VZVd)koCzM!7|FR|0W5AG#w~Z6**zE%Kcr%@+xu2q}1h9EIQbfQTgd|^ORxb<7NnR*1^AkL-H%_~?F4FBFp7|U zG@lQ3GYqv|vx{lK-7pk1D)Y@JRV;ZGffk>W5}-|gH{8N;mHh>t*5v>^-+c%xBrn^w zLe@;qSSHaiwr&sJ2T{5njK1Dw)lb0R1Ph>eUBJ^UV>`*ZAXfcb0DfD zI=|HcK2re}WZfK=vZWx521K6-ddfM;Y}sGHeC2l(VlJplWNQ7H;y|G4rC?JPi(uhn z3hfFQB9W-Ttt#%_IB<8!z1VGCtt)Epn$3oO#q>9UFCB%Zp5ZK@TAwLsQ}fcIR8d7~ zAyCq;yA?w1OdTV2Ps5jnDr9$gfl_%rrc!-7NP{=S+8A0bK@~0>?K}nR8#>oKeo?Vk zvL`-M4zI$k(v`ITEo-r_>t6HNuDJ~zcEQbKB?0<7aq2dpv6&M9Z&<8)y+3&FJwSC4 z!0S#dQCPiKGd}0v4}$j@osR*tFo3}*?D$hKkKJ!4uoqrvCkj3&#%v9S7IAi~0PfaJ zt0Y^191XEl;ny`)LDz}}V2d>Dd*3-S3Kn`uHkI?GOe*^wr5&-Nva-@WY|A(kgoReC zGJkdssnlkNZeAAk4y`pjW~Gi!koI{A%BfqeYbE(bQ7Px{XifIEXg-=wS{H6Hcl$Mg z20v%8S!$tz%F$eHnoGz%{;zid+=Q4+f0h`5$PR+b-V7men@#81r5v`zP*%9+Y^Tv{ zYi)1$l}NxknHovh_-93S+Q>|vCa0vZ+v=hWZs!Lfgbbj_efGec40e~`X&-d2w(g1= z7h9+y!keOc(AVqEs|5Z4|7=XJwTHl%eoXgnz2$*1r3wgAnqX__0-F;_#BtFA_4>bL zcxUh|XySq3%l)m7o~#ZEzIxTXLSRk<30965n&U45TuvvKKrCfbFvmRZ1*vXqMoNPD zIs-SkqQyOgycXitH=q9TzSOc9?jGf*Sc6Dx8a1;_nXC}=_k8Qh_T4qMAK>*@Zz^8t zbAy*@+{&582^IpPVfyhZas%`!BPR+&0NrZED4TPiClSD^w{t!i0?yYgLD7fOEI7W> z5qOu#SzHbFEo_v3hdI=OrK6Bb?a@L&$HG+wP&a*q7UUqz&fP*UIsnlE7#7cAktrf* zkFFF$#$;9gZt0aa#C_S9{Q-?K!=~e)Gcslcsieyxn$=GO%<*N@r>U`?1w%J0bLgf} zEzmP|0~~+Op8?0~!VeZ3#-I&I5Hm8XaJcMlh|cX`X6sDa%ZPODvsHR;T4f5YsID`b zj=ryOAIb1;%?vT``xVtH4G3Mq#AlTW=u%a54(4QkWoa(NkOwt>fH0(25YP7^m5B#r zH2)Jrq)6v?aNn1j0yu`X7GD!|biy{RsBv?S}_&6;TlmD-~=NJOq z{4a>ms~&l!4Q&hz+kj#jEE?EmAH923jyJ7Iy7nZ1E1%7@krPjX!K_3wo%KSHFBZ&> zZC`bW1~c}caXqQ+_ULX0=)ySr6#*N79Ziybl=Z5e@Z1-WI$(d!-_FO&^=|7f?5e$o zxw=slHZ5vjlMFBqC$YOa8&pavbtUCCJCQG8mlcR&c*&H#bFwuzO-?0VeTx3rejhPh zIk{l_#i9-MO?w(ZX+~skv~}zN$;W#-8z%AnJU2cYH0zF2w*AJka=m*J(H17sjHC)@ zz{5Zh)v?tjc#&H1(XrC+?|L51MBXj@TH-h7Z@!@PEMwu9;w04mV1)kE=5)shM#GB#oK!2C%I)Q>W}^ z9Z;#%Sr!_&3dgouow~8iXPA}TipW_4>t=xxtfbLm;?BgevEyR!P=3P-lC?@t3Fx-O zo?iT}z;<^hHxk4k6%F7>x_9Y9ShknOxWUG1wY8KEE9lqAR{K>vUeoIh#eD@YG6Umt zF?77Sn1XW&N-=y;ACsRdhd`n0d<@Y~N*ooK}4ywtTq=3OUEk z+6bnF_E&4cXo-CtMcV>)U#r#Bu!(OlKQdM@7ZA=Dx~)*J`%V@k9-&^326OK-g74Wv z247_FW`eNwPEs~Ec`caQ9N9jhg$4~)D7DoM;oZCmEz7lC2Z8olR`r!0dh$NX5Py*1 z`t5r&OPu9i>_h0ZUI#Za>n_@CpZ39m{;_VX(j_nU^{9k29CP1_QH)!E5qAasyM^+e zf^F)8>N}O*Ugo_`0Tzqe`PldU1wON*8d{UuWA=R_T_CLy2eCt*X}{PO+S-pk3$l-+ zLcvpoq`JHeX0|6~7aPs(ub2)qb49J+s^|6-+qH^YxN86myA}v!xjB`Un|BJN9B6i} z9{nOYha_a~fHDTeoY6q;9L{?n*JsWDB>pf-><3p@wAc{al)qmf*q-PWi;4qyy7alv z273L8o_3hwWiVJCnUce(ZS!1S7c>k_|Mb0Ab$uIPNKT~+paXBRUf9-QQu+)=&EUDY zbt$%gTO@`GhlnsJ7KtU*vcI+7Y<-?p1m@=k`{^V5R1QEbd`(9&#@c(eA$9rtRfE zbE5+4c;HQibq+fhaKES$91ij1S7~<>Xb@fVTFo8;51F%B)Rdvf;RJ5tW~QP}`wQCE zetIi98%%o>xIh~k(UX=3ypa!*0jP3%QqA8A`u1oi-Z>U@hku^WOR*KPptl5UTquEs z6#6{~&XDu)awts)h%4&9sZ#X2#|K1?(=5ekzr^x?QF`@SGrj30LNhov`=IKtb(2My zfj658JNTsyFvV<<&tfeDW*F52cXa8ljKcL=+nOumAsh*-Ti$#6DU{~lZU%>D4Av+= zJ}{`Q2$D^ZJFNP~JKfs}waE!~?QUef;H?mw143+|*uU9(2opzZ&JTSAjl(-Ma=J$K zPY#UjWo-iF#i8!l;lN`uG+Of4DJ!Rin>>SysLWyA5MtKftI(NcE(uSC00# zW9l$jMWRkCqSzm%AIc2BoDfYc=I`i6`y-W5DFvgG!8qu0vU(di@iSdz}e8+C2V=#{j1wDQ5>#`$c}C zIA-Qo=}nVbKRpgK=kDro=%fs+%ape_vCpf-ywOAZ&Chj4_dIHvL5f<0g4us}>7N3bgs%nf zeCJ6OX?9~e?a=)tBq+n`LN9s3voltLqOzt{y7oa%;O*}R=v3BqaNUrQ2v!2Ge!>3xT(95DZ2QxDA&kTBVScU?WyQ$a*^ zCGmg_e_^mI5X3{Xo7?tLK-oiU^Jn%ke-9V+Utpra8K+LSS#DD3e|&4b1n2&+D7ow; z@X29AeTi6Lec-mL@#dfj^0ZgY`0~Z|X?23e$PW?N@4=c7XH5b2Sp#}-M5EjbGGGAT z3S4*I?y(EQ*T4MS__UbC!=`QUj=X|sNP=4WR51^eA_2V@IsYfa4x5dy9 zHS~#FIy#hos$lp>C)-Jji9%Wf$gvwjtICfh0nO;cJsmXuMc7ld(RCYfu#ekhAlAj~=o! z-L`M@LczEk_+K)5u?d_L&~)hUrk9amSV#gGrj@H1A2b3a2x^12NJ}`xL8yUq*M!Up zy;>GMXa>QnEi05JK%g_h)p_-Kru9v+9y!lnpJsmcvaC5qh(k-r+YrM3rq-!?4xPDt zXgL6S5rY&28x@ho7GP#g7gT(;cM3j?WI;&?bIlI4^I^^av|=R`P}nZ2(er;;d+&Iv z-|&CDL{>&wl|n-{rLw}IG*FI}$gGTv2u0T6=v_(~nU!(8i%^Orl8lDE3T1}uy~n}9 z@463K@A^DGpU3z2kH^b7uk*U^`?|0Byszte-HJrSRuGd%{V$?~Kq`j}^sM~7BEZ~c zZsJe@_;3c?^ytc4ai|uh8sfZr?B;W5zAUS`u>&XIG-qlEvgfpd?}|gA>*H;$=N1hZ zW*n@(odf;|tCpw(Y^{!MEr`O)LNyF`+@3T2C_@K5mdaJqTEM9D% zNe6x>oN~A1h9rrrS6F9YYfrMmZ=aprlE6Y?hVmw_i_bykkT^`rhZK|#d|gU&4D(3 zaj7hF&JH}?;-9m7$dlp_ZaiXn`Op?j(ikL~02d^}Jhkp0-@7s1^sLou=0Vg83vKWd zc#h6Yy);D}S~%U_15gUE0U7!25?KcUTM!470XgyLUKSXCFKT=Q*B+2-=5Z)IL&4q9 zpV15@va!c_4t4ZsIa3Zmlw0NRmNgBj;9noupzPrD0g&1gz2nc>Q%$Jk$WKZg+JK!$ zIr5GD#b3~HhOqQYRC?U-dwzb%G4sBd1YNgiHo`y>>ug-cKh!#`ssqH9=c5u-#n7$` z1_8PYzK`Fhu-9k&x#JvO?1h!{ynvOPKmI_qDSl_FY4owV(&PEwh=Pf*a`HVYsPB}v ztrI+)7m`okDA_n6MB5ZxU}*ew3#FCqqLg}WaWM1(LbPY$ceB?;?eN6cTeg_j)L6&p-!j{bx>KVhIs*6RkFYI3u3T0 zAOS0dCntdB)+{?CfGsE+&_L$ug%U^Iw?gx7^bt-#Vez;Y{3aFI`1Duz=Iu$l+e>uN z78#|6VurxKujW?UTNpKz_Ug7y-@OBUY`V2@wVFs;by;Ah6wMy^aK8^z)D_+Q0rUjP4I=%BiVd z2t-5(JPC*FdQPBI;4X;F?lX_0i65dEzS81j+N1uNf$4j;Jy4!Tmo*`G#DVmxD0g0H z{zd-9G>_UXo{efHYZ2Ab;ZW%U{SHoG;4Ku8W{K|{d2oApD6Vg*Xwf}%?#Edro~_9!U)rP=X(JPv??x%hE1s7-G$JvCj_v*(<(+e|T& zUARSby}?`=O1nh zM`(yVc~q+04?>KN6ioLX5r&8t`KLr9<48zF-PXQlrIw6lxBPA-YboG(25)tq0=hcE zPT3YlWg{+xyiE6{yiA3>l)Ud*^Woj;ayxDTT3jl$>h8Y<3DJ8^-BIWTqT@xox`29@cKt4j zPRM)I&XIOgS_Q|i?wE}JN>INjp?9V49R)9Kr2UsmE`yxSRVf*R`h+|Ct#yhVD`l&9 zM zVSo3nGpOp?)DlivZi}Y5j^g(4ULG@pf9zF`B<#AiNB%s;dsEn*Ja6cFPv0}J0k~?X z+$L|c7ZA~=ftHD4WV!~7!3cg^;+m^!p`bjr;!BM^`~VBfze;y0Y53Iy_W_ynGA!_T zkUg=FU-ut>?RuTDVI-_Pptx!==iJ9jyNF_WqqU10HP?V8H1=vwUfdJAmWButq1v+J zN-F90F!uBa5}*{`JYr5Zl$A}$ZQ}0XOr?UUfteb`qqaq@NF;_ncn85=WC9t*Y9q2y z-yKT|$ZWan>|84F{%BF)wnMSW!wJw~t90~SVaJD?ES8;OX7ZiY=L(oGa;vjn8rpg8 zIC4AiRPI8#xP4o%E1MZ=)Pu~`fa`*^9&Y+<@8BRq!6Ofc<9;UsxGmi8Ye3I~BmC^h zcrc%5ZY4J6-I=@EUuawsejt`XsI?aUJruOm&ZIGOImyc>cFZ0p>qaS+8@6l?#eqRM zYEjnDc(;81Onw!x$_m=t?_*7HiM9{@Fc871lnhE)K>0I9UGS1 zp>*VoecjFOJ*v?*{hvITs3*3gxuiNR#LJqqp!Kq#MR+DRph4v(k5n0NZZ7=g_5B z1%14-oH1h5Q-i@fvVGpOyxMa}h+BXFxgtwxc&>At(52>hlv8@-V%sg#wqC6X!BWJx zt0*q4uN(W&KK5})ew7|7 zN8HVm2Tfi+PqvFes^1>m;I!K?HRe-_M#N3*hm38knV8)xbnY zBaqIaTtejG+jt8lzVm`Se>~bn!bfkz&CK8Dm6IclhbmT8Zx|XbQ&gEN#fPTw<7oM% zcYOkA6<4cTYEK#c zdwQUFnL3RR?DwDt@N0Or+qpeA#4KpaXJ2Wr#pODCw7zHHe0h(kzxhB&j zpa9Lr^(O8u@?TK%i^VVDnYifS@KHsz-Rw(;hS2LqOt_nALUy#YyH>cj7ae-vKRLZe zzPwQ2H->nfKZ7&!(HIdKOy+44JN15<|7|=$To}0RAKxbI-t(&0^X?XD2PIdgtqy{t zH^+MSyOTz$Sw8AF`attMlI1tQ$)hJ1orx)1WG*SZzPgYCMFzSv+YV`;y3oDfrcOZI zs_gE_O?QvC*k@(l0+EZmL$Suw!Ilo`G$%Q_00mEIZ?;*7ef{jb2?y z&N#&=9YXAQKUzLHDp%NYeHWqss_G&xm`-gbNIMn#UM%ZmRS=OkaVNH&7%}i*Z|ErA zKbi&?)eRj(SO&4V^Lui{Y>S9-ucA(~Ebn3>d{%qQ%zbdVZ^$bg*HM+3q=HkonKT1W zmpLVRDhuxFRMjk&XUHAUQC4jWj}4Ob8&yobRiRzM-P2>gAQoT*Ng$W4xdRKoBzG=U z$llF02=mOP`q-!QHkt8Zo<4~#X5N7>r3qX;SKo!xH|HY1l7}Ca; zZgcum%Uwh|XI<1(3aF*up1oDQn6Kb~`yj@rYhzD3%Oj1MZ7n47Sg7~2cas#!5@~kG zI&31%YUbla?jnPZ@TJ-=Fxk#xAmg7qdHTgv^jPnwb{|5tS91gIWiE?@>@l3f(?!nB z6Q3sM$46uAVB;UT=P&vtcybfJoib3cJJHh6Lc3r7a?;{ClEE7W34bOyuM3?RY)PKQ z6%%>gLT=hQJ&ENVMXVw+R5&V`6?Iy3W{-T4g--51+~nq&mbo71d7s7C|2~jlA-GRC z4w60>F97)ty{{Nie2J-GGV`)ZrNNyr5mze^L(1EI9L{=o2GRzjOv2F@gmurjA+s0% zxOeB|@YPX8t>~IfIg?`0GK9hMJ;jF%{ElgAl0)$RB<5*IHp~m2Rh)^E&7p+={CNS@ zi1oy=*%}c2g}JaBD((;Fc@xbdjzA${jg0^a6&3m$OT@>#t3VQodUlH_QL}pJR54*ZRVCi&Z`6u%9X)3O# zH|>-kMe&b}1~`OK8!z|4V?_}H;Bbi_`Kx~%K%o)5@Omdri5tt$y0F0{vTD~c33OV! z^pikkK#z_e7ltT#D?hlujO%1h0(21%2Qv;bvaHBgSeh7lc0c|=9Wm5`W$-tWtu>f+ zC)(X=mf<@a$zC4$C&$32N2nkK9mU{943mQ~=8GBt({emK2#5ARp7zVtZODSC+9<+_ zS{R_4P5?#jdnKXLn*YvO7|oec{v;@EJ~Zd$p!bi@h9-dk&6BIW$lrftGl_h#RBf{S zY)kOT;%N7v5RduWoHRK#=AtT0IHOI`@~;zKM-LO;y*mOK4!8;bj^ef!UG?+rEA#bI zSPKrlIL~t$_=FjbNh8hCcD>>Sv`T+8X5U|SZxzLL*gngRcgvB%hMN@5041*V>H@mC zJQwJU6B`fjK0-HK1{x>7Z-tXZo>nh#co`}2+yBfK@URd*2$IH<>RFcO*ui2F8MF*| zEIm9GRh*UIj6(}L20RD(7KlY9!OwTt!5D&?EB%qkQ2GIx7)xF-x`!uYReQ*?#a-S$ zRCfzal96YQuxq}U-B1UD8i2M1A9i;lH$Yoj@ba!K(?=a0B$SfFBJ$UPC%m9j178>t zi>0{~?SdySf6@lz2)H$Z8j(Q*hqhot2A^xNarQ{l;~Yb~6YM+($~Cz}hhgKNM1 z_9pbMc@sxH~$xEoQ=nj;6mRGasvoaz&8 z2~>m~+!Uw_JsyyU^dWx3^Ln=Bt^W^?czM8+8v<7IF7GeA52Qe#SoAo#F(LW0pXpo$ zL0~kwGEpJM06}|88Cbt=-O38W5JO9^8bBp;=t=kKKxwGFU-zAQcyv_0+zhw_QutgL zh1t=#D(L)=($oosr~jES`V3+g4&kpisd$(55B>;D+KY@_Bcm9;#XO{=g>yI3R_Bhwgd&xbwFwsT~mV zSsYYUTwVvyF5r%}?~Z<-3H}kNy8UryP@k?C5h%R6a8Lp*C=E{0;?o^c0k&J25_u57q!p_DFeqMLIq={~hI$IP^P?KVBom9%|2AXFNDjck#8c zNuZMa8RXcO6*lSu4$2NH2+JxRr8~8S0Tm&i8p~)AMqr#cxYQ{@$kpz0`o|Mft}c;%?dd*@Nm38Xy_{Y zZSn6`?pN4_jLK3!tB(j^&+rRkKoh;N9%M!2wha>YAH@6V3TpmDb!RsSl%V8TP-xv? zx_jT;)jGFwKhFs;EBm%}A+s{b0a7@3q8?eZ7$~z1_UGzH?6@+GU#_lzSy3H6cm%)1 z3_Tlx99vne1Q7^F=1@~qJhH~gSK@Q;W6a^=njT$g<3Vbjvm zA>YSdW%Ar{hVO#14>quBshQVZphf0#16~mN(G{WpGnK^v}@kNR%TP*Dj2DU6#s<<7# z+v}ba<{7hDvZCvTmGT`dW*XH8&OW?B_54<}Z?t#3H^2A9qkX*|&ff^MIbwF$F|{Dc z;yE`Aw@YyGaq;n}%*JB#Xoh<$>suk)8kdqo&R?0E3)IoM!}10-Qc%j(KiUo_<~*&pR!w*3>~@6KQ3`qKtMJ(L#G(~< z`9H%kQ{ii_Anv$FNdC?U(E)ca|ZJ9MJuq=>*M z7X-zTQ0CCVC_<7P=Dn|Z~Ee+o{J|`#;y5o z<46n53q3KOgZgGAH;s3(%~=xbGfF~Oa*qp6Rgb)|3%$Sh@|n-A)N4mbvTVg?38NOP zP3<>g=y`6vC+e-z+fqFKGX)brLYf?8@M@x(gp`^ub?k0Oa?n$HQ>2_8>sA`|JKT$fv< zsjSqxBRsXq^XG*J=AR)6dkHhP|3V`(sYsEY-a^{;+cEKbfEp%YA~#3FPZSu*;HDx| zJKu>#+|HihnX~t_O=fcJq;pt&?5dS(kZs|y4rBe$KzgJ!E_g;GxEFf3)#BK6KfM%#U3Dskrx2QL@vedonz@iqt^+kUKXw10&O8Jg0Ndp)FiFAGaAd^;Ep`gIKWd z{65lveq7gaL*2=OkMUP<(Y~h7D~Zb-@Ml7hnT5aeVtPz`{oY4K@H$}eMb**N1~ZZ# zZKu4yu`TzLheUMAWr`W9bexWgdZ;*LeA2VeBA(+#_gk?nzo;F=dJUBdmK%BToA+BQ z&tLb8J^j)u)xP~meTuDN3LwGTn-c?Ssq3#qT~D-(4caHJr)$f0lD+QQNp zTrrp0^oXNiSR{9@DO0=~QJPJ)BEUG+r&^8_>C4+)C|3WzmkXzsA2i+`KJe`l6DIy_ z@yw{|)Wz2vM{;ZO;y*vpDH5ub73Tbs?AYKwNIEk?ui46ib3MfT3omZ%7!7}&Vnqy8 zl*KsLeT9X5X6@@vIi!`^9!}AAkptsnB2Yi7y4wELEyAIckO5+xmsAr&kTDR4unV`N z8W&wOtL)?PB$YbRbMHyQ>9A+Pp;wptePsjxDMk{yq<>%x ztfHb?T2^dfsdq0?SHs9w-sD*Ve}>NFHtNahLrZA?|4L*0Dma%m78r@LXqqQCxAfZ{8 zg9SEG7IfR(zOt1i(bTyE5>EcD7Dol#xJapub<*C1t#Jb`(3Cj%%1-@{)kHDO9px53 zmM_>{R`o6Bq+fNDfJNZ^D@uXCaa9ew^%)C{B{sSB66+mH!sv5t#HXsR4iwI3X3Lj_3Kh*i z={qs+Fd03$hm_>!(3vL|uGV!9Pvc%%JMUR@R;XK3Wv*;^;tvT~=_@RHedAEprfZrWc7g4ui$8Ht>akrQ5X zjx7n9s5PvKs#hML{&CYEf#ZtPux!NfC<6tlDZ9S3``J#aQp{JCL&?bFat z$&7be*vn2FH%D&}At5MDFRy-Zpfc4;XwmMs zP`$!TM@5ofG$9SUR8st2ae0ovkq*L`1hh*e*MW__A18}q%`5KB+GDnxEK-t6so~WE^1==Xq z(_VAq2d7unBDXaN7N|01f|5wS-~96xPa8!&m#)#r)-ZgR_*fjD+1sXjmc2W_4`)jc!@cs@T7kMGEq&S=4Z{uTIiOcL@$iF}O&!OV zKn>rfoCGF0f+FgrjsO0OWdYNm?Qk{8?3Sl4vX769=-LCr-ENK7`(-$~j{EViT((xA zgq7vt{Lyey4(w>S^JuuIM-#x4XUzg%J71pSJZ9z2-$qq8rO;s#ZgiH@l-al#hoix% zu$@_Pt((|WU>py*pO*Ct6<;GN4sYv&Rp;*lDn6f-8vFrY{kn0!26+{0N~a86kNMah zjZ^k>|8!-%TDF-Kvi8slEnaOmv50Ofxh6&XeXd?%u&mSWtO%s05X+l)Y0bJp2OYQW z&@vOXO}DE3gz){cYxuJqDRX(^`Xkj(#2CYjyURtLjx?Zl&WKuEG<8w&S1wwrEd}Q2 zQxh$a=m>RFUUK8{v&)72y*AtH+~q3nQiq@<-@ArGRd667jn zYRe=f{Up#a6Ink;#~J>G`BqVEq8f8CaXD|XgV>vL{4F+s^DWj<+{j01Whr@y3i9Ku z@wGfZ_{qz0wRd!6ga*Q@Xfb^VRXJ+PpGHM3i5c zkA8I&b(qgaJ6vDLw{k2cMlZ&37mK}pFgFaE}*o#nqg`sa~S_+sYr#sbxRRO5$^#v9sv2rTT#pmMCPQvUvv0lJjPh(K80p$7&8&EGv?r8Q8ZTah>D91KjY{&Dy#kzdb zf{H`(m%@}ycjI*pyx;$LyacQ!6|Y3r3-8csUO8HB2Ce{86|e5Z8M<=(^YcQ;(*?GA zN*z}3O}Nf!hdW&qK^Pn4Dp|rl)N3eg%e8zr-zoTRlJCPREGaa%pjCLmD%STX-3Nl+ z0qZNE`BnMcZ*%|gZxUsbyGi{sE$7~*>{AWAJ{Zg~_5~R+ktoWQ8S#XBMU00S)PCFe zT`ee>1IvkL1tM6AH3Ejq|I(fYhRRzMUA+=)omx}swAHUQ{yi*FK2*;-RW96D)Y?qZSzb)v5TUm>ikk?3wg`H`gq}~5l z*JwmN?+JC-pbVG!o0&xC)8#&LiwVNBmvN_MXjhi2@Yw6rct}lu%8JedyK}-TCjJ7u z4Vg4HY^@8CchE8^!4Zo$nWTRC<3#a0w=T_fL^rRLI_$!MExQc;iKJ5H@n{0XbolWB%XKS6CR6&S zKVG3;wM@daxYWMY{>#h-Y0b&q0`<>SWmbNqejB)r?Obv-l2JJOneLv7EJC)B$g9vA zY+PmVR~V9qnF1%9V$=9<#AsLixvGW(HDHC#f)(mIxMGED*hbDpd+%Qv%gc*K5ewtN z((nc#KiySiK5WeeySfnJczA_Ne^)wq3OeFsp1Ac$^^1U_wrlis{CVU&XSkmyfdW^q z<=uem`)dqC4GQzV;gad)_hZvhQt!>s;?gKz}X>>286=aK||Z795!jh#u(6{V~6fp ze^-Jlj0E?QKchU7H%uKyoiS`hiP;+QW#Qk-O?J3hKS@m7+rXvmQ&>+=l*0;~wYtB8 z${*%e_^7qsN#+F7F=MR21z0IEdddaXyJNj@{NH>9W|~I|+qiVi>2aHM6ncmrBdp zhwpsrv)K+OBR-F8gIT{o)skTI%i|A%mc!m>Utz>Ow9FIQ$Foo9qZ^zlUtydJ@4P_d zu|*3C+u8kB8KSwSu#H=n>(Y6SUZ)OwOEpSN+#M;kgqD~)1DUl8Ri@pBW`LT-s)P#q zS1K-TRyPH_@jdM2lT)P+sK!kTCW=#SdN*|Q{i|dU6F44ng?D?}TN2N~C}k~RC~b-| zrh}gi?<5N=V($!}-HgJoE8FwtGx?Gt(ZNQMJ`Xb<8y6R+nSJDhfPlcAv9S}H8XDUo zP)r>r;v!jA?p=e$E@dA5&v@jo=)ww;39wwaq2%twPfTAgAF9f!JpgtC!b5?X%L`j@ zn4y?8XWNs_8mCe#aZk5|?1Us>fSylLVCF}nj&EGNrv1d|z59Z`hDOD>F?Ah)4r?*H zS7E4efndgje>8cF1)Y^5g((}|aqT!c~cK^UjYSv&{Y$lZY-aS53iFr5f z$Z301?=JUFs}yv4PkGd925)5i&*-$+HKWDwpTJ7&rQJI>c`~Mmo92tH@x8i}w8g}% z$k%u+YlLzWq4A%RJAR|#YYGdtk!*N6i@c2)w{ZG+_iz9@_j1SWIR3~_ULrYrm+9%U`354i9|1U(T7_P-6e!52EuE{3V6If9-n9v^F_rU2$4(T7^ zyL*L1vYBZWhg&L+ZV?fgl8<5DXTX9)A@88cr*|{ro?q7KJtsNqT_Alcz1;t0gjD

zJ^I20+ibWo7DkDgqX^>WM%ZQ4q}ih;gk2iLewq`4^DH&&T>DhKeW;d07yG)*(NDI*nKkzTXycs+CPDw7?C0zu-$N> zjr3JO`zmV0^egMh0AsoV(JZ()nhQ9us!Du(QC6k2r0l*$^O^}4`kiSJ!B8g zPo#|gpN~zJ)zsF4(c0-T&fv|436k=OD*U_Y772p zyX}idiyK{}?snpQct|1)`W#xFl+!Y;i*iwydW zzW9#0Qr8CnChT!n=v3g`sm~F!oqcls=ZJcooh5i<(WtUQbh@Nz)^EJ($ypNb?#X%^ z67P|5F>%}G$jmSD@tPPpcxTn$Pmlhrt(VW8(9u%EqJQiW4)GCzuG-fZj`liy*rPnD zdEgo&&iAv}joe(!=xzE~qxrS=dnpKQtTxEjQL!B}sC#48N$29$q1rXxQeN<)MMQS- zp~a3e zU#ym&;ozcXt^tK>VUICNVOF7bA=!IAtIc?PDR3@)_EYXGg{wuYCwIj>kfY;GL&$F~ z>QDdjV9?p&wRP?)Hj4dDQL%27EE|H$2EQHR3cg0)^(c@AR6-8ZD1w7PYdVm?4HHM z+aGCV;fD2raf(Fef!eo8$f{+4hwIW`TEFB&{4_DRk9;%5F6IvEFiK24w{W+y`w2~R z3PO-n9r7ILb_Kpl(K~szsFj*dCw#Y&RMB|I?knOLnnPk5kW#{b1mrNku7Ba>y%@g5 zq|6OqMb(dkOUj{TSFHnn<5h4;&-C#2eFtBE_vTvfD}3bEO}DK@*vn1J!L4WB%=Ah& zlUSY4oNfK0Q>ScYv7S4MU92mISC6>Kub*a_t68-f) zXQCg}9<)>4iy8S6{sMVjGjyQHPx(7!LOf9t_kJl|#t?#~%Txj=w0R{24u4j3B7WBS+zst1Jcl0b>P9iy1Ykl{k{#>*vP=jNH_%kCDNTBd6_XXs zEhn&SzdZe<Eq&nCB_d7mkrV zbjpKhy{Y^4<}7!FODaqf+>Q#BzKN ze+{XXlz48VkWGc#UD!rVavSOnPveai>ALOqIBPb0mj3-2{PHG2n&%8&KPcaW%RAb4 zDd6R4MF9`)mLt3i0p&5`v6&uH-xE%L=OyMn_!RjR8%yBa8xZffeg;-f9`9C43Qvl7 z|IXZchXeY>HD;4DFQQ#_y9HdIIwkKLUo$N%jgl~1AHn8I?!Pr|00E>$ZZ*_xE5rmM z8PX(JBZlh*@r{cJM19479~r&{^zICPHzvi#<)YgTVj}kR@SE9pCOe3hPN!W%Saj>Q zbT-FbfSb$_J5L(jh2ce<<6(H`Ez+nFTx&WEpKZ&rF0 z5aDJ@*xby71q;=4>lJvE$YPt6g2Xo280ej|%>wbs8}OT3uUXkg2FJv=^;n!na2lls zAc8zobeG``@n-?dNWAMtNMDX|{cxz@VWvX_cxUwbJIozaZ98glJQ?M^0%T2wn%#reHc( zeDPrX%8&Xo}PB_f$!d4z>NqWX0-LWLlRM>^_yLYdYC>lkn{kLLju zBq2tiEk-mY?|1L&5x76E@&qIWznk`=C)cCq2hTuRu7k~GJ0w5P4aUnVx~?aa7#%k13;<*|jM+@<&TTeqL{M`|Z9z!%viXpiSH0z_U~ zSaSS@-@Fu#;1lG4;ndxvA2<`z(*4~>Y4vv7>6~`e-arQo;9SY&@YcmbS!+jYao>1f zKfIcQ!)L=PGpc-hfUP2t7{1&<(mqO7bBk;zJ+cLrlm+dj{|52cH7c5OjOP z8>CR9=WqkePy@ksD%r~Vf1wj3*HAqm=A~}DN+5wV@YU&MXDW{4CY`&(n1&tx^<1-$ zlE*kQX}*UMhsbTs2M)RM0+ei|%N=yIHiFcEan-jRMn&v0)Ip;J$AjYull+5F%9%nB zK=l+??809-1nTlBAHcC4z$>Z<5I-_pj>U=C=qO^DzB-4e)j0;l+DmwJ3D2~ZCYybG zcR1C2@bvhrlIl3Exmb7WFG-<7$=Nqs<9D*bc^FR#nVr5SRA^0T4}_cJOj>*+VO;1S zRK`TAVeEcM<4R|dt6_~;uLMD;na-9_4DgQzAZNR$HedcbgsRU|!X&KE)nw$~^O>*Q z+>{dNb-K>I`$EP}s=bL`@khDbRCXPY4CzYRa38oV+<2@uR-B$gBrJ!+c$*-NFG|H? zzD!mo7ehdqh)=2P#iVpAiNaL!?7&{&Zu#`PQp#O>lAC}s($$5LDpSQ)!_foHE#waL z3iSOz&|znPre~|KLJhYryXr_VH+=;5z>HF6Qp>eb`{@NA?$R9r7&9R+ftLfi?StwW z>t5}}J#&{(QC00s3&sZOh%g04-5=x!=pY>43|@MpwmF0#HhJa z2zut9+IYohx)a9=5}Zx*OG1^+rs|(ui*%VSHgAAl&>hCpn8-^8gOLs0l+q@P9_14O z@(bEJ$$C5Z2v-bF=NzYf?2pAvpCzfk*cwrC*i%|8XK~~lwq&eRsBP}KpOEPMlbYmH zl}#Q_MWy0)3ltjcl7`MNLqZac8g9qR?^VL>ZO#cLTDo22lz!%n-D}w}ac`_- zdf2c4B(Kz*lfak$mqBxtG2P|XT^#;r3k~Z*uNlQ{HSg_Dct^kcgsnlK61ZM~&pxlU z1m}iQ54N3Wn(^{-Nd|oVn=-j*7_*T}H(mDCRR9@-s|JqbOvDP`J+N0q?l!HFm`$^7 zR)aVx-$KdbNq}p0b*N|Vrz;P&f@3qJ%~B)IbezPiNlxXexK0kNuXN~qDQV`Rr7f!! z<`;IPwMuS{onI~Ap2jc{{f>uN`OpKyET>BYo(;_N5gs;(`E=cBC zC85p7F6Z0k-um_t;zE&Rvv|uRHZ1YnxiUAqWB1ng#L8#1Tuyc;5h~-H1{=nPBHk|) zZ4*D&WiwOSA{sFK#7{_UPG6SadNe4`p+V16O{Rhokfy$vA!-Lv@9e>BI4qlr7! zg+aj+s@vVHx91_zK6k)czDZx2x%=vIAXZr1jr1bRu+GM_D1`nghI!`xOCR2ph=m%`TRA!I( z$}YC4?@jE)&y_x0oKF7mJ}9xwgNZTd)9@R+E>#Bi$4N;c!Ie^&-g5OsJho3nO^55b zN|HgQikj5qK;5%92drMzJUc0rliY0bx%>77J1^g@DJ;a;v1Zr8+>YwX+#75=Mg&CP zuBBL@OG(kI%+l==a8;=XZ`cGExN+mtBXr|e2NvDF(NN%!ozpt7rFMIdz?OL>5d?Xh zWrySXB}1;j3?3@o*<^LT|FGr?r&dz>_TtUHw8n?SL5TD>+<0&;eZ=sa!7yS()P^

-mhga9eFsd+P-yjex-9;VmIW!S@Z56 zQ8qhflhuG_aNm5Ta$Zn+q1WxLv_o^f#of6?yxQpTf&zKBVO}hw3hq#-46Z=hqdemn zZ`VssVw%%e8R?~t^B5)m8PABrk$21;e)~>n?w8e z=q8-#4;%aF;hg`%oNnMIcUkHvfvF`(khkxSf00{({=*^VE7mpt`lN-r4R1E#(prqf zO&Q19w{HzzqgC;=hXKt^?dzc&y-}wVi*M54D^nJMW0Vt|G}5PO1Y= zI^7HQ-)8?AT%fE3V2ExhJ__3??{c#ql)GEIvq#|W{K2PW*{gy)6YP=~&mRjWjrenpDbhQ9_9M{OKDlq>jmVU6t~iw@$w{%Zn19Dorl;h{t0e ztG8u7do#7`-fnwMQj-p6xs#3HA>%88(St!kbEVke_z%;c3mmcX+h1CJ7O%GDB-&Zl zru!vGiX~P)KKZ1Rs8u1J!LsNwb@QlcrQH1pWn+?aWRrV;UJ@Q#8lD^&tcIyA>(^=<8b^oG!=4fud$V~7jP1eYb+?j>oCDhzsJ!o zdl)MWEOYe&R~b{f-fm2t`CE3#e=)(S^Us(VhR6IkA1e}pb7xy_f8=fAz(?uGkgENw z9pFz;cn+b;=k$l`Nte#vpSKpn@Q!zv9aCj;^(N3quv`r#F}nACi3@JB@Aorz*4EJ} zS)X0CrcQItDo>=g^qbG+J;B{&QGDH#**o{&YI125sfyEb+w1XVK-%H$;c#9m`KS6B zMq$ai+Yan+{8TnR;V4#eEBW@tPCx90(_8tOzItZ37+sEP=8G2P&Yiv<5*BvfvU?$p zP!=WG(xkIkN9#UYX<_`KQ5I};)v&KMt-CLMD&8v>xkKZkU%)grq=U&2k9W0 zU3EvHa1y)@E9&vnlyX!rj1$P^O$tt69$z$GB-cItgLp>0`~IKUh5Q*63x5~+VA)90 zo6vPlm@HDmInu|iYM)*3uRhA{dD_UsBP4Th-$4SbOf>FaP4xcbZCQRQjK=~&zBn47tE?r64U-Xelewch zy>;K1rDs00myHV>rE04kuNe;vC;dF9>81qfdHp zL~?F{aJ=`k8vPhGnQt2%33>5Se4I2_M3K#JJ4=Y~>AeXUj%bfgD+{c)U<-Kn1K?Pv zHY&}-$*RWinFf?JrF06M|DGuk5opeF5oM`V;2wVYD+{^MjpS+WqEf^s~w-hC>%06w5gtFiNk(k+f{n^K*=z9!~0BpByL zBS`$X{`0eO1|Eko$V+te{PZB-VHRx7;0I5xH`8j;2`7a1T8@Q)fQ(u5PWoZ3&N!Ce z-)}n6e<&^~t)?u?YSJoEKi)qxs*;l+la5gu+C;3paxzEKJG$oR=iHN}Yub7_rm{32 zogi2aH8QwE-t)^h#DVtFyrj<3Q+Fl$c2dgcTh=S&IU-%OelPaZ_&GpM17`3y=x&?i zQZ5`%fulnz(9@c^7i)L*Bwm~{K*g2{3dWF3>2at6vA`<I8KIC( zX=*t9wDEG#kR0|{e{!v{3-C(yMA}3Q@0IM7%oRZ^=b9>6lwyG4xHG2o2X0(LQac>UU1HORN zc$$3GaI)u~@m&kS*jBBxc_-U4H8Vap-e0?p6n<}D=Sbp=ZC24ZmI10PCTVOMee%fZ z46QGb;r|C{L4)Y28CwF2#qaCMPgN})K;Ib+^z*QpyRcZVECPvlRsYrEYVA+xl%y-dxV2doMlsv4?Rm+iRHQ(`xdU0#ZDNeODgbiz+LB@DzQL{%- zvr=5M+Gs_@`?kwj1CRSntFV{@jPBsw-+yBr8K0CSY-GH2y3v}6Sn0+RE5Uhl*Q)2( zvq){-rE8&KJpz%+nI?MslityE|5ofL1N?6wx21{xWCe<`JH&vK7MwzUlryh*+ske^ z&A+RdgsTrcJ&~p6pj*jO#rS5lq*~m03WShnClSc_QY$;N_ugA3-u*7$9^^luh|%T= zZqVUo>!^A38DGHpz(3?!)PbFyr|_DBxfK?H>n~l3S??Y)_^>(p(wW>RN>qmv1L$Tq zO}*2q0`9XptdxDSw<%}dv^XfvJlX)W8n&|eu>C~Kg!QC-LRa3B;hocc3~J6_onF*DGd!@@$X^?@?AiFm z>R!H5s_rOW03QN)Z=U`r>sDbfQ+UC-^vw)?Tkmr}>t}D2{Ch8lgoK6_1i`W5!GgtM zx0&uiXH^#$7uk70G(t*e4bKn7=Rh;}FHiN4Hg6eyfJ{T#__w=@MNx~cc}@QF~sHR3Mae_N~EknQg0{(q{2 zCVToIRQ44Uhi2HA4ITW#P2RN+A2}F>S3#Twknav{y;S@$p zTbl0|q~|A{reH#K#pGVLb;Fh_J;nol#I$vG>pTh|W)2H8Dx$=2NIY?pxKO1#^k$yj z@_FG<`u%LD!PA+&Uk;RK9IO{?Nd|^yq%=?LZWx$0q{^1_Rz$N+Tc3tkH%@r&3%1yuRB*_tpcQMyk%O~I+Mwe zq08Pyy@xgj1?ea+;p1=s&%%PjOTpzbnPkl3jTu7uGbXFWg2&kTvm0hS+QSL@Nvya% zH%U38rIjZ_+ZJR!vvidUjE`^6wIhu=-U@vuw(CxdGc!64O*4#oU6oc}p?UiBuF`O^ z(EU$ziVGO}%Z*#Rjt<%i^u>2Cwaody)Rp~IDnp#dsd_5nl>Iz$ia4*JwHgEIALmJc_rVxtU>SsUBi@S6Pv%FSP zEd`aCdS_`#8}>)qwRblO>v+$N-&I;@xt&WI)K*?P0N?sy^nXraQN}jKRn=gbHvCfX z^?xbJge<4->3%{@&%w3wRP|zzU4H)D>MS~(-~=BHeFXi5yh*glJmmFz*6h}^ezV%{ z{q@V58b(|<1gU4b?SLyJugm9;J5oQqK7(H)oQjm8JfJxr3mF?oyuc9yo3uLSM$g^L zl^Pg}nY6Q-Of-Ic^N6+YlJ1r9JVwenF0n&G#(I#_*_Cs@##Fmsh z+D~*&NZ2;q`Nk1kG|ZVx zYC0P?a!a{m+Rqqg`&^TlzjJJ^;I}cC`1E}bM{Hhv%-q(h-iy68^F3*AN4ruiASuNX z5>k?=1G55_fZRMaJlF zPr@5NxITV?6dA!AmM5n1entXUQNBU7H9X;)J13^w{3h>+YR$zQKZ4_n4;zSxa~U6! z%kQktZ)+j4u7&&)reH?HfaBs?2kaQ#zR=)ic}2b^Q?g6U@s?jk=Foy7kv_uMt#eai zQo=rOg2XX1vuiJcT|y2NVLY`sbQm_d6J{O>M-v)3*Of61NZ&y||A;AZxQubB6!Ee49l%{wLW2Y! z)pvBt&Jxx{6sj?9my%Ci!bK@H(I1dj1z4J1)M2w>CMUqd6r48W;e zV{>PUlM#`#sskcXio->HbhP>4Peg8x0wS-Z!YD`~A|J(QsKPlC*J=uaZ+x<)z_0uG zgV0{v^46$MUsv3A75Het2t%$P%R7O<0ZVZ*I1tl)6m`1E69SGmDt2`=@{WFE--%S_ zDvEDVvnOjXfA|7q1k9q7<=g;ERHO)B{r8W8H-sZByAA4uwb9|aVUMgD${4)DgJ`M! zCt6M;TFyO+BzMN*i3D2uyl6>)RCz#e^5U1!8${+6FaD>iA|7z)*YV$1h7|H$hHhJe zox(JBM2FW`Luuedx1LIIT`L{VFF0C2p<`5@-bc zMd3Uq}WQ1wA=eA-GG%unMk&4tGYmg?AgeoF~EX(9{)iqflSE3GfFA4Xvu z6BQf=`jpBZt_0jAnwy-bpA6Xe72f`47g|?`%AmdE0|TW)08*Ww*zpv`@1X&ZDk>+I z_rHW)Cbk6S6%)%f0+qrS4qOTrJ&G9U78yhMoGM@XesYhQJTLP~858Bj`sjd6}CYQ`bhd?l0 zVx)!Jjv@})>O@CQdn1s~R?GiD&L_^mt;_Ps!+Zg)>uYWr)UCaPBqJ^2?Cs5eOGBYK zPXh{QO{LdnA%{v8G_)bURXEnj>CMR;~cmC5|m z29f(4so8rvP)&FR@=@rp#u{3G=3U?r4%o|HiU;LdrVNmB1kutX4xp}iM3e&J#ykro zpZF#4?pOKjLMt9~e8`FfP{AIOQH%`cPgsL|5;j-*; z8SdzXuJ}(!MyikdAuejn<3kxm>Z{Pu|Nd!c8MLv>MSwi&NLo3TGM;Fjf#!QV$Y}*# z%>T^2t$2_ZIfa)}aZu>9-&sn*N}``<|K^OKzR3vHjI{(_!^zHgZnXvra-mJkZVC(I zD~GGDVItEXY9|@;M}$>|_}$_wzTR045pA$=o-A+udn=HwQ078%7(}xhLvsYfJi&S! z7sF1T!Z%bTv~-pkgSJC3I_FW`pC<>(>^e-3e($=5%LBGh0(Gh(|7h;4H`t|O%U;2M z)4nij=5}UkI=2MJxn9jSEe$K*Uf`*puB|e6f@xRiCUGJ@)?=v-nr=tnY(Z3I*kz7H zO~I3ob;5(H`ZS-WEeLE>~?7nu=V)pLPbt5P5#p^mVj;~qHE>mQIqah;Kww}Zh z4+RFYws{8`b1tuDZ#4irp#(u+9C!7>zp)ea@@DGcPu+GNV*f4i(qi)9a!)TfQST)7>zpvBRSCZoFwN z93_0cz5{XBM+6h6`#@NoggHePTAFw;v)=|Jt-v6DLIs7dJyc8oqa9b&wK#~F_!{2; zWytnA0u?c{W~ny0)5=vHDUESy75<(zR;6F;C+B0hbkz z2}D)!lse!RE*c*C7`)hJuw-XXBbEFFW61z2*%+zh>1`rQW^HBTe%jHCU}sgSb-66$ zVynM_viLOiaQ(!DenAZ1Nl+ASO$?C;)4h07!QzbL&Hs~*_Mrx22A%qqngtYGt&di>@_so8u z@7T}#{+d4=QiQ9lYn5}YbuM1=#c{$VMaH|Q>fhfk)Q(r#X4rN)PaiBAA8@ThUi25n#yA8LT z`wVP#;Iq7Jc&1)^g$s1edmfM;>es^?vr*EN2_S(+s~Ro{MR4S_r`c~YWSmV z%r7Qez_VH%Fk>8$155n!%``+zkZdggcI!IWY5=ZHN(R{6rsU6}0$J>n?Q`<>LFNl5A17hc-h?kxeD zg3SE!5iHZHON_3@o)`je>d_W|MlXGUw9~ZUt zaXxoOD7w{ZQt$;JFE0UkxyYj0>g>swl`Q=E2$BAa-++KFDz(4SNE$S z-@ae_buV%6{Y0sqxu#DSlD!`Qx%st$@y~B+${bh^vS(cKgE1PC>rAq6$xQs0^{gj& z*o;cMF#UE!CCz!s`l<}Ky15?s2hzo>4=`a^F{@xJ)AM~c1_qRPi9qx<`eW@ zzgv$OssUh`wMWQ1yoj`!_PDwyYX6h_nGZm#;)VN>aPlAL0sh?VVH>dBlvDS>FywatUA$q^U zk4Ma#!=CnpA!-a0BVq5S0PVwgKRNFbPz;e`!U8<67g}rdaPlf0d50pFQS0~gX}JCd zjnNJxNt(svv90hT^QN=7W54xY1Mu~+kbn-VY<8>bTtx}7#f$D9MgQ~!-eni;~{#695rbc)0 z`FtghOyJ2W(zHKyQm2z#jqZaq@k~Jx73~*#SB=keUqO zmCP=q7Kfa!XW+2f6F4kotTZaO)w98+8Ozx_=2cP zG2bzAey}h;espZ;0=JQTG`-t#Ym@JKBP&M)jW2~ZRAe$%mNHj(uKXMFmVrjj4cQnj zRHnooCuc}~`d&QKKkj6RoMqe?!vaY|AN^KlQ?5gCc%ze{tZ%CapC-)J(gy$mPfX+F zR2#*w?_U2cU?a^eAwLnw8=HKxxj8vkJG#Dor2Qguuar~SEl85H{o59w9$;R1LfrS%)o6osGK6}?n|X&^M)QI$vb zT@lWt_CZQ_x||7+A}~ojyEBwPR38qTa}#ODpBWNZOw!B~J<=k@a5Cy9d0kCg?6DQ& zHKDZaxsWZ*L#4o*Db@Ga+L535thFDiThWi7PI8?-#R3MIn&DahKr6@}e$k{Uu%O7K z@`jx2UC3mX0wk7n8t6?G|8IIze>UvWJK@5iL@KrE4i;%UHBik#%bbNY&IC;v4!yfG zH`Ch`9lOo33c` zu12NJ#YMFpDe6~Gujf7x%1#oU8X`~Sr}pj)Kf7#UKe@Cp&!5TNogp5(? zYUm<+Zi;(z;8WXwBgRC^4oJ2x8Yp1j7yu-gYTPYL9dz%>QElJ73!p~u;m#7#HtVaa zk^(Hdy*0^PLVm)%usc&lyUxoIUaz1km_fomz~88s^8nqNdYbfHi|{Eb+6OIkj)zuR zs#pBAK3v$V#31*TfZuIB2cPQ!BLORoHfyo1>z_XFTc1>dbgdw0C8#|&P6D=1id)Xu z)%=_x8}57R^`B3~-};B4p9&Z<`M_$1L$A0eD=#)yqGY7ta4qk4&O4)Ao!L*DdD=sZ zUIK#yBw|QtXY>$L2rCC)`xD{3_W7Q)Tq5$OO3hI|2dxL7K- z<9Y6=FXqW#Uj3(5S#=?p>jWGNlwAux1mE#kOsc09MNZqDjwfA$)&>+|+zE;kMJ)6NKg)ii?zw z^nS=@>E-Q1SL4?{^1ZY~nXo)oQU2jpU`Gx?3`UvesLT@W=Bi+m4{7>%C~86ZO;c1MXyUgGJkNKXG*&(r!}eUVB!aDz;FT8x{f9t-G5j zC0iA-vWXowRkU&^swDaqT`aP!yez7F%!xS+>R`(;O>Tb2AwV#?N5Ww{a^NsJX+jys zRVg6g0vst6-<$^~G+uX=o-|U#B^8u33J!uUOCEke&qHMJ%o4*K1vdw<*8kL;>lxh! z=O;U|!1r-(DWN>x=#Th*XUihnZ_mTI|jN7;4 zG3y(+W19on|1}k)qbEHVbqzd$Mz8qyYnM$3X@WM@mjxN&?xcsRo&4~t4F>`jgStPg ze;(*f*~W&0e-MWA@Z~68nRUJwsvZa9Su66(C zZoriJ0L4B{7BP}rtXPO1gY|1gjT1n=7?B;S z4AU>phWZDE|E9QhX;V4Zw+9-*sJIWtitW&MEQ7t4VB4;z|6pA_v&;SyoQll;a4ix4qn(DhtnFx=*jQC9Cgysp8gp2i0DQ znz$#rxjb?Oy5nXreZT6^iwgSLCPBSQ&r%oBCABO+bIENh^+Q{D`~b4?ZYr){xyRxA z)O-=*O&H?b7mc3S2B~*APva0Fy^Hq zz{M)Mk{?-0&$!n9hjXn3qYOV-(a-hhU@z3lwlm`CdF$V}0RF&2EWLZioli6XqNzW_ zbLd~Q+zT)io_#nK$Ae?vQE*!6*YH-taj*@YTJ2ykQa%%+H_4(Z2>YmY(S9|~z_Llp z6o-f^vZ$9^&aAmWt$*2Hu@JewG@#cR44aJgec{4<;vC&mRw&(ysl+$Es4y#XBX%1) zLX3@(O{@D0Oq}Y!Idrew1Z=nFN`u5e9yvL_q<#kYV-i#1MoA(_t_NN-WBhtFZU?7o4vv*v43cb`HK<)kG_%=SGU+ciBi8}Xn@x0DRCAqk@nWjW3#IZB{5gJ=YaFwlZ zhMWo&jZ5V#P0v1^Al{$8%1hWZHVHc1o3~_IKxp!oZ*@~*lTSC{Y%^v+ zvU1BL#Pit=Y3jqKR;|V!@iELAC^OMI3f%G|kJh=6mmYtPe_`)c-Dcd=o&=|)_Ce5A zRJvgmt3pPe%vf!0y7y$OL!KF+p~L+Ga=O!`PvVkYA7?a!>KXK2dhHt}i+pf(tapnO zbzgD=UC+K2F+1Ti8HwnD0Gv4wt0z*sO4;YT*5|rrTKVLh#coExV>~d(n4!WlghL@< zT6bHO2J}Xl2Ggla<9FS6TU5mQTLz)}s`)xbF^@0=pJTRgO9aY&o3&}H)NftgXlIS2(MBx2F zC1aS4lHP;5cUCLbk#T@$(7|7d;Fd2VeF52w6%sB0)j*EjR}k?u%1T;A?Wkn^vV<4b zRjS;sr{M&C;HBLh#snBZHZK|Fq>#;9%f2Y3VY?ZM91JdbCMHi(DFMbq& zgpz<%hRGtT6dqst@osXU12HyEO_0z2b=s1}1vV0P`fkLHBXq2F;oH6izvr!-p)yJ7!2eeZbO0+A>?PV^*eZjg`La za33DQbgB?0A5ScLtkXD9L0UW^u5k4q2wj6zBZc`u9Mlh7WEn-NJ z6zq98S2FsV(K~fzTt>Vw6;otZt-IyYXa1~lr_S@ow~hl8mG+l@iHLcqu(e%ho`NG$%9%TQfjY-DOylhV$|O-PAv2J zrX7Hur9|jSw3A=v!Q+75ZBcF>Sxmrc2q}Eehk%&{s|cE|_o$zpAEh$JeP}M}^MIjz zo#3#AC7hQ`hwM1bifa99Vz*Z$=ZY3RxG3d=>%#z&cBAPIDQ738s zwdBsift@Rxp?uo#KxNU*_$8i~z)Lx?V4wQ47gy~Gb2@WggJTT0)c_J)$>^1c)+WdA4ux`TDG;AqZD^=d zygAVQ0^z2vCToSt$?(%Q9mE3vw{ zlON9y-rZZoeYNoEG);EW@_fMXS%?0L0^Wn%?DlmFGD>{nttGu`G*+*g>mQXS41 zolTNbrHu!MeijN?c3>4L&=_;n-#9d(2x=s%S0l9&+O0uVBE+HZpJrE#tzz1E#U86& zVi~vmrtEQ@XJj?N{rvSyHcLaJ%gXdJyYv)9d)lYWN}mtP9ya>}`}g_2x^vPV&vd8s z?M z0hsQTa}s;(w%;31gPk-Hq>u`^d4)x3AEW@j=W?2yiwtbI+IeVH$GD}>#Y{MQ!}iPF zskl^BzP!Gi{nutPZ_zxf<8sdA*5S07{CgR9nii2JMJy<(~8l6FP>F z;0C}MP8(ZHKMYNe1sW(>AW_2d$aKwoMe0hLTiN|jtPVqU5xnL(x^L#swF!Gv_%(fo z)p_DXr5a=g(|hx$M30`T3?yD0vF_!z9lK-cg$y;rK`g-^oU3q|nuJ&o+;8&0w!Rn1 ztv_l$O<|0;1+rLt4;W`*n^osuZ~V47uaGurH3(bGE-9XLG_kb2zoEykuWq`ChwG^V z#nHsL+MwSY*e09E>)PWlCQ9|Ub9IAd(SiTDw zC7f_K9CzXnkcd4ccvJdkHsM8d@B|6JS2pD>-NOu_^K^clxH9(#DF2^f>v3+NR$}Z8 zF{9L^mo0ZP#BNM%2{IM;?rRXONmB^A8j@32@U*DWU)cJs;6!#knT(&^UNaBVMEhfc z^dU~ST2wK->~|2yNPZ3JqrQtH$K5?kCv8Vf?9x*`%@YjghA>Yt@HjKqx=EmZ+~Y3c zlg*0{_5|8UJy(tRD}2ZdmjUw;W_|T{j~@pI2Q!!ji&Y(q(6nbcT`+UjQdBb?d@?Z?Ww^LScoyCM` z)UdPhwO&$Mp0dj*zHC>#Dy8_ygzY@Gn{g2X4^r=1=^4)Q^I48p$^N1V?|#Il7bS>K z6!2aRp*rURCUt$dX5Vt~bb(=B`(*t}s)DQ8yw0`bMhz`pd`oigY2Fthlk&&ikMCn# zI3hOJJpa^CD8AH6^<>7uhsTkd^Ua2Hnf7i6Hl17oQ8)lS5=!PQ_V%>ejQXX#oSQ1Oq+Y zZ_33TgTo~ADBoxK%Jm%g#B5#J@G)h&BXh6Stf3hMF|*s_zt9>p`8I7HFb7Fc3aK7J zZ6kmd@|If z_9W?Y$CMB~i}b8FsL5k9tVickTRO1D_E0v8Em;1R6J-;Xv`{`@Gpu>3T&t1z#eM~Q z5$<0s4TfW(D;)^1uB9(@!r6?tQ^NO66*thEqn~}v)yfCmNN7*pd>8bb^WyrPzAK`8 zX(hvVU3fOOtK^YgV%=(k$HUK|1iQ}HL{;*S8CSJ*)~7D@J;NqJE!{7RZddG~guW`V zl>Esf9rEgk*gUb}gj9MMJqY?m0?5)|KJ)CsUuNmAo@{3CvNsQ%AI&!jSa2WrEigvt zpVR8%-`;4+d0B>54VXI{Cm$Mx+@BSy+jts1rBA``@O{nhdW}#~`x4Qk(v=|36o>p# z5rnq1tXi*={`7?N$q;V}w0xy5tFXI;R-7KROk8i1?oBM6MRMj<=-mhla~I`%?iI1YVWmB+hb%B z8rG=n8H@`bv8oC6fqm~DpJlnT5IoU~L3-#7?0ExeB93au5(jy?m+J^v0Cfic*lDlo2hp$VlzX^ z+&ji!eGs3&?1;_#EVz+_$^s;u(|6rDb`bp4#Q$yJdI4$7GlbP$c@1x%N+79p-VcIbnIUD4W2B zS&HJ^$&rAliHpyHM>Ovh09rVEcLjF7m1CZma9Ax{nvIxb0Q7Y^n^Dq7^4-s6hVV9c zw!%viXLK+1ar{^qC{G)MogWA&7k7x(P142MnqBN&gE$?mXD!FR2~xlfq=X@JJU@Y5 z-F(tQ^s=uZ=8&@m>W=lCldU?7t^t%*2YBF#fF-$a6NFjmUTv7&wSwx56d5jsAM&#O zew#TAn29>iPJv#O4`o0WmS`QRV(Ixd&!uYgghvxhBedpP(|RiZ)L?;y6Cs-Q{>=>4 zE{^0nLT3H!y0+vx$PESXGOT0{R5%z`bG-}FPpmtwM$2*?k~jV}{5ZXLa4XPqAF5rJ zuKgY86gD?2HFl}BfCLO6!vFH2h{gB5!_B*82jrGL8Y)I`b*AfQAXA1>t`-j$Voxh{ zc`mIXlFpRYeaYB-?a@}1;<3&lG?WG6fcB3tKU*rZo)7e}!In&1WouY`BYk?o>MN?{ zH9V-+HBp4)bAND=d6+!^V}3x)vMCzg%&_iilFLSln5?!ext;Hx`9%e^7Gz;%5g>@ycXXb(s9*in!^S1&}@s z)ncr~!ZJqqToGOq-ADZ+Z>IFDh*ePLYu3tIxy@`d-bkw~9Qb8kWThzXn_AXomK(C~ z{U-C-=bm@?80Q;MyCeqn9Qr+(6xPDEolZ%jbo3^92+QT=9x#5aOCniXoDv$ROAIv+ zTsZ0)+-+nw%LT2)PJSD6Usvo&l{N;V?)U|!A1|u_J^Zy7 zXfl)Jv3TT)T$#MzmT}e2%b!xI?}|Q&(z1LXiF}ZwetB}5Wf0)SF!1-prOTd)_KAf0 z&wb@h@w64C8N6x+;o|Jkr%=o&T+)IA>2xl zWus};WLYTCz9V`D*OfgP?NaBHWS0pwpsvKnU2I$5v}kNfW^Loyue0O(#o6b}*;2Is z#)r0!J1BFIEldXglx9X8ivf#YL|Oa?G`k?dF0!8h2y<96grEnf~Ze5lwTgOX1JY#Vx$*l01~*@R%i}?$oVUAwBGQs%Nbbp8ggOy3CzkLpxV! zzAt4a?tSX6tut88$}5tJdUSFhB@_#3(Bf2`eg9ZmN+JZgku6P)zqnd(cQg=?t>(T0 z5L~QR6@UA~$j~LokL7?)l}{^48e!ZwN|!C9+Zvle9#x&)`)FpoD)TNr+@F

Thjpy{%VRsF)Lpki&VOs>=Eo{{&yBgN@vpl&f+erLVo7-Zl{f;!{Q%GM`Sj4At@4@&SuFQ+yPrhS=9Hw#S z+P(BMCPz}hN%_;E*gsp$HjG8&y?*yW$xvP7CmhSGGcBNSTU2u4BWr(Z6Gsk@xTxu9 zD|;vo7g&+}bJRs!?oUXixD1o743uPK4M%l8qU763>1cU?{zO81X1gGBJS8kEK+Em& z5xvARgaa`)IU(dO$arLB$nvkb#g|NR$*_1rcQ`&untTrDe?{WfIMn>|Z#HfJ0Nfsr zVb;o1!~@672>$tC5~i4$l*nlwwTki_^_fPSeOU%;BX!2cuL_33YS6=N{{HZVDfq$|j=0%T}0`Z zR}2PF`u?*EAPa}!O9g*Vez%u;y356;6b<-l|8){ZE?V*WVw9)FteXRoE3wWLZ)3J< za%^N0d4gr9ohIXr8f#FVmRhq|@;a>#T&RB9`oM&YJixN`+GY0%=Ka)(c0J!;MAi!X z8{y_*?wu$MO1Xgrcw0&uc83EJ&orK^8R+?-1X5z-L&$_It8pb14nOX1Bjsomv}H1n zG6Up;9%YT)I1u%6$1O{hU+U@!81GUXMHFCeyy^8-mKM9e8h^`mhAfNX_xUN_#(0eo z;&X2RULJ4v2^WnO`tCm2n>S5U&tRrP7CUA``nqZ;)=L?d*lel~0?IMkbUW($V zw68O@5?R*xju>0i|-i>%aR4L1U#(H@+7BFLNs~41Ha;+sCmm8w%daLWimi*MJ{V3m9?10a zF8_w>^A2%$=RE!<7EGxsaTaf|H*2S2R%g=1Ree5|(D#78IS-QV6P|R~?S}pE;kR$* zRH`3p(#dD}skKcIcGuC--^QZxo9~}OX>QY#2A8Ux$rvTg1sx{sMspO(^tBX`1We=U z3f~{HqNRQ0FT7Lj!v^Ik3dcmkqUa63$S9-jZ*V{9QY!&XhaWc@RRFA~gkT~S8rW9# z@CB1MdnU4)1uTzhb~+*{o6Y@FmL)FPFyNc)oGPsR z4&N^@(DMM~5!#G}Tz1Sz^P7$2<625X)!BlKZf6iyy1D-`fpQ>r`ge zc>88B3lh2hjohU9342T-8Vvd@Dd24s1HHM$Xz6WPo`bL9rRV+gYq<;`hFR*E>d(kr zEa;)#i}QV}&AsyRL4bW+IKZ@3y$XlL zp8m#9jsKp+MwHRnIMm12Lp`$&G;#NUyS}Iu4sM8g!MKLXdy#cFEb!@jH?S7P+C^W5 zs?9n*O{KlGVv1f%n6cezHjkfDuv$cmR6?RXR9L?v@4-k%zqrunOo zrJ`H1g!`+W7lSNhjr4yg3&0Cqh*-_%z_j%2^)2ci=90NOd*OgmtTn zxD=12`C%_AymjOS73_q}HU4u?-8)Mj#=Ji!&G`+nr^ii0e3-2yzZQIxBy?he|n4wY8fcI&HDeCZ?@q8Sko+O2h-rkblpF-Te>m({i1#Xv}l^pNb6}uk{ zb9ciYQ!mX?s@5DN$5`2vF%QMX9(3|J@2|!TRX?0>?N0U%ozebfhyyfPPoxYCnsn z%1iay1x6d{F8gOf(F08kW*dqwQ5?S*n{;iY{e-ENpnO0*TALyrlfr0Np| z8R^qNFciF*$ME7(TA2R`U3>9Z0w8;S1CwjkiVtFTok23el_MNRzL@qsiUyKq-LyP`pvRJ9T~ z7DHJxHOj0rNzBmj5%9Zc`~|DZ)>)dctP;rp?X_tZUdCn{-iK9zUhKxr(rxYS1w#?& zPB_DCJ$3#VM4Ug@B1McBAE*HWhPq?nf!N2FZu-8@mP~4tIvki{o1l>n{6Nt!u<|MT zx<3p&&mQb8Ia>x%Gb|sRpWOH3wpDk~5s->#frdprmsG9&i^FN|FLet? z`T2F0+@jyDnEf#hbC7J*G&U&U=8~l74<%}$7wM6@K=pY*IFlLQ!C~2;TYYv($B^)Q zg#zrN&&}h%5@45+7HbS;OtYxj9aB@Ta{Y{^$J<&-@%nP${e{ZONTOCKHP?f}e` zK~ja)P=wmA=@9cVn?k6ptmH2u7MYTzxaX)y{;=OKuu3)M^bI6Gzn7)?W4ZnGrCD0A zNs0BWrC&(M-T+0fB_7@io7F4b_)Hp%|j5IjxX2XAH?$=mpYtOW+$0T>@NPO(g6f`+f2sscbnSR9@M`^{MnztJ$ z8e-HQ8s}{o4gY-1A%vWZ)7I6|_-kRW{L`$b>El8U^w>ZF5i}UJ=gOG;6HeQQr~4Zo zW0dA@In&#Zqo1jH*tnS~dO?FJg;wZG3n%TXpW42jaz1kT^*xS_PpqcWCbBpXn|*1C zdqd;b{i}F?q>J2=F)fhw&oX7h-zaEa-Q49WO>O_^qq zz9f&4zP|2C=FSioZ|;`A7+K}?T2YArwSKX82!C>LRQB*#JnX%b$8cv}%@>I2kV+@h z7esy#7B(2QvC3xjA=_The{+^a*hrS|^7&n@X<7WuH=@~ZAI%juiOrD{NTjL&n0kAs zxGX28=lGINDtYHKyJbQsPJ_Pwa|h)#ozdv=y&8)d@o`-m4bsy17LeVLQ2_#mNSDW8 zlu>#?aZ}mW6GuNT>zoB^fXMMKyl#(7=oeHSehb7}3lmYLQ$JNp?rFL$Iux6X5+flY z?cy%B;py()*X=6*&_8W&rz-zaA=mENCwp3?J%sHz|ERyNV{H5+$@N5f=e4uQai#fQ za_m|EgK-n71TS~aFR+D9TQ03hycb=nX|{=uPag*MBy$I(e?Tp8Xi{y1^Z#}RlC?CN zYMG1emphF8S#0WCCH1TnkM45UI}jXs?Be=mX^{zush?nKmfCG?ynlAGnX${!wGO=M zC(7r}`}X@Q{nKNrrS`#BaHA`oF1DLY_omncPQ?%)m#Qw_i&L7C$1u1`N<7wa>}8XH zAR&sEh(B#>t}h!Q~+$?y}hAji9D>yPb}@V(t8Nz zInd`Yw@TPwNFy&&KDS@67aq>eGtry$|K-OGPR>B2B`I@g1C}Ew5oAuPi}e#^M%v@k zZdqmssQwe?6d7jpSJe^aU&RCKFa7vkAA$&3KnBXevwD@_yv}k_k}U1A zo3wjkdN(zysF?)FmgwTFp2de!^r4$!n5R@oAXFN0;Gds6L0N((c)a zpvR@E_=*$9=RX~zIQVqHHnysG=3Mu#8qm#%8?)OD*|kYYFF9sxD6=cA6-@n9{E7Rc z_E-z_{zOwTvfZ|tqq*-X z!|F~oYrDtut@*6BxgCbdAC@jl>V8n}?GG!Tf(1^sSbRIrOhh#te$Mwcp+3KexFQ&L zAW&Vtkh^QltS(r~T+bi`*=4%@@-Z`o)?@9cRECpir1<+Wp?UZ7JLICAJ8yM)OY#I+ zhD^DzpDmP{sfSD(y1^SWCzS^KkNdRr;266!T58DEU=QC)@*zs?4{TLP)FGaDXM!-#Gv(72p zn#)U0rm7N*VX8z4VoS-=#-1ed!thX@*~^kdsZ&!)p{wE|=c4)$ zWEaOXrnM;oH}X99n)X8q+%g(O92jPe5JF|n|3ReP&WAeu{^DNj^ zX5R}U+J|lm{y_6e%yxM6(Ngh;xlbp_7d7~W6@U7RB{|BMtg46>Ij#>HJ@`VdsOfe< zwX80gG?z!`54(gfmSJnYZsfutt2>LgNxvB6&1-5aC{yj6lO=94>YvJAVq~4Ar(|qz zQ`pk#bner-kFM9sRhi*5&%Y$PO)xi~1&Z$emgn$^)t zKN-`wt)h*a6g$G? zX%af_b4HJuP`RC@zPr$)((?nWV8yj5o zw4hw8mHRl_t4FF#xPsZj5tcklj;(D8%?d+CNdQN)o*Ln}d5s=&uoqNPB=XzuNc~(p zVk*XnlInF|2`oO37HPH2Q_Tu}q@ib8-wIcw==16vPiD=ylNRzGs+H7c;f>i=tFl!K zo!RP+Pp^l5HBKtauLY?Ulz&l8SIc2Z-jwg zRxiKTwM-A@PGG^tYy|CaMmrA0U*U(0+$l1X=1a67?k7&H)cD*1$s(sr%c3O4!09Pv zxO1nWrw7X|MweO4# zmM%oCHQR?rsuHeuks($(|3_uPVpEKZ{)KFQh4DvB&X#fZWNYkZW@=t1A6@I0_`C3D z$AK(wXvI8V&0CA^;}xo{q=K-E*D?@S8nr3eeS7Zx=dJ4-=IJHcp50I_=UB+`3+NFmA-#t65d(clR=x;kUs-L1oXoH1Yj^6Q+xOE;hOd7@unPAcKi5B?$T>0B6t+6MxMD<3Z}6>l>`S3Z{3 znYF93xt2|4?hE$lV!A!^{#>fN7-Z?l)LNmZ<2i7}QvcuftXl0s$wsGBywzm;i|?li zPsZ?iIb~~4cZ)59oHxI$B+zNOIE>8{m^HZiLGKT z^`mC)3#_C~x{g(6ZSt+^qYfhSMVk-4m`^R`KUQKusXgvd$@$TCsj52l^mH|`u+@dK z{8Zp@SXf+C>HHnJ9oysE`DZ2Xg&h`Pq?JK7BC?$^ME+pN8YML|_)v{$Y9uV0CwEP^Yn5Lqjc%yg3 ze%l+`-D3}?fO=bGZV|i9J%ut~4z7x-*SIBGjHLMQ50mG|B+zIb?ba*?pY?t_iCR7^ zJQAt93=CRVB3k#0fbF?j;VKejhglLdymlZs;X=;}9BeBKocUTE=$wcGX)#$)6Sb1j z6s?uFD=Qk$}j(A&^~S42!d^yI4G-*3z>y`>!>Q z-~h^*ocd(??E#^Dxy}R%MC{BCE^H<4hbaHVhPekS51wXWG7LYu+`Y{_Qaz{$X#8IA^% zyEvKn_(4_R$XGuH2!uCBot4Zqngu!9 z-8*=>cOKE!)m|_*5%*L^-{y2do_MOPGcqh^qTScUfztyVY@F&6vz7IR_A7V5h?Y^7 zS#4}s*b$daRSVZX5IFKz#~p0SqQwk?3j9Cr+hKc}pX2g0 z1JVDaVxZSwwc4pybj@dykF2R)zXH+EeO2#1{k*Fibxnmxh^OGSogywm^Q z*bo?l_kguRqDS$6uWO~LrjtCkKAK}K>)N@O9?>EL{;gQ8XQ zgdx4Pf0Q`;Q`?QR7?{({Zm>81$y9ifar z9rtO&gswlH6B|$mBUED}?L+^g*jK9*D0fh^bAPvYx1d_qc`gJzRiKsY>I0WZS46-KcN_&NMzH|w6la>#{WLG zhbK-T+4b{t;TVtan0(soRa>;SuwZ`l?3myuIyysDp5fEtcRkL_7BzozCGDbKuu_vR3t7nZUK8T({}6&Ib?_ZUF_&a&)asHy=6iHd@i!2>e-pAr1KC%lEw;x*l#z{c zSLhKBD^i317{Y5S;kJpDx)YlbieaAmL4o_9q^=e;5US;Z^ifl+{uI=S)Z>xH#Y<5O={#CSxaRKXKZEy6$536SH{1Y(@n#ynbYt zyFul;j02(R=S<=cwwKsh?0uTlW#S>9a21-m-Hss0gvGvu<#gIlU) z>zM@2Su}!XC0}(JF`f`2I18ZQNN_{UGa*?TWJ0ZhN*V=V4iA*OegZVY9c)xGHfT{v zmF>m_(xCG0CcCed1}0)U$xW7w*BhF|_jx}V@i~7>@yxKt6$HCJ2^PbCIm|S4^px2F z%XpHeo{O4-^?|zC+Z{N^t!#PZ)YJoSRqkE!xgN2D5dvlNt+#Uei_Co+t$64tzTP@3 z7@X-QC2I^v^O##rm5>641Qs9!4Dknjf=9D?JzyNI9wrvWUmr}Z#B z-EYnBU2}PAP5n^KVad7A^uI(P_XtOyU|U3g`F==H;r(LxiE@#1L5s|Pdh8V+0tTv+ z%ce%%&sQG&gb?@1$UhX15w-!Ch3g?0GFo5*v1Dr>KLDi(mRMoTYgL;N0My_VVE!K9 z`q?M_Y9=gR^_}{`qL?KW`(pTyz`Jl-ZQ25el{gxy+Y&^)AZjrbx&FOnwfn?`dO*9m z5#YN|Jc+||kIDlgof*G^c$|%~LIO3;y#5iFc7arUY#bbqOQF^@RsC-!YqH5aK8pcM zH%O5^hX?RUdVjWG#J`a<`~F7oKlcKN0d`Yhmm77=3z`kSV+)Te06h2nm*-vxo@)bJ zc1JnKgbP@@IE%L{q4yDL08GJkc>CW<20-;6OHuk>!+RD8_?U?NaldzRGMP_EEy1MI z(cr+Vk89MmCmX!_-!e=)jJGk64RO>akG2(Gn)NB(t^s{5dJ#S<(=J~C6#eQMV_q0# z_Ac(iL9H+dZi82t)8a2;)0FtVNXd5PLSsx;g?GS~ z0x1LL^y&>2z|7IQ1fGIIbLzk5uKqq6Sk5}{_dXY24d$2VJFWD*uk5kZi<_TLDhn9( z_(v$XXcuIyB2fBD`cxrigb@d1xSq)2lLD_HOLAs;!sQLseEx+P8KK?f9)MgH?i(rh z=?e+%&Zvvm2OtWLpi9B|YOod5gN7n|XVg%Blb43~=1`grSreXH7S%RI*Iimw))wK@ z7g|R@To0?qN1n{Bzyu3zDiA7MW=1hLhiS4=tG#WL3Q6{8!U354>@$9TEYoOa;qx!A zw94q`}n$&XP!km{qV~5vs_5<)K<>jvOit#e^KBP#EuT=f zUJEDnOe*50b>{wK$N}4aB;ax_AS0C9{a4m?7}x|}vpd^<cjj(brv`Gl3Bu^IYw46nFneYLEqDIekdj{%Bbl_7k36 zLxApP5X!i^B1Qk|ek15y-LbVvpoOn$vp)D36n}=K;D^#~x~))`Uj^|p2)q0o!(-id z!hQWNX8*BJLDXIJ|G1&+d(ae^$!!lweIGCsANG${yAuIZyohXeb00qtHHg(8UYHdK z;{(K*;o2QP2e;{Lzgwfd0s!p>YHPIX`@M?@WRP|jnFR%#ta>6__O&iT%{-?%^S7!HSHGu*EA&UfbXJadv~%QcC<1_{;G zxvG{ql*ooaJmgJ4DLrNf1C~>bdR5zL(D$YF22qpW0js3JE8i#sOT#p3=*bZOnBxUp zD7FUEHMY45)7e+_r_TfI-4KO-Xru7|Z%1UTM<^xol|bbUQI{W1LWvIvs^7VkQ)v%) z$poW=p&@UOlj^N5p1}hLIAfb5fM5f}j6$R1fGM*GG>y(1ap1~4raCrFIaj6i2aen3 z&yFl_p>+f|+)EU~2y^&X!>U%IeDQ?n3+-^*`QZ$=y%YMLb6Xw@~&}-!wxp{lz5fZ~t~K z+apz=>`PIAeVG-zj_}IP1$_785&3;8;H^Tg>?f-%oXmWNJ{-^^angR&f8R4`tM?3B zb$oFU71N3^a)5Z2lB=ErXt`~!|ELjh+F|MRU&3r{ZP6b zvg7icb!6vjH_%Xna=6aDXE5OYgL{`*;J4CkAk55>88p>-WGTcVU3K?K8xWPzIneEx74hxUSwPKceGEh6K)4k0rT#Ar07_o>Tr~);SB9+6iuaWGEk@?DUXmyv zZv0y7=g#hA{r)m^sBo}#IoNbYfz{C#9u*;aoZ_kNTBLewa)}3Ul~h?>paiG?EAO~2 zQkqN@LX4=SfY*$-Q<;GIp9TXD`T=okl`Dtn8OzaBBL394d6+fu%j_N2{OwQLT&zJ& z^E#II_xJzk@Q#HARmb~=viZR_uIlz;9l6-l7}Izlt(^(;00gq0&Bf+RJCFPFosgo0 z)QJ)a2}#M(f)&~O4jmo5w}@h*kxkoVxZ}k0aJ(Zv*dzDK?W$-`f*(0R`MS(NYX32Q zCssVNSPzAPnBclnJZy{%JW56?0DOcd7TOTt2~!W#>8Pc;y|#%&Qw#7f{7|v6X0Uow z%GU)HtG$yjrRS!w3y;wv&)O7aAp$Nddnfb4XBi=Kh_7L$(UkbyYJOMLdTtinG-Nhk zn4?;~sdB-kr)v%9>o%vI5wbc7I_`C;{t4^iuzq55!3%dUO?Ce**gb`NXbB?}3`yd~ z&|tcJu`|hd@!uiD2>NZ1S(Szbi?&}Q4>vAiXO3UBdj;Q63b4b{brmW!$c4CJqdDZz zu4a)c3|^6M3ICSQ`r2tvfX~iAmX8*sTr}G}l5|oaL-BR|Vd3_}EwG))HHF_B<_3jG z(94S?iOtGi^mQo@kIRlX>6hh|9LXl@=1V!@N`VsTnBR6pozW8t1{Vegk;Lh@;B~JB zrOTDOU74HC23G(bNAEfVI%y3uEu*%Fkw1&YcQ{S*r47>H>wc~*?+0^G{N8k#h)3Mv z0_Y#olt+qykN2|~r`_T#v<4GI3>miz!Zgrxqb^Fs%MkvBFY3-B2MfGP_Xk)z#5PUY zU)mlIG+%Q0K06`?>MkuMJg-DGXH@$3|;h84~XB(@HE5K6L6}NF!I|#O8KJ z_^oh!3?0`n3?Sln{^g&DZL-x?BZtcZsA1BJdigl`1zQh8&GS=-H}C%$YeWGY(iPAD zkv*i~_G>Tn*sMLlMm+&kK=AOd_NNC`QfK(*q$i}P)8>9 zBcaXL%h55IiXYeiz!Zu8Sw31aR*6t-zzsZg6aIAz`5T<%q7CcLS#72-h4_mP{#&eG za_qxu2xUL;B$3JtItrjO(r}yg&C3g^2f=jhNm>z9J`Qa6^L=Nfelz4(uR6*D>^s^Q z7`~Q`8V{^YaPL=4l*y|4D+4<=B~KY{j^mh;R@)z%$T_sI3Z~M$&J8W*PHQ~bsSgTU zPzZ;IHvx!-Wztc>tX$6oSU+!sMCQAtUK{{n-TX5qFcBY*jzXM@nH4bQ|zfUCbv4n)(x z#X8-LN#74zpmW)Go6C%M0xjJqI9S0#^11Sbf@z#z>;Q$p1S#on0p-mA+75Bq(z_mH zj;EWfOCfMyzNlvmW}wqgKJ*g#pN1L7p2!wueotFYKk3;PCee!STR3i> zA^VV-FV7&U=y80BZlT>0x)^WXlQ2p)Y0nG)3UiQUoFyf8VSm2vb@GQ|j=a@VfOyo( z1{WAk6sGM7Z+5F^@E?-2FnP7vvVcXE!9CIK(G3y{9{E%CPo=92eQVybVl!37lqiQV z3p0>cOJc*)(p839Y5BMj8^Y1!zO<_=6cMHtQT_$4B4jy5Q-^4CklqUlgQKHEGPAq5 z9gYLMr8|ARM54{^ue@1wPvR_5cIxOg>ka4dKG!{v0Jk0xL-L71QWB9ZcO*TH+1YHF z;Ksjyle?CF{TA69NUcE|<-7eOuV^!_6BMy&!YE_nNY0Aqb^j^KdN`h+6BmW-?o{*# zsg7TQWK}w3C|jB8aZiZuav}N@&DC z)P(&Opez)Xs;GNs)y+?am$>0XwmOzB&R?w_+`r1>-1^dep+r$-&S91}YIxT&5*TV7 z0=@03f?W*M!b1T9zrPe|O;x)x#b6S9dqcvWubcQ&6xp?|=1^rk_gz|gdy4-S>x_V7 zq%tlhC7fTGNk~wz5on7~&^G5FxHFDh`$L&~$@d-KAl_Vz+0oE%vy1quY5C1*woI;KBoYdsWi>QM+DOBzh>^6(77e9Zj!W#qghZ3MZKLK0yD@leyGqmvgil^OXWOn zPQyyeXr1bW__eT^`>*dA#!83-G||a-e1pXCkz!F{~TU(%Sh_(ABG~#$nUF z4!_ym0h8FHj?qDGi$0JyF-KPRuv#W4dWjzI3O_`gw-PP>d=Q(^?%U=jVlo8`yKj`b zr5xm}KYzrH2)5lE2O9^ckb^|gB*&SOAE(Kft>Pkgnf}4|~(0F_K z#h0d&Fx8v4@4xRcjZ}$Q&)JOb9b&SCl=BXxat4(0d!lZchSQt&1(fqjFEWe;D@j4sKmqo z@)apDu^?8#B6-Tdm5^={CFY0QBK*tcJkD=P$G~+|oJ?@KcZLh59kl`VZd(p7KZV5Y zAsLJo;^h@(`JGn&gjH6suH*Q6E{oV?#jFcZw3n<+<3Y{h!UUrdpxo;wW+6Dhb@Cym zQ=P{3fknG7@Ocp)?7c5}zL#qgre=1hAq`QfGi_yI0_T^~M|+sUX=1CZO>hI6^_+SB zm66P=G!6ry+dXcZk1t>07nt633{zg7hoMHLranHw(>F^J&{Fg?&9hnzcAaKuc{>d_ zSsc_JxPn5`>V!_r!Vb>T3-Xz>C?*|+ojl!+{CW6RdXO$Yrp$Gopre}=w%{cSv}2S( z$Kx;~DyfSDD7(64kIP1%D&i=gZp?(YTb}?sl;Vr+@{m`nO95@>tAENVu65{E?fZwl_efiLTysIybuMtYw`ueM9O&1jvlK zvQZZz%k)DztbDY|NyxeJC_#{c`}3bCA=XDK zIps|3+vjo#$pyvE%)w_eUdrX|=cZIJDhO~Y)+NQxg*7eh`|rDVh>;+>Z{PiswxR^o z0+hXAe0%yni-5W^l1_z@=6Z(%L~m*Q*HpS# zFtTVs-)K0tTcL$P%kP`ZG_$h3aEFFPMd3V4jK6|Emrm&KL$jZug;=pqH3U)7sWhFO z){D=RC27BQWQaKsOyv@Qx>}oC>#T+}#{TE8VJ=?##oE^+szG^MExx$I%O!l!(BDIws!z{giIkB-y z;Y9AqBbrr(pm){-7m{uV&Ce5#H~HD;fl4HRB59!cxe5v2?;xe|B9KT#kN7%)8sF+o z`r%m(E4!uYtCCCex~?93SAS(Miet2n!JMWF8@&pbBI^-7N-e`#Z5c8p;nKq4y?08c zoHM_~iLH5Zhk9Y?lb+gPHn?8O%JO387-!GCVrM%A8M7Gxc}Sr~Q_n*-3q6w&uE<1T zwryO<{NH~ELua3M@qo(u0VyPTK}=ipYp$m?hj{dO?JP~ER$fVx-u}$_hrfSPm>1ZU zGN2(R{Ee9y=Rkm@B~$63=T>=A0=>KmY%Mq_L3M-0&(66MHW7VG~A-z`V zw#u~*o)3UVnN@_Mu>lcQf zz8cXD%;@~WjG*6*3|l#coulVCJ#w1*}n_dT@&jCe%{-?D*&@ zp}#~}pYl+s5Abi%y_KEe6jD1_Gt`!=I)LC`d9Fd6c^|hS1zuisoh9&Z!1v%X9Fh5k zQs|08?SSq0;inD;Euk-oXNmJAhw*e$xK)+ms9Oi|oJMt*D;OD$!ha|;IU(#DO6l)E zJ*{#5JGKUkRzd4*P`?JqX5o1DVeOkuSQ_9U`qF=2O$HEcW)E<_6cy1{zu&nXVu60S z!^i2>+c2PXdsdWC2plla@V$FyH>C@u)B5`QP9!aQTx2t&XEop7KJQ>NEw1F=&P5b& zcKAKh&9vI3+k1CG>xv&Cd2Z?sc!iyQXUY6FybQn(#*U8jxPkC+Sj_nwr+JT`+ks{@ zfWWb`*ZsS}TcEApo04TG%k0meC;+uXC@=Z$3u}n8JN6Vi!?L-#{Psa6tqSL$d}w41U;?`xL{S0#rQP ztIihwu4%{8X8{YuodpUxk_j#c?It6|IpA#SGBbd?q+LA}vz`cGG(L$P%2;ZkO-Sp2 zM8+Sur0PZ_t@;a56V-%vC@=IY)9k&l*;i|kDhGu2XZm3rd&6ZKvi^Zwe@VT0P?A5~ ze~bM=_1w+)J2Yp>3F~%50LVa5=}Y*3tDv5;hYO7F?7r7CNa;xPuEB6Azy9j=xb|DY zC#*v}gW_=v=?NV}t_y+m;jyPTtcF2D9`GCElhCcCazL7O&|q!Y4(rj8jhVSnEwu$$dbDCG7HC2wT{<|kv5EKA_ zAB)4??F}1SjoJqP55SPc06q40n{>JL&%mUHTK4znw3uTFM&}6w?(UR)amby(WB8_9Vy7glD;Ca>)K1YshcD%oKP%cXex|#&h^0W zqtoq=s#>5oDR!Cc(69wGadeZhlRDQ+|i#n2%zq4@Ryo#$p-dP_nsV8d;cR(p!;!MH)S@86kv9|D%OA|2U3tBL6NPa{QKMPoAf~<~hQ_vR=eh}-d z{*A_4)N)xz`0TbRF%}xC?5Hd!=flaGr$1TU0s^3*Rz^5_1?Xs0Z6Egf6HrKH2&-(< zXE9)7&eL-bZ zTCLu$<>thRy0p%J9AaZ?Fs0mJ-e2oS;D$#%Wo?Xn;A)e4od5s@;_8MJem`i!teN-t zZa3_`=t>$E&*(hW8m#B{?(8TCTn^|IR=^L9>p#;VWJMn{$Fp?21p)CXEt+-Cy!TQ@ zyOW@h;Ls0S%A8$i@@MYL;7Q0Cv;i@nB_M6S$hGSaj7UEGb5g2aS|j~&wbarxd(;gX zBCN{rBTV{Z-WO6~?Z8!91JTHkz4%C~pBs7IOqF@)(dfS_?gsWvK0>Wo5fb z&^av@ne9NM`oQJ2)>JsFT8UstN#;~<>Yr)cN4I?%6AE;q*PaakH2LQ5U4XWR?Y{=| z&~dTM*O>9g%$+|2?8Woofrzs?zQ4zMGk53H{!-g@8DDcUFHhmTUDp2aN`;kZfL=_)O~%=B-{pFr``Y#EBv&sL z80(a4TPM@@>&({gixUFcB(HRh8w%#zyE5*;Rz8O}x(!EDBbDf1i}KCW1pCc%)$3{3 zpX~8(VW<@W2t${DLi3_3Ps|n01z`8p55}6$MaDMOPmhB~-aT3a#Kk%BnD#Mz$ORdG zpPj}8MK@j;mkJQ6W#jC-8_?5>Dal9BFfd>)dR~#s5b(ZPbLkiHo=? zl<{d5uX4wQ-ArVXsrpxVCEM;D9yM)`0*W)4dLdD*+9 zMw?#uuzi3c9X&nUNb8DugG;HVq<|c2512o;o!ylxdeu8@XT;)$(kgujX1P{SP#_+V zG;PcIMzK&n?dho(=Demmc)ZDdyW_UXfYR zXMe0+Y+*%#Q%d5a-%474UpZ&I<)6$(>=Rc8R38NBpu&Q#XyzVsnZ z->~G>Gs0zaH?D^N+64d(ME<8=>;&4ALKluC3|TaF2|c9|MDHJICyK%f__%jyIBLPI zWEn=IuwxcZu8QeK4l1w8BQTSn3v(Zz(=N*ANWyug9KE1dL1C%NG$r*41WIBYjZ&&i zFqRdQ)<^hzFRzu?wrY5G?X_QKqhA10($+lE#_Tap4ChxDpS^^kc0>ZEt-Vt^;A>OU zEj+%zIMkL8vJ&?*la68ww3*=3yFbU?6sD7}oL~8QZi;98i0F>9>Sd@c96lol9EV!U zUMA(Kb3t?{ep*`n4A_!^v9~ovC%*6@D3&+ehkJs%N_cHRo#JcWNzkJK2QUq!9}Q>- zD~brA8oj)7rdU7x64^S1Yut>RD*OS8ir zlEoN`7w85EOZApwZ~<`fQ-^>c)8??1ucMoou`KNajwmo>kvOR~naO%xsHBKoyVuPS zFb98OAvU-C{9NP@bfuS%DMC02KRQt6jr?bvIF8$Ys?d+JZ2U9O;_tkmTtj;*F6TZ$ zM`5(dY9?T}3Di8NOG=RxDK1$5CHnd*EKO{(+GB9i6{lPYuXl$IuJ1TF4u)aYvHzp3)8hnyW~l5*nBtQuSS01{)m4y#`n@~|{jFQm>V^(t zME9T=kj<>fex4WyKgh3pzh&tL_JA^qcByi37aXS&A2Y(EhF}F*YGM zb@sjkSYiqh=BLHw+HXt@P87^!>(+mj;q9(%M!vBaEGj7IfymC= zLMw_;MDW2fxj|daF6wGlz`OOQoRP4=NWbo^9EwltjLr3%kYHL=>8a@XIX`n`BM+0hAV~B zhtDs0zJvs$!a<@j<0xW-t)5p@el*1*&;Zjhl6L--rPLKFpBe-cL_GXq`il`nBFvrC zxiQ6=Z>H~zTuk!W<)BXLp%5s$92m#+o2+p8JoYWg=xK#kR1 zAT(j;Z$W<8eI_$Hdy(Xyf@s=aM{c6wN&ROaG!O42j zzhjh!&G0<1H43frV5&W{2gwyiyeZ-9>mA(X%d)2P`1b&ay%Yc^*kLSKOCN^+Pp29ZLaxnveEG53q#H=6SX+pFIdezmjob?Jxo4Iq?Ia4&>y-j`}H z+aCW@qy1Y7L4r`td_Q?Zan^%DnzyUg{=uzD@npLjZTyB4H}m6TeMTXw{782srH1}9 z6uf-yuSR4`E)eS9BgsDeq8x5mB)hyR`XFL#XcR22Y)!emYZ{4%oJ!>zgK%1J#P%i0 zN%+$zKEXDjFl-HC?nY8T?A@7W=?#z+-`d%igN^QPZ#y2MpRH|dAeJfHkC_uuF08q+ z-|kVUNkoJ6tezd0BiZOaEKXfcdJG$Xk|-$)2fU;Yq0(v+A6V^?Z3LN-iTEs9&*gdi zaUg~7TL&u*ki)je9I>_N=;@J$&j>SRnz{hBYAdI6NBXg?7|PP-FVA3p^o=?8;>S~} zZ>VinnVho}Ys}deL?77ogMO@0Y3((C)+| z#Rou|J6=DCtaR0Qrj#4MUfevBxzp1DMgqgkf=`i1B)s@>Ei0d7t4Zc~-T2^gTlL^) z*%~7yOX^UNl7m)6X&oo$<@Ty`z|vX*0D)i}vcdKzJBl7?>&wfjW*|T$F*UR#n}c7W z_gg+RTjpb-`G0NXF);W+&QpxE&1Mnaiw;5q<)u+HDwO>MR@6KQDI`?cuEG-WoYoW) zK;hTsPZ^)Gb4|vIsR_C(ZRp#+2lN8l!TguD*)RrD1-~4-{&+*B8cM&$}m66#8kw+~Jf#=j7B|jTP}_B+x=TA+1%Fym}kpE^cjvpgc`y zpJKtLknXL&`*6wk=VjQG8e7j3AkhEr6AxvJ2887Ni(V*-3>jI8TkWu}Nwk`C$ajHt z1A>3$zPQc!TAZr?#Q44Mm%6T_r*eyEH0wzOCm;=dj5(eyOG>-Xw`CGp*`Yy3`am@Z z0J1am6?!xLv6 zvZFaQ#c#ec(LM}tu+ITv^ipcRMqVOCc`q(H1GWv(xh~Dq zMU#SHvvEm#Ma48Qn2Ex%6VVq$1dMkw=$>fZjRCDw8V7=a#*(f5Kcb(Ph~I&lAlZoO zy+ruP#dx37p?(cyaTYswOqCHJFRJdhM}|Wd35{_*f*#!vglT8@P|?(YL;& z)fyzK&fH1e75w3FscK;Z*`*+QoI7fE^lU>z<5D(UIF7m@iB7~D(?#Wv^OE4NXhcL= z!YK$C8;6Iz0OvnfxCJGGq46Kz-pr_lo2}C;PSC)xP|NYsBfTbI z6PbS*AvgO;SVAQzH8IiG;pi0&4byWq!J$NOYJ>+lMt|SnCv8CS8qK7hb^u55_HD){ zO+Lm~`T#Pj&&8Nu1<@(|^Ol!Eas>(*Ma=oz#)gK=7PpAxKe+;h;GK$kpVm@Yzp)v$ zbj}uv-%lb}_z%$v56U4u*cG>62Qs_nP8nr*$tW5+MV7OV-+|b!cEfs^{*To(k&K@i z0$2M7U)ng!;2vU4q#!Wzl!}-WmOV4&G;r;KsY5@-uU+JZrPZ!JVvlcNUU0K zyzoHE9=r~`7J&LUOZ_!@J;v7}x7TRY!YbtCnIsZqTPv<9+@1u+gDD+Hl;N7|(ci`M zfKTW^4m{rrgtGDRr0V|!5QjJ1k&su9lz8L*Neq!Dp#t`L7KK++2&z=XsgR2|CIkXw zJg~s+Q8u85K^_Q>CxX@^(37>mZ~rF{DUfWDxYv3yPv zx;c_2)8*LAA+Mc|Xk@RaHaRr`$3cev0R|d=(@wDaX~2m^C~Cd$1aq2;-5F;9kQ2Hm3j5gij`-BJw+{q6bUdj}{xf*nsO! zq27g=lC%}KZE;X1M0cH(j6&@STciRoROKnvpSv^Oqpsgly;Y*Ois&AFtSHwSByKr6 zQq4K6^s=wBFDD?gc^3_-gGAVjv@lolDxzb%wa4`p0<_Z+WCAmtAl2tCX z?;F{-POSPeN-xd#Hvl!hVCxj?0sJwORmIi}xJT;%f%S@@eSC!e z3i|cl=;+s~t5ZJ;kJrp!sYn&AnUm}NnZ~@tskztUvBtSys9iYSSp-C zHTw9>uz%HP&;PBJK!6~LjM0n88B!LP1K2FOI(D!djIZw@YSdS{Bg!+yy*-9 zKDt`UIB_T_#E@reYfIMq02fQhmMwVRv$CdIWLk_gom3U7XO z3~n%`J$UiJ8Z?BR_DW10u2x(xcOu7gwH~_Ito`_&_Z|zX_RE=) z!PH=Wtabk2WI5Y&F!+jMa1r;~k3C?Bp7tZ$@-i45i>O%mzm@|;mplab4O0XtulsaM zF+A3gZIz0(ko7JkQe!ouDEZU1NEQ;i6MuAI^E}_*6ynz{K4iGbEj*~bDZw8OLW7#@ zghCo9)vKBciLcK{eXLZR#eQDSJFFe*?M^o#x0I?yDCVtb5h->m#iOTnEqa(Ia_KbL zy%_syPhX-6CC~|BB^A9R9S1?55J`jCaoYdQnel2niVYu9s((<7)%I7sS ze$`0?3Ht}_aqzz1LWB!fKcLF{OTn=o_nyqAabcJ{3j|zd34BGEd0Auf%Y%A5n_)m1 zqW-#FYynWe5Z%6a$FZuj{K^n-z7x8Ld*YSMkVPJQ@7!!iOnH;WZCp*>qEm^oZ5@)Y z@WTC^RGEN;&w$KnZ!XiD#sc68wQeBbF;_~?eG4IuRQfo1TB$@8B0VgDJFvRaDNGf1 z8qfhJVz7>~!Lxp2hKzg-jTLnim(>l0z$%5e@>c^R6qPa2MY|%(lGhY^dm{uyQ_foRF2`J-Z{jOgg>dxvN5Zd;aIf z*MkYJOSV=e7*elZK5+t^4f^S@tZBaR8F8VdYvASob43PJZ|^zU83IV2q5RtfmQ4YF zmq32ATjJgens4U~f7jQyk%J-80{DougTx(S%ND3t7J?+)H5O3)N?pIA>)%X|n)pOL zjd3!2Mqz!qL3#sydFq~ka9D?~a? zW;qzs5~9-YPvk39#pQKBrQ(P@Yw5*ZSEE% zob|?$PVRg)auJ8FD4OjSv+%I-8P^@L-!&4}msqm{l= z1(S8gx1^=Uz!$ySlq7nnVr)x_q3QZQfoewuY;}mF=ON(=?tC6Mt*knK50D$?tzkfZYej9# zZ$~S-UvCcU|2S^!IR5iP0O3_=hq8ham_-_gz8M*hW9s|4AE`rhT@Vy~;YWfMX6@$@W}GdC zc(whh?2>~%BtGOtP+*pVZq#wz8~zi!^7qkT5EU8IeQzjT^o3A9mU_s>{4r~-z-_{j zYfS*k!T*loR}01y7b7H_zar-q;uVgjwHnfFrt6s2-E`93%Ck+w021;4OWsoa@* z{hFW~YiFbL1X1;LmXT<#reTVU8hdlyTEcS^lsnm_@9qokYzfr&5?+5ZsZlPI2F$cM z)J?F-77lMZPpxh4T7QM6A72a=T)OPeRAJK5#iL=4VnNhvM8WhRu-#RVeM^^ zd(}GA+kThz#nP}3Ho1aU7R-Hm4WHDIv{OPzGEXT*R{0 zMR9KiTXcQ_%rdhoFbz7fmRLx>-Ev#NFNP736GQ5G|BTUWv41$pH$3x+1PNJ%|KNlY~4HWpwZeu^W79@WHVXtCeS zBN1Idb(3Rketpc87C}P2Rs`R|z-7N>@u8z0{m9kd1+rl^ zch^9Q58Iq6NF{G6dL!$KHpur7Gvf3)+fAliQKe!&W3J|cJvfXzt0Y6H1gO3y&-Q{2 zjP8rWzpPk(SiN8`a>R>vX3xCvv_x0;e7ooEveQy(t{V^(Boqp#=(<31#8?ExTJ2=KMoT@UBZ_*oFV<**A2-B05yw zuf}Pf+DF!#889*-DF*9Kd)&IiG3&jKrA^lud^c0a-M+XEw8w?^}ZvWw0w zYdW=5Qs$kAg)%|5u_nMI_YedP7Bby@{%f8U4&6HvJMf$?*F`r>8D>!)ppQgG*B1@M zsa)qQF_P245UfnFsEr|ID~4m|^EirMV9HEzlp5Vv2D*HOEC8|thg%ui$C<9@vb9x!`Z}$cI-PW5eS=)5ajiYP z`=P>_#7ADqoX`s(0B;ft$|4YN5pM;PH3es}iM()cnOwB948}$deF2wqvEcr?>0&{H z3@%2%$Nz9J@onGk{;m;CqJ)w2;;?~CGV2D9aSSoX$!_<~uQ?F8&M^pc=`15x&qIBA zHv7UpUv(Wl53^XU8KDoi-d*A|Qcg{<_HPw(y@523{^i0` z$z~)(`|~w(6qOv6V~}`4h03MV{?V&KU_DWJparN}^97sbo&RfC5e7n}H;q05B|NV3 zKjrjh#Rt>4zD1bFh4LGd$zM`J zm2YgPrQTWAzWJrkDpG`m&G2O_l>J!f4Lae(YC+ok+_$Pp#ipbApXqBH58+pY=^mH9 zv*!f`KTN>y*$s(1NGE|#DCQW(YoaZDhl_ex@{?wU0LBM3s zds*0AjJFzsm?mt`THMd=Ga{9Yt?kiSB`XLe`~$!Shf7=JZQBS$oNRnBZm8f z1=(M02>XtyzI;9|#3kC13(Red&|E5QQO8Ob?|t7=r+$jg`w^^cS4j^tV9@Ab&`5P? zp_?fZW{^mX2{H{cGsG+qW@8X3#wZ7y&>jDd0Z$#w)xk2T$g=4t?LICRdBQKnTUX%H z_AfB#`B!d#Ndi}M+R6haq9KgmqT8Rg68?k0V8G6&Z3iVe5^_a2`C?6*DZUh|F4S%y zH_PwB!6gg=uC;uO0KcHp6@gtjz{_05wiF8c7TPvv`Y>}0wDTZDxyq5U_gD~z)-Q^E z=x-G(>pcxgWn_0k-D^rUtQOK<Zca7T7>z!6cm6WM?`<~W>Ylj(AIXbdjK!>G zA1}C-R)Lm~7pt)L>mMt#6LMr)Ov`b)DOL5Z+n)UG$Lg*#*+Nn(P=CEKm@d>_KcMHQ zxJwrB5(}d6j0(h%1&TSP8!(i_lD>MzZ?4znxL073ld({BfOfnw$iknZ({y8+uJiufCzt6Ml8BSd-xWP^OoY{z^Ixq}tN3FD=FvqM*du~WLzPk0-U2X-E)fjy zq9*4lFQ5LQi6CTj2S6}!cHfyQ5}~lavQph)n@U;9@bZOYZD55rVzn4&s8o#Ps&rZ4 zkIL5!QE?{J(@N!X)M6Deqrbm`HJQIf^>#$>OvrY}L6AGiYM;*NKH&zJDvkbgA&RGK(N8~)@?pW;oG4;3n=oHv>wHm>t2=rPl3CvZ$u)Q>DnZn`o$Afy zRct7^X5x&$!WDle`{bsb;{i6SChzLd>@E(;wsd_X-dYHpZ`o4C4^`&UEh|_@NT5^K zn!Sf-hFneA*-x-$9D@t9Zbt9WQz-LB^=KlAe{C)Xaf035ee+OBcCd@bGzCd+@Lh|{ zq%5|bP)CoyQ~pNv6Gsga@DiXxGzw9s=xr}k+*lipygbA8xEqg04O)4VBhI&i>EHRh zuOy2nIA8GKZsR$RLeonm97ccli~Z%5PUNXFPi{V!2jY(I?%4qfl8#g^eU5So{a&4n z495K6UVX91shQ7dZ0O#1@7m&=<7rj%(VTV{SU#98{2-S}`M6(F*H<6OcZJ2IQPp*9 z*mpP{pFUlc+@Sl;Y^*pSmD?%9KB#+ddn^$+;6@l(V;(v5)2=6tm%Bu#<(ndn?8@Mx zcV|`r@|d*ZXBN$J&3(#9ESYM#`ZmkE64B|Q5tPX2y5lzMJy z-;>AyocYx8SKS%~byQKhc;2)}<}22aeD(9oNe2rnA)$i3t7rI!VGf!fbTsQ75S!f3 zqHYivaKA-+M@EnG);qOTnNM1Hnp1bEpYA*mS#@+|n0KGcNOy2vOP+!0RX(NhxZ3PY zFs1OizYNRSIq4>Cwl^Du-FfuJdQ&_K%0PAJW1_@2zNfW|bi-a$b}GABu3meBdpE=t z!bO01Xeqr6b1f5CQA1GU{$uPv6Xusfa=g7=g99F=h(3O6$)X%1#Lhf0;# zhpV!~g^uP|u`6fChnYfhi-bv(lcy}M9{spEA-H;~F}?#u|q2q&m?b4{@8_K`K` zufy1B2IPV3OXvv5kZ)F6iymZZA;0;tAY-OLK7+_K#-C@Tdi40+$VA88V^H-e3+7`y z@J1DrNP@0D>Zh<1dv zgNdHQpLSk5ny;IY8!~Amrc9Wz^x_Pp2Yq7UJ1CqfnWG)D zPIqo>1RwIlR3)wx*&JUId~h8rh@eIDY&yFxN?>)*HEJpntSB*W$^zpprd)+Vrx_{n zaJ7MFB% z^tV!#81meM1AAc_8yxE9ZA8+ca3iZ;G&<{fa=S;%bl=wXo)mH%jv z{&xypiPCw%0izE<^l=Q?C3cC`g+NC+>10@Ly48+3ygfd-*m3i4$A9I};Jhc?eQvq# zKrP{~UjC&jr9{3eOQYbjhW}o$TSg0w?)S2z8Q(1yt?l9RYTmkg3}2J`GGJQK#P`21 zB<#8itylb>`!_b4Z=itaphS3OD&05}FrGV%@sFF-*?4CS+ZiHE#7kn|M%S>V=><~B z($%^Y0|po&oMH?4qL_91WFPR{5)5mBj3iLJ&_=J*k*gPsDs(9`t58i!iOn~;6JpYM zhZLy{hGp0Nk97CW*ZAct(ays0RD@!kDlDnLJ2x6}iZqN*h0MQx4@2LaDT<`hV0R(_ ziHcNbnXFf0F&*JXp{5;|GZ>5d0XM{7(=r|tKt1DKkkQJV;Ek;G z1pzJd%k6E;kLhLlvgX`CTmHOmcXp=>6k{6b8O( zA^AC~L4wJ%K7Ic4np0t7ggR^;L1NzhR50D^E(c!u{ihzPsv?z7N=jJe5?SfNMAX%3 zO=(|)yQsF|i#q7h=UYd6l<=9hV!N!b*kLuL)LGA3WbgYE_~~mkIl$9qFDC)3NPe zETVMwVl%A4XNq)G8sD6MFGW8Zs)z~`W@D560Ql27`Q0-AL-0W}{`Rnq|K^*CPsN{9 zx7N;Z;0r~Hq~e)-(IIeoYOHyyKd?Oa7MiG%b#rfd3Pc!&yR&i_$#1kF*<#Mlc~HnW2Y^y%Kvcc=W#by3?gJ{WSe^PE5wA<(VXuK z_cuf!&q!6)H#_q%GrITHV{Y_lVu(lHq%uyQWC?eBM`iywNiLpwKH9waPO^wIXP2do8`n&m#>uEF>grFSHBULsKmH< z-*S825PoudWp6?eGSzF|Je&nqwJ&R?F#G%SprySUqOmqP%sgM8skl*cjMve$ksYzU zyqm~sm$nE5{bGq$#$kH5Zk^iNYaw%)q-+WperhrbbzmXem+vWs@X1kyYZzC&=$zEJ zwB?|3|C~yhg|O!x>0kY2!Hu|Yz_;lsph@1SpCpz1_D1}wBjNSYqMK=mtsf4_ROM5W%j&{~Y> zP3VE+BnI1siRS&O;x1(1a^JH^EL6FcK9r zcg96EEsE<47-u5xol`V(#Vj!36Ku7@yc7Xc%3}WILwG6~N>H#Sb(TwrH1Mf!+g_Yx z;`{})igg$eK-Y@c^1vx+HBllhwY%6N%h_S|uyf$uiyFn-c^4++#fUuhCa*6ZH$WTN%&2^-$c&JBBfN#O={sF z#abCDuRjE6cydjsv+y7hQ;d-Z6%U@_En@ctoD&;5E{G2|yU2AVwtieB$RCt3A>l5T zAF@!Lvp{}<5pNBz8L#w=*S!Q>Q?ZbBD@~}c9k7RsFIYVf&z$*#->BAk;9p;Oiprc2 z0+c3p!~}Bn`3OE=w;>6zp)U{eM_{3#h8ru5DNm1q?bADQVaOf+EsLmoyvPNK1EjDM&XPkW^Ay zx=R`q+;n$Hhjjk;#uGlz^FH7Ao$>f|&6&%_=aeux*~zi^UVd?Ywkj8xKaLQ$8Td;!v?mmyBtx@?+Y0 z+w^m>yA|?QLy25pD)5u63nq!EmKK!Lxj(SypnM=b>N^DHZzvL4YMe2$-hZ$70hvAF ztYV%RV;4?q39)`hgh+I-a0xTc@^c=~d{bjY=fqw=(Db0hM=v>V%kqv)5PEe%4=D<* zRxvqOV*GRlYb1o)jANW0=bKm+_4`3NZ5F zP*vr8mYFKBv2uc$>)#oNBXPrhAVH zO62y-K0%+3NM_-j_Y7D>Eu527Ytva<;B)6Fz&F=499!0x5s>P+U6yO?6X6fTcBl!ae{k22OLZw(iOpP^#a0{ z*>@G`54S%;5ebF94)4X*k`Og$yVho7sY9H9e$ zwE-(q2vq723*g7$9gj$b(ZraI@{q3%{(LavYl|%7{?oh0l>=ugZ7D|;%%5Jh!!dzs zA;yhXGNgYUp8hAy4&nV6|9MZM%(>r)?ADTac-~+f`A9$t9M7515eFQYt5Kp#l1&OO z?4OMr(8DU1nqVe)j}%HI{dhyWa`;8R7G57rDtVr2L!n8aLg?+DwH;LwPfGIZQe`L^A+G;b&q zf>lh+1Z!z&se~sst2WzfUGVL03{Y|YoUVqvmsG0Gj^{C>C1y8|&`F~}wE2>IFp6#A z$`g85%r9q%Asy+!&%HEHs-gT!leJP}rV~XkixU;-Q|SEZC3RN&s)+`3HE1#iQsA(L z2ncB%=`(8-PMbyH=68FJ*#;cGqrNXi9$9mo`{t2n@ZjX_z8aG30pW(38hcyg+x&EO zA0by)9!76C^c~e^R}@2FDNcvU)5CNx)khZj>b2HPT%xJY=RPr8^*wcAdJW$d9@yh7 ztZ{|0t)NZhh=-T!=<1NfKeBj$A{qd7NDb`@=bn>!fAKEX2iuz7h&rqQMvfo8;lPG= zqk385#J$ZF!AMUp9<48e`W83`UOoJ0&E`SmZaWMbB)dfqFZ`y;^C`(kNOvi8Y5o96 zY(o-}94cQd?YU@Dz@&wp5>ux*RYkZB6!61z#;@(}$l!!hv1p1W#_cClyB;1I`ITOn z9rhgRe>(Z$+R5ALZFMpG_M#?}?|L7w)P$5;X@+*(*2%l)-C`9^%wGf_&&vTQ?ML02 zXYk%%*AVcZT^MM=>c!fCq$kum?tLCVqHrmc?5FEemh7584kVJ*nwbrcNbr!)noj!7 zh4n;DK;H!h-SWNDRWINl?|KUDIPEOBJ_>gJ^$$^KYuS}I<35FEDQ^=+IU z_Ff{!E&c^KaD2pjr2Zw6?xc`HNTNM_S_&!?g>%xl3oDAW>GRjg%qltKE>Uwhyvb_! zyZd9=bwxL#Pd{(oedcFp z8_u{0V^^7MNXQpYRZ0rOVb=%Dwi9L$#{F?57`j^ zfcpml2F8SzlG15Mu9C9-?6AoJTT`cx3T8G@i6#<&--6^$Ue)t4bNU+sk_YbBu3Y7a z6SGbN!AEp{T7@n1v!}qr@Hs4GLk0&+bzMxS>RxQfkRlkFQs6(ND<_5VS#b!2k;D$A zlodE&>u@1c`|y0M0M2;2Gq(Aox3rpR(@2n%psP=JnAr{EE)9%kqUKH4{kqn@GrV30 z6rOllZ2JCbGkoJ+ulP#Csm)m6$6jS9m{2Lu5CJa6Sg=*w##zyo5}P(m+l{TQgDiC_ zqI(d3sAx^ueT1(-I$>UOtqkpQy=Q~K`;=6}O~0p9!a3*+y-@!MnnL#p7~RpNl`FEN z>-FWTc*olGo^Wf<9DlrbkK-Qltnmga6gY%ka247^srHoV{gg&_5mEjthXNWEhP)QH zt^oMlXNM`SbU&BBu?&EkrNoELTLlklbO+<{M&Ve z%a!b*e2bxp32ui+#|PwA=W7hr*7~pT=v6mg;2R&3vFUYWBg8?n3y_|GPs8llU-wlj zH~*+p$woYPHGqi4OXop1PM&`EdzNyQKxhC34P!(^#FLXg#?zxVa?>v%pHz+|q{Rgc zjoiLO^w#@DQIN$FsyPQjC7+-^K=)^nEmPyL&=(iZiP3Z;y*R564U3IM#~EplG#jcD z!VYKF?~V-t=Vrg;6Am>@_j}IZ4;4hk6%5lrbpBX{X-5zvveiP94wqx5=9!yIALbhs z-eZ6)xoaV8ii8y-%J@M~5THBmok@e-3@ z-e{@S+7Fx()4}F}@2a4&B&-p+F1R!uE1(ugX4k9Z9?$(GfFlixD0fyJgd=I4`5rY7 zoUnG_rx=05ovHL)qI{N^ov*+P@9%h7;; zA&w(AfE%P|*6kt7u81U})>VQ%LX%VAV8A{{Pf`jzWFXZr{Tg9BEJOe%lH(m)>^J%p z1>tgb@^Owx(}SEw%6Bwxv&F_>YiP?tPrfPt&Ak}ZoBggBN2_%K4GAKoqlUkDDB;_< zZ|N0NJ~4ByeDx7`S_9E2ll>2Wf%z+qt0FnPXqZ$MldiGsHe8dA>@S6_6LeueMMX+h z&ZNm*&nB>{Uek&^BYy0Re|~_t=uj+-Fx1<%%gcqcZT`X7WaC#)R7cbW;pY|Ue+!_Z z>!z?-{Cc>*TClas!r!3_E3;-|RLb?6sJ2hhJt?!FBjGnNTf@LYSd!+l!`q~CajA*^AkbUl&?>>};+aZX34 z@3(e_-OtWsZCAz#wzs#7N>(0C;}=75{|G>@f>0U5YaMX=vGtA&)=S+~Q!cwJ2!i;h zqJ}%lfl&4wWkDsSD1C1E!!dG?kGh%6el@Q5?2MtsCJw+%ff*SyMPACldd`W}i>j$gt5{qgc9mGb$(W(MEJFQYm74!aa}#6z z#tpdnMBUx{PrpV`hEB1560-**aQ_NPr&&;s>kn^yVN|k?+gRModE`N;2cdiPFYvNu zjG_)~QrSDxQpXKjQ`O?}txEY4HWCJIX)(ZA_ToI1)uRWl5|^d1Khy-uBwxvYzo{D zS_-1Qqtirgo{&WDh`#KrmD1ojR?u|fpX3HU&Xld@nN;^F7b}5P>D*z2W_#DV*w6X5 zja9@OXRjhn77hkX=A8b5Phn3QukJD!Oq!e`pQFCg#c%1%>_v9=zZJ{!G}Mp zF_oz1(yxgZfC=Zs)2U34Zq!>TR&CCRf_js7wZdxGdOW4vkZh^-lf+%zJke8DTv9H( zvdHYHsqH^w<=}zhG`KK?N@Fbehfo-Z2xgPS$M5^Rd#7EA&-)Mz>UP+i6p6fHXSLib zLic@T=%>9IOy}ai;ISFZ80&&Cx4GCOqKY|SN>ZyL< zw}2+lJF?|1ARqwkFBl`+TPcm%pednjap?`Tk55Z;87|U$@YF(`Vj^{X(7ajUU+j~( zm%v2~(2p9RAKL7TJ+GA(@V5%%esg?4hoG&KLPXvQw^$jQ5E5qeh|qjZkk*J4Q@_R! zaNMMU=`^r!37lkw;T`fXY;9XIsKYi;ZxS&F*-s>ua$88ID9`4JH

%jD6c@xpXX1 zt$W6)m@Q4O;kfR`jmj~nv+xNzl&?_;F=*xWTDuN;V6mXluD&dRI!{l{KIpzR{171- zw9)+j*3R4flY@1U>NZ#<`R8mX$Yu-#c>k;qUIJeA?c?JrLN`XN85dxEE)G=a_;R=LMNrfWKl!*ThhP`Zc!`tOiIytu`GF{Sx7c{d#gka%yY42!jZQ zJb7Em9!8odh%vZBV}*(rP7D%-%)nISqa$}j{Z>7dsw>Z&?{A< zASF!6wsdxKz-q3uL)YodNXpIp2B-?_(_hL0-fqqWq4t#+vt$37s$hLZZuyN$C$=k#0bl3j6SbqVwosoDcN9h;Tj_E{FuS zd>jQAdcI9=?^56{e7U7hukxl0)N->{I2qIE$UeNmzo6=(ZZcrvonL!As=V_}o13JH zjZ=z4Y-1-eJm;0m^3{3Q-k)s;=@*e{ZV@#ciY3Iy-y9q>Wci(HX0_)Aa-hyn>=znU z+H~#LI6dE7zeUN#MLdwBwDpOlO*Fs|4q7|dXacyPE>SFhr0dIHtPAzcPFLO{Oa;hn zUBZI1CskXSy$XW*+b0Y!RgX7aHnnEG=h6HJ+A`S9(hO;yVQ3`zY3B@@3#e9FQd5tM zs4nA{8L5I;8fXyS02Rz1t;=DZ*R!D^x59bhrm=E?jxG%@P@eUM@qPB{#6F|+PMe$6o~nt~H?p=kjh z2mU~wCb%IDMg7r!wd2XeJeI|9mEPkjhvgs5=fhbx?Q!go)*v#U3%6YlnY|Q&{>@2` zyPVeZp4@a* zjYG<2v5msX*Uu=ySp-UW^h%$ov!OrJS$>psR!ftX4XTZt1(3bHTQ-;JHLPMs7AfyCW8iU zdS?`z@5u?_{^ms9(et!-o@}2YXCJfx{>Y2$;Hg#T?X?MqD=Tw@`GE}}-ScW6alZW& zltf*tJfG`%N6E^H7~JG_IY@FFc9;%Rcd33y_!V%q(+QAC@oxuiP=nF6ud>P!RPScyx2aYr zGwiU@F|z_m(&H$_w%@grDPX;4GhkIO=}h2!yidx*c#9bLARwYwdC6$a0k+|))?kf~ zHJ%tE`wWkig6t{b7z_U$aC(qCQ)X!$FQO2y%wi${WVS|?bI5I(R5DOECTmSpHYI3* zfn%*>;W#xZ&zm|tPH393mW6DZ%{-Rj%I zu||aQyP|EUn<5GLy8IR%UV^;1azh5OKrq2PV%yg6;O_p~Wcr7Q13*oK@#nnG{9{BQ z_=4+!)9mc}S*x##zt{A*z)R$EfV;PiiGVG(Ol%@1VW4xXb{nJvsN- zK90BOvd{?dKtpF8+%A35!-(8$i(JaQ=$~N)z4GHaeuzJ2XpfhptG^pS71BL()%4$Y=li&K27{ys0{HvryH3v z>rLB{)m9th+MyxZmy>({qP4zDO;f+UjJ5h0Ca>j5Hz_A6$Z`<`>Kl=z;s?}U z^d#_-*9VE8KT=K~&vprbLe=kuKxlwNs6d&PooSfjuh( z26sp`t3i#q#y!qyYXZj9slff@n;wQ2=F)f1TtqRu47w9*1+KqlQN8YU)R|&9^X3zQ zb&I+AW4a(=Q`21am&T7NkH5uwv~?lOnqU0bO7>`$+WyiDqW; z63L8~EBzAHiYyv+H{lSK@UF$~_cU%*jZ*e|$c!ET9PLN_JlJr(1$@{!Hb^ulu%zcjOx9yIb<_|Rn7PY&}}VxTa^%#Ko<9e5!f zKUPN*K_V-q#B_vso!izMJFl76J-S)wg#XToMt4sA`v)+8RzGy6PJ0k!Jjqp&>fl;0 z*6Vub<{R>StwojpblNS5{G>p=S}c1g%pFSCIXh_4k2)j#Be3H|94Uu~ZHV9}7J(A1wJ3H&H?>!5#ZPI;4j&s$rewX`^ zBJFmxz|Q7c=R%}UQh&l%;}m$T5KI&Jo>ZVXH9^;`SwAYAuTsji;I=aka8aZCX5$^1 zh$!L1Wfo%r8oX7bsHcD;IaR6Rce484)E>M65-YxksJRDIZntaC|1V`6q*wE>Hi)o$8P)VUqVL-gmkGB7e0-WQl#)L! zYFol&vEZF*Xtw~0u12*lyoOU=)SX_RFA!L^nCYaY)DjUBdBC<))K{D!dB2dzgTFv7 zt7x~*@xue0;{GrFd1~7glx|z))$5_*7Zf^ugxm+jW673iD3+s@5kS2dA&E-J& zpd)_wd-Ngoojuz8A%mn1|0Z8xGtG=Z@*h!&jqme`zU-q=ou{ANqB)-6G{~BTKQ@r5 zd@1-v{Z*Bt#Q8mfp{zr(ieX$l+^yt;sm2n9$OWGImoc8vhU_ZGx@NlrU4x($ToeTh z-Or_SG1RVPP8(Fj%1{dSt7O4m@J-d#x_qxQGpV*&?Esai{v4R;M2q;okrbsl*wE2I z=DdRSl+=>_8Gl2XQPasXDR(B^fz8}fnQEFr zO7DE}F=74%Kn+{Cn6WrHAyn|(^1E3)7505Rs$z8DYki!V0n^`P!oT_aG_aceA&-6} zInr#^lIAWYMQ)zWvs7yKQ*`-gf<9d$d*2vge41u-m(w{{?CevhBIcoKd%0?*b7Dm4 zI@l{AWZYg}ZzK6hG&n!Q;F5>?IXz&=1U1n*za=_L{dSUqSqHBOM2h(q+QL=9P>=~I z#L1N?h+A$30}}mxvGE=;yHMMP?3i7h)*!wqtiCfp=zR%}I2J%@xpC8r^Cfzo(USMJ zRM~Dn-CrIH`z$MFI^vHk7PGvY9;rK<_j_TCGCQOEfTVV(_ttP7s2}p|H}k&2X0#%m zX{A)4a8+<$!U)9cdnQ8-U_OfimvFKBac<=&mHMloI-ByA=!)pZN|e3e)BF5Z0lQe~ zv-T-*pNLRKYB-CxH^wY}xPK@IoY3KVX#Kp0t55Vzc^QLpA}kUQzSs2LJb2J5Z}r5S zuiq`|gnBe&sZ5~Dipk3H*k*$Tn!ZcN2Z&SKAjw`j9X~^Cot#$>Zd;kBgwltDLMyd5 zOUHZRp@`$bbQ1?8cV4uMWa9H^$>8_w)FCPGL5Y^PQ$uO8Se&#Nh9*O~t$vyw2xEPS zBEREgnX*lJ#Dvsa%~oU9!7}SxmzW!0Zv!}#Y62%1b6?$Bq>o?CT zQzh#2Ftgo5@>=1>N!lkH;5Je54kwj)ctYH)EttWoEbi!SF5-$?AhK;@%< zgh%am_e&!>`wG#W#8>y&N(xX^IJq6VVGs(c>4$)5#_Y)brIMBm-RcTEYq@0zhZPT+&4K*0+PEFb)g8>hqS> z!$Xk!iNxan3;}bL#T(*)TD-JTf5wRW85cYm6m}=X=eOuW0NavA&1|ZMtTi?gL>VldNlmX4*YA}cxlngeUU;#z)awogUI;B;*sgoT z?gej@%&Se1lJkQqXSxf$^u(o9nxPbt*KnSc!O3l&%1uqjBCVyxP!RlrYo>0N!pF+` zJVb-$oOZJUWL~R4$u^hmDid#0tQJRqe*iQEZ`(BWaQdc5nKg~gNaCYwkMZ-^u=!*Y zX@Ns#JN+k#3yg(LG_`nym4?d!-h5}|ko}ufv;*z6Pnw{TzE_5#Rv5A;F4CXX`hrZv zCjdTgsI=6b)Y5njZT^SUihWYrEh2_Dw4qPoU&?OitVV-LZnG71z8$kFsiMIPhIoix zp>nmS7CVQkp)z41!QKs&-g#R)3sxXq?!*j2ljUb9Zkf1t{q@ZkK6&PK6RUvlALnV)@(G_XE#ej@3ZrOWDH6y-C6M+ zFqirm?}H)y{Hqf?nRtJGZQcK) z5hYRYV|s*XY4`K8PJ&TFC&oSDjhl%ye1iE^EN-%sCn<(@htuv)49At~2+gH>u*mqG zQNzPy*7#0qUQ}a}X+l)eu)6u(R;a&x=@LR$hvMX=q%HB@67Qi1FdK;5JKXKESX+!D zL`d59XN!O{Q#?Atb3;h^y_V2M#OjK;U)}&2X}v9!t=%kI0gwjd`m^&vu7u4(f^4(@ zT5x=68FwQQdCdb6g-TtOR_PUt*WQNkW5ka5<=c1#Q3@a!Q`>*mh++du1yy8!MqEIu z#M-op2h?;pAR|=u)fPmA0P5}szRdV4e?Qkg^gr{EMBKISy?l?e#s(rp2nbFj33b$H17Ji9+1w6!dh9O`=;vg`Kp)2n{=#7AA{i{l^c7%U&a1ubo5lq8{< z;8mO?C5^@YOc(>eWs;CtrriMTi6#zjf=yI(W)iaO^}ePhT@lIYFP;lWuIRKZ__?D# z`OoWsC?;W%C0*NW=V^5#EGIAps)xW>CXi$>6 zpyyOD8c78?Py9kj6VQnm^;EC|S0@@f;LV%2uPY^)4E^nwnP6^D=hbpw)yj~iL>m&| zN0I*2mySxcnW%QansDB0+Plwj8x+nVBrDk}=&stJgO;~OcnTa-)zp|1JkeKm+%}Fk zESfx_n)Mf7#v_mAH^I9Y7IG>hpGEu{SVkkyHlfD}Km%@Tq9l_vfMgW#q=Kg2T?ARY z!`$xRv{s;=wm|B{Sb$9(^@n8e#%Et0QGZ)xfmUqG)BDwI0TW{!y2s6|lF|Q~$lk(0 zk-c-ulC8uz_k`%A9r@avUUCE#V5K9Uu5*2YanS`6=4EupzO8Qyvf)F#jTm#-7+wMO zMe-xt{%zYE@dfScm?T_5jRmzPeunJ(n>h69*=gezfn|x|QBl;$6~_5jrC%~hQMT_` zV^YYap4G9SSm~r8r5^6T4+_uN90sa*M$k%EIm!}+$M3qHdsqzbNT&q@0hDadAuhK7 z3-WclBu^H3z!q4n(%;Qp8L;rQo>{;tbSITb2nmGbw&TR^yL0A0N-hlamKrG~% zS~8)3dkwBZSM(s{YH~8Zf8P@qh!iMuU64x~7;;<-*NW=4YR&pK8Ou0Kq$baJAd6V( zT#%};XS#{#RWX$gdXa%^ByT@+`m*wsrwu4;prxgxplI0ggU->tXaXA`aZoy^0kE^9 z+3BBT`N#t%Yn?yn_*hoPmytRP;FL9!Kp)1@#E|paqg+F)cE@yT%H7t+L#F zNSUuSUB@ zF45qC{5-LAUixq3Y|uonh{)St8-8PiCwg-0M)&WHq7;c3yJU~hM~cyO7w0{!c)2?J zi;2w6X?BL3CHTZrUDf2dhT*2l&#m(|q^gvQEPYNSdM^&-xU6^sCa2zwSK3gC-z>7) zYS0+>3wdhyRn$I-#p7y!)|6ay2AH}>ndx)aZm}QZ)iVdo?d|e4nM@i*jG2{^-I)}2 zR7ISNrx6oOL7<*{g zQfiK zzx-Da9EwaI#Y~C5|GZN)Y`b$P-{+mfGm|KnJ7LjI5;pOay}U?S+KCR4ZN9}A^^NE) zXdsu63}~C2;I7dq!JUl?ODTEEgpf2UH$}M87?l%I#=rrKJj|ithB3kA@cDjuJ4kI2 zAGgpM_J7D9AF8?&zlF#YN;oc+ybA1iE^6Dy7_fIpn_VSJZla?Lr!KC~k0kTkptOaq z^*w*{qBb0SYNHa2^(eM0CIw#UI>L>Fp2M3+3se+w&WRNOJ+ItIU`O8lK?D3E7S=Ml zs~1!a2MlKx-#B%D16=}?e7zjA2vhb>m5dIjzpd023{`K>7bOa30;Ymf0BrXcsh<*)zQNUm=%;H~2gbJum&8{CsD~}~&l?EFTvugI$$_MG z9C2xBOU`N(pMVs}J!k7$Ll@rT>;z_91>6)Yc|szWriJa?Ext>wdd%0L#jN=&;JO4j z2om5rC6AYQ!1tvpn?dB=56E?>Z5~cSJq^7wmAPBbz7zyN?vI_?5OcXr*GJzm%+aeI z^}=kJkw5h7D-3~}APmtHxN%d(39={bM-8hSC0-bN)7xkO%J?U4KCjCiqG?=-R!l7L zgBG%~f@%kh^sXp72$T~=E)e?sc_Tfv231fp%2PbhtnXbZwp*s&>L0$(c*`4+u19v@ ztf%?x9uve64j$gEJ*z(v5Hm}84(IeR(QTJOC1v1!@zU0|fo6x>d^GhFE7LyOU~EEI z>)__+WHGJoQ<1V70z4qk3PzGhIv@cj!R6=oa{{3Rj6>eo>CJ?83%L86lRH}T-PJdh z)5=;TJK3PkEAyJ4LG}3ayyI{4t%AKNrVC%c#Y+J%vD(?yv+-3O*tH8?lSnx=s35@& z4&Uu@0^fV=mU5AI1z3QhI{O#$VjPlRt&?5$FzLScH#g~7fMdy^wmuoMaBGQT#W=0t z#rvPX?OWXTD=5q&5WR;t&{b$gLxnd2)T7AQ5At6_zO^cR1hQN?ng|JvNzeIVBHw#z zJ|djudUQ)bxcVl8JT7H#B$CX+zJGrX|44Gz3PdKA)Utn$M2Cp_s0wag9K%@2ju;Z%Bp(7dYE35?D(4>V}_ou!g4y?fQr%wPcaJZNKuXXCB?De5Pm_VaNuAPbyQGCoM81#E!pZ`c4+$ri)n0t)mgu4*DX zVpX8M{7cUfo%}ApX(Y@_kJsA%!FQ~|twRIFf>Gr0E_PQzw{wXQ+!YZ zuQvVBQhCzyQ5)CE>_fnot19RCL$ktjn{7=7 zEN_NAy}$G2gt2SJ_QEDJMLsKVr5L7%O;4&J z0VWzg`-~L$64unSv=%f7#?lC70Ral+ZtU4PeUJCd{dIEuy=zf<3cN^e_hMiUUIM_iOahpUEJr$VmJvI@CZX82pBbJOFg~>!GR-Ua?DjLuyQ{{kFZa&eR7jNYkbD#iQOD_bjiy9~fz=`rj4Z%Bb0L#aSn zHpE=HM(LhM0^ibaU_z~Bg>sNiuTmcQ1}BPUaw~jNR`SavZ?)yo?DeLTr#V6aQ2p?| z5O)TcQyZ66R5$9w2QapXEK8^2FEdq~JjP-Ma0StJji+u&Ls1~MH;`0WcA4?Uk; zPQAR?6%b#3>i*r?Q+us_=9%5>CmN4r29tFrS5V#yY302PL_N8Y$P?4n zufCT{Ob1w=TZ}XwE`=srp8j}H&6e}JCYYtoWCJc#H=je>u=@N()8UgN;vS_5s-tY9yUDbg zbMLcVcAwU1FF-yP;ZJ1iz{SG2E%^47Vt*aFe(8aOEtX7e391^_MoK4gC}G#HU#ChF z#$f0*R=Q-^&fb82@(y zpkrl!V{%401>V!JB&;CPAYT$teJ_xv7tLTwwyLMzA|v3_{`1MxO{bh=p=j*9BKa65ES4DK^3Zu>dwLYqQS{8Aa*Iz8UN+^ zRUq@Vc`xha2=g54=Ry+dxGX9?|7 zGT1b8ZGu2Wrie63-?D1&qLYl)x8;9jyk{}jwH@cO045}6V{AFg^*!QyQP=ud`9Qqx zZ<)IJScrG@w!*)pK`$nv?=6}OI@anY)y}Z4J*Mdwuvnw$vo=r!8%=~Dm zM=xU^jfo1nZsH@TigX&Ksc9sH zpoS%uRT(ajf=%u;w0S=y8X1SM1$dSjmI~nJ1Dq~Wxa{2tTp_WmLsoOnPt3>tqI$9XfhwFcrtl=^&{3C3W3O2; zvP=*JY2z{|N;iv?_djU$n~cNwPIvvAur(RXWR^a>hU2nH4Vm~u??YJ{7Xp{84))Ce zg)$Z~cMv^=1r&YPUw7UQ3PnOg+5Z3yInmu>wo3n3_(hz)^a~AM{4Wa=4HjlyOZxDH zgM{nz(EqDO|ArF3qcXK7`<=PIc@rK*yU_U@FobTD{E(1=_>E|UmU4~;RrwVkal75E zt7~JWciKWoY{v#8B|+VEsaARd2So*T=bdq{uUE0CvWRJ3$(Jb5+iWtSCWz#yK1}3L zC(Hv{Z*oSm6h*JQDMOFX&rZa}r3G{Z-xw5&XF@?|Kyy^0 zFg-_+a(Gz8C%MWDY2&s(u4=9~LrU8IK0B z!u7j_e5T>!&FNw>cc0d6)a2s1#c1QJD}BMh&fyY)4c{@fe7bxq!B98Mz)2^EWPypu-@!yu6njJh?F4JZ+Mxli=CG+s

pjEEy^^}EXU16+asNZA2>~xJBQ&V4&7t|hybEr6O26RkXEv? zk4`*gKu;Fa;684<9B@|I@cCsgkATq-0%@~2F71+sFsE-_ledVnNw7Xvy08{v?Ztd4WDn8(cHD5|xB%p~vE?zlwUs}*z;E$%q+#QSb zyug`0i8?P|O!#$j>R*|h-!2^QUv-EWNFr7H{5&F;Ie}XjFs2|AcN5zA;b+ul&@8Da z!^;?#TIA!$(7)7{2ZDQ8^@s!-0DRqazaQGyazO2lcgUOmqsMfXr|o=BTTVX-nyE_f zcPuxd+0PaQqKl5aeIuXa{`h4(Zm?oR(LCnSHxnem>5z4J6OX^&Kp^N~3*&jd_ePnQpf5i6A<=Sb=iL$m9E_EwbzxViGe2~BR#Xnfa zB-B?DP;i)NQ~&ld;2xZ+LBADtE`I*=7UPd#Rt`>V@h63-FXw!g7ktegf)&}(OJSg{ zV2o4<(TR!nSVI8F7g<&CNdjEZ60QqcVCRvDCGpbV-6JlK4h$t95%cQA2_s(s`c*xQ zB=-KnzVX04Jgvq7(_@OwcED)UMlj14BohBlbNsnPf8U|t#i)qL1&NOUBfN8&o{z)b z3-qvi45}kClr#ZPj#LAT_o}MeUmSllr16G~%L*E98TEgy#u`D1n4bfk>5XlSQphN> zLvQ8-4>A#TOEWH0O$acA*ympaWX|&euR)#D|qDGS?S12XyJ&h^@-Ph;>5)qw z^_v7DK8)<)v9W$kt1-*5O!3FWVD~NN(<7;kf54$7|JnIg^y0j|(d{nBii%ni#_x#m z@7Lm>ID{tWTf}R2THbflJ0!tzWnU_bGp!cqS!2wCvfEV_jPQ+)?to7A^zZ2=i0mI{ zW;=y|)PCl%@kAsCU%Y6P3rU|DFg?R{L&p2l3m_vMvRnuf+2A!dP!y2_;6ET}Bt9sH z8pxH;q?UDvY1DYmOnI1hJ%0WhYw>Rz2aIvWv!r>sK3azHnD$I}f0=2>W2W`O_s!mv zr1mQY&}8x!jN1g@ED$j;h-4tSOd7*~fIO2V8q04rCJqvS9Q#K}7;3o!`Ny_v=Ot!4 z4zqLH3t|jsSEmLO{?Ee3yQ&f~(4BXm)n=#OXk|g>wysxJIr=|z*2d@@3qjH`$ns&=<{v*k zJ)r_hPwnYbkeM0tie-d~?I|M&Xj-_y01sopKaz%s{NA(hM~dsF|0Tn635&X?0k z0{NikGF1r=)u&%#LhdyRF|9z}4Z69ePc|NOw04?m7=_&x1<(vQ)utQHWP zu$q0D0^>5oxd99t8MKqJg@6j5Al;tFnV{4MLV9|W0OR>dzU&BTp*U_HCD@Cs+O2V@ zH)Fzt8!`7&rXwm9t(L!VnqUrhi2|p8{CevDv!m{bijM+M_k;2#yODu&wOWJi$V z`ahTy4%8KP<98tw$@a#D4nt3+NjW;R60Wx*b@R5^egrGnS9-S{lGxXg-hni1_PnpLmg03mhiVrX#3)pZ*yKx>~FySaOZ8!vJ zE>7dY`(J2ySR{iAc?-?wA<4+Qy}m#^yE9*l!#oRc=~X_mB}Ki?`7ljluUJD$9*U^P zYHImuu-^Ip_vG~NHu3V>2Y?$e06hj#xn}hq2lmor+`Z8TUmO9%1sQab^@Sq;hVHk= z_mH_JnWRLQeUV9&>tbis>Fi7X<`k;0;oRK~$JaRwvP(j}(vHAhO%LxhP9+ z(DgVRS-0EU%95VS081D4+xxZ2kc}`JXp_ijm!p8J?J|^F2DPBd$AydUK~f$gidju2 zI?sCPn*m2l6WYGk=@ix4ALls!w{rZAiA`B;8&$5CDMt3GAVD|v0vCGS2D{!{SAEL^mD~(4f%Fq$n;P;xk-{g zs_T1!!dV)c5o3y*gv>e|-_m~?=uBj%gYwOP1IFL~_mIO2OwUglQ#?zc0Ef=p!fQL7 z0pK%-tbf;zy(9N zv2GIGvLb#iy>{no+*Y|F=PdjBEdOF@`Vp)QqS;u zci&q}-G|4!oc#Z75x{*c^!`uktv54Fkm@4~md`RhF86>qJ zHB6zgL}|nl%=Kg?5Zl4V{d~jAu8U}3q8e` zY(Y8reG5#G7As?9up#23_e-%tz;8d}cX9ZMCq~+4b?V}YLRdw?6tz@BqlNSTvG?9_ zO)gvis3KBCng}Qz3n&QK=v`D41XN7uAXw-EQbGwtRA37NHi}Xe0U?CmAp}7{ktRr& z#88aX0HK7Ea3{L!*>d(~|IYc{_ukL@4?ZSOX4b4(v&wg^nbA3D%KyyfIdfs~9o~+x zne#)>yQ!jTr}bpziV`dB?tdr>r9a$u=>+rJq3EFKB9Yi_c7ae|*XytLZ?9*e=g`=+`A>gb zld2z<^NtjCJW zkG3c=nU;}0W$=N|4oiaOvvv(}YKT0l4hoAI*6^u|wpI^VELv@M^Vj8<`5~nj+Qaeuu^7g~i>wg(e=CRS%rRe0*7{MjHbE-zHn*70z+Y zy$_8$V^ksE?y=1IBkpQwhz8!jZ##U+9XZou*){y;6`cBRr9aNc`OYl|P2?3B^r5FF zLME1#GIuDda!mO_kLl=9@gHr8#`H|4buSjL-q5`8bmx=k#sbqCukP&QD2VLpaWGi7*K?`}zERudeIbq@%@mfo-|iacq4#@kZK4Zh z<|w>4p<@J$)20j%$4Ba_Chg z!=L2k+bGZLe*VfLK77eAYhdx+MXIeM#{wtV^@4F@d1pN&C!X z^KIz$x?Pc*=nN!X@q_yn&s%cdB!^G2jZTp@g;q(hw*h=VX1a*a)@@UIVa-KhE7iDF(nbf?>+W^?Dc)GRz2#q704@PPI zO9K(@TipCN1>&>)*4bH>;V7fl_s>HKC-lqK2)92?jPAsE!H_{qWe={{o&3S-)7TU^ z%y~fK;N!+x+0$<&_RGo+2eGgANm}{)NL>{UUtr$n+oprj?R>b*VDdpN%hAT;vUV)N zF;aJ`iZV-{DWCK5m2VisBMa|u-z_+CY*|j(`_UZWcgByB}?T1pa!$4!LI<+yAPtn}{l1?LAFuFQO{dy{LKvHXqzjZ^Kb&|#& zMiiCZD{`zx@B=^lvcl9z|_9|LW9e4LzdC z1|w}=Z?!}-m7W)YStarmD@is)$e+xzT)PwY@U>Zf;atoi87T+$Ny6ZZteiD|H|Z_w zXdb@6!a0u_@0(W*ydu2kLKZ4@Sd2z^d9*)GpI&Tj@1>%%va?PKyx-(UzeCopNcCze z?t?=vM%?L)gtBdp8$r@S4@2r)b*kRPx!Ez*7-lf1fHVL4ha;hS zs_EQbJ~3K@$6E5v zsdp~)s3$5=qn-1@n>KA)Tf5aFp7P7lFB1doS^GNuWyrNnXcFTt2D;+S{9Ib($D2vE zhd@0G$SkiEh}Sjyp`Q*!(%UdPsh^nW z$!iYN%O|tH(b%MQ>o7+>!}eXfnv!;3pYo@jNLeFKAZG(qrAe^y2SeW}XLb>$Y0KPdAGT@%MZ=r5b36U09gr z5+=)UVML6jjn_;KR4^9%Xx`einXW);y0|2PGhkwiy85l@Ub7q9WQe{2m*aTp`wqA+ z@3sv>A_i?4$`?M^pbZasGyM81*ZSSIA;OeqImPZHTE_DVnZE!|vW;WY6l0nvAjP zR2G{;5G_h%`sKUO(~l%;kC;V_qf2ZTk@(ksMDv2F{1bA8I-lENR)WPAh5mU4Iozb> z(KxEdOp!Q!pM>kB4@WeS#Vrv5oFZ+zH)|p*4foqcbsKpC%Fl(}O71Ld8g`1%YIBey z47_6I5ILL$KFhUP5Z6dP8)z6NqooAv-+IDG??vXR-;MI;;a;Yri&UMBv~EyWy+ofS z#9CoFH&VnEd;7V5Z(1^B;6Z0vvv$b)?8-FxDRCjc11hACEf=>~BQHklyX-6+o11I) zAZ$fl_g!X9+yq!mk9zj#P)Shj2^z&QdNT!5_5|0~$-mMDbtJCdatwDq&Ki|=QOD>VNBVe=S>y`0I?tE7BSy)TrV@PsSu3)oB`%Fmt9mfv%2d= zGM*%}osbB#R=6?Vl{-?3vaYSyLye`h{Bh2|bAzJ>+r4;qAP3Fog`S3c4+|67Bh{B( zd*rXJ>3Q@K%A_=r<)TOhbr;3?Lf4k!Fh4_2oQ0L;ywXW)M!K>ycZRdiQqWaY;JW9FzDTc!2vgstXx&BjM zopn(Ga6+$bEw9?55&nw-)_C=`2Moo>wx>-Na4)+#mb$=FxZjR@ttP(&dyx9bJyqMB zeZqT~AKw`RLlx?d7qeGj?`@tSvzjup3)u}A2T!&s5-bF;7qhH}jHfCoUDoWa;8IX4OPqI05DSQpqC2BF@t-E`4Z%1%{Z^bu?u* zL!JHjRFEE}bPS?Yeo~{&f%&Hxuw-BD6|sY8qn3|2Gn-ntzT?J|x%4wX&V&e;R?J%? z$srF*lHByY`xoz=j$-I4=_m;ci%jY(OX=VhY3S!{V9BxaSxTM$jE2pH-X zn(y=sMYGJ$9d$470s{A2@Iwe z6D;JDy~@2iyL6c%+I7#$w|oe{BKhtOMW%AN(X}ah$ajU$ybT@iLa~f@w+5wz%H7?IfBSGR9voMQKR;u@FT5NFgOX<_dA~Lio*%NC z&l^|UQB_28Q*T`sFZ@E1qem^fSeRYgHB<9R8S^PynPF~mrANxFwwOiQg2V=;G(1s_ zgcW)ZzxIQoqg;C3oO^h-Kxb-($UnhE!+0;0j6RfBi4e_LA)?c7c2lP#U6^>C5k{rY zOABgcC@X6mV6pdn9vo_fdrg#Tn6!;`wXSwg4_L^|1qchP!Aqk+`0gu?A9Z*s%oe>vm(-8eLSI!rMYg}91et*I=xz85a}-jRkk)IRubA_*~R_& zi&?Pfhdqb2=&orZ4F*;TG_9Wn<69LlCLaIEw-?pH@fkzgZ2)fYPJB5af6A`npW*hlIsKW@MW2xrnu@T!i)WB~JPC7ZCg! z=Be~Jh%29Wn9G)*_U~`J4VA}{#qsYF49GsvLD`8kFsH@bCE2POrJj?ABa5*kqQUho zD&wn%<<&7`u53aoZGP%h>uV_OIO$KSe*JZIr|KF|OOxCb-p4ptcMNZ>%{#*Dl_~R2 z#a(3g$|Px(Y<@7tyindfEM_CIqO$!5&hr#5_pdEHoxaIgs5FhH;Qeqbmi!fhS*^4B zx<>GRj>7U}ve>I30|mEN%=RQ-LcEP$Zdb~fuXym+AzyK7>f}pdH)n85l`qO=TnSz3 zXTK`0W^+I~cxZ5McFbU3vDA1%xu)cJ0@h<0vzzMxi>W`gpyaN94%!Lb@!9sdK&b`k2n6y@^hZO3f$(6h{0&{$tKSzpPnXij%51PwhLfOo8f%Bay4 z;PVrvDT&Ih;@X|o^wA8cg~}@BRlS+IUTrqv8Jv7bp!pSC_Nt0*?bj0sGtR=kTsK37 zFR@o@gTwj#U3d~hupdCGyP(Th=mO7);BY96_iNtPxtETN`WPs z48yT~SPOuwO_b;zQmwkzJ@W$pI84L@J|Q7}H{fcNOU@a5nZi^BW+4@OgrYWcd+e+w z{L@LW)R@P!3R+ofpy<(g#4!=toX$F1ecg&$;9bjZK;ZhxU%}Gs{bgx7tc(~f)-=}M z&kEN>mR`Sydj(n8<%#YPZjnYN`I&7qsgu=(tE_$Mux_Yb%<=9koeEo-I#|UyR#kC> zI9XCeF3x4atT|gdn-K5sD9p#2xGkfPq|(-`OaT6vwF@Ws%>G6@3ihnv5b{mQxzsXe zc-(*C@!Fj8V>Z(|&igyO%O@HgL;3Rs1TFo6F#tZ>C5GK2@lggg4HI;_cc3}EyB}gG ztLZiP+PZKb^VZH-OcEyif;5lA**1qO3Q7zpxk}E$(6zxrWxG^NSW@zK1Dnq+1ko)M zi@LMTSIqbdmrrsQ`sPn+B5$m&h}m^E5#+$STe)T=Rq+^7`B-cFT~**u>4=Boq&bQA zbLaGpW=;&OOi^bC6Lv^&JG!P*A3y{QD{E`ptBu!2v3||13zpJojiq>!G@Fa!NO*47 zJ{h$e5_a5-2c0_ANr?sp8a{1fq*HBUb^UAgxVmYAlo@QBaeAA%rq6o~ zHt0}W*PzFM8r(T&1s5Q$PRC)Wua7j{H{{rrLu1_9${?ZUy$qV8sw9_VfoQeMB}5{z zc{yv(rRIV1K}kD^`|TJ3sFzXpt~0(94_6#futCAY^5BjH*XXlZuwYh`I=02NI(HM1 zY`yUWvD;9$Cdzn%+1m0k{MsrGA%0^)M`q|DS8M{`{k-*+jqws;tIvD?30{wwXb zVO44|pczDQVx}VTnl*II(|26aH+#ojPK37e(&B%E?nH31eFfo^b7#6Xqyv1xpr8+Nyqad z7Oa8@iGIb4pVl~Ic>?p3J8f?)c>@Jg=bQfeY%$iJqu}LE+>R#<@-xo=l}EXvgLd2@ z1#_6@953`|pSqa1dYMy^R!oS+?yADH`ol%thpvY}nGUg?Fk#$(_695>9*!E;ADjTyH5G~gzTs3lXOXsR z-nqy=r0#I2)XfsCoUT&81Tg z5c#XzQaPoWOiit=Fn~nJ+i`0RAyKdZA`Br8$Ga!(o=+L^rbF!jmVN-h5$I$HQYrJ; zx^ci}x^P;c%gqRp<%pvCt&&<*1-(?@Yneh2$86I#aVRchzCvGAY4$>gJjH%|IYWy+ zdK;6e6!*+C0AI+0@Y^Ao)$Q%eJJ4&^FER(#8l96+<&MRa#@jX!>gOHGPpHWS7uzJJ z+?RI~=BW2tJ5m}?HQVFLod+I3wj0+aL*P#aG92v@V%)`<{Dr>6P9h6t5wV8R4au7* zO71+mgFj6J1Yq05+=4?6k0wKUiKNVq55YiceJ7u$do2WX=g3A#j3-d%H8MfX=rNtQ znFvZrUr9)6-dvrwU^`IZT0R!^8Ug|q-py8S^DB%kCi6940`CNSUjQ>{Fw<3%#Mz>< zvWo2;Oeh%?Eba0=2Xul5ekK=I7s zGJT8p;#Sn@l}&SN+4@nL)Wn>8>?pfK`Z99shYmH*eh}Zz#8bvG$}SjL0Tu7d&DnGO z5t2?(UCOnRTizoV7)|`KUq<)PQ!2^`T&aq9x3udp8seYb2=R;Wc zSY3mI)#pCpx1lT0rK2B8leFc*z{`&q_?DT2=_FGz`bp195Ss*^09+lmmG+d)KnaZ^;kAk`E+}k7~_64B^=O3|S{cLA& z8CH|5)A^D)%rm-rLkU?nn;cWMS6%vf&2OIiX$@um)?t6@)D7Okv8hkZzO4Y#qHtYa zrDr<62LK#QL!qZYnCClW(=Ev;on?_%;O|m+?Sn8;j=SN3Q0*t@%(0*b3QX?|!DQ0x zK)YIPF$F|~4Ql6CUrzvx1tQHQ*gjAa>~=={E9NI<>?poPhQQK}+F7`aVyAeKpBJ>A zwJm_$=qQAHgr8tvGH+^U9$%o&x0qhhX_zZ{Y)k}dn6(1CbccN{z#Cv1ydl=;f;0Gc zJHeFb;a~FY_`OX10Rg?t9azkWvgsa*shE-EvBU^n8KvsW`690~U^YrB$g{DgRRGCYWR?_9UF2r_= z%0x~erMsVgJt&Zt+__UfQW_Q6$5O*r zUJUiT201_51pgauup%k+kxNS$Z&-+G1x#jYtY+xcHiNYDG|esU865mEI2p1k=-2C) zZBi_BATD^<&8ij0+5!8FEPccN=xi9Ye0<~p;J|ob&!Tk~SM7bzC%K*9v;jAchlg+= z`z%r|I>IGY_DZKOWI-3aNsH7ad>5WV!1zoOe1^oYWrx;=&>~L z;tF%yQ^Il8u63Ptb;bU$Ow&gYQkT(^G#Y_!8tQaHd>DIikJWf6E2|-l-^9m{g-M#BB4sE=E9`TiQ2u z>O9X7>sGGC9?4|u0Ub~)?nBXgA^cs+AV9{Zse&vHd>E2@$1 z6eY!FD5ycV*4obt!#7ni{+==*w6yfAiBcN6xl7Ec6QP}7K`fO5d4-A|T)z0@%C8Cw zwyDXT!qgd7t*t2P=UR;L4eFaD8MY5W4PiSI&pijd?$jUK&YGd8iA;42N$tqJ_>=u; zzz`e_!iw5Fvj{Vlk;AYYa}~RAaoyGKCA-#+b1jRYe@S^d6X(pG`TMTVWG#v zD?b2nEl-`)*}~twwL~%jifEy6n^HG26_I=STz z6ur1ewipYa=IW`T?eP#+v$_gcy?;e9P2}^jyUDM7G%wSre1U;Ed@}b{foY z+KNi^^-cG6y$v-~MKfsMsxAe?p4BPYZ`WB-?YY8jeIp>CZnLn8tB8s>EKh{cUshPky%E^CK2Tj%Ek*BP@Z^;ABzNG>j#6ME~h*Va@G#><>_E80f< zF#c|u2B^*c9_*+rekurazxua54A3>iwX)L}{M%*lkS$w8#IA_$elyKaJq=`P7Ye_a zaH%a*zd94)QDM2N?>!t?u_7Q!H*gBIE?zVm(jvN9bRpjaqm1)hPc6m{1=96 zS03SC?kw&r^l|sjEk#1hwT#PIPE~TOg1~-~I8{yZSOtrk<*|VF#77-Xr26U*e=wWr z!0J79D*@oe@*Y%qdIHdNF#h9izV?^5p()w0@~EZ(xlvuufRW85?M#N0t<6p7YI`E7r(yKl6JDr$CQ+Z zI18U8l*wJBqdy9~jB9VCbRw1QJQs??Kv0(m^*cXfGvo~m^u~{GjWNG)*W6OF=G-Ft zN3(-hAtSd(0#9gF{=_?6uYA6a#c@S=CVPj03iZ4BA*u=DhhrjKi9 zh7vtAGB5@+K9y&bB9zs{d=~FnG6s_|Kox5}IWPce%Y0H-e~=S+u8;1;f3Uuv^CxYUz~qwBBq9s|>)>52A3-Gnq#!X9xUMN+Qhme&;x&;`bmwdD=fXINEV$92 ztaibqD#N?67keC1m6eBq!JStRe%Vqnoj-Ro*?(lj0?qPrD5y-Ac#gByWTxkj%El$M7ytco5Vdk<}4|&u8JS3{vqD^1LDxJPsC1EuRzi73Xm4GVp23G$m+j8 z#|Ki{T-+RmjqlZ4k~@p{-1WG~c_4Gen_8A$%cU&DSNc_l5>_J0Lsmd$jA z(xBW6cDrGBAs+w(c14#Hv-|ya5#nKP-tP~lLvHW3eJkO40PC|SxKYlzFJ7+GVJN7b zUES3{k~neRQA0}UfQ2`F+zKHE48yVT`H4YYY1Ww}{_K^M>GZXczWOnVlgX^0SLfKR z{;wnt1D^iuU3ZU-N!D3p*|;iVCuf`7TXHI~_e7C`>^Q6Ocu)3F>+w>tFn__3yxiOz zUdvEXvB>LN+kFYk!QK11l$%=~J5282D0JwCe`Wm_(f&={Z_u86)sN_y?R`!X?f(~7ofON)-`<-O(g++8YvHAsiC`lI$RZ5;xA{;7O z>s})<;#G|(u-@R+q_r5_HmfoUF~8F&wt64X)?&}6;`NyCAG4dsItCPbl??gPa;g&p ziU)a~F3jtf`*kZ!)j<3%D#1S|4S49%P=I%Gx2;x2thPt0FW40?Z{v!+3%tO69}^z0 zKZA;alQ9_aO48ta9_3uy)~V?jdCL-V9~Yf7kN09^RZeN~@QXU>s)aF0d`D7g!1sb8 zU{kuDevqM~SK3dTb&e9&PYn#Bxo^fV!{4&R}XgT=W6^c&?zCa{#6YB?FE!V90%5qP7Tvo5|Qo9;xvg?@Zk z653~-LGu)b@;L^f`gY`-D!Dh@=;e#(y=l%_s^t3_wJW!;02FbJy{}*>_5<~3fpS0( z71_(pT{8}p-im7PDF>jHZ_QbJj}0(Lu0^@I@|BiZFo2=SvR=>y?|0GOzoFyt)4DVF z0P>kp-&dFX6hV5wh0wFqqaKt)9YAgAuM}yM3oIzH;0PE-cW?I?f4veWa}P6){Pqpa zWs_?ORRe`!ir}%*unPo}JAG^#w9v|;ZwM4vv4i7ViG_|kpkE6ffJ)9zjQa5c@2(5F z&CG;IJ_jH(kw_r$LPn7F@eF4kvXS~Cu?CbYDYexJMyd%^1+3t*I2sE=b`PUBlHE>cNs`IuvAZQ6wV%84_~2YYD%mgRriLLE{h|s_g1qDD(nKO z@Ta-1uGYPNavZUDtCu~;Ywn3xDGK;~>bjPWSp5)ElTd-FLXQUSuM@PZcx^h_T5 zw7~j_9!Oi|JQ}0H@FI32#{m3q&ur@H!#0;dV;cuxTMaR#@)7uR`kKi!HF8}5BC2t@9*lN2U=#SWoC$#KKzo|ekA528?8ao; z{H2m#7W5GetO_5riMno5AaInkbhU9Y$Q|eNVQ%}|GuKaC?k2T{C}WmWLHR}TtVkO- z=rFtKNx%+~HV2wibnN|m<$-@Ne821eTuikIAyF7xMwz8m%yq~fPI;;pxK~tVd0M{4 z!fK^rls}GB4-J&lM}s_YJjP)*TCboE#m65au5qin5Lg~yGh4nWfXQ~phSQQ0wLsgl zN?u2-A1Zomix2oxhJRv+<%t+5mu+fp4&gA|EJQCRpyy9B%>T-PiiB25YYiYC6@Ij%`VxeAMga9#0scDKfx~z+N7Op$TWaHmJzm z!W3Y&-PQYBwlKERBXoulRh$TW;j;d&zLtt6i zv?OLhJ!F2oTgHpjo1VmGwY+L|sA}QvcQ#*sA1#Ha**Z|n%FiSE2UE8mb-xf^Z3jq8 zSyH5}N>w0ntHO6-7(zphBEd?*^+iG?#gIIP8&Jw^{s!yBss?(0n5n?6JjQ?Q(C6Q^ zdS}sJ^%G(-;hR0W9=KRZq=1cv2=C-DWg%+A^n6Z${V)9YqjN)(5*H~R-lT)+Y}={A zRH`H%&q%fY`GwznvL9$74Szt}vR4FvQmbib*q&3x;viLJLoP$CAm5J>2TJ5s(4>3Q zed9TY{93<>dF+kAG8=ER2<3y7Lrn!W%S+@jDR)Cvw`ARmWj( z-Xv!rC^(t%kwn#s+G7SFSf9E^?EOYjhZKjAf?1^c!PU>~3H)8CFhtafOk}sE|9 z83BFs;hVs6(OIpHIfMEs_LeustT)T)rG2}(@ij2CUpd3IEoD#v}6|tkeGz-73 zAb$JGPCpqW+dap-g678wH5X3t*F1C`e*4gs-1gk{6*)beozko<313=Z@fab|YQK6s zg_&`EOQp0*G^Ifj*{5`PfXLb}-J@o+KZK?+tB4#yz=iSBUQgYA)0z9cB|`#wq8j!(G;>P_`0~ExDVH0X2(pUCOqU z>8+=F#$M#Q4F#)+UyP#hOX=YBtZqfkmc;??M4y|4&%OlLJnT~9yuRUM2Xx1it3HBN zBhq@#BmMvP9#fp0PqjG!ZG(@!5;18Zz=3gA!-B(!#{Fur=$y!-#ZC=lE^>XA*1vJ? z52cOY1WIA~>y?_-U{<`Vo9&~HRt3rUxirI?Xp~uPFe|8(lv<*$g?p!6XN#1-=rfc@ ze(AlN_$juy1lftJB)tYTK(|`8F!fBWkpkR2JPScam=zoEg?>#W75U^2)TcwIK82{KAk~D{AZl9I4aUAL*i6a!s2XaqIqgLX4H~5f##$eC^QM z+<6z?@q}v^!*Aqb?Vq@t9I1MLhHs#{L(eu@DwJUq!DySXx@j z%`3e!v}!)#GP8pEN?HtM8RjwdYdB45UdovEc?;N_#G-~#3{obT(Ps?`x)TUt95;vr z;=?_5MJ070Cy0wr!bxW%P_SA5JxYtDCSnO(IQT_=s}|I<%E!mgO2Y>In7u4)oDq>U zMtVRG5BPCe?uHA~epKV@j4cA%(A)M=a~!Tz>#Tsyc2lXHumXp1`Id1PlJFa9D11fs z8KR}cr^7h!ke%oI2A8h`;A)0~FHJ)PSVvk)7)#@qAx{z-$2(KAM4rSt!<*_@u7p*% zHaDZ)7VpX5hO$_%QG?{X#uuG+Gh2&gl~ z-`c-x)ixPp!|RWNE!*by5cv&GIE_F|H)tCM(Lc4>-oS-?elJigr)Ti}UZnVwyGoEZ_u(XT<`?m1xa`J< zaOD5-%e`B1pq3KcNQbK^^`n%}t9E;LM{Z$c2V0!jF1ZPBWYr}woCru-dyq%uPPdq5bTi!U+Hw1`lZjU^!TRB;WHU$Euw6P<(DGPl{##$ zLeAb_6~jGbHj=7_K@uP0hLw-vGq;kn8;{M#!L`NAi#FjPKBog76W`uN@_eq4XnpH4 zEBMs4lMZe)vU^FdYA;u|=`CWW%3jPn*wq>c%k=t^c!tR3RF)x;9q_Pr62=bAnL`&j~@9e zuj0?Ne5F-Cbx+5G-erN;<4~h`f1`wels9dU%zm!t{2)j-1CRZr^u>Sg-u#&m5s-~+ zw54%@6+~mQw_ee2d@!-efSdF)3C}ixup5MViDk!k{Dq(OXF_82fa}^D4@(i#NVW!# z!J1KfH$FR80Di-Fth57w?+L(T?@-J+y*?=RXCl6TQUG>I$tt@$zocin3TC_UCnPO6 z`Ah%xkMHcd1DLYwLBego6foJ(sETqYHrz<;4Zw-fM5~m&8kf(3@m#s>#kb)`L>>Ua zm*C3E2T@uyAj+w^F9xk4b6JYuP?RmDT+;GEVK)04=6l-u44pUV+pu9_+VG;hTn@OB<`)niu_^EfP@mzgi=J;}A8e-6N9INL_J@m)4FO17GE7MhmaurS61 zNDDv;MFp6(BLtX3*af$Rgd+O>bsJ5j#p1(hR6^vpZ8Uq;h>ZkMRzt*pG5q>vi{(F$ z<%(IVP#|m4>cSK!=fdXhPC9ZOa(4$?2xVn4h{D3+bN%|8%w^?0pZP*a7F$5byYwyO z1-o_PTvi`X54VV~s+hgbYPp_-Q*!8x#G4Idwj{#GUqRG^T|ALWezT|)C}mewCu(fs zT}g!L{1q~^B(p&Lf7;7qiGT^tJ*5W)+?(>iQ3m1Y3X?izlSw~+1KRHT%%NT50U#KQ z`z;ttS{~M}HN^Feeh08BC6hvqpZkw*o&D$Y`lEfg0Hxb!S9C-`@D7w8%Va7D_KA%dS7=)-lMdrlihss4#QTK`XNhKs26vNe6)g;%)mtC^aC`56l*WJ7n8h>= zMhmD7&h;T35iOqKyaQ#a8^~Ii?2kKS);Z>a9sLY|gJdvAV0V|4Fy=W-TM}&4xAiC_ zSS+c$yfF5M{mTE0hIKYS|0f#rdR+oQ7Lc?E0hMF9U^5@~9Jq~TpMZk5hyW<;Y;C%4 z3_)nqn-95GIc^Fk%i%aT8!1!*w54Od8^2%NM^Ky9pFf_&fdo^f<BJc7R8{u*`qpnAZb-%38YEf}m7~=HYnQu!e2ef?ubVtX@y+(_rR!ORIe_H2Md= z@B`qRNnrAh0YvAwlZVrf_%IaR7&rwh6BN*k`b_>&G7I`YgJ991Q5gs(>B{Z4<#+itKd1>*8-V z_q7-dr-WcYWahBD2Of3BPRMVVkXsrwcoQ9Vhze`qH6t*!Szsv_J-R>n4`|`1(Gn|;-lviLOa0?N0L&Z# zEvU`Iw6%8$V0W1>u7YBujk34R5-@k61>}iE+C;%4n_hJGKLCel5Xz37aiI6#PUG6} zLi}AVqac8o#=gE8rPWGpa7g4TAgz%!Y2~A7>`fP#H{68CVOn_&^Pn;)Sn8l5imLAR z`!-64$l*9J%>|0Y(?Da>Rx|4ziGQN84}t!#yQTw;twht#y2%cz&IR6nK5< zI|DQ}h`ypYjqLvcQy2hKj)*9OqLB_zr!Px!ce=ZArVId1bf{uZ1JEFrR_jAQ`7P1E zF`P=|G0+2I#@9d*s}vxr_nAw|hLNGbQJS)^Qk308M=u887}?Dp>Fe)fTUR5n0^~#X zr;MH83_qG}t#Ef4-Z)cezDmcD$kUp)s_%kH7E{@*{|`W_(;&v@<7~r&{(k}us)2JT z*Cl(Muaf)055L!9CDVX2si#Z>ztf`Yh}WOG`CVd!0$QQ)CH_?j+Mm~X;1qKq$gG0v z408i0<_ej1S_(Tr-gXC@u+mO8?zO_1=NKQ`px**N;fkrfcr#_;MN$^xgf<)-)vCpp z29BuM@Uck$iOAsBGnW2sW6r#AaDLLWBpipFGgbhc*LbBVlWD&I+sY!5Wrde#wyEhS z$UN+1wJaN*1god=nf28Pty*fPe1#cjZNNmp`AC_ox|=kB4_};+t`<+Dn)1>J5%QN*m8%HJDnpRd0nJMi%rE{s*IMe~k>5+X5y)lpWQ9 z+fWEe1`r0NNSF-=AIvNEGQs>w|F2_RerG-c)qver+in0r;PU{G&diP<+ITA(%D{u@ zJHqa(c}t@K*i9w1!19gT&0{oYh9tas6G+Q|(5dt83%oMJ@0sNKNmeaSYX~$CNjlSXI`B!p( zHxobps_8yR%QT%U3Iu5xP+2aKp53=`rijqOwSX(OAmPLSX6pLoN30JwJf1XK44awW z{TbA=#{i;AUnczM6yqNc<5&M@7(_^oLzxnr>5hS&8?slpZj^3#Jcm8O92?4~GMv2i z>z1btH=>bDLxa8?f&id^mU_GHJsOnC6&>kF{Bm~5i2zEgqb4;Qe+OKgrZ7Uln6{oD!=vG*6Z}ne! z_cZOW_m3F+`?c_GSDo7dWw7(ykmiwL4<<@VD^z_QgoU`bU~)@8dk0jC!{lhq*ris3 zO7~iI)w%HL$i)D36s6-J*l|bO<6!PO6FJwVJl=Ko5&O6;ZTsE1loP!5kQr-;En;^;x0k zYkoPj+j>)>l+2tw@!a%Czf2pzU_d1Fg@0`yxM6~sb_Dy}nk`Z7GxETKT*R8;!RKcf zH$PEL7tu5+@m5FPlVjv zx39XQz%6FrvFbZT@q%{;G5+e;VYaq}CitTHG4fRHliAW6cY<$@?I!5(A&sLhKI#Wo zvILTOdh(p(nwD;sFDZK`9l1152pgzyUm^viH3&(Pjyaa*b>V^;1)W-8S=0jUZ+GTY z>t23eAAWRYd^Eo#xtg4l(FCi!uVcvLNMc+zdzNl7izY`qU3$hxjy|0;>^CFT`|7yt zv{bm|yTw7X{0sIDpUwEtkBD_8S5w+QR+k+2-H!`%d3QQBBhbZuPN#|&_b6P)a0{;e zYZP3jYCnHe8bej;2gxN%xUQUp9xGfo#c2Hw>TkPTqDQq$UV3u>zQiNT=eNtAMVY>n z5LedqnrxIdDHCvLvqF5Bsp~$-A&FzmN$w;s;+}L$#*m1|2wS8^W}f;>NA(qrKSS*t zCiJ65_+_F;CK~fw6*XuBKeIh>-`VK<5|I5%xG3buSB7h>L)m7elGW8(`T8W8k6{hq z?|pT%R}kSBZedYN5!bX4Qp|`2!rY`xC;KaFxv6;KM9ce_PnBO+kL9cHC=8|D29r$x z5uWZ)9oo_bx1Dd~&YvcfHNoKI%)_{u&7B|iRk3XsW}BJ+zxSvYa$!edrbrZ|O#*$` zt_ViN9$*)1v(m$sNe2YR3ohp2=*>ymKF|PSyl}yDaC{{`090kPO3|Ku-x=EA_*Ytz^AvG)^i!sivh6=b-}M|~S-I)`>;al`Mt`+Bg!=s)=K!x-&T zZ4y$d77~y~jv}MDZKkJ4VGriyXJyO}zy|q4FAjT7hkwd0RYrq?yM{{ZY`Z#4Yv^MZ zO5bj@jGUzy(gl}$y>r`MyCMWca)s_Yo0ugzb`_c~wmK|XFT~_`8+S>x8aGSG%Zp1m z$0jYU7~8yCj1S9xGSfc>IT8WG-gru; zj@#_i4O}Lj(hT&Mdd5a$)Nz}-lD^HdFJU;U^!;mLyt_#WSB-Xye-p)fQV*WQ?_-pA zwBLKxcJfJN1NyrxaY&LF9Si5WA5Ggv=BQ^wkz~^y)QOq-hE4}=E8UtT)hcSKDQeL1 zEV-beTi6H*fzuW?d3ng8C^Tn3zE#KyVUB{%6zyB>9U6~Bc1l!5-&Oa6Q{0M7>(*`5 z{}B1~skTPp0Mk=Iy)^1qgX4*OKOW1s=^e};KPiB?nBdFUxEsAvewy4(#OU}2g=Qbs z|8^hN4l|K%R$!)zp1KlIj(| zFfW&`Oi{5OPB`36#vz8bzI*@PJ<9DHUw?Ej)gL~42=1#3Z3?fTbsqz6GUE+dc)T3W zr@NR)sOYmObPc@p%D5L&&rB0Y4I7q;#>Pipf|0JG=a#=Z_ZIu4An$Y0zqpWmwt(m6 z#S+WxY|1sDrkPF4&M9buv4h+HV)AZ7Dk2ihw+mO2%7?Ez!~RbwV>sQG39b&D%s&1T zkeWB(dOM`I--~;)Lbsv!<|}tg0V+8%z=vl>O42je$o|NB3IZQ$Orpf4w-z(s4x z#^5@zy4feodo+<3x!S)8B?p})C}R;u?=_RR6?;S8ebtHOxP4c<@rSWP-6F;x8tYzv z1G}l<*0kB~m@aT3qbBHkX(gH2bZK07oW|WsCT|8*J)b60 z51gnnvb%w#08RoWbzE}-U*1yN3|3PJF(NuXp?}VwN$T5OY$AVX`%gVTs0Npv?I7ci zdC+sTfr}<}l2VOy=~0!J4rtNL9@9<{JMIHDK8I)`keYtVism-Va)I)rfCc!`zaEW- z4Y(*y=RTq70H;Q^E#MxNPTtPrfya1n!@Ou1kMx6W+>#YQdcT=iC-D6}%IX#Wx&Mc_ z_l}Ed$@WJTK@cUWh-4KJ1OWvB$)J)Y(+xC91te$54G1WD2of74qhy*U2T6_LkfT6@ z#70SyLrZAltIfIdo0)s(Gy2}|-uwRHAZPE|RjXEB-&#eAdAxtB*B>Ie9UuWJTqx}~ zSQRJ;u$HYMAs4U~Zm<@PY(*VXjHD*_U1)snDPkGY!cjZ=es@_ zmPN)W7_wtlfQVUiG1>q6Iy-1;e`mN=TF{In;4U4+rG7dP9?)H&7n;(; z!R3Q0pUI9U@e)Wk`N@~J03-0surabKfYI8(bFk`S!rR}W5JcJlHj#UPw4jA4f@q0G zT(g=k62L&SUjrM!W0GqA_;pY^?6I_mLO7WHb8!7AkI}7p=z(8-fi@LTWVJ3Ade0M* z67w%`r5+V#PAZ7iodF$q3fUb;X7=!iRu!3T%Vv;3J3mUt0q^^_6fSaR^(^s_ES z=!Vc=5a%iw9sS&U^vs3hqhs+Q)$QR}o79+DPM;a%# z0ZeDz|K!h0E&)~)h+FtS_K410U=f;dK(RKJ#O@=R|7QaI=S@=5h1hjxicu77Bt6(j zRGE_5G<|u#X;GokmzBq2Ywyi6RZwA9_II9aN)p|>B#BR(I<5?I9}Uax1Kzf9?Bbd~ z$6b^T3!UlA?5?g4Nm+StXqTPqMRVjp$r8ckn>>e>vNZqs_yaL^Ihl`_*YG3_dPD7kV{~AnY&94aCQPW&qakMCON`0?Ne*D4~Wa3(#SX_;a$i zYBbKj=($dMcK$W&W^%hZZAW$!C?$1Y@Sv3xGAeU*-*ldy&N zQ)B8cvNYXY+LD=8;J7_KDqil$)h#15%FnddtO%E6k`pY(}-ERIU zG|W=0(kalXUMl<;9h1+oW9t#I5t@4@+fWGWxqntyMNd;*714DjhXL*<|FE z;>K%Gohw>OMDxe1?rb_6Yp0>5@zrW+;sYCx%Ls{sYngd{Q)tJT`{oNcHVcZYiGZ)~ z`+Q#$9xtUtcy)RlY;F3if7w<}C8YF)i+xZVq;cx>=%-BOFE@REPP%5r7Iwr>UWc~8{C51UJZ_(Wv z#J77GtC>-o!9vc-@!hnt7Rm7h6sMF=t=|391y74g#NQwo{~WGKc8_zjS~+pg?(NrM zQP*d(fxzsltP046(KOr$ga;5iY-U4b267$<@(r8r(iJ5|72>Z<}hy zeVmbqpsvoS7| zP5smnw{30oPH*|`Ha({P?yJ5VkZ+(H$MwPGM{buU*j+oug_8BIA#?maJt=K|p z73OlLTgY4%+?-Qcr|<6OAKvOVoaDBus;V)J>=9*pgWBl8Jlx0Rkxo$~j@cBQi;=@+ zmJxUKK58GApf5jNNmovJ?VcD3q}}J7Gg0ew+@a~P3FLIgxG$%ZTjO^H)8XAv+mV_k zWX?~JP)dXWtD~k}bjfo9sq$h;_eWRtExfahQ<&^iDE2Fym2>=+LjoL;?;1cj_M~(a zo*yHbz65zlKTE;2-=_1%z&$i_Tk3p7mG9pWIvvu!S@h&7@G4pZP5n-z!=rg5cJJ8l z%nBm^R3gOvhgHy<+6)XN0h&X*wX2Josa#uBEp0tYw?O|(os83>W8He)ZCmeRFEz|g zf5srV@9`>{e?zLF>P+2?3c+vV9wyo8GoMHM44>g*X*4y7=^1Jdc{B~)%NWRvtzX#A zsH;F-U5jFV39d-5`NpA7CxW<9g*SFfMk{tCYz39elw));+KmN53+;|m-yUhy%u8s1 zwE&YT3!Gct{p@mmcM`xSE?t}#_G&a8s?9X@Pt?ur9PiEX5ZGm#kq~*|n{I|Z*M^ky zO?Op)Hv_Y=;HmHxGb_EynRhs9#^S$^k^I?mZl;6)%$a&z`A^+4tB(SwJ7Ll(gDLhx zc;_}i{r`LaRDS(?2_jD!^VQt`bDB3iyYr28ip`LO>1*l><-;{@Ntv11U(px$ZXQ}z z6UNCysQ`ygNts&SY*by?a+WV-{hE%g+ZsT-6ODt|qJ_MZuW@;ZeY`PJ!KfTES9U&2@bCT?#zc#LsH=(c3XbEYO z(yrIo?We2Y-WT$vmo8&!9&f&7&!$~Jqnvm8bE>BTWJwKXBSkR4 zBUSvmK`yoW3h-C`Q?a!>j5`wtDE`9gZ|+3fwXv1Wp}!a%j= zv9%=Ho{*FF1l}sT<1;^3p9OAgSoiNupHAz!XH_j>9FVTEE7C;Jo zIn)Ol8R}q@0gxICoc>Z8m;=a2I3nXtn-3WVXn2d0BbYblXlZ^@_mW8x227_IwiR^^8~!jq<=niZ9b(^2z3%az$x zrrS^*2WV)PQet+mSjMVj4C3l-62Y9H zFRdX~`b-0F9&^QKMXzVRG*loGy=(f!|Fv6WTADyks&k?*{I=DxG%0xm7*SYDP9E@!r%gv;o1? zkwQ>-FNbDGW4`>d+#ciLW*>kjn~~sWQ>T3;4!i`dEu|l{zx4H<$tFXZxs1Hc3FOI; zfRBj_Cg85UM>Kc=E*6h+sYs`we!GaPf9nOH&5kA1^rQ6#v4@Zi;N=~W9(1Oi4}tSo z!E)5?iK}B@qLVZIaG}-Suqqvm%Gz&6UsUL&Z*M!ydH4P?jKS$OJ8O27lTZVRGcXS+_|z^h`)-f6zsbd6Q~pH==Hl``#&#h$xx6BYVjPY?J&_##^&rIn+>I=}P)IcASCB?9oN= zv}`rRr|}SBv3JpgoU%O{fP`_D;<+sXeX-K{W0$Qq(?wxgJ zFVC+rGclTSd*T%~3C$d7eh+&4`Z~>KL*N}A56=2sqQyZ9VP~yJ>~|CbNPp6k(?nf{ z6asJ&*S8pBLHrVa$q5x~E%c;qH7AwN-HDaPR)9lMawb2+L?14|zcBvEckPatn1OV{ zc7SfaZi$i}Nf12$Q}em;cpjKwN6kppN+dA)3C%pTxU#JS1~lx^)ko>wGK>P&*49sw z2>u814h_40gs(f!4`w-xzZHT6LksW@9vh2nWdY?*_>u{A&d$JtwETw57v!puqaE+_lw&x%{5%wY-#rcu#xIZM7lPYKn4$TW7Gvi~@ z=^-dc>5oT8y%5BoI+Kas{banaGj^`+$O}W~og0tIhvmN+HLP+tS21ioF_Sz9t~}^k z|KLLc^ebtI(`(rwkWuGhwv;COr@ZmM$X0=@pEIP5mdh-sK)M$sx={)bBC^|ftlYk@ zHMeBkJ6Y?U4zKh+XdJv>|7?D=KeWx)d+TgPO^~bMe|T$MSL~a=VLc0^^)VkZ;nyfe z>jL3HEA_@TDK0J#VciVH9H$WVgeKK@@Ct21Ik|wJOQNzO4x{G&05l>`ke>Fi zfx#5D!7PZ&t0zlZ*{<-;*?Bl4@wSs87WXF&K8{J4TJvS8!~V%RAA@g{XbmZm`{L}l z)*E^R zDL|(405JZZ?@5rX(ayN|bP&^+o0WTuI%ah0@AX=z!OTz$3p0=h+ z$wU(F>$$L@)jO5mRJiO(hM{)o)gMRN$D&iks~6h>N_SR-3)erSqY%e=eFpjUSQqZs zZ=>Nw^FDr#jGmn+cu6(B)B=6OutYmiL`(^o?CF|plMC=I@v7dF7+u2vHZig4(jP^Q z(dKne3zBVEG{+8G+I<%5$oKAHeINAM1WO{u`C5Ke6D$U;TqYTRGBq zvVfNxXx`okg4HmE-F=ay*P~*bAm|sSi$-kV5m$Jo z`q15+P+WVlytJ);lc(h0?K++RNci66hqUY#EhdzBpLV8vc zL_#FeKkqQP7@WlPtH4C5SSA?xXyZrc42q~H~r{`mW$T0oF^lzA44yE4Ba5dW7 zpt=G?@zy6x-mIMGY83vzPByp!-KkKYoNppqXjxza>)p&N@rH$7=se1*=GT}?yPw2J zr*0-l5<6UHX2ZP*^wypaPZ0Dmw7A_*euaLyG2|zcA7qa5?kkOR4K+*u5sK1M7qB3BEjovS6Pi-|~ts+nQtElOIYo4~g^wfSMv?mb92m;UII*|M9%uUu(uX( zV^{d26?ke&vqx_4yu30Y1xm0?-eU*uyP=ATO32t63C9EM&>Nwy-2+9hC+6SgO*%a6 z*r;h=c|(rd;j15)e#3DK1Ewuxja+F9)Of`q6S2$E#$lDEkO}v>18N#m&nF{L=Uz(; z3%6vo>$L#)A||3qEgGn{&Kh7~N4JVm=ySLH-hEOhXYFsHxF#G0k~1iJUcFH7wW@-u zur^fIyne0}gcXX$0vjDvvQD5fy^psFxsuZd) zyAL4G{st`{Q{D%79AN#mwY520zlJWxfMiMQxRj51#G1x!ho6J^oInArdVoGr8Yt9p z?+q`5YUHUyX;1KtE^y#8+N$q^0F%|QdLKa=sC{>eR-nD+=-#m>wSB^bpQsX znZ(oQT_T7t(fm=w`PPFSTof3sFe8lD`UsM1TYPiyqjgclYC|}VgU?l*ma`%=5?SSL z<6X$+ytjuJP4~0AF08rP{E%tVYsf2;N2W0CM6BT)=k4fBbAk`dkQ+(jhJOzJH$BP( zdXJQsKh4w6i_Xl>&U=Ge)Ba!rARke6qelB213g#vanJN0oZG$-l=1B>mWfs>ag`F` zyWM45YC{w}@SXWa@1S)9sHU%VCeqie=$CbJq`^+mVxNI~8E0~0%+Yk^ZTJ+fT8|a# zhA)EegNO+YEhXQXRe_81C&{eD(9n=elNd05`yzef;KfVd>C1OK*Y#V6N&qshNkFNf zgT3H#-~Sl6=3gUrN+y^AS$iZ-q--S-mAvO^ujoh^Po zvc`8jH#UBakMm*V2nZu4@%}pSBBQQ`?!Y%MbXaWVc!fna*4NZdkSp!)Y?v=@E3bDh zdVM>SP;(Sa&`|(3!|v>z6S6|ZCvj9a$$WW#ONOwO_h*P>0idZ4NKmeLK=6)Z#|0q7 zMwrI6R(=kvMr5<a=fclh}jo;KO|Bkop;$j-QC5LVq z1(((WeCTaxD;b2c+XgxlN+m?~*4JG!qOZbdBrdS+S6uzMdZDZY~ zm)2h1YG!PaeE%9?2SL$g2+DL;4Y+~tq}H~X1VB~IJ2mVinB=M|U`Nx^^500aKa+h6 zwg-C(km=dA0J(dLO4DIH?zX4>69gb)`gX}pfx!Ao)ucM0(WNM8TYLLnH9mFn&%$7#Gs^ia6j`r!zCQtGuXG=L`;YDZ zNy`qPBW4W*&w_7!fbd>^^SvTqj9=383Mpp$0`yoSDRr)v>hgR4H|Pp6)9zU77-^UP z?vH_QQA6KCkQK6c*50=N(&iv!saF~1{p5|^NKGUE0TTBQ z+V_$clzE$viHLAMR~`~E+rkYEe*_xkd$9W(Wc-6a()`$>>QmCD2*4;m&fY2hA}6?7 zxogyEKUAlsASLwxI2gv$$+0&glM!0Ig4D6Wog*!Oq>Q|Gcq6mIe4U%y=|4c!kzYwr zyn0caiY(K2w-?*lEhZBiwIfrmgKVao@g!-06|Isw8XWOStdze0TDtB9S{2VoU^V+R z$umg`@$;n;vV7e}u%G?s-M;(<%>M;X$bJPR{&a2fBp58+ zGvG9Ty~;5AvR~`&&|^2MUFWB=ojbQElO`sjvtS?Z z#P@7_n4(f7JRqDqv`I>K0Se)Xt=FZxoiFbtkHFk#vXl-s8!Waq>7#4cXj%0xcSMTKYe|WRfe``hpm!z~*ubSoc@w}es`0W{qrsvIn2e03@9Z*qU z9O!$oYOGGvI#REklOB;O^Aj@HStDPz;l@)FJK{drp%qg&>LqcfYP ztJtBCL+`^`jv`Z125x>URBST8^7Z*NO6|y61DAtT4g+*U^diob+%b|DV2zd3F;`(p z9`QV#l(Q1o>GP{+BuFv0ANQRHB0$?r(nyA(oE4vow(Ia%FB4VjN)#(~#W9rHc8=b; z@W|>nIP?ExUm=dxNk^|$siuvN?TbD*+}JHz@A{!dK}Mk~_8!gR)bc_b(^=hw@_nJV zwd7jw3EYBX;W|g8(+JQEg10J6sA%&lMbpiUm3T(mncg;W$LxM7Q=_EoxvW`X;NgnZ zslXX1xQ-K81L5MC){ugFbxVR3)K(sSUV+?h)#3fc;7 z2I^ze_R|L_Ls3lni5kJk%ab1;N$@C$vp?P3GGL02ttS(EQT=5* zXV&8lf3$bE2L*zjs}+g>jvZIMGzxOKa)?e3cSqwV9UkK-OhY}8$mNnmGf3Wlt!BZ= zNeqeX9SFky^i;Xb9(VObFFNG5=vq*f#lcotXe^huT-HfNB@9PlybY$C`eNnL{7K#% zy+XTs{?%*2u8@F&3}d^L(m=F^`D8@5 z@^Y|gNVx{MV2x7Oen8D8kJuHEBIU4_x&mCO^mmZoE1UjG)*57rv1Mjo?hoxvDz%Q4 z=PK=<|22_;&G-S?jD6-0+u;0yM}VImo||ukZGMM^zEt}W`u>O@QyRCM#(NDO;X8sY zJ@uxNAY1Z0^zjiH;-9@vN0pSL%!}S!XP%Yh7fU#8yyO}v%S{4HO675T&3=P^p=Q>9 zcVz>b?6AO}kd1yO>vWtIz;U8yyEt_?T{kBSrWlhGd4Gc=PC@8(Id;j<3Lt+*|K6=f zGY?iG|=MtH!N+ zJ9O7u#vWI7|JD(gKcML0OT+On5Y@EZPj^wEXT1INepEM4cQLF{1;r_9sTU-LSw1)mY9u40V&lfdy-{<9>YGsA5kHWy z!j8yw-=oLIQ7*OMaFKdwbN1zrrrc*B2RmAygS_RNU!Y(4bx^BcY)2%|b(ic^G76qA*)D#^tC0B z-fPZUY_Mz}wm!irW6S#K7WYK*N-l8h1JG?$5hAk^);Q*u=~EDw(En}O<>Z)tB$sXD z?0PrX2@8#Jk>|gqC_I7VcIuG+7+7f=BHj2UN9M}(;CbTL4mVqiw(TwR>2*%|LZa3L za_y@PKH>vxpFcvWQ+?2YUF*~MZlf8v-J;kTIzu7*;e1d1JJ>h8>g8x+r{>Vl&jjw~ z^k;*}X7Eywj)GG7XMP&379Z@r9-jNs`H-1C#h>mY&ufb<^BbrywfMMjst|yce?z%( z?;U0y?#3~&9LbXfXHOns&86!_JU#LKm{+x++urUvA%YNM)Mq@g@x5e&v4%tsHP6l; z-tDKSEi|vM7GJ#OxAx{Axpt2dG5zG=n!iR}zdp`}ulLq9%~7PH-ULs^7w6vX#WfSkcTStpJ~O%@W)717ucXCOm7AM+NfNuJI0IP+|xUD4Dh=^ zz~q5zNV4B1F_rzW@n@c(ZIf=dZ4G6p&)V0Wu-=n}^DI8`{bHLA=xW-{BQ-)9@S5jn z+229c?MvY<;PIUiL+<7`vfP9e=!KN+$bRwprkmzqTn_(KA z@&wOyG5JKJoANyDp0T(G6h8mV)22aii3=KW!a7BF#hOSzC9K>(`(7nav-8c$gSZg4 z;TM-DkC^%7Wf)}jNiVDlSykA7^C@+2>O57@-t#+b0knt*B(K~a0ZnR&ZNj4X$)N~T zdwfeyOmmxzf6;oKN#Z9b6UjMI7$0Df_Rb)d#w+i_eVyW_EFG0J zjiJ)auWbp4zE6OsWOXTYWzvIxE_sCC7QCxxGV+OxFdd(UjgfCSoOcs@R|@LYmD1d? zA7B^`$4Ku(#>Zo4zyBqCm)EtZz><}mj>`nWLpIa$^x8KYW6m0hRR)_T64ki_&^68D z92F7uLJ!Wb5UJ(RHyQIFhwN(Zvotwg`5JGeX)8iZNY0J%w}Q^U#erHJk+HE?>vxQ< zD6+ZU?UBYHu)2N;hbcF1-qj=4dXQrn+Ftb5dD>N&8cpOsieSjxxy+ys`>&J+n!3;9 z5Y;gh!TH|Bj>@zdne+YwY_e=THlMGX;#}jAws@eB4>9X0o(Yd09zxRF(z%zj=XB#A z{SF6%!=NkBPSCoM7}svZPSzw}q33~94p;Fdi6jP~`I1E2X4Dc&oj-fGc6OdZ;1>d4 zGeltA>q+!F`H4n60}>ti|CQ7YfR`CGq8f5c5+>S8gpnx()}jxv&;z`(cleY4${W-O z``smDgWVy_sr>fh|2LfcN+qCXgX!WUv<^75-~4j4!QN0bl=7i{hmk;SX{k!x%Cp3Z zsnv|vd?hA#=v`dhTSKx!E%s~NN@pgTIfXOS?^H3n{pBlNxs75%CNsFqaAA}s3@ z(`!n^7Hx30O10E4ZI||5FBwj+z<4c2x+D#Te$XkaV=g|~JqigP32H-WQzgygVC6$- zY$R;*lW~f;9Q#S&13{|)-~M=|8gSK2_YgZxA3tfP39@vPhEh7>NwdRHDYO~8qRMoBzoL}u{2&5Zj$(5sK0$d`;^7ey#8)^ zpjFkbc^DjQDqH;yTSOLQ|0fe7vjI9dNrHdubld2Y-igPz)V7xlF#vR(J@%+~ zCUR4YwI&3W4%^?MnnDi|%vZ+iU5sWq%)v#IjgrRvjTy)A0npjA>rsF0BQc`n9j@;F zwI_?z0gHPof?|X-ipse!0p0~gSs=Q#o0jZ3zUc9Zj+AzUS@t#!tOocWKJ&51oZATPWr-C z+r6=KPbfTBu=PxcLHzw28=_-x&f#(mRCzy1PXfGCSKQJN**feaj;?%33jatR9ew=} zQK`bi=&#)VitA;&Yqzw{I#vHGrHAXyX)4X1BO=rMca*!98C&!1>3na9UVbL~>WHT? z3B0^Ai}a5j?-s%14(qS}G$AWe_758Q@jkGKx^cpOf_YS-nI7rJebVs+enLdNZ~}er zmM8P}$*M2TWTvbkA4fijz7K!RyFIUYX8a`fqy1B(k9sd3uZpZvIb=*yV#Ut~RRuUY zF|+Ee;@)1YqeA}sp}&kN#FAoolmIeJ&?IoAsvGnP&^NeR69oS`xG&u6lTG4*WdE5c zZul7j1l);3!ju*Ogl;f+l|bWaF%Xtl3Y_(_&Y5^$PWpM4vp^jRu)BJ(BuA3QD%q+Qxq{J;lUD%+u_22yj{TQ6h0w=mETo zsHozMpOnrFQc4wQY-Mfjkn;EINt7%4_Yq*rTlKccDKxj79SuqVG} ze`zA<8D0*(FKD~wPI=k{I;9_X3CmBt#IX$DeSPaG1d2l?>&BjMef@FJ&(34Lk)m>`@$Pg;-B>cILBCGfdkEiHkiIBP$WO8 z;J@$7v;BSH{KW1=e~(YWLgVCzXDD2IlV$yNm|^Opl;HQk0sjghDf7CWiNc-fj!$Mz z3jJVyteAJ()R;|{f8Od{iN?w~ewUz) z4L(irXEH<-KAHL(3k`LqwWkTJOPTIL;xiHf$9Zd=CnqMPCo|XO4xKN&a9TWysRfO% z0G*T45L-a+75;Rxp|k%sJg{BlpthrnRpN@{D+!Q)V1Vpg(oA?{hnR-diUc%f;mI{O zXDgYHdJ=hPIixYmu*ND*ecp!F6!hpghpdRHVfu5h@$EjT>3`d!G5V|FA?Yvxh04s% zQdV&ZA=38e!--@>?Z~vE{kK1?A`kwvkUVa!Di>fQKdo;d?iNw2Xv6NBJ02&A z>hQRGO5cE8r+%ZlceNuP(?`4Ymmfl)E9V({#RS~ULlQp#>zHy7osq~<9^a$~Npgzc z@%Sj9mJJkV8X@4tzN53n=TP*y6y^8&?2)a(;Cc)ooFDS-xX zDXHy1Y{|K6NxtGM$z_mF;C`qsGx?x;AysaDnxV}6M3?=t^S3d}@~Jg^?H9ctZ%9PuDb!&F7HguEI)zq&We_qPOyzFQuAD%=G(xj z*_AjLuU?|Xd^2m+*bSM(pD|u0qaGiyAMaQVr#QBjxgh2b|8-J}srq7HTk>Z9deF>4ZDC6Z3~`cfpZ^l>x$+=?#Fid&8s*FetZ zt^fMR(^!`N%s;>pM6F7@p~qc}*BA+vw^p#mc8C3qC#k4oKhj8FeObBkaBtkvyrW&) zy!kcj4D#`hdt2>$M41aC!FU40?8_>LzNX|d_d5j{{e{Mgn~OsnfD=(^Gu`oW9{9^* zVq#tMms#7sL=*Mpb{WNw%k1<1RJ4%nfb3<89cv$(MTU^<#o_42ybos1SG*z`NysU?D|DAyf1~J! zKZrfXjG3EssJg`upl!9}O}@AgUB50$U(!gCyq7fNl5Ocby?ZS58V9o?Wf z3zX&$D8WVPzQ=(M$FaJI?w$3v%w?n}Y3%e+VJ)))IcAh)*zXla)G#rb#`L2bO=nI-3%J^msW^S@;jPM$1wM zRS6O>VSVi$l}?W) z80f1_-~@(+Aeho&$u|v^VzCg)DbulrG~}+@8sR2d%2tLrsgadI*P{3FXPM7taY*Mw zoCks7O*b*~+-p=fc6<0t#RxqMx$WQqM~>Ul6^Za?OrWdE5BgPJD^!(NNkIbg#gx7A zyQh@|B2NrWawnXN{#M5P9|m(pi<=GD-Y;CVmNCEb}zHR#|WZO`9Mmg{X7eZ8M8t^(TFy2YWgS(!1py#7$-nS)B4oBZ(g5 zb%gO~@uPYcH&61i)Q!)S2>Od=N@{AtaPzPH-O_~ej-5TBJU>}Cu`)}6Ie#23Ixfy( z{M{#Go)1%_D(A|z(JFZ`y8i6DCi7%Zga-l?DB6b)5alfuBu!xnrpif`_MPqi7t!`o zVtco=1QgJ)x*9i`u`?eH1ibLxeH(&)qxxlqgfcd!om>{rhxhuXK7I@;h=>MXYX`SQ zb`YWi;WX5YHigS?dC>7FQ(vMy@#!#EbW#$p4Nj=@US zVj``Zk*Fbo4{S$A_hqgbWPr-xe!%&K#I123>?A0}yl95KG6JU;AMbJ^Ae?E1R%ir!~H!k@u=6N1`vjbmmShI0w%m}8u&jug)U|SRy zk@G+#0>hrQpOQa(9h@|~``9sp_+c?Eu^|suqZ_%~EpvEtmMwmxc9h!5akyOh^`d94 z7<P`~h4);$0QO8s|riHM#12 z6s%yH&pq@}hu<*eH&z!P(to=lD3qBs&ppc_&hn0W2%zaQo|%H)Y=qRf4zbU|o3X#u z^6QlvD0P$&M}G(dUr^H~-~&U18+kziH5}A4nV$NaX!FtsYZbVxKstAtv0Qs!S70I4 zO~He>5l>d=pqHig|FOmlTssl?N-)HJq1Uexk-CE-=(=gA%aF5UHpcxJPrQvdDmZUf!WX zJC@SWe)zrC>zhsI--oB%G!SR^4aLaP$xL6> z66sQ_e<*1&e8zgDa+ULO#e5KA|Kl(?TL;?&o>?ZIQ(o_U?eY%ul=S4ZeT5g16?UDRwHrlk;=_0x*G-nOyRdP?ICn5Ev>!)Q`9?kf)Uq%!phb*vPzsex6@5c}+bkL!8}y-2GFD;t;ik7+}d{$1pvz zAMt#KHeFh}tF6^}FgclnpF)I$t`s3d{>8o#uj;Rpnt&Sva#B5wQrU_4EB4{ubFjIg z1-r7n!Vz$=>RsR!6li`G@al*vFbN!z%cJkztKG)%Unl(mAQfOi(Vkw>VGz)QLg#}w zh=re_$|N=p3B~=A>)w`Hk!GNJ(k=lsDut%MPQzd}yj)vgGvB^#>JOLCZiAjM!VTAx z7!yC|*fT!nuPp2F2S#=UQ%|2Uews)A`6$&*_ZtJgBWkA8u%)Tv!JK(P??Zcdj|y3n zcj~yB-|hy(LbPoWTv}7$5_)MEz1v={AzfJ%Z_zVo5tc+gnDhVzd&HRcgt3dxI} zpVb7dR!_{Rj*^S!vwIqVb{RWPqxZ#TzD}x~`I42H+43%nSN=uAfk{2$wakoCtw0wz z^`i0e9)kWnsqE0jkFOa_Ux?ApFgv6j-a2BbQa{uD*Bf(Vs*tm5$u58`Pdnr9 z^4yE>rj?ugA=>;$adW4w2^wZV#pbbhYW+ZQva>I#utEKr+6~EpHDI@yZh+2UR5l0c zm4=R3xu%Hy7Rk+>TT5jIy@g|M-@&KFJ1F8-MoT^y3>@YkUti_;+%burO|va{M#Ky* z&8+OoTo4e_JI1^|u`jq&@rk~;&E;Ty{N-c^?g8$ixQBRwl2h0Gc1DEM<^4kLJ#`WL zQCZ-0ni=!BgG1Q!&Ft8C*Y0J;@)XV4B01&>5)ukh`c;7P_Zzr0R60?Sp4R$TbHHCD z)Xypdw9^$S`z8n{atDC_4B90}DlN(~`qMs#2pcMo6-Fqdf@)${kArMgJg^xU>Ynct z3XPj1-jDP!<4#HoGmQgoCgq^R=Gfr3;@5&W{aecRCkpF~vi-$7hn_Ed^*$x;RKd+_ zwXwT$dirNyP0jKtNrM`f@apd`ysP!=&F$>Lu`U~Ak6drbBweYqS$0Q~MDzUJDA0cB zWdg5o?&+6Rj)vyKCEzGzT#<=w;dwfh)wxu;py}Wwhg-Y3*c0;!`JIgAJl66r!CB)F zgzuHuS#yyt8c@2sk`B@iW?x7R4jUg{ZyC~^D&u}d6#&wsNvs<}4=t2+3kK!p(|*3u zbu!7MFnjXTK&QP=6t-pSy@*>uY)I(Y+u$BlcxMk6;6K~Yw`WkV zJd7jTeUu=c0`|HTiIa&=jDt^!k!@C~;PTg-P1`#j(^t|Mr3e>e-Pph;$Hu6~E?>dc z{H+%NXXs(6!}ZdJE$r^}4zr_3`$&cLBl6)8-Aqt3_;jI%wS2g8Rm$LS`r%Nm1n(l& z>BMi84N2BO(@h?>G#)c3(s-wtZqwJ7Ij$U`t+drnS zHsx%A#1kU98COe5GphhE{6;)~GrQR!Uwb-g|1Bp=E<>Va_wJX1EcgxrGJUUs&9WIN zxPJNqzu<@ji2A2qt~9t-uzJ3Ommx~OJC<#OJ`b@)*u77Z;3#BGnoIN^ah5%xYIrsS zk2F-5!ql2Oe7&T|Ha^Zj3l?>kp@*@2xMEpxXm$ETblE{pkA!UJbB5f3^&5HkX*y-h zK=H-Xz>x=Dfa&43D)pW8;IRGG6V>|zNg;FbEqi3Av((3G)t z&9*mmmFK1(9@vn8xk>8x%tth~XQ`lg*1HTH+kCgiVT%`W^6gU@G~@9S4!mbh7+fwp zHQC(8CwigbESmBYyNi;95DTkaR?ou}?xj6>j7vT|RNGMbG7@GvlrJm~$7@eF+P@{m zs2_B%mD4I|>VPU|H#T~Q8)l}Se zKt}f8B+*n>w%NH7of^ka#Y|r)k}Y9{!}!p6ErnNgbXyOVmrPAhCp0(i7n_(LfK1CD zJBs$-NHGd~9+^f?-{eaz+Aqv`S|xp#4zUIKvHP;%1j|--gZbnrmw9uqMj-NRBLyi# zuGd$TcJrH+Ox*&u%;+s-Gsq2B?0nJDkmT=<*mI1OroRA06|-X*w7*;R^&|@e?7jYr zFt>emm>T%I!M@IAUiwNN>#|P|Px~DxgUrY00tc~hPnY+STZ=-R!di=NGP45e-H#>c zoYu0m1X@6x&!Rc+n-9){A}UkcPXw)?MDZ7w_8-Mwc?Mv#HGyz3aMG@6NJD9$?GxSA;EeNX{T;I_pvm!wg*?n~EOy5pay zZ5B0Y4FG&l;QC>>w}HC!w63zcI=}NMsA&x1JaLBBp^x=5SS4GrQ2ws3xt{=Eh^H)&>@ltNDU!C0)cSX=iW1W?|b&hy>r?=zvEwo z>O!enqRpX=+U|gjwKg<@;s3RbGMZCBf6dc(pZYn|7t) z>*eP!4z%D^PJ?QH#f5|cip=Dk8E!ejoyFfKnbWSv6~8s#D9>b%QDJ3qMRsEG8v?pu zXQA)1wx%I2r+BkHsM``-XSgp;%4@AzvOe&KI~UBVax%X>5#wkNdd<-wf*2G{L#-A! z)nbPH;Kl2y7}mMs+s4$F_@MXA;DFGeDU7CYVpD!1i-8aFCH~A^Q{k5sWWZZmH4=^q zv2RHTjSc*)IU>uN4!TVHIg6e9i&h4>cyKJBfP)@1PHAWsLzN|-uTJ>q_YVE-rjZ9B z;J&O2Ua!u9YmPH4H&??(4M#lMS7(ZD6h0r2FjA*h%z`pxI_v>$1f2D?Gg`!!YH= zYCha*|I(mm`!hc-_@IC~YDqjQq6=0r(LDF&Q0zWD-8t{(;@ej+ePjVR;wh;ID^tU) zrErkRofyI`xYbw>Q!)m~Pp=VKSfDaiAT_SnD*yZtl# z@4FeJ##ZZLbBdHexSrjkr7E8lOK^k2V$XT?1+fv?_0@J|wQj%7Y*qWdjy9jj4#SQS z>l-kEuUf>bz<~x|?=#W3^9LUuBmmMlEMmGL(kN_hS%S%_&Q9P&eNVS^ihh+y|2fY`Y>_+=!FPOgO0YcV;Zaj=A~`6R=f2Ne<@n8VDp zw~D%+FLH?=8Ta=ME;Dff2u2otJv|~Tb7hSNV`=(Q0$4sIhJhIA(hHBgc|sxb7zm23 ztjvAZbetPxs;Bp|rrxjbq9E}DSykTe$gkuB{U-He*{!gQhtEW_RGAF-fqaba^{gjp z*%A)%&F4I%`0-xg@}1m0Ux3{r6K;j=?g>X0paou^l|!!(uUDZ68x^)!|b z10#RQ3fnH~n~|687`wQ)bftc)6(?SGZNIdnYGb|Ce96gr9E%wqIWAmEwCqxs)v-)- z?3k=3;*LpKVFM~gm_#mFB+D}kY19UeHFii6Ud2#WrsfL87~{vL_UNT}%^w?yOIOEK zWcq!0l|d+V(cPPEZhhnox|MD&Bw91#Ir3Bp#sfAknfs;gyI?&c!(`p4p-raexf!Yt zzXd94rD`h5@JF22$kq|Xz?tYSpEm|z1NJ~*-%H|7+@c>dJW)d$m6b-cfbs z7WKv}D{r$@#m$kO#`RmrgNiF|DBxw^(qviVDh=m>+?GfzdFO$YB~5AOWftzZIcB9F zJNX%0Nf{_{JT8OKn`*4kten1E$ju>-T@_2t3SIvBk3{iz(p}yQZpr?c^p(Qz%j+Jh zrSJ7oTd;3(;?fokGO#1{_>$KJ<8XpOq(GT_Mg!%p9Op#?F9-+;B|ki@a|yeSW!4wt zg-?%q&xiw>Hq~`{_Yehq`W>^}-}d16EZ6(3++;J!^nImOsG%zN4-t4BKNJldl<|_I zp%Ayco2N%~{fD!k(UI-qqVxs#9t(u7IRe-+n|3@*U3H=3-bi+qu(C(Zv}S3E7AZ-7*6SG8X*;o`d`NWG#i;n5(xMf|&Wll#1y?w^+tXGh1by z4E$78r=GMsEZ3$~I3#gF97F;fg!=OQRv16_%fhojaoE(8gE4-Y{j8p9mO>3xCpN#L zPxyxw-1-V-<`ae_d5ZN}TR4%;5a<2pT{`Ibb!TOSX&QlE#*MESG7r$x4apjm`yC zO94%}`>7`2PAmIct4Ky2Ztc8Bi$R=Q*XNNI+3HiP^JuGIBjJ58%5qj{Y|3&mclv&e zzyarUgEja%bp$LH>iT21z4Kn+0#IzUq-j%p{=4#u+$QGwvQ?!1`W%)X#t?VCYjm+b zt!|p#3!I?Z&u-vaxxRAThhBEDV7kba7JDnpHtlT2MeELa@i6;nYFirjC{9wFNl7i~yfed7^alCSt9dx9{61 ztGOvt2EmqvMR@3|WlQk1uH^1VO}uEC zl@-N?yP+Hnlg@=ZWSN!xIv>pO4WWf?u8PRq3Vkdvb46$nC;3fG%xe-_poECVR;U8)M{j95S|OU z?UuWu?$a)BGaZAjU&`n5v8s^V@Uqk3v(`0Ky&wVK?KNA5H&Hb5hlBk%5~F1Y=nU$p zp5G`#Uzb@+RjgU$GGm=OGPh(wJoo12YPkwUnstg5#!8qMlsv4H64is8Olgl1^Y0yz z?pd8LtnpdxR+&9kPz`+2(v+z&Oc}`M&$?cANn09jez%tlV{}%L`WZD=s5PM@7VD*U zY3jp|Kbe`+#3{bFT9(0uElO$qD{bq`iR9?Fji5>L`dVUyvpPML!>sLPdChvd`f-oe zb;c{4LuIDiQ=iq7>CF1ZWk%k)j-1gX6J5Kzv_|>j8Ur61i=3`}ihUzE>&t8!ulxf-@eAfLy5;W|=_i*CGjcx|z@ zrSLIBEs}g^3~_)J7C7HEuA35zbB><#Zjq<1AZlnqy5_X#7VJsvlv{O~c^CWXXdIKm z!U_mAd9*y!iZX4ZGm{0UI>62{@B8G^F@?r5BFH5L#y30=zoJqdoi~2R0#Uwz=v3X=cJ1%OW z$$C-ikc0dL-8P*(tb}bj(=KAQTEW0ormj*7sFaHo`7M+?h&q)|B6FO7<;DM(e;-e% zSZkrfQlcTlJ1Jd6*|a^BAG=^E9j{8y;|hxwQY;sqT5Rz`@0UL^7lx@_(`x_`VEr1M z$iLKgi};Mez|e^S?P@j@)Y6XV9gR)JuCeNZ!}DW`A%zymt9piCe6-LeUrxrTDWojE z^{fXj;Wbrq=Xp$6HKj`B)LD~*1$ErUH}9L}wWQaq#nxxR7T=NrR?nMuPO_L3u9id! zAD;{|ZTI6>&4pR5#gj@VhJ$_2Q3Vdx?-Nl+C#yORTE{g*e}ajVU(ct6)&d`Sa8ZTj-idaw(zn}3V$g%xIP~gtU<8*d zTTZ0Ml|yd~J|0{GX~dxc0S-3~53L-fbC(CiVID@lOtG~yEBzkC)<`2FbJlw#`+2(2 zBVK$9eGr8(85ZEmEOt_*1_!b5b7?q~F@C)A&JV%EZ10Rpm6>_5A;r-`{*rG98~Otp zIRIoo7IhDL@QQe_IY8fblu;F_{5q(ylQA-z4RVH#Iq+^#(>uLzaU@SKW$3Y2z-r@- z&t4Y0ENUnD+t?vv?v*{YCf>%nthD?neTO1YRU@J8L2h`aZQTS;ot0xd58ugnk!)Kx z89-#Z`F2fN35hyfW_KID*5RZ>UWM0;>WswQN*7v!eY#_N_I8zw?oZgIB?YoKncws+Z zx$7!{@VpLQ7P&!eH**FPq^wpPYgwG?aht{kudHRS(UA{k=-`&70L(F2Xx6{teyG&D z(I$3lR%XEVBci>GISj=Q?(2PsExz7+!rTkD@BtpGh@*OIy^$8tV>Ua9*|hG4Nnw3< znyyiBetN!ZLPUd_a4M>F&w-9=u%MKiv)Qp4AP91?U)52jds^)Z7YX#;6Qe5~d+>=6 zoDt}|C>f-Vq?Jh4rv=RJSEu*2hY;6NiI);fr>%UN+r#NKbQI6X_*fj5;#nJtAHBN% ziP+i&+DJnC$u;0ImyDQPSW|DA_m8q~jkW{JEz1$hw9cJaXD5_AuipwuJPq|wUHeorTjHVfeckaQB8NrwT4EmS91poE_)#D%0er0dqxvc&etk( zD|fb@L3dd(RwMM~=JttqTGl!lns^i9n{U^w zBx3wYdE!M}!>{K>M7kA?I!*nW5cU0Kih5Pv>uX#`@7gnGF>pp_f0@=}$$~0E3txjx zyWeb1bd{*UY!$6-t`&}~HIdIvJn^B-BR+3Db?L6HVPRp=49T5Y2jqrcD}~*6 zMVi}%z7tT6L@PD@pr7R`(<~b>Q;U#OFsrb(k+YN#GWO0zWYK`1TKe#oxy4i|KlbSR zbVV3)QPL{O$Gm@He;aTNuLF9#`c?98px*D{>OXwYfB^!peW^@@jOb0R4Ba#6>yGYC zTu;C`&{Vs9=Ye86%@4v`n#`48b+(%zA#TV^cL<3nSe~Uvb-|HC&hR3y+T*Vw@jvwU58s^o89ev1vgt|Ssvds>4P-Gb!!Rgt_K1eH zJGgdvTUOymuaY|R?fF0xc}DX7YTFuvd>7Zy94?wo@O`bQ8zx$j^%UF=B*oi0}<{}B9o4|l0x3ievp+s&2tjBwO$BIkJE zSl0-PIh(vN2U~Ah=N+CGf=kC(0kpTlENHDYuE66CIL8KYM?(#ab+VJo>C6UDL4zc? zw7CX_wg(zpKoE?DRduZ+7Y0M{95}87rhl)?*h%^N0dTNdM*}Apztwy`=_z8^?|j8f zw^>vj0n4O_ajGqJK&CLt6I>Fs6H=JHAbat7r}Bw;(7>Vfoj+tp041iQd{%w~(px)h zWy=pMcb11R$A&}4`Ol!&Sph-ZEQa3jo^rP#!L-%JE!zZXo>mpdp(~ngTIpCJ-JlWL z_9|%!J-`MeYp4P{=j{WEWc}jB} zg-CC?J_g4)%I)|_;I%1nb?U`~xxbA9bd@xI0kG-AVmeY`&bSU310pi|rhVSxj|ee9;Y zxx;h8r0&%11K;Y`DP7)xgV-bh)|AVBO%Ag8zvzJsYkK}eXpWb``wbtHpZ9<>-#e!~ zrH_C%F9QPId^RS!;ZSP<$Iy)mz7Fp+1ZExbjXew+xC2CFw@G-8TNHSJBU~2h^mr&( z&3(r?dBCXuL74w9b_9X@6t`cKf4}->EH2wJXy}pZd&HfI14?j4?gQ`A|KyC z47jr|0Hyxpg{H4ur4AZJmS2JheH@~bK0L8Ne#*nZ8-v_Z!MBpB@G^s7RExIerMDFM>f3@l|iWSqt&l2bJXib zqu9wdNTlj?FILS3zM4bM#QFt<$`WsGqG-N4x0t@Y$+#nT1#A2xpg`Ew3@Hcik#QJr zAacF7DadNNxA=KNtLP&lIV1~v@mYUuhGALSr9*%gMLQpD&2Lj<;_7>wcQ>o>`czSM zLmwa3qDr61nd2tzl+%tRncclMauCaFo3O75!}hXX6Dip!bu1FT<5Fli!|49?Yx{_M zAMNC#=5xP#aTI&_D6c5V?BLCdSCQIRBvczQXWu`3#z@F8@VyWJcEjzOW$dQX<`qY! zu2-FsGATOVoF^E!*(XHWthqj+HJRyRnKnRBjCGcXhd+GtYCIV)AOBAAqCqu(X>PZ^ zBM=b*qu`PZLX*`B(uBxvs#fK#-CO1DES>DO`U}Qv8(1F+N=}zxqp39`@po?P+k)9s>#DPru%3|2KVo?xVGmlP--W|1>`hZU@qNIj^(V zZwX1O$h@|EBtkU+>u0W?gN*w*O^v8pkYn&i&55xQP1*AKq%HUQ4ErS(IZ#Qq^5}|( zgx*73;X28pZ@W&S5^}Mq%{~>W@a-AudbAmyqJ|ly$`7q`r5S`>BZKFF1=z!Ll*1H7 ze#QZEvk9$sHlAcX5k+!%P3?)J*txnhJ*ZVeg9o^hOuMicbH0Zw%B$!b=sXli>UZ~RCRcX^<#-hO+wqGM)^y)YtKCtZbL(+)j8T9`8N(fUsbmR(O>B>BRn`54XH@vqT zW!8&zHIvqQAU5yQlEDC*DN$UHbOArx?1A{1l@hB6a<>l<64Rg0?1#MociaD+tpB@s z@!R6O{WS(SJ*uk^144rVetbgOM^2zDKJ$Wsr6Ss{M`sY!{KWFSHuC~YYj`J{9sKy< z4x~w@U#VXMMl)kM>B2YN8K9a=fJwI(U-|*O%l*X|SYoR)bVyK70hi(2^Yrktc;JHd zzv|Zlqi_Pgb?%~p;6@hR0mN2L{M1y)_&SM$D5hHG>Os)K$7`VdgrR5GEOr7vV#g@h z@W=k30=N$MaX%yh=lh%O_JPhzcmlpYv;aa5LSY6Ia*_mrA%EW4-q3#u+zT{weFj89 z8fD-+g1^L94E0;CLMfPhSro`$fmX|aHj&fL*Fr*F2loTNh)|$ya32~p@Y{3kG1&%*pi_&pl~B}kNCvn#B-uM- z8#uEXKA`jIM$xa+SpyVVl>8D1Q6vmd#9@I}R1VNElK`V?u!2|efv@}*3;pep&VX^u z{0MS5P=o+j$f@VB1jsc9n}YTUC1wV>+MrXJr{-TR24E9GD!&E|knvkkJ<- z=(4H3yb$Y1gZ7>Jq$LP1L8pmVWFVj9K46n*21mv+=-^xJ{$c?_7nS1e&_fzH(CFIE zs&uek&mo^(a7{HYe_yF!cN#$ktg-=MVZ;2a58rMPv;$4P`aT8f`icq|bia4RPKb39 zpg~Xb#ZN*)rF}FJs<3DTgFm;rwF3z{_|{0@02YZ)?cD-Blwk!L4cs~e1;3pjyc3KL z6zw+JX}a6F-H9KpaxP%uzxp%Zn!82@n0&59BLeC=8w96@GgUu_LW71VZt4?t$r}h2 z;qapt@ZE6|82lmDW(W0evpxF_z#{K-r@^_T0CX<|jpFXk0wJh#02(j)9E{6Za%+BA z*{!lDu*w9$Vun*Wr#6`TfetWvf(%Io>iVND7_^VYv$N2kA&N^^YrU)jLN&Sf-B&!r z0}Oso(56!m8Naor-__`MH40edyBhtjM!&1k|8;8g3MPXfQ!T^QVm!Uar_bKcq{hp! zvu1k_j9Verbtl�?}JO(;1koDo&R*DVi(xk?+Uccv}(yuGuS>R;{7FCh571XOtK2 z@}~0!gx%v*mr^aEK6R(*5GAV{G@9hb-T z;HriS1OqrNVYt}v%24kerrs*U5t~LCDkqN)9F0Z9sE&o$rtsspBwF3J$*+3vn`Jcg z^u!hbhsqxid6~4)6pElJ40uaG;auk)Fonrpo^&D7yX`|R9`hbU4My4tG92L|)CI?T zc3oxi+w$G2SpBw#3nvQDv`QXbb?KkO1w_qW`P=8``hUpD3Rmi@B}x~l-X6+r33obN z5~wo>s{vg!3}BvjlqiGK;$Gl6Yr>$SU z{q)R(OKAZ4*zx@AHVAjsP`)I;fdg!9z10Z>zKU?m$FQI?y*b5PHmVO|W5Y!TFyS-N zFz>;Sitxg@(E+JXD2MKB7A=F(4NfODMn(pa12Jaia@M0S`3VYxCG^1Ud@~b@Z+Hf- zV|b-)lli2~d*y!M)AaN>;WyZS&x2~7Qlye-mgFm}d95~2)aSj2c=)K~61&Gd6XYfV zIOL6aCS7mj*_WKAW(Hvf9I*AAIWiNJPBCr4IS{W5w8vu1+TZlsnXO&|xv; z9v2r?4`U``e8H)pnyPzr^P-;0?2EfE)dcu89g^`1@^P&zyid!)LZD9K;2LExW-v19=xT0zRAkX^HD8V4Rr4P1*uygNo<&IgO2iYkp zm%f_H_Oa1Q3)H`X+sc@L89v--vo!5?*2qjOVOA>WDyy&FzjfKHajZ3(IFf$3#$xbs zNcD}k9~=weToO6~9?fxbH+aQ)@DUB2K~+Ttp1y9Q_WU}RPsJ#7W}{BrZgxuKOFbe= zUlDzYkS~J;@|Q~-_Hk$53eYtEpb44{>X5_Ymu_hraLh)TOBq#j*lqtlA~Xv41zEKZ zQxpSPd%CBq;?rVFyo#rq!UfUV2MChYK5o3KNA>DM4sq7rJ5|w$n}Ve$hA+ZH*N*Oh zP*@lx<@i#EKRI=$Rmgt>_@Nb*7y@=$9F{VzsW54kD7YcN^rpe4EA#yP!sYarx$yKm zB5vaYo3h)xkiUUGCsoz5&!EkEh6PCJ%C23Zd7|d)8WqfffqFGWfn@&e8bmsZOTtK7 zqT0GZTrBG%-a|gOLd~5xWYansZ*M3a^YZOykB5uzv~i}w&X%JRqK{h?4EK~qO4?}g z+n}EXtl6gID-Hxmz+dPuMt((9wVyiwq6H-Ip>p=#SM)4Ki0mOOBXVH1Wd$MuFRz8##9&fzA_mqSwrqJwIs4z>tXusX==qOhhk1+ z8M|H8MPXK`CdDe5thM1lEM0jxLK2zgKJVCcXkdLa#OW)$O`FaMQWj`Fm55)yV$#@8 zp3%Jd3IY^^-e2#X2)v+U^q-2k{|yJ_x(k=SYsA4Xy;D1JR+yyj23EbYIEm2Po2jbS zbt`A`HyCr0c8aLJNoBANv!!E~9*1cwcfm|KSyxqlx@O8v`n<~4ha|Qka04kH`aq+G zQ9tSD?n6R0XrRC^gh#H8HNz1p$U&rQ%hvta1?34PBb!(}MgJo#P$v0+W%ygXAt+i> z84wr42bSy+P=J8m9^8CW5i2;Lp}RG?AwfFXx$g$R^M}6T`D?iCRE$i)r+s+YRx|Um zlLfa=6Bs{*y&0D^;U;;vn$h65XjFmjq#0u8lLv?-{7L(fqA^-A%5#s59ywJ4oCdMG z6~(u{H(06d)nB{&J6yT#UjtWezA@_>%knylNRvsro-?U(65~c84dj1(UqJrtvjMz^ z0NL6t4(X)>IlMEH+r6sP$CsBPN~za9?8DJG&$o}_V#xB2^Ul}JlEh1zox2p0Bg?po%O@i)zX^ThCz86tjSI6+((>3csY z38VXT-q&@dHPxvmE>I=8CAHP3-K&O2lPYH}ibqPyt~q%wimUek*97eBQjqdbb${pB zgq5;Z==2q1-<1t@NE=7i>?!SsjB+|B$lJ(Y|F6s2fLz?@h_M6&!|aNJs%Lzxif{S$ zdx$T--*1dC_3P78BPNo=cy#^F>?yctkLMM!B~oj>-98 z)*n3b#xG{2S$;gdE!y^zL$0fgxR^Mzr0%1^Vl=+%#pFam#Q3`-afm9s-)3+Azk}Po z3#(T4IIx9q?#{x_*-P)emA3erTfxocbi$N2%_+84^-#g)GJk@7?cl?i{sm^5=#^1l z@q$N$n%y6K$A9w!&DRpzy#*-mPdN}i{PIv%k+@Ln4qR#NHl?4f-64y9D}C|TA06Z? z@~?S*6Lf;mH8B8Ctt^BlL2w^PWZx4kjclFp{_tfV8%iX`CVT1aYma)z6yJVFZJYFo zv#0IR=RaFY=cNB)`0BhO`s#baXYviAGw|&n#Y+0fhZEne_*JP(R}af=zIOn4+3dA1 zV)S>s_wLA@rXzE!%EbyBe6ysEcF({q03*$=oJb!;A6`5;?8u7RT(v*3ba|F=Q5?EeU{lVnB!@r#cz|>Kl{b_Xd06++L z+ZN_{f@+XUdruDFf1wUDMSE|1VsNwxMMM>`xrC~VdA*o$$$R-Fk*Z5$Q0BE|c6oRg z>JFI4ApCcmdOJl?b;S>kZwG~FPQL``4Q=GPa{~-~+tb94zXEXRkj!!5oU|t6>w$lv zJYI|VtAG7C8-GYhY$v*);s%N7B?irq0-Jx#bJqO&0aq?K@_3`6XzuVzs+aH-k1;(G zT=h)irX5-@pQffDGNUTe6o2o0wg{B^er?$$!$6# z3E%u}0L9Ic&Wn`@`dL*qZ;fG;T>4hb1@2;w+=IxG7JkT zwkbD6#gnt7_xntCdDW@~p8*sUd@+2j$0xXw)3j-&bbCbqR4+>{1_8NOEtJbl`B#f- zYi^n2i}Napvol_LE4y{t@6W`dwG3-PC%i4Q-Zea1jN}}6F-oG*c4?O7St5vQy{M+N zCh5v`(w!Sb^~_1=5tiJS^zx6!sVk=};Cj}-K;+E9e2m`!4&HVZ@CSE*PAcFJkY4o$ z$(5>i4VRCUjZJo+3YL#2wuE$f!LtHLHwKlCVf>uaj}IW-GSls@Na$|XlQe4FQ6_hP zpSUvOm3-lc4pHk#uOM12wI4*4N1T6=>BIEA>bW>Kvv`VHp|7U``%P{v!F3>o;hF+gbqaUHmIm= zZtEmC?JQC}W&Umv2z6pIJg!Z?)0Ul7UhOKbQ`|84zm*# zn^jI5c_y_vRC!JyPFkEKP;SAX*N6o8twezSFQZ>dDGx!E~l%g&wlbYqm1jN+=F)vqpw z^o^B}$1NL-s;8?|g#$>QQMSru;%aDAi64gklF97Lioipay%NS4dkissTt_5GvwuohQ_TNypr%akoU3}z)c9fT#87~S<&T!DxS5%;Ax$}Nu6&sJ zOs+^WG$-UH8{)^5Z}8@PXe2LTBZsvUq^3+g8&;TR1@hF2(1yf=Ag?Z1!YNWbwhQEw za|v?eB`rx?&gF>8IS^{zT~$_(L($$no?tB<_f$@^BhL7W$Gjz(JWb~AH4o2wrvG({ z4-mI&wB8Bxfkm>JxH$8Ny!;n753Yie&1JVfLRmq!BWyrgBZFTGT#Mkb$m%b54Jc(7 z81fvi%8@yyCfX81U-Gwdv~k_ua`(#6Wvr{@&3A?NBd;XH74()rW%8sR5mOZMG7Wvs zc@W)O3KXuI1L5QJe$>9wq&>;WzXN#MUsVE!1IAb><~kGvJ8;p;t$J8$+X56^DqtLF4ixlA#C!ihI@ETTZsGDs)kEgmn7 zxNU;9jZK&|rsgS)DCw%Y4Uah)7B0QTx7w79&3*JbShRGp-%vn)U}65Wj;b4%X%nvs zB$x$JRjxBS(mW%;pGs;A-2zF|oz%>CJexg5z}2J^RK+76=! zu2V~XsRb$k7&&ExGVj0Lmqd_^BBYvfE-_yE3IFPr4_4>&s?FWY?K* z&A+*~$Z7W3SVUnfJ{hK{r>u+j3<*dQ|Cl+xpi-=$+o-)^&%1neK$b8A;Q}zJvATmS3Q{ z)$8FgCZ1yw4g`wtc+5aIAKFj1$6^Lh7Joor4K2mZo6f7*ebT~DBCN>n=&=~NB+L?V ze9W^Fh7hE<46E`PS*{Qq(R=VJa^{MO2hk?4e_sR&7dh3jn)r4TR6Q}rX@J@wM97Bf zpl7NtY=vA^>+*X>9`jB~NM-%C^9t(wj4V7Z7E3f5@B|Eqi)7vM=IOZ9vs9vI^Lz|I z`s68NtG*J_RoZfnI{soG0CZMgT*P~pRcU&v*{w^PR212tUHlqGm6;6){Ft0eOiGWZ zc_#S|s(UDPyS{xmYb+EYY0wy`3(WS#`al5)=r1-tpQZCkq%_wSxFz%~=1_`LO_z>_ z^O0IBzK$o3Mb5dv@6LU4GRKaW-pGnFTZxV(l6}R&r3<<}aIG`1=3>9DMAIEJCp$&L zeKcAg-mKCpsLquPEOgOg_R=3)y06+nV+h#A$?ijwUkjt-*lwzT=-n|gPUTir(~d%q z(GaE6rwZ=O)zu=xE0nL%6bLWKZuc}=?Y)_&yT?QHbtO|v{iphcfKqoXnf0=t4eEG3 z@=HTZlGjBiy7~4;{gT}^Nj>I;*9exF3G83Y-o)(0SV{zb=xF85D_{w>m5qN?+4=rv zheY(%6%k5a&BC)E4J@;$y1TgI^DFj84;cGBz`ra1!h=_#D!xKRkyCqT-I_1Y(8pFq zjk6-3u2ke-uRYOty!U{MV@(%0eF`(%tO6=caBYxRG%Ml_N>;up6*f?nN0{ZuZBQs( zS?2#bCDBxRu()S6cQh8(|RLOCa#+u6Ze$NMp}~YmhPs3 z-6K0aLL6@kN!Z<1^PhuFaaz~9 z1kmRO&-rcVtrhMWwc?^r@JotP1(eabu3v}@; zls-x~5HXe5*}4EIpHtN~Arc$(L}S(N&~Li~`oC72f5X&yLq$?{h1ooilUK?PR(|rY zhP!iq)e`$6{we7NdCBlcTlR@xqq#zr{4l7N%7=!`SD74UWmW^Nbmj0o+cmojQU#ax zO!<+My5pOw9Es)@aYsY}2xrLUJNvi5@^LGuQ6Z-aWJW%nE{T6`+w1hYK2%FdrA&I} zmS+u5(0Z)W7~?~oL9U)Gvnm#0D-f8z#wl@@a&Mp1C9=pFwB_)*o|r1IRN1&q{Tr3U zRRV6h%^~@(=v&zKN)((brWI7b)I8ab|74Ql zVu6p(yZJFgaOlwy(endJmDRaGR_&W|Zy5PzUotrD4Q8aYb=6-* z%dQm^bmz!P%2r>{DByWW+XA9yd3TG<`fqR!^waOVFthdD2w8NMxiAHCCz5oBH9U4a5e#a*tlwyGXg11g-BwKwEc${eg!;crNzQ_U7h$ ze5H~3)B9u!wcq5{p11wtlxUHNd4LcdW>|wV+GMJ(N&=`<`}?Y@Z~1D+Zve_^c0Wx5 zx;WToACMga#08gY^6TaDSNF9zaheglKX~xE8f^otH3kaZoMaZ&s;z?icA1KJ4!&J8 zLXZN%nt}2A7i{nCZ+ONMLp21j-}L%xB(xt-~aMP}dNi z+t|kg{nlo*pYr*mp#m7dS+MtsZv*r4Lok#P_Cv*g^}l)9cWHOzZr-T{y;XM#{L=MF z$uJ<;W``+3)D*JF$3KBDw+sj8ZY1kvz})Ae_;U_GLdI_Dw;iHxh7fRs+#Z?h8-u@9 zOAq{^!az&V;^HJ%*#^6Lf=3|79IH8n^)v!guw#9oM0)U56cF!F22H0MhOD-JZKqS>Z=Z z(D{`8O#I`<6uo3ls)+tvNAP45A=T z^a4ZH?0G2&4Ot3&zHY*+tPTFYVw-`sxCyueYJrnU2pd%r_k-yWuu%rTK%KMY*KC1? z+Yt@Oqj;$x2MzvO1e~h{-(8UfE&4Bp_kWu@V5b7)n_8ti?SY1@YYlAAE?H$VL3&1+ zJ{TJsO&=b({hl8zF1LVd@D@&WCDrv%81b(A@M$rQDGEKH^DaqSdMl?tDXsw=jsGB_ zDm9>cdqZ=ykXg*~S1bHn+I`OEd`PvO5$lg1lSgtiVh)tV_4Xz?MI{H+JH654aGqhmh0vDCvyZ zEy2nh)5YV%BQFd6UA1{}i)FH*Wr`NWzs)C34|UadUOy&9qgS>3Fmm!e*JUI4bS-objZKPayQM_=$-vZ8RpW3uMQ zH+i&MAVOqOEPWm#>cAC5u$4a<9)4Im;j#hbLhT+88nc6bf#%%F*XvwZTR&0AAn=6@ zz-teiBS$Kw@yHE?7<79RD);tOL44hCDYa8LVD;F@7qYH{A8802yeNbF{IJM_Tq})7 zK}~^59?;L0`d4~t($lO8eA%hhTnbV$uX5>Kf*qDS`&HczaTrW>@r#{lZpCc3Swnnc z;7hsTzTVq|e_;!0z!pkMDZZ2KVHQ5i6IL2~x5}(HYmICt;@nD)mu`3nkJLAGZ*eU?_TR0#RVbub?)6WyR^MGCXwXxa@Q}(y!NcP&KB*mH(q5XL{1GC7eRd0PGJ@qa>Lh)f1EC(tH%lYud5+KX)tEQ zMf_JuhlusZlJbuW${~EachAV9@mk-6^hposz2o;cTdjZa8!0ynRJw0yJidotY5IOv z=q=cI=^o?1lwN=NsR+d^pIhWm7n`jhck3o9Z=~MY*cT4`b$cDCHKE@v(zg?<_Z1Km z<5DSya}5XuO;+T21FxTst9eG#R#?LIMk-pe9c(e!VE(%=wy36$`cP|!o-o&r3 z$!11JF(lQ;X?0weyiN+TdO+zN!O2QYj+_yO?dlJLi=w6@Mkd;kK3Zy-0$=4_AvoWx zJS0BRQrK;+v$a{}iE@vxIM1|Rk^XQI;Z>A4Kev*tribhV{7950|v zdfWm>g8>Axn^-#;SroXo)~vEWz>OQv#af?Qwq&Phst=f)u)?-(9uEHxT8ckjW3V&m zuf;Jh9}9D@moNWqvtACiiT6=9miK_JJ{!@|T|%h|v$@eR@{`JL-K|;AC?)nP;h|A{ zypnO#l|5LSrnCSc$Jh7pNnama3Ssc{ROzUH@W)QVJr2iLnA#OTd#AUP*lBY0a6#@h zybg-CwDY$aJ_&ML<=w62>$J9oE2P>DcX+UP_Pmx26(*c0W3kjr(IUTz5gBMmC@wy( zQ0_R!1wbCE=DERho%g;ZH>-FIf{UQHhd{+;)iYJ9QYJTQx+nuAB5rM`ZV-$(fm%^( z!C1YXpcJCv!W0*`2X^e-5U(s}KMh0~QF`WQhVl|s7)#Fx%ra!af5hV| zf7@A@E9WS+EuVCw#2?%Xj-jug_6j<0jsjv^Yg}kNKVz7OnOa^NBTNxG5ste|<&Sj0 zmI8{^T--u#;|1f|CM&>})8kTZdA$|xuk|KXhS}L%L^+b3t8JgJj3HxdxK4YMiFan! zT92u^W1}_PR)yC1Wn4n80VzMl`WQeero!9k2yXl>mbSX1OKV}YyVn_=k#@3UnI|#1R0b| z=)*4p_l#n7enO8El?t(k;Q{}4PjB{@>Khl$pWd)ZQM6jMY>c2K3yr)~cHu9gy}4aeWiMZj%o zJe_%yjVfebislzP$pPE%>YL#h}drEsIN0L5Qj@X2->B91Y2&O?fF2b#&D?y+vWV~m> z4VxOWqSB6m;dBwSnV&uq{jh7x-c`wP@u#dd+Dv<4*AP-=$08yP9u$~5J2vo7oBqr0 zz-8Jvf82rb_GGKa%@Lbo-2zUz1T1vwHhbQ-MA1rUe^(H?(l+2|8N4S*w!DcL*eHa4s~4 zpul2Sa}u0C^KBR8j~e*<9edvg@O=foufX>e_`U+)SK#{!d|!e8aVx-BpBZY^O*zfI zwFB-@wIj}NT|9N}&}KESnbg<^e$ih|eV77b397|Trk4B=;snc4MyU$?_52Y`U={O%E z=Kk7_q-B=<3Mag|h4t&|e}i%Qe3Dq>==#}Ae*Ou3xKv?2UvT-oBHUDH+2}vMnV{`N zX}4~?ufd$F`{qN~O^um% z;rDn1sQ(pBjYmBPQr7h{ws@3vGVku!9+Ok94h-i zab^Dl=uCW#h|@xclPLqw2&3y-=-AlUR{s1!Okii%a=H6B^A{r#6f(T&K_en;^2=ux zshdAxPa2#TC)&szqNYAoR$k_e+8;sLMd*BsFnNCgc`G|c7u#Taj-;aL?KLmLcXBUr zf9~@*O3~wA8EscYQvdUs@*_Y@me@jNFlZHPLCi{N(^@1;9z8yuwJOees_K6RWBrZY zt%O~R9lVuOW0Blzf%&i>gEPr7fX5;%`{yBl_oHj)np_@|wEQC?#113-& zu$TYOqA=EFceKz1QriYaPJg(()+%5E18NZ*8`M?);Q|+#0x5Fx82{7nr-BL0q%}fk zbn~Ft_HrVf$wVIyEpLf_6B-wJ11vnXO&WCV{z*1u$U>2TFcm2I-R^mBgVjH zRp^F{`TWgTu78#I@gE$@uhA?BT0m4xTfV*Oi&UMZv}5Ga?T68^A_n>x}cZ)nUra&ZWft^RM$mh!Nkb^wW4qwF@^|-TdkUS z2DPG=jW!X(|C`~We=F|)0A4XfkQkHFT!#~X=S_Q3H1TSyH zRg;d+RgKP7jrONT8&Z@vq(-N#N2jbQUAgju->3Dt!OFFXTns?q>FVdQ&MBb@0MOqz AEdT%j literal 0 HcmV?d00001 From 9119157f072db2070d17a7b9cce4e3925caaedb6 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Fri, 17 Sep 2021 14:07:08 -0500 Subject: [PATCH 4/8] Update to test --- bin/generate.py | 37 ++++++++++++++++--- .../ransomware_investigate_and_contain.yml | 17 ++++++++- 2 files changed, 47 insertions(+), 7 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index d9bf78dae4..38ab494f0f 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -395,7 +395,27 @@ def add_rba(detection): return detection -def prepare_detections(detections, deployments, OUTPUT_PATH): +def add_playbook(detection, playbooks): + preface = " The following Splunk SOAR playbook can be used to respond to this detection: " + + for playbook in playbooks: + if detection['name'] in playbook['tags']['detections']: + detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name'] + return detection + +def map_playbooks_to_stories(playbooks): + sto_play = {} + for playbook in playbooks: + if 'tags' in playbook: + if 'analytic_story' in playbook['tags']: + for story in playbook['tags']['analytic_story']: + if not (story in sto_play): + sto_play[story] = {playbook['name']} + else: + sto_play[story].add(playbook['name']) + return sto_play + +def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH): for detection in detections: # only for DevSecOps if global_product == 'DevSecOps': @@ -431,9 +451,10 @@ def prepare_detections(detections, deployments, OUTPUT_PATH): if key in detection['tags']: mappings[key] = detection['tags'][key] detection['mappings'] = mappings - + detection = add_annotations(detection) detection = add_rba(detection) + detection = add_playbook(detection, playbooks) # add additional metadata if 'product' in detection['tags']: @@ -445,7 +466,7 @@ def prepare_detections(detections, deployments, OUTPUT_PATH): return detections -def prepare_stories(stories, detections): +def prepare_stories(stories, detections, playbooks): # enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists sto_to_data_models = {} sto_to_mitre_attack_ids = {} @@ -454,6 +475,7 @@ def prepare_stories(stories, detections): sto_to_nists = {} sto_to_det = {} + preface = " The following Splunk SOAR playbooks can be used in the response to this story's analytics: " baselines = [object for object in detections if 'Baseline' in object['type']] for detection in detections: @@ -505,6 +527,7 @@ def prepare_stories(stories, detections): sto_res = map_response_tasks_to_stories(detections) sto_bas = map_baselines_to_stories(baselines) + sto_play = map_playbooks_to_stories(playbooks) for story in stories: story['author_name'], story['author_company'] = parse_author_company(story) @@ -513,6 +536,9 @@ def prepare_stories(stories, detections): story['searches'] = story['detections'] if story['name'] in sto_to_data_models: story['data_models'] = sorted(sto_to_data_models[story['name']]) + if story['name'] in sto_play: + story['description'] = str(story['description']) + preface + str(sto_play[story['name']]) + story['description'] = story['description'].replace('{', ' ').replace('}', ' ') if story['name'] in sto_to_mitre_attack_ids: story['mitre_attack'] = sorted(sto_to_mitre_attack_ids[story['name']]) if story['name'] in sto_to_kill_chain_phases: @@ -532,6 +558,7 @@ def prepare_stories(stories, detections): story['baselines'] = sorted(list(sto_bas[story['name']])) + keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] mappings = {} for key in keys: @@ -600,8 +627,8 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH): objects["macros"] = sorted(objects["macros"], key=lambda m: m['name']) - objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH) - objects["stories"] = prepare_stories(objects["stories"], objects["detections"]) + objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], objects["playbooks"], OUTPUT_PATH) + objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["playbooks"]) return objects diff --git a/playbooks/ransomware_investigate_and_contain.yml b/playbooks/ransomware_investigate_and_contain.yml index 7da8d697a1..a8be2197b9 100644 --- a/playbooks/ransomware_investigate_and_contain.yml +++ b/playbooks/ransomware_investigate_and_contain.yml @@ -1,7 +1,7 @@ name: Ransomware Investigate and Contain id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 version: 1 -date: '2018-02-' +date: '2018-02-04' author: Philip Royer, Splunk type: Response description: This playbook investigates and contains ransomware detected on endpoints. @@ -9,10 +9,23 @@ playbook: ransomware_investigate_and_contain how_to_implement: This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response. references: [] +app_list: +- "Carbon Black Response" +- "LDAP" +- "Palo Alto Networks Firewall" +- "WildFire" +- "Cylance" tags: analytic_story: - Ransomware detections: - - Ransomware Notes bulk creation + - Conti Common Exec parameter + platform_tags: + - tag1 + - tag2 + - tag3 + playbook_fields: + - ComputerName + - Username product: - Splunk SOAR \ No newline at end of file From a9c1b46eee5d28f741be2507bf08d09785903914 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 22 Sep 2021 10:07:02 -0500 Subject: [PATCH 5/8] Staging for merge --- dist/escu/default/analytic_stories.conf | 12 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 198 +- dist/escu/default/savedsearches.conf | 2260 +++++++++++- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 522 ++- dist/escu/lookups/mitre_enrichment.csv | 1004 +++--- playbooks/GSuite_DevSecOps.json | 4034 ---------------------- playbooks/GSuite_DevSecOps.png | Bin 239611 -> 0 bytes playbooks/GSuite_DevSecOps.py | 212 -- playbooks/GSuite_DevSecOps.yml | 17 - 12 files changed, 3520 insertions(+), 4745 deletions(-) delete mode 100644 playbooks/GSuite_DevSecOps.json delete mode 100644 playbooks/GSuite_DevSecOps.png delete mode 100644 playbooks/GSuite_DevSecOps.py delete mode 100644 playbooks/GSuite_DevSecOps.yml diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 3a4e86c306..5048d3a327 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-09T22:26:38 UTC +# On Date: 2021-09-17T20:14:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -105,8 +105,8 @@ modification_date = 2021-08-20 id = 8460679c-2b21-463e-b381-b813417c32f2 version = 1 reference = ["https://attack.mitre.org/tactics/TA0007/", "https://adsecurity.org/?p=2535", "https://attack.mitre.org/techniques/T1087/001/", "https://attack.mitre.org/techniques/T1087/002/", "https://attack.mitre.org/techniques/T1087/003/", "https://attack.mitre.org/techniques/T1482/", "https://attack.mitre.org/techniques/T1201/", "https://attack.mitre.org/techniques/T1069/001/", "https://attack.mitre.org/techniques/T1069/002/", "https://attack.mitre.org/techniques/T1018/", "https://attack.mitre.org/techniques/T1049/", "https://attack.mitre.org/techniques/T1033/"] -detection_searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - Password Policy Discovery with Net - Rule"] -mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001", "T1087.002", "T1201"]} +detection_searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - DSQuery Domain Discovery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Domain Controller Discovery with Nltest - Rule", "ESCU - Domain Controller Discovery with Wmic - Rule", "ESCU - Domain Group Discovery With Dsquery - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Domain Group Discovery With Wmic - Rule", "ESCU - Domain Group Discovery with Adsisearcher - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Elevated Group Discovery With Wmic - Rule", "ESCU - Elevated Group Discovery with PowerView - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get WMIObject Group Discovery - Rule", "ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule", "ESCU - Get-DomainTrust with PowerShell - Rule", "ESCU - Get-DomainTrust with PowerShell Script Block - Rule", "ESCU - Get-ForestTrust with PowerShell - Rule", "ESCU - Get-ForestTrust with PowerShell Script Block - Rule", "ESCU - GetAdComputer with PowerShell - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - GetAdGroup with PowerShell - Rule", "ESCU - GetAdGroup with PowerShell Script Block - Rule", "ESCU - GetCurrent User with PowerShell - Rule", "ESCU - GetCurrent User with PowerShell Script Block - Rule", "ESCU - GetDomainComputer with PowerShell - Rule", "ESCU - GetDomainComputer with PowerShell Script Block - Rule", "ESCU - GetDomainController with PowerShell - Rule", "ESCU - GetDomainController with PowerShell Script Block - Rule", "ESCU - GetDomainGroup with PowerShell - Rule", "ESCU - GetDomainGroup with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetNetTcpconnection with PowerShell - Rule", "ESCU - GetNetTcpconnection with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Group with PowerShell - Rule", "ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Password Policy Discovery with Net - Rule", "ESCU - PowerShell Get LocalGroup Discovery - Rule", "ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule", "ESCU - Remote System Discovery with Adsisearcher - Rule", "ESCU - Remote System Discovery with Dsquery - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote System Discovery with Wmic - Rule", "ESCU - System User Discovery With Query - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - User Discovery With Env Vars PowerShell - Rule", "ESCU - User Discovery With Env Vars PowerShell Script Block - Rule", "ESCU - Wmic Group Discovery - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation", "Reconnaissance"], "mitre_attack": ["T1018", "T1033", "T1049", "T1069.001", "T1069.002", "T1087.001", "T1087.002", "T1201", "T1482"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] @@ -927,7 +927,7 @@ modification_date = 2021-09-08 id = 4ad4253e-10ca-11ec-8235-acde48001122 version = 1 reference = ["https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "https://www.echotrail.io/insights/search/control.exe"] -detection_searches = ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"] +detection_searches = ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"] mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.002", "T1218.011", "T1566.001"]} investigative_searches = [] support_searches = [] @@ -1164,7 +1164,7 @@ investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Email", "Endpoint", "Network_Traffic"] providing_technologies = none -description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] @@ -1301,7 +1301,7 @@ modification_date = 2019-04-29 id = 57226b40-94f3-4ce5-b101-a75f67759c27 version = 1 reference = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] -detection_searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"] +detection_searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"] mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.002", "T1566.001", "T1566.002"], "nist": ["ID.AM", "PR.DS"]} investigative_searches = [] support_searches = [] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 68279e3e25..66fb5fbdf8 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-09T22:26:38 UTC +# On Date: 2021-09-17T20:14:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 31c2e0592a..1a5a5c5387 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -414,7 +414,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_ransomware] label = Ransomware -description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' disabled = 0 panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_rundll32_lockworkstation___response_task"] diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 28d0753ab5..7e45fe3a6f 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-09T22:26:38 UTC +# On Date: 2021-09-17T20:14:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1391,6 +1391,30 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[domain_controller_discovery_with_nltest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_controller_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_adsisearcher_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [download_files_using_telegram_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1431,6 +1455,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[elevated_group_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_powerview_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [email_attachments_with_lots_of_spaces_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1739,10 +1775,82 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[get_wmiobject_group_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_wmiobject_group_discovery_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [get_web_session_information_via_session_id_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[get_domaintrust_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domaintrust_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_foresttrust_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_foresttrust_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadcomputer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadcomputer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadgroup_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadgroup_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getcurrent_user_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getcurrent_user_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincomputer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincomputer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincontroller_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincontroller_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaingroup_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaingroup_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [getlocaluser_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1751,6 +1859,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[getnettcpconnection_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getnettcpconnection_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [getwmiobject_ds_user_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1759,6 +1875,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[getwmiobject_ds_computer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_computer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_group_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_group_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [getwmiobject_user_account_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2139,6 +2271,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[net_localgroup_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_arp_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_netstat_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [new_container_uploaded_to_aws_ecr_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2243,6 +2391,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[office_product_writing_cab_or_inf_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [office_spawning_control_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2299,6 +2451,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[powershell_get_localgroup_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2331,6 +2487,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[powershell_get_localgroup_discovery_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [powershell_processing_stream_of_data_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2587,6 +2747,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[remote_system_discovery_with_adsisearcher_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [remote_wmi_command_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2951,6 +3127,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[system_user_discovery_with_query_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_user_discovery_with_whoami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [systems_ready_for_spectre_meltdown_windows_patch_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3019,6 +3203,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[user_discovery_with_env_vars_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[user_discovery_with_env_vars_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [w3wp_spawning_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3135,6 +3327,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[wmic_group_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [write_executable_in_smb_share_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index ce66dbc308..9a8c2a782d 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-09T22:26:38 UTC +# On Date: 2021-09-17T20:14:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -3823,7 +3823,7 @@ description = This search detects the suspicious commandline argument of revil r action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. The following Splunk SOAR playbook can be used to respond to this detection: Ransomware Investigate and Contain action.escu.known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. action.escu.creation_date = 2021-06-02 action.escu.modification_date = 2021-06-02 @@ -4218,7 +4218,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process="* share *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_or_delete_windows_shares_using_net_exe_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process="* share *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_or_delete_windows_shares_using_net_exe_filter` [ESCU - Creation of Shadow Copy - Rule] action.escu = 0 @@ -4738,7 +4738,7 @@ action.escu.full_search_name = ESCU - DSQuery Domain Discovery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Domain Trust Discovery"] +action.escu.analytic_story = ["Domain Trust Discovery", "Active Directory Discovery"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -4748,7 +4748,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DSQuery Domain Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery", "Active Directory Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5508,12 +5508,12 @@ search = `wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName= [ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -5538,7 +5538,7 @@ action.correlationsearch.label = ESCU - Detect Copy of ShadowCopy with Script Bl action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.notable.param.rule_title = Detect Copy of ShadowCopy with Script Block Logging @@ -9985,6 +9985,275 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter` +[ESCU - Domain Controller Discovery with Nltest - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-30 +action.escu.modification_date = 2021-08-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Domain Controller Discovery with Nltest - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain controller discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Domain Controller Discovery with Nltest - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Domain Controller Discovery with Nltest +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="nltest.exe") (Processes.process="*/dclist:*" OR Processes.process="*/dsgetdc:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_nltest_filter` + +[ESCU - Domain Controller Discovery with Wmic - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-01 +action.escu.modification_date = 2021-09-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Domain Controller Discovery with Wmic - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain controller discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Domain Controller Discovery with Wmic - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Domain Controller Discovery with Wmic +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process="" OR Processes.process="*DomainControllerAddress*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_wmic_filter` + +[ESCU - Domain Group Discovery With Dsquery - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-01 +action.escu.modification_date = 2021-09-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Domain Group Discovery With Dsquery - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Domain Group Discovery With Dsquery - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Domain Group Discovery With Dsquery +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") (Processes.process="*group*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter` + +[ESCU - Domain Group Discovery With Net - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Domain Group Discovery With Net - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Domain Group Discovery With Net - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Domain Group Discovery With Net +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process=*group* AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter` + +[ESCU - Domain Group Discovery With Wmic - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Domain Group Discovery With Wmic - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Domain Group Discovery With Wmic - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Domain Group Discovery With Wmic +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* AND Processes.process="*GET ds_samaccountname*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter` + +[ESCU - Domain Group Discovery with Adsisearcher - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Domain Group Discovery with Adsisearcher - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Domain Group Discovery with Adsisearcher - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Domain Group Discovery with Adsisearcher +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `domain_group_discovery_with_adsisearcher_filter` + [ESCU - Download Files Using Telegram - Rule] action.escu = 0 action.escu.enabled = 1 @@ -10425,6 +10694,140 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter` +[ESCU - Elevated Group Discovery With Net - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Elevated Group Discovery With Net - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Elevated domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Elevated Group Discovery With Net - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.notable.param.rule_title = Elevated Group Discovery With Net +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process="*group*" AND Processes.process="*/do*") (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_net_filter` + +[ESCU - Elevated Group Discovery With Wmic - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Elevated Group Discovery With Wmic - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Elevated domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Elevated Group Discovery With Wmic - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.notable.param.rule_title = Elevated Group Discovery With Wmic +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter` + +[ESCU - Elevated Group Discovery with PowerView - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerView for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Elevated Group Discovery with PowerView - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Elevated group discovery using PowerView on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Elevated Group Discovery with PowerView - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +action.notable.param.rule_title = Elevated Group Discovery with PowerView +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter` + [ESCU - Email Attachments With Lots Of Spaces - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12721,6 +13124,825 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter` +[ESCU - Get WMIObject Group Discovery - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.creation_date = 2021-09-14 +action.escu.modification_date = 2021-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Get WMIObject Group Discovery - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System group discovery on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Get WMIObject Group Discovery - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. +action.notable.param.rule_title = Get WMIObject Group Discovery +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_filter` + +[ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.creation_date = 2021-09-14 +action.escu.modification_date = 2021-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System group discovery enumeration on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.notable.param.rule_title = Get WMIObject Group Discovery with Script Block Logging +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*Get-WMIObject*" AND Message = "*Win32_Group*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter` + +[ESCU - Get-DomainTrust with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. +action.escu.creation_date = 2021-08-24 +action.escu.modification_date = 2021-08-24 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Get-DomainTrust with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Get-DomainTrust with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +action.notable.param.rule_title = Get-DomainTrust with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*get-domaintrust* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter` + +[ESCU - Get-DomainTrust with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = It is possible certain system management frameworks utilize this command to gather trust information. +action.escu.creation_date = 2021-08-24 +action.escu.modification_date = 2021-08-24 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Get-DomainTrust with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 12}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Get-DomainTrust with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.notable.param.rule_title = Get-DomainTrust with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter` + +[ESCU - Get-ForestTrust with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. +action.escu.creation_date = 2021-09-02 +action.escu.modification_date = 2021-09-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Get-ForestTrust with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Get-ForestTrust with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +action.notable.param.rule_title = Get-ForestTrust with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe Processes.process=*get-foresttrust* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_filter` + +[ESCU - Get-ForestTrust with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = UPDATE_KNOWN_FALSE_POSITIVES +action.escu.creation_date = 2021-09-02 +action.escu.modification_date = 2021-09-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Get-ForestTrust with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$ by user $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 12}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Get-ForestTrust with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.notable.param.rule_title = Get-ForestTrust with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter` + +[ESCU - GetAdComputer with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-07 +action.escu.modification_date = 2021-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetAdComputer with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetAdComputer with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetAdComputer with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-AdComputer*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadcomputer_with_powershell_filter` + +[ESCU - GetAdComputer with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-09-01 +action.escu.modification_date = 2021-09-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetAdComputer with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetAdComputer with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetAdComputer with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter` + +[ESCU - GetAdGroup with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetAdGroup with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetAdGroup with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetAdGroup with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_filter` + +[ESCU - GetAdGroup with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetAdGroup with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetAdGroup with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetAdGroup with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-ADGroup*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getadgroup_with_powershell_script_block_filter` + +[ESCU - GetCurrent User with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-13 +action.escu.modification_date = 2021-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetCurrent User with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System user discovery on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetCurrent User with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetCurrent User with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter` + +[ESCU - GetCurrent User with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-09-13 +action.escu.modification_date = 2021-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetCurrent User with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System user discovery on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetCurrent User with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetCurrent User with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*" AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getcurrent_user_with_powershell_script_block_filter` + +[ESCU - GetDomainComputer with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use PowerView for troubleshooting. +action.escu.creation_date = 2021-09-07 +action.escu.modification_date = 2021-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetDomainComputer with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetDomainComputer with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetDomainComputer with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-DomainComputer*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincomputer_with_powershell_filter` + +[ESCU - GetDomainComputer with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use PowerView for troubleshooting. +action.escu.creation_date = 2021-09-02 +action.escu.modification_date = 2021-09-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetDomainComputer with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery with PowerView on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetDomainComputer with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetDomainComputer with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter` + +[ESCU - GetDomainController with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use PowerView for troubleshooting. +action.escu.creation_date = 2021-09-07 +action.escu.modification_date = 2021-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetDomainController with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery using PowerView on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetDomainController with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetDomainController with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-DomainController*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincontroller_with_powershell_filter` + +[ESCU - GetDomainController with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-09-02 +action.escu.modification_date = 2021-09-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetDomainController with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery with PowerView on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetDomainController with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetDomainController with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter` + +[ESCU - GetDomainGroup with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetDomainGroup with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery with PowerView on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetDomainGroup with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_filter` + +[ESCU - GetDomainGroup with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerView functions for troubleshooting. +action.escu.creation_date = 2021-08-26 +action.escu.modification_date = 2021-08-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetDomainGroup with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration using PowerView on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetDomainGroup with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter` + [ESCU - GetLocalUser with PowerShell - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12810,6 +14032,95 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 (Message = "*Get-LocalUser*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getlocaluser_with_powershell_script_block_filter` +[ESCU - GetNetTcpconnection with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetNetTcpconnection with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetNetTcpconnection with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetNetTcpconnection with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-NetTcpConnection*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getnettcpconnection_with_powershell_filter` + +[ESCU - GetNetTcpconnection with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-09-10 +action.escu.modification_date = 2021-09-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetNetTcpconnection with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetNetTcpconnection with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetNetTcpconnection with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter` + [ESCU - GetWmiObject DS User with PowerShell - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12899,6 +14210,184 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter` +[ESCU - GetWmiObject Ds Computer with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-07 +action.escu.modification_date = 2021-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetWmiObject Ds Computer with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration using WMI on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 21}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetWmiObject Ds Computer with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetWmiObject Ds Computer with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" AND Processes.process="*class ds_computer*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_filter` + +[ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-09-01 +action.escu.modification_date = 2021-09-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetWmiObject Ds Computer with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter` + +[ESCU - GetWmiObject Ds Group with PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetWmiObject Ds Group with PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetWmiObject Ds Group with PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetWmiObject Ds Group with PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" AND Processes.process="*class ds_group*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter` + +[ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-08-25 +action.escu.modification_date = 2021-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = GetWmiObject Ds Group with PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter` + [ESCU - GetWmiObject User Account with PowerShell - Rule] action.escu = 0 action.escu.enabled = 1 @@ -13173,7 +14662,7 @@ description = This search is to detect suspicious google drive or google docs fi action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. The following Splunk SOAR playbook can be used to respond to this detection: GSuite_DevSecOps action.escu.known_false_positives = network admin or normal user may share files to customer and external team. action.escu.creation_date = 2021-08-16 action.escu.modification_date = 2021-08-16 @@ -16245,7 +17734,7 @@ action.escu.full_search_name = ESCU - NLTest Domain Trust Discovery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID"] +action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID", "Active Directory Discovery"] action.risk = 1 action.risk.param._risk_message = Domain trust discovery execution on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] @@ -16255,7 +17744,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - NLTest Domain Trust Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID", "Active Directory Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -16274,6 +17763,186 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter` +[ESCU - Net Localgroup Discovery - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.creation_date = 2021-09-14 +action.escu.modification_date = 2021-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Net Localgroup Discovery - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Local group discovery on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Net Localgroup Discovery - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. +action.notable.param.rule_title = Net Localgroup Discovery +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=net.exe OR Processes.process_name=net1.exe (Processes.process="*localgroup*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `net_localgroup_discovery_filter` + +[ESCU - Network Connection Discovery With Arp - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-10 +action.escu.modification_date = 2021-09-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Network Connection Discovery With Arp - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Network Connection Discovery With Arp - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Network Connection Discovery With Arp +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="arp.exe") (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_arp_filter` + +[ESCU - Network Connection Discovery With Net - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-10 +action.escu.modification_date = 2021-09-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Network Connection Discovery With Net - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Network Connection Discovery With Net - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Network Connection Discovery With Net +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process=*use*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter` + +[ESCU - Network Connection Discovery With Netstat - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-10 +action.escu.modification_date = 2021-09-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Network Connection Discovery With Netstat - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Network Connection Discovery With Netstat - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Network Connection Discovery With Netstat +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="netstat.exe") (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_netstat_filter` + [ESCU - New container uploaded to AWS ECR - Rule] action.escu = 0 action.escu.enabled = 1 @@ -17373,6 +19042,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=wmic.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter` +[ESCU - Office Product Writing cab or inf - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +action.escu.known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. +action.escu.creation_date = 2021-09-10 +action.escu.modification_date = 2021-09-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Office Product Writing cab or inf - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"] +action.risk = 1 +action.risk.param._risk_message = An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Office Product Writing cab or inf - Rule +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. +action.notable.param.rule_title = Office Product Writing cab or inf +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path | `office_product_writing_cab_or_inf_filter` + [ESCU - Office Spawning Control - Rule] action.escu = 0 action.escu.enabled = 1 @@ -17942,12 +19656,12 @@ search = `powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit [ESCU - PowerShell Domain Enumeration - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -17972,7 +19686,7 @@ action.correlationsearch.label = ESCU - PowerShell Domain Enumeration - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.notable.param.rule_title = PowerShell Domain Enumeration @@ -17987,7 +19701,52 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter` +search = `powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter` + +[ESCU - PowerShell Get LocalGroup Discovery - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.creation_date = 2021-09-14 +action.escu.modification_date = 2021-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - PowerShell Get LocalGroup Discovery - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Local group discovery on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - PowerShell Get LocalGroup Discovery - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. +action.notable.param.rule_title = PowerShell Get LocalGroup Discovery +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe) (Processes.process="*get-localgroup*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_filter` [ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule] action.escu = 0 @@ -18309,13 +20068,13 @@ search = `powershell` EventCode=4104 Message=*getprocaddress* | stats count min( [ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -18341,7 +20100,7 @@ action.correlationsearch.label = ESCU - Powershell Fileless Script Contains Base action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -18359,6 +20118,56 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter` +[ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.creation_date = 2021-09-14 +action.escu.modification_date = 2021-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Local group discovery on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.notable.param.rule_title = Powershell Get LocalGroup Discovery with Script Block Logging +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter` + [ESCU - Powershell Processing Stream Of Data - Rule] action.escu = 0 action.escu.enabled = 1 @@ -19710,6 +21519,185 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remote_registry_key_modifications_filter` +[ESCU - Remote System Discovery with Adsisearcher - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting. +action.escu.creation_date = 2021-09-01 +action.escu.modification_date = 2021-09-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Remote System Discovery with Adsisearcher - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Remote System Discovery with Adsisearcher - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Remote System Discovery with Adsisearcher +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*" AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `remote_system_discovery_with_adsisearcher_filter` + +[ESCU - Remote System Discovery with Dsquery - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-31 +action.escu.modification_date = 2021-08-31 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Remote System Discovery with Dsquery - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Remote System Discovery with Dsquery - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Remote System Discovery with Dsquery +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") (Processes.process="*computer*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_dsquery_filter` + +[ESCU - Remote System Discovery with Net - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-08-30 +action.escu.modification_date = 2021-08-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Remote System Discovery with Net - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Remote System Discovery with Net - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Remote System Discovery with Net +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process="*domain computers*" AND Processes.process=*/do*) OR (Processes.process="*view*" AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter` + +[ESCU - Remote System Discovery with Wmic - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-01 +action.escu.modification_date = 2021-09-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Remote System Discovery with Wmic - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Remote System Discovery with Wmic - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = Remote System Discovery with Wmic +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_computer* AND Processes.process="*GET ds_samaccountname*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter` + [ESCU - Remote WMI Command Attempt - Rule] action.escu = 0 action.escu.enabled = 1 @@ -23721,6 +25709,96 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter` +[ESCU - System User Discovery With Query - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-13 +action.escu.modification_date = 2021-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - System User Discovery With Query - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System user discovery on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - System User Discovery With Query - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = System User Discovery With Query +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe") (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_query_filter` + +[ESCU - System User Discovery With Whoami - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-13 +action.escu.modification_date = 2021-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - System User Discovery With Whoami - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System user discovery on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - System User Discovery With Whoami - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = System User Discovery With Whoami +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter` + [ESCU - TOR Traffic - Rule] action.escu = 0 action.escu.enabled = 1 @@ -24117,12 +26195,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Unloading AMSI via Reflection - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -24147,7 +26225,7 @@ action.correlationsearch.label = ESCU - Unloading AMSI via Reflection - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.notable.param.rule_title = Unloading AMSI via Reflection @@ -24371,6 +26449,95 @@ realtime_schedule = 0 is_visible = false search = `stream_http` | eval cs_content_type_length = len(cs_content_type) | where cs_content_type_length > 100 | table endtime src_ip dest_ip cs_content_type_length cs_content_type url | `unusually_long_content_type_length_filter` +[ESCU - User Discovery With Env Vars PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. +action.escu.creation_date = 2021-09-13 +action.escu.modification_date = 2021-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - User Discovery With Env Vars PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System user discovery on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - User Discovery With Env Vars PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = User Discovery With Env Vars PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter` + +[ESCU - User Discovery With Env Vars PowerShell Script Block - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +action.escu.creation_date = 2021-09-13 +action.escu.modification_date = 2021-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - User Discovery With Env Vars PowerShell Script Block - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = System user discovery on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - User Discovery With Env Vars PowerShell Script Block - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +action.notable.param.rule_title = User Discovery With Env Vars PowerShell Script Block +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter` + [ESCU - W3WP Spawning Shell - Rule] action.escu = 0 action.escu.enabled = 1 @@ -25577,6 +27744,57 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter` +[ESCU - Wmic Group Discovery - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes and identify any further suspicious behavior. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes and identify any further suspicious behavior. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.creation_date = 2021-09-14 +action.escu.modification_date = 2021-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Wmic Group Discovery - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Discovery"] +action.risk = 1 +action.risk.param._risk_message = Local group discovery on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Wmic Group Discovery - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes and identify any further suspicious behavior. +action.notable.param.rule_title = Wmic Group Discovery +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe (Processes.process="*group get name*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmic_group_discovery_filter` + [ESCU - Write Executable in SMB Share - Rule] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 15521cc1d2..08869c70d7 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-09T22:26:38 UTC +# On Date: 2021-09-17T20:14:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 15db00c81a..cd3d19f2de 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-09T22:26:38 UTC +# On Date: 2021-09-17T20:14:56 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -75,7 +75,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0007/", "https://adsecurity.org/?p=2535", "https://attack.mitre.org/techniques/T1087/001/", "https://attack.mitre.org/techniques/T1087/002/", "https://attack.mitre.org/techniques/T1087/003/", "https://attack.mitre.org/techniques/T1482/", "https://attack.mitre.org/techniques/T1201/", "https://attack.mitre.org/techniques/T1069/001/", "https://attack.mitre.org/techniques/T1069/002/", "https://attack.mitre.org/techniques/T1018/", "https://attack.mitre.org/techniques/T1049/", "https://attack.mitre.org/techniques/T1033/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}] spec_version = 3 -searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - Password Policy Discovery with Net - Rule"] +searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - DSQuery Domain Discovery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Domain Controller Discovery with Nltest - Rule", "ESCU - Domain Controller Discovery with Wmic - Rule", "ESCU - Domain Group Discovery With Dsquery - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Domain Group Discovery With Wmic - Rule", "ESCU - Domain Group Discovery with Adsisearcher - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Elevated Group Discovery With Wmic - Rule", "ESCU - Elevated Group Discovery with PowerView - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get WMIObject Group Discovery - Rule", "ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule", "ESCU - Get-DomainTrust with PowerShell - Rule", "ESCU - Get-DomainTrust with PowerShell Script Block - Rule", "ESCU - Get-ForestTrust with PowerShell - Rule", "ESCU - Get-ForestTrust with PowerShell Script Block - Rule", "ESCU - GetAdComputer with PowerShell - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - GetAdGroup with PowerShell - Rule", "ESCU - GetAdGroup with PowerShell Script Block - Rule", "ESCU - GetCurrent User with PowerShell - Rule", "ESCU - GetCurrent User with PowerShell Script Block - Rule", "ESCU - GetDomainComputer with PowerShell - Rule", "ESCU - GetDomainComputer with PowerShell Script Block - Rule", "ESCU - GetDomainController with PowerShell - Rule", "ESCU - GetDomainController with PowerShell Script Block - Rule", "ESCU - GetDomainGroup with PowerShell - Rule", "ESCU - GetDomainGroup with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetNetTcpconnection with PowerShell - Rule", "ESCU - GetNetTcpconnection with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Group with PowerShell - Rule", "ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Password Policy Discovery with Net - Rule", "ESCU - PowerShell Get LocalGroup Discovery - Rule", "ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule", "ESCU - Remote System Discovery with Adsisearcher - Rule", "ESCU - Remote System Discovery with Dsquery - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote System Discovery with Wmic - Rule", "ESCU - System User Discovery With Query - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - User Discovery With Env Vars PowerShell - Rule", "ESCU - User Discovery With Env Vars PowerShell Script Block - Rule", "ESCU - Wmic Group Discovery - Rule"] description = Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments. narrative = Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next.\ Once an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, domain controllers, network shares, group policy objects, domain trusts, etc. @@ -639,7 +639,7 @@ version = 1 references = ["https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "https://www.echotrail.io/insights/search/control.exe"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"] +searches = ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"] description = CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents. narrative = Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, CVE-2021-40444 by using specially-crafted Microsoft Office documents. MSHTML is a software component used to render web pages on Windows. Although it’s most commonly associated with Internet Explorer, it is also used in other software. CVE-2021-40444 received a CVSS score of 8.8 out of 10. MSHTML is the beating heart of Internet Explorer, the vulnerability also exists in that browser. Although given its limited use, there is little risk of infection by that vector. Microsoft Office applications use the MSHTML component to display web content in Office documents. The attack depends on MSHTML loading a specially crafted ActiveX control when the target opens a malicious Office document. The loaded ActiveX control can then run arbitrary code to infect the system with more malware. \ At the moment all supported Windows versions are vulnerable. Since there is no patch available yet, Microsoft proposes a few methods to block these attacks. \ 1. Disable the installation of all ActiveX controls in Internet Explorer via the registry. Previously-installed ActiveX controls will still run, but no new ones will be added, including malicious ones. \ @@ -805,7 +805,7 @@ references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-resear maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] -description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. [analytic_story://Ransomware Cloud] @@ -899,7 +899,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"] +searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -2250,7 +2250,7 @@ type = detection asset_type = confidence = medium explanation = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. The following Splunk SOAR playbook can be used to respond to this detection: Ransomware Investigate and Contain annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. providing_technologies = [] @@ -2656,7 +2656,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -3706,6 +3706,66 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087. known_false_positives = network admin may execute this command for listing users. providing_technologies = [] +[savedsearch://ESCU - Domain Controller Discovery with Nltest - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Domain Controller Discovery with Wmic - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Domain Group Discovery With Dsquery - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Domain Group Discovery With Net - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Domain Group Discovery With Wmic - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Domain Group Discovery with Adsisearcher - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - Download Files Using Telegram - Rule] type = detection asset_type = @@ -3808,6 +3868,36 @@ annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.A known_false_positives = It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior. providing_technologies = [] +[savedsearch://ESCU - Elevated Group Discovery With Net - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Elevated Group Discovery With Wmic - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Elevated Group Discovery with PowerView - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this PowerView for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - Email Attachments With Lots Of Spaces - Rule] type = detection asset_type = Endpoint @@ -4341,6 +4431,192 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087. known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Get WMIObject Group Discovery - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +known_false_positives = False positives may be present. Tune as needed. +providing_technologies = [] + +[savedsearch://ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +known_false_positives = False positives may be present. Tune as needed. +providing_technologies = [] + +[savedsearch://ESCU - Get-DomainTrust with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. +providing_technologies = [] + +[savedsearch://ESCU - Get-DomainTrust with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +known_false_positives = It is possible certain system management frameworks utilize this command to gather trust information. +providing_technologies = [] + +[savedsearch://ESCU - Get-ForestTrust with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. +providing_technologies = [] + +[savedsearch://ESCU - Get-ForestTrust with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} +known_false_positives = UPDATE_KNOWN_FALSE_POSITIVES +providing_technologies = [] + +[savedsearch://ESCU - GetAdComputer with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetAdComputer with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetAdGroup with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetAdGroup with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetCurrent User with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetCurrent User with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetDomainComputer with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use PowerView for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetDomainComputer with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use PowerView for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetDomainController with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use PowerView for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetDomainController with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetDomainGroup with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetDomainGroup with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this PowerView functions for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - GetLocalUser with PowerShell - Rule] type = detection asset_type = @@ -4361,6 +4637,26 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087. known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] +[savedsearch://ESCU - GetNetTcpconnection with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetNetTcpconnection with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - GetWmiObject DS User with PowerShell - Rule] type = detection asset_type = @@ -4381,6 +4677,46 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087. known_false_positives = not commonly seen as a normal command from network admin but possible noise may exist. providing_technologies = [] +[savedsearch://ESCU - GetWmiObject Ds Computer with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetWmiObject Ds Group with PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - GetWmiObject User Account with PowerShell - Rule] type = detection asset_type = @@ -4446,7 +4782,7 @@ type = detection asset_type = confidence = medium explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. The following Splunk SOAR playbook can be used to respond to this detection: GSuite_DevSecOps annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]} known_false_positives = network admin or normal user may share files to customer and external team. providing_technologies = [] @@ -5175,6 +5511,46 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre known_false_positives = Administrators may use nltest for troubleshooting purposes, otherwise, rarely used. providing_technologies = [] +[savedsearch://ESCU - Net Localgroup Discovery - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +known_false_positives = False positives may be present. Tune as needed. +providing_technologies = [] + +[savedsearch://ESCU - Network Connection Discovery With Arp - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Network Connection Discovery With Net - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Network Connection Discovery With Netstat - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - New container uploaded to AWS ECR - Rule] type = detection asset_type = AWS ECR container @@ -5437,6 +5813,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00 known_false_positives = No false positives known. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Office Product Writing cab or inf - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. +providing_technologies = [] + [savedsearch://ESCU - Office Spawning Control - Rule] type = detection asset_type = @@ -5574,7 +5960,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -5582,6 +5968,16 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059. known_false_positives = It is possible there will be false positives, filter as needed. providing_technologies = [] +[savedsearch://ESCU - PowerShell Get LocalGroup Discovery - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +known_false_positives = False positives may be present. Tune as needed. +providing_technologies = [] + [savedsearch://ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule] type = detection asset_type = @@ -5661,7 +6057,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -5670,6 +6066,18 @@ annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "m known_false_positives = False positives should be limited. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ +This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +known_false_positives = False positives may be present. Tune as needed. +providing_technologies = [] + [savedsearch://ESCU - Powershell Processing Stream Of Data - Rule] type = detection asset_type = @@ -5985,6 +6393,46 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out. providing_technologies = [] +[savedsearch://ESCU - Remote System Discovery with Adsisearcher - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Remote System Discovery with Dsquery - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Remote System Discovery with Net - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - Remote System Discovery with Wmic - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - Remote WMI Command Attempt - Rule] type = detection asset_type = Endpoint @@ -6906,6 +7354,26 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. providing_technologies = [] +[savedsearch://ESCU - System User Discovery With Query - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - System User Discovery With Whoami - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - TOR Traffic - Rule] type = detection asset_type = Endpoint @@ -7000,7 +7468,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -7058,6 +7526,26 @@ annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phas known_false_positives = Very few legitimate Content-Type fields will have a length greater than 100 characters. providing_technologies = [] +[savedsearch://ESCU - User Discovery With Env Vars PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators or power users may use this command for troubleshooting. +providing_technologies = [] + +[savedsearch://ESCU - User Discovery With Env Vars PowerShell Script Block - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. +providing_technologies = [] + [savedsearch://ESCU - W3WP Spawning Shell - Rule] type = detection asset_type = @@ -7341,6 +7829,18 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00 known_false_positives = There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. providing_technologies = [] +[savedsearch://ESCU - Wmic Group Discovery - Rule] +type = detection +asset_type = +confidence = medium +explanation = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ +During triage, review parallel processes and identify any further suspicious behavior. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +known_false_positives = False positives may be present. Tune as needed. +providing_technologies = [] + [savedsearch://ESCU - Write Executable in SMB Share - Rule] type = detection asset_type = diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index 0717cbc6ba..fee94d3941 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,440 +1,564 @@ -mitre_id,technique,tactics,groups -T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no -T1564.006,Run Virtual Instance,Defense Evasion,no -T1564.005,Hidden File System,Defense Evasion,Strider|Equation -T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no -T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird -T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no -T1098.004,SSH Authorized Keys,Persistence,no -T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer -T1578.004,Revert Cloud Instance,Defense Evasion,no -T1578.003,Delete Cloud Instance,Defense Evasion,no -T1578.001,Create Snapshot,Defense Evasion,no -T1578.002,Create Cloud Instance,Defense Evasion,no -T1127.001,MSBuild,Defense Evasion,Frankenstein -T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda -T1562.006,Indicator Blocking,Defense Evasion,no -T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 -T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group -T1573,Encrypted Channel,Command And Control,Tropic Trooper -T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater -T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no -T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 -T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28 -T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee -T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon -T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1001.003,Protocol Impersonation,Command And Control,Lazarus Group -T1001.002,Steganography,Command And Control,Axiom -T1001.001,Junk Data,Command And Control,APT28 -T1132.002,Non-Standard Encoding,Command And Control,no -T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork -T1090.004,Domain Fronting,Command And Control,APT29 -T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29 -T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT39|Strider -T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak -T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork -T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 -T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33 -T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32 -T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314 -T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no -T1564.002,Hidden Users,Defense Evasion,no -T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass -T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no -T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no -T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no -T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no -T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no -T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no -T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no -T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338 -T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10 -T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM -T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla -T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41 -T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no -T1568.001,Fast Flux DNS,Command And Control,TA505 -T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper -T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang -T1569.001,Launchctl,Execution,no -T1569,System Services,Execution,no -T1568.002,Domain Generation Algorithms,Command And Control,APT41 -T1568,Dynamic Resolution,Command And Control,no -T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla -T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound -T1059.004,Unix Shell,Execution,Rocke|APT41 -T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 -T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda -T1567,Exfiltration Over Web Service,Exfiltration,no -T1497.003,Time Based Evasion,Defense Evasion|Discovery,no -T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein -T1498.002,Reflection Amplification,Impact,no -T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 -T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass -T1566,Phishing,Initial Access,no -T1565.003,Runtime Data Manipulation,Impact,APT38 -T1565.002,Transmitted Data Manipulation,Impact,APT38 -T1565.001,Stored Data Manipulation,Impact,FIN4|APT38 -T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group -T1564,Hide Artifacts,Defense Evasion,no -T1563.002,RDP Hijacking,Lateral Movement,no -T1563.001,SSH Hijacking,Lateral Movement,no -T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon -T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang -T1087.004,Cloud Account,Discovery,no -T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang -T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 -T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak -T1562.003,HISTCONTROL,Defense Evasion,no -T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda -T1562,Impair Defenses,Defense Evasion,no -T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 -T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 -T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 -T1561.001,Disk Content Wipe,Impact,Lazarus Group -T1561,Disk Wipe,Impact,no -T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6 -T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang -T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang -T1499.004,Application or System Exploitation,Impact,no -T1499.003,Application Exhaustion Flood,Impact,no -T1499.002,Service Exhaustion Flood,Impact,no -T1499.001,OS Exhaustion Flood,Impact,no -T1491.002,External Defacement,Impact,no -T1491.001,Internal Defacement,Impact,Lazarus Group -T1114.003,Email Forwarding Rule,Collection,no -T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer -T1114.001,Local Email Collection,Collection,Magic Hound|APT1 -T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no -T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no -T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no -T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group -T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28 -T1213.002,Sharepoint,Collection,Ke3chang|APT28 -T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats -T1555.002,Securityd Memory,Credential Access,no -T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 -T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater -T1559,Inter-Process Communication,Execution,no -T1558.002,Silver Ticket,Credential Access,no -T1558.001,Golden Ticket,Credential Access,Ke3chang -T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no -T1557,Man-in-the-Middle,Credential Access|Collection,no -T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider -T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no -T1556,Modify Authentication Process,Credential Access|Defense Evasion,no -T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM -T1056.003,Web Portal Capture,Collection|Credential Access,no -T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon -T1552.005,Cloud Instance Metadata API,Credential Access,no -T1003.008,/etc/passwd and /etc/shadow,Credential Access,no -T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,no -T1558.003,Kerberoasting,Credential Access,no -T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver -T1110.004,Credential Stuffing,Credential Access,no -T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3 -T1110.001,Password Guessing,Credential Access,no -T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390 -T1021.005,VNC,Lateral Movement,GCMAN -T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN -T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom -T1554,Compromise Client Software Binary,Persistence,no -T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM -T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic -T1036.001,Invalid Code Signature,Defense Evasion,Windshift -T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel -T1553.001,Gatekeeper Bypass,Defense Evasion,no -T1553,Subvert Trust Controls,Defense Evasion,no -T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee -T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32 -T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no -T1552.004,Private Keys,Credential Access,Rocke -T1552.003,Bash History,Credential Access,no -T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 -T1552,Unsecured Credentials,Credential Access,no -T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 -T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 -T1070.003,Clear Command History,Defense Evasion,APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no -T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 -T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 -T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no -T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no -T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 -T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no -T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no -T1136.003,Cloud Account,Persistence,no -T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 -T1136.002,Domain Account,Persistence,Soft Cell -T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3 -T1547.011,Plist Modification,Persistence|Privilege Escalation,no -T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group -T1547.008,LSASS Driver,Persistence|Privilege Escalation,no -T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no -T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no -T1547.005,Security Support Provider,Persistence|Privilege Escalation,no -T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla -T1547.003,Time Providers,Persistence|Privilege Escalation,no -T1546.014,Emond,Privilege Escalation|Persistence,no -T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla -T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistence,TEMP.Veles -T1218.008,Odbcconf,Defense Evasion,Cobalt Group -T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7 -T1547.002,Authentication Package,Persistence|Privilege Escalation,no -T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no -T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee -T1218.007,Msiexec,Defense Evasion,TA505|Rancor -T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom -T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no -T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no -T1546.005,Trap,Privilege Escalation|Persistence,no -T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29 -T1546.002,Screensaver,Privilege Escalation|Persistence,no -T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel -T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda -T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7 -T1218.004,InstallUtil,Defense Evasion,no -T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig -T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 -T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no -T1546,Event Triggered Execution,Privilege Escalation|Persistence,no -T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound -T1098.001,Additional Azure Service Principal Credentials,Persistence,no -T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak -T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke -T1543.001,Launch Agent,Persistence|Privilege Escalation,no -T1037.005,Startup Items,Persistence|Privilege Escalation,no -T1037.004,Rc.common,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork -T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer -T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no -T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no -T1055.009,Proc Memory,Defense Evasion|Privilege Escalation,no -T1055.008,Ptrace System Calls,Defense Evasion|Privilege Escalation,no -T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no -T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no -T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no -T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group -T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda -T1037.003,Network Logon Script,Persistence|Privilege Escalation,no -T1543,Create or Modify System Process,Persistence|Privilege Escalation,no -T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no -T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|APT28 -T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 -T1542.002,Component Firmware,Persistence|Defense Evasion,Equation -T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda -T1505.002,Transport Agent,Persistence,no -T1505.001,SQL Stored Procedures,Persistence,no -T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke -T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no -T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 -T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 -T1542,Pre-OS Boot,Defense Evasion|Persistence,no -T1137.001,Office Template Macros,Persistence,MuddyWater -T1137.004,Outlook Home Page,Persistence,OilRig -T1137.003,Outlook Forms,Persistence,no -T1137.005,Outlook Rules,Persistence,no -T1137.006,Add-ins,Persistence,Naikon -T1137.002,Office Test,Persistence,APT28 -T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,no -T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 -T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception -T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group -T1528,Steal Application Access Token,Credential Access,APT28 -T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no -T1525,Implant Container Image,Persistence,no -T1538,Cloud Service Dashboard,Discovery,no -T1530,Data from Cloud Storage Object,Collection,no -T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no -T1537,Transfer Data to Cloud Account,Exfiltration,no -T1526,Cloud Service Discovery,Discovery,no -T1505,Server Software Component,Persistence,no -T1499,Endpoint Denial of Service,Impact,no -T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no -T1498,Network Denial of Service,Impact,no -T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group -T1495,Firmware Corruption,Impact,no -T1491,Defacement,Impact,no -T1490,Inhibit System Recovery,Impact,no -T1489,Service Stop,Impact,Lazarus Group -T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38 -T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 -T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,Wizard Spider -T1480,Execution Guardrails,Defense Evasion,no -T1222,File and Directory Permissions Modification,Defense Evasion,no -T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus -T1220,XSL Script Processing,Defense Evasion,Cobalt Group -T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan -T1217,Browser Bookmark Discovery,Discovery,no -T1213,Data from Information Repositories,Collection,Turla -T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM -T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 -T1212,Exploitation for Credential Access,Credential Access,no -T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28 -T1202,Indirect Command Execution,Defense Evasion,no -T1200,Hardware Additions,Initial Access,DarkVishnya -T1201,Password Policy Discovery,Discovery,Turla|OilRig -T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak -T1207,Rogue Domain Controller,Defense Evasion,no -T1199,Trusted Relationship,Initial Access,APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,no -T1204,User Execution,Execution,no -T1216,Signed Script Proxy Execution,Defense Evasion,no -T1195,Supply Chain Compromise,Initial Access,Elderwood -T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no -T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil -T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no -T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 -T1185,Man in the Browser,Collection,no -T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird -T1136,Create Account,Persistence,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER -T1149,LC_MAIN Hijacking,Defense Evasion,no -T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug -T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1153,Source,Execution,no -T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 -T1132,Data Encoding,Command And Control,no -T1129,Shared Modules,Execution,no -T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no -T1125,Video Capture,Collection,Silence|FIN7 -T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla -T1123,Audio Capture,Collection,APT37 -T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 -T1115,Clipboard Data,Collection,APT39|APT38 -T1114,Email Collection,Collection,no -T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,no -T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla -T1108,Redundant Access,Defense Evasion|Persistence,no -T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 -T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 -T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6 -T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group -T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3 -T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28 -T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla -T1087,Account Discovery,Discovery,no -T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang -T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak -T1074,Data Staged,Collection,Wizard Spider -T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 -T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,no -T1069,Permission Groups Discovery,Discovery,TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 -T1064,Scripting,Defense Evasion|Execution,no -T1062,Hypervisor,Persistence,no -T1061,Graphical User Interface,Execution,no -T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang -T1056,Input Capture,Collection|Credential Access,no -T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM -T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no -T1052,Exfiltration Over Physical Medium,Exfiltration,no -T1051,Shared Webroot,Lateral Movement,no -T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang -T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 -T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 -T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass -T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 -T1034,Path Interception,Persistence|Privilege Escalation,no -T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 -T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390 -T1029,Scheduled Transfer,Exfiltration,no -T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 -T1026,Multiband Communication,Command And Control,Lazarus Group -T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28 -T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang -T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla -T1011,Exfiltration Over Other Network Medium,Exfiltration,no -T1010,Application Window Discovery,Discovery,Lazarus Group -T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang -T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang -T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Axiom +"mitre_id","technique","tactics","groups" +"T1553.006","Code Signing Policy Modification","Defense Evasion","Turla|APT39" +"T1614","System Location Discovery","Discovery","no" +"T1613","Container and Resource Discovery","Discovery","no" +"T1552.007","Container API","Credential Access","no" +"T1612","Build Image on Host","Defense Evasion","no" +"T1611","Escape to Host","Privilege Escalation","no" +"T1204.003","Malicious Image","Execution","no" +"T1053.007","Container Orchestration Job","Execution|Persistence|Privilege Escalation","no" +"T1610","Deploy Container","Defense Evasion|Execution","no" +"T1609","Container Administration Command","Execution","no" +"T1608.005","Link Target","Resource Development","Silent Librarian" +"T1608.004","Drive-by Target","Resource Development","APT32|Threat Group-3390" +"T1608.003","Install Digital Certificate","Resource Development","no" +"T1608.002","Upload Tool","Resource Development","Threat Group-3390" +"T1608.001","Upload Malware","Resource Development","APT32" +"T1608","Stage Capabilities","Resource Development","no" +"T1016.001","Internet Connection Discovery","Discovery","APT29|UNC2452|Turla" +"T1553.005","Mark-of-the-Web Bypass","Defense Evasion","TA505" +"T1555.005","Password Managers","Credential Access","Fox Kitten|Operation Wocao" +"T1484.002","Domain Trust Modification","Defense Evasion|Privilege Escalation","APT29|UNC2452" +"T1484.001","Group Policy Modification","Defense Evasion|Privilege Escalation","Indrik Spider" +"T1547.014","Active Setup","Persistence|Privilege Escalation","no" +"T1606.002","SAML Tokens","Credential Access","APT29|UNC2452" +"T1606.001","Web Cookies","Credential Access","APT29|UNC2452" +"T1606","Forge Web Credentials","Credential Access","no" +"T1555.004","Windows Credential Manager","Credential Access","Stealth Falcon|OilRig|Turla" +"T1059.008","Network Device CLI","Execution","no" +"T1602.002","Network Device Configuration Dump","Collection","no" +"T1542.005","TFTP Boot","Defense Evasion|Persistence","no" +"T1542.004","ROMMONkit","Defense Evasion|Persistence","no" +"T1602.001","SNMP (MIB Dump)","Collection","no" +"T1602","Data from Configuration Repository","Collection","no" +"T1601.002","Downgrade System Image","Defense Evasion","no" +"T1601.001","Patch System Image","Defense Evasion","no" +"T1601","Modify System Image","Defense Evasion","no" +"T1600.002","Disable Crypto Hardware","Defense Evasion","no" +"T1600.001","Reduce Key Space","Defense Evasion","no" +"T1600","Weaken Encryption","Defense Evasion","no" +"T1556.004","Network Device Authentication","Credential Access|Defense Evasion|Persistence","no" +"T1599.001","Network Address Translation Traversal","Defense Evasion","no" +"T1599","Network Boundary Bridging","Defense Evasion","no" +"T1020.001","Traffic Duplication","Exfiltration","no" +"T1557.002","ARP Cache Poisoning","Credential Access|Collection","Cleaver" +"T1588.006","Vulnerabilities","Resource Development","Sandworm Team" +"T1053.006","Systemd Timers","Execution|Persistence|Privilege Escalation","no" +"T1562.008","Disable Cloud Logs","Defense Evasion","no" +"T1547.012","Print Processors","Persistence|Privilege Escalation","no" +"T1598.003","Spearphishing Link","Reconnaissance","Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky" +"T1598.002","Spearphishing Attachment","Reconnaissance","Sidewinder" +"T1598.001","Spearphishing Service","Reconnaissance","no" +"T1598","Phishing for Information","Reconnaissance","ZIRCONIUM|APT28" +"T1597.002","Purchase Technical Data","Reconnaissance","no" +"T1597.001","Threat Intel Vendors","Reconnaissance","no" +"T1597","Search Closed Sources","Reconnaissance","no" +"T1596.005","Scan Databases","Reconnaissance","no" +"T1596.004","CDNs","Reconnaissance","no" +"T1596.003","Digital Certificates","Reconnaissance","no" +"T1596.001","DNS/Passive DNS","Reconnaissance","no" +"T1596.002","WHOIS","Reconnaissance","no" +"T1596","Search Open Technical Databases","Reconnaissance","no" +"T1595.002","Vulnerability Scanning","Reconnaissance","Volatile Cedar|APT28|Sandworm Team" +"T1595.001","Scanning IP Blocks","Reconnaissance","no" +"T1595","Active Scanning","Reconnaissance","no" +"T1594","Search Victim-Owned Websites","Reconnaissance","Silent Librarian|Sandworm Team" +"T1593.002","Search Engines","Reconnaissance","no" +"T1593.001","Social Media","Reconnaissance","no" +"T1593","Search Open Websites/Domains","Reconnaissance","Sandworm Team" +"T1592.004","Client Configurations","Reconnaissance","HAFNIUM" +"T1592.003","Firmware","Reconnaissance","no" +"T1592.002","Software","Reconnaissance","Sandworm Team" +"T1592.001","Hardware","Reconnaissance","no" +"T1592","Gather Victim Host Information","Reconnaissance","no" +"T1591.004","Identify Roles","Reconnaissance","no" +"T1591.003","Identify Business Tempo","Reconnaissance","no" +"T1591.001","Determine Physical Locations","Reconnaissance","no" +"T1591.002","Business Relationships","Reconnaissance","Sandworm Team" +"T1591","Gather Victim Org Information","Reconnaissance","no" +"T1590.006","Network Security Appliances","Reconnaissance","no" +"T1590.005","IP Addresses","Reconnaissance","HAFNIUM" +"T1590.004","Network Topology","Reconnaissance","no" +"T1590.003","Network Trust Dependencies","Reconnaissance","no" +"T1590.002","DNS","Reconnaissance","no" +"T1590.001","Domain Properties","Reconnaissance","Sandworm Team" +"T1590","Gather Victim Network Information","Reconnaissance","HAFNIUM" +"T1589.003","Employee Names","Reconnaissance","Silent Librarian|Sandworm Team" +"T1589.002","Email Addresses","Reconnaissance","TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team" +"T1589.001","Credentials","Reconnaissance","APT28|Magic Hound|Chimera" +"T1589","Gather Victim Identity Information","Reconnaissance","APT32" +"T1588.005","Exploits","Resource Development","no" +"T1588.004","Digital Certificates","Resource Development","Lazarus Group|Silent Librarian" +"T1588.003","Code Signing Certificates","Resource Development","Wizard Spider" +"T1588.002","Tool","Resource Development","MuddyWater|Silent Librarian|GALLIUM|Sandworm Team" +"T1588.001","Malware","Resource Development","Turla|APT1" +"T1588","Obtain Capabilities","Resource Development","no" +"T1587.004","Exploits","Resource Development","no" +"T1587.003","Digital Certificates","Resource Development","APT29|PROMETHIUM" +"T1587.002","Code Signing Certificates","Resource Development","PROMETHIUM|Patchwork" +"T1587.001","Malware","Resource Development","APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver" +"T1587","Develop Capabilities","Resource Development","Kimsuky" +"T1586.002","Email Accounts","Resource Development","Magic Hound|Kimsuky" +"T1586.001","Social Media Accounts","Resource Development","no" +"T1586","Compromise Accounts","Resource Development","no" +"T1585.002","Email Accounts","Resource Development","Magic Hound|Silent Librarian|Sandworm Team|APT1" +"T1585.001","Social Media Accounts","Resource Development","Fox Kitten|Sandworm Team|APT32|Cleaver" +"T1585","Establish Accounts","Resource Development","Fox Kitten|APT17" +"T1584.006","Web Services","Resource Development","Turla" +"T1584.005","Botnet","Resource Development","no" +"T1584.004","Server","Resource Development","Indrik Spider|Turla|APT16" +"T1584.003","Virtual Private Server","Resource Development","Turla" +"T1584.002","DNS Server","Resource Development","no" +"T1584.001","Domains","Resource Development","APT29|UNC2452|APT1" +"T1583.006","Web Services","Resource Development","ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29" +"T1583.005","Botnet","Resource Development","no" +"T1583.004","Server","Resource Development","GALLIUM|Sandworm Team" +"T1583.003","Virtual Private Server","Resource Development","HAFNIUM|TEMP.Veles" +"T1583.002","DNS Server","Resource Development","no" +"T1584","Compromise Infrastructure","Resource Development","no" +"T1583.001","Domains","Resource Development","APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28" +"T1583","Acquire Infrastructure","Resource Development","no" +"T1564.007","VBA Stomping","Defense Evasion","no" +"T1558.004","AS-REP Roasting","Credential Access","no" +"T1580","Cloud Infrastructure Discovery","Discovery","no" +"T1218.012","Verclsid","Defense Evasion","no" +"T1205.001","Port Knocking","Defense Evasion|Persistence|Command And Control","PROMETHIUM" +"T1564.006","Run Virtual Instance","Defense Evasion","no" +"T1564.005","Hidden File System","Defense Evasion","Strider|Equation" +"T1556.003","Pluggable Authentication Modules","Credential Access|Defense Evasion|Persistence","no" +"T1574.012","COR_PROFILER","Persistence|Privilege Escalation|Defense Evasion","Blue Mockingbird" +"T1562.007","Disable or Modify Cloud Firewall","Defense Evasion","no" +"T1098.004","SSH Authorized Keys","Persistence","no" +"T1480.001","Environmental Keying","Defense Evasion","APT41|Equation" +"T1059.007","JavaScript","Execution","MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer" +"T1578.004","Revert Cloud Instance","Defense Evasion","no" +"T1578.003","Delete Cloud Instance","Defense Evasion","no" +"T1578.001","Create Snapshot","Defense Evasion","no" +"T1578.002","Create Cloud Instance","Defense Evasion","no" +"T1127.001","MSBuild","Defense Evasion","Frankenstein" +"T1027.005","Indicator Removal from Tools","Defense Evasion","Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda" +"T1562.006","Indicator Blocking","Defense Evasion","no" +"T1573.002","Asymmetric Cryptography","Command And Control","Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6" +"T1573.001","Symmetric Cryptography","Command And Control","Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group" +"T1573","Encrypted Channel","Command And Control","Tropic Trooper" +"T1027.004","Compile After Delivery","Defense Evasion","Gamaredon Group|Rocke|MuddyWater" +"T1574.004","Dylib Hijacking","Persistence|Privilege Escalation|Defense Evasion","no" +"T1546.015","Component Object Model Hijacking","Privilege Escalation|Persistence","APT28" +"T1071.004","DNS","Command And Control","Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7" +"T1071.003","Mail Protocols","Command And Control","Turla|Kimsuky|APT32|SilverTerrier|APT28" +"T1071.002","File Transfer Protocols","Command And Control","Kimsuky|APT41|SilverTerrier|Honeybee" +"T1071.001","Web Protocols","Command And Control","APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon" +"T1572","Protocol Tunneling","Command And Control","Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6" +"T1048.003","Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol","Exfiltration","Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group" +"T1048.002","Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","Exfiltration","APT29|UNC2452" +"T1048.001","Exfiltration Over Symmetric Encrypted Non-C2 Protocol","Exfiltration","no" +"T1001.003","Protocol Impersonation","Command And Control","Higaisa|Lazarus Group" +"T1001.002","Steganography","Command And Control","APT29|Axiom" +"T1001.001","Junk Data","Command And Control","APT28" +"T1132.002","Non-Standard Encoding","Command And Control","no" +"T1132.001","Standard Encoding","Command And Control","HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork" +"T1090.004","Domain Fronting","Command And Control","APT29" +"T1090.003","Multi-hop Proxy","Command And Control","APT28|Operation Wocao|Inception|FIN4|APT29" +"T1090.002","External Proxy","Command And Control","APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28" +"T1090.001","Internal Proxy","Command And Control","APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider" +"T1102.003","One-Way Communication","Command And Control","Leviathan" +"T1102.002","Bidirectional Communication","Command And Control","ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak" +"T1102.001","Dead Drop Resolver","Command And Control","Rocke|APT41|BRONZE BUTLER|RTM|Patchwork" +"T1571","Non-Standard Port","Command And Control","Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7" +"T1074.002","Remote Data Staging","Collection","APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8" +"T1074.001","Local Data Staging","Collection","Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28" +"T1078.004","Cloud Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT33" +"T1564.004","NTFS File Attributes","Defense Evasion","APT32" +"T1564.003","Hidden Window","Defense Evasion","Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound" +"T1078.003","Local Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32" +"T1078.002","Domain Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314" +"T1078.001","Default Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","no" +"T1564.002","Hidden Users","Defense Evasion","no" +"T1574.006","Dynamic Linker Hijacking","Persistence|Privilege Escalation|Defense Evasion","APT41|Rocke" +"T1574.002","DLL Side-Loading","Persistence|Privilege Escalation|Defense Evasion","Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390" +"T1574.001","DLL Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass" +"T1574.008","Path Interception by Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","no" +"T1574.007","Path Interception by PATH Environment Variable","Persistence|Privilege Escalation|Defense Evasion","no" +"T1574.009","Path Interception by Unquoted Path","Persistence|Privilege Escalation|Defense Evasion","no" +"T1574.011","Services Registry Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no" +"T1574.005","Executable Installer File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no" +"T1574.010","Services File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no" +"T1574","Hijack Execution Flow","Persistence|Privilege Escalation|Defense Evasion","no" +"T1069.001","Local Groups","Discovery","Chimera|Operation Wocao|Turla|OilRig|admin@338" +"T1570","Lateral Tool Transfer","Lateral Movement","Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10" +"T1568.003","DNS Calculation","Command And Control","APT12" +"T1204.002","Malicious File","Execution","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan" +"T1204.001","Malicious Link","Execution","APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla" +"T1195.003","Compromise Hardware Supply Chain","Initial Access","no" +"T1195.002","Compromise Software Supply Chain","Initial Access","APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41" +"T1195.001","Compromise Software Dependencies and Development Tools","Initial Access","no" +"T1568.001","Fast Flux DNS","Command And Control","menuPass|TA505" +"T1052.001","Exfiltration over USB","Exfiltration","Mustang Panda|Tropic Trooper" +"T1569.002","Service Execution","Execution","Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang" +"T1569.001","Launchctl","Execution","no" +"T1569","System Services","Execution","no" +"T1568.002","Domain Generation Algorithms","Command And Control","TA551|APT41" +"T1568","Dynamic Resolution","Command And Control","APT29|UNC2452" +"T1011.001","Exfiltration Over Bluetooth","Exfiltration","no" +"T1567.002","Exfiltration to Cloud Storage","Exfiltration","ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla" +"T1567.001","Exfiltration to Code Repository","Exfiltration","no" +"T1059.006","Python","Execution","ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete" +"T1059.005","Visual Basic","Execution","Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound" +"T1059.004","Unix Shell","Execution","Rocke|APT41" +"T1059.003","Windows Command Shell","Execution","APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1" +"T1059.002","AppleScript","Execution","no" +"T1059.001","PowerShell","Execution","Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda" +"T1567","Exfiltration Over Web Service","Exfiltration","APT28" +"T1497.003","Time Based Evasion","Defense Evasion|Discovery","no" +"T1497.002","User Activity Based Checks","Defense Evasion|Discovery","Darkhotel|FIN7" +"T1497.001","System Checks","Defense Evasion|Discovery","Darkhotel|Evilnum|Frankenstein" +"T1498.002","Reflection Amplification","Impact","no" +"T1498.001","Direct Network Flood","Impact","no" +"T1566.003","Spearphishing via Service","Initial Access","Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal" +"T1566.002","Spearphishing Link","Initial Access","Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound" +"T1566.001","Spearphishing Attachment","Initial Access","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM" +"T1566","Phishing","Initial Access","GOLD SOUTHFIELD|Dragonfly" +"T1565.003","Runtime Data Manipulation","Impact","APT38" +"T1565.002","Transmitted Data Manipulation","Impact","APT38" +"T1565.001","Stored Data Manipulation","Impact","FIN4|APT38" +"T1565","Data Manipulation","Impact","no" +"T1564.001","Hidden Files and Directories","Defense Evasion","Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28" +"T1564","Hide Artifacts","Defense Evasion","no" +"T1563.002","RDP Hijacking","Lateral Movement","no" +"T1563.001","SSH Hijacking","Lateral Movement","no" +"T1563","Remote Service Session Hijacking","Lateral Movement","no" +"T1518.001","Security Software Discovery","Discovery","Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon" +"T1069.003","Cloud Groups","Discovery","no" +"T1069.002","Domain Groups","Discovery","Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang" +"T1087.004","Cloud Account","Discovery","no" +"T1087.003","Email Account","Discovery","Sandworm Team|TA505" +"T1087.002","Domain Account","Discovery","MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang" +"T1087.001","Local Account","Discovery","Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338" +"T1553.004","Install Root Certificate","Defense Evasion","no" +"T1562.004","Disable or Modify System Firewall","Defense Evasion","APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak" +"T1562.003","Impair Command History Logging","Defense Evasion","no" +"T1562.002","Disable Windows Event Logging","Defense Evasion","APT29|UNC2452|Threat Group-3390" +"T1562.001","Disable or Modify Tools","Defense Evasion","APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda" +"T1562","Impair Defenses","Defense Evasion","no" +"T1003.004","LSA Secrets","Credential Access","OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390" +"T1003.005","Cached Domain Credentials","Credential Access","OilRig|MuddyWater|Leafminer|APT33" +"T1561.002","Disk Structure Wipe","Impact","Sandworm Team|Lazarus Group|APT38|APT37" +"T1561.001","Disk Content Wipe","Impact","Lazarus Group" +"T1561","Disk Wipe","Impact","no" +"T1560.003","Archive via Custom Method","Collection","Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6" +"T1560.002","Archive via Library","Collection","Lazarus Group|Threat Group-3390" +"T1560.001","Archive via Utility","Collection","APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang" +"T1560","Archive Collected Data","Collection","menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang" +"T1499.004","Application or System Exploitation","Impact","no" +"T1499.003","Application Exhaustion Flood","Impact","no" +"T1499.002","Service Exhaustion Flood","Impact","no" +"T1499.001","OS Exhaustion Flood","Impact","no" +"T1491.002","External Defacement","Impact","Sandworm Team" +"T1491.001","Internal Defacement","Impact","Lazarus Group" +"T1114.003","Email Forwarding Rule","Collection","Silent Librarian|Kimsuky" +"T1114.002","Remote Email Collection","Collection","APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang" +"T1114.001","Local Email Collection","Collection","Chimera|Magic Hound|APT1" +"T1134.005","SID-History Injection","Defense Evasion|Privilege Escalation","no" +"T1134.004","Parent PID Spoofing","Defense Evasion|Privilege Escalation","no" +"T1134.003","Make and Impersonate Token","Defense Evasion|Privilege Escalation","no" +"T1134.002","Create Process with Token","Defense Evasion|Privilege Escalation","Turla|Lazarus Group" +"T1134.001","Token Impersonation/Theft","Defense Evasion|Privilege Escalation","APT28" +"T1213.002","Sharepoint","Collection","Chimera|Ke3chang|APT28" +"T1213.001","Confluence","Collection","no" +"T1555.003","Credentials from Web Browsers","Credential Access","Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats" +"T1555.002","Securityd Memory","Credential Access","no" +"T1555.001","Keychain","Credential Access","no" +"T1559.002","Dynamic Data Exchange","Execution","Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7" +"T1559.001","Component Object Model","Execution","Gamaredon Group|MuddyWater" +"T1559","Inter-Process Communication","Execution","no" +"T1558.002","Silver Ticket","Credential Access","no" +"T1558.001","Golden Ticket","Credential Access","Ke3chang" +"T1558","Steal or Forge Kerberos Tickets","Credential Access","no" +"T1557.001","LLMNR/NBT-NS Poisoning and SMB Relay","Credential Access|Collection","Wizard Spider" +"T1557","Man-in-the-Middle","Credential Access|Collection","Kimsuky" +"T1556.002","Password Filter DLL","Credential Access|Defense Evasion|Persistence","Strider" +"T1556.001","Domain Controller Authentication","Credential Access|Defense Evasion|Persistence","Chimera" +"T1556","Modify Authentication Process","Credential Access|Defense Evasion|Persistence","no" +"T1056.004","Credential API Hooking","Collection|Credential Access","PLATINUM" +"T1056.003","Web Portal Capture","Collection|Credential Access","no" +"T1056.002","GUI Input Capture","Collection|Credential Access","FIN4" +"T1056.001","Keylogging","Collection|Credential Access","Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28" +"T1555","Credentials from Password Stores","Credential Access","APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon" +"T1552.005","Cloud Instance Metadata API","Credential Access","no" +"T1003.008","/etc/passwd and /etc/shadow","Credential Access","no" +"T1003.007","Proc Filesystem","Credential Access","no" +"T1003.006","DCSync","Credential Access","APT29|UNC2452|Operation Wocao" +"T1558.003","Kerberoasting","Credential Access","APT29|UNC2452|Operation Wocao|Wizard Spider" +"T1552.006","Group Policy Preferences","Credential Access","APT33" +"T1003.003","NTDS","Credential Access","Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0" +"T1003.002","Security Account Manager","Credential Access","Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass" +"T1003.001","LSASS Memory","Credential Access","HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver" +"T1110.004","Credential Stuffing","Credential Access","Chimera" +"T1110.003","Password Spraying","Credential Access","Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group" +"T1110.002","Password Cracking","Credential Access","FIN6|APT41|Dragonfly 2.0|APT3" +"T1110.001","Password Guessing","Credential Access","APT28" +"T1021.006","Windows Remote Management","Lateral Movement","APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390" +"T1021.005","VNC","Lateral Movement","Fox Kitten|GCMAN" +"T1021.004","SSH","Lateral Movement","Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN" +"T1021.003","Distributed Component Object Model","Lateral Movement","no" +"T1021.002","SMB/Windows Admin Shares","Lateral Movement","Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang" +"T1021.001","Remote Desktop Protocol","Lateral Movement","Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom" +"T1554","Compromise Client Software Binary","Persistence","no" +"T1036.006","Space after Filename","Defense Evasion","no" +"T1036.005","Match Legitimate Name or Location","Defense Evasion","APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1" +"T1036.004","Masquerade Task or Service","Defense Evasion","ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7" +"T1036.003","Rename System Utilities","Defense Evasion","menuPass|APT32|GALLIUM" +"T1036.002","Right-to-Left Override","Defense Evasion","BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic" +"T1036.001","Invalid Code Signature","Defense Evasion","Windshift|APT37" +"T1553.003","SIP and Trust Provider Hijacking","Defense Evasion","no" +"T1553.002","Code Signing","Defense Evasion","APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel" +"T1553.001","Gatekeeper Bypass","Defense Evasion","no" +"T1553","Subvert Trust Controls","Defense Evasion","no" +"T1027.003","Steganography","Defense Evasion","TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37" +"T1027.002","Software Packing","Defense Evasion","ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon" +"T1027.001","Binary Padding","Defense Evasion","Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee" +"T1222.002","Linux and Mac File and Directory Permissions Modification","Defense Evasion","Rocke|APT32" +"T1222.001","Windows File and Directory Permissions Modification","Defense Evasion","Wizard Spider" +"T1552.004","Private Keys","Credential Access","APT29|UNC2452|Operation Wocao|Rocke" +"T1552.003","Bash History","Credential Access","no" +"T1552.002","Credentials in Registry","Credential Access","APT32" +"T1552.001","Credentials In Files","Credential Access","Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3" +"T1552","Unsecured Credentials","Credential Access","no" +"T1216.001","PubPrn","Defense Evasion","APT32" +"T1070.006","Timestomp","Defense Evasion","APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28" +"T1070.005","Network Share Connection Removal","Defense Evasion","Threat Group-3390" +"T1070.004","File Deletion","Defense Evasion","APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29" +"T1070.003","Clear Command History","Defense Evasion","APT41" +"T1550.004","Web Session Cookie","Defense Evasion|Lateral Movement","APT29|UNC2452" +"T1550.001","Application Access Token","Defense Evasion|Lateral Movement","APT28" +"T1550.003","Pass the Ticket","Defense Evasion|Lateral Movement","APT32|BRONZE BUTLER|APT29" +"T1550.002","Pass the Hash","Defense Evasion|Lateral Movement","Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1" +"T1550","Use Alternate Authentication Material","Defense Evasion|Lateral Movement","APT29|UNC2452" +"T1548.004","Elevated Execution with Prompt","Privilege Escalation|Defense Evasion","no" +"T1548.003","Sudo and Sudo Caching","Privilege Escalation|Defense Evasion","no" +"T1548.002","Bypass User Account Control","Privilege Escalation|Defense Evasion","Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29" +"T1548.001","Setuid and Setgid","Privilege Escalation|Defense Evasion","no" +"T1548","Abuse Elevation Control Mechanism","Privilege Escalation|Defense Evasion","no" +"T1136.003","Cloud Account","Persistence","no" +"T1070.002","Clear Linux or Mac System Logs","Defense Evasion","Rocke" +"T1070.001","Clear Windows Event Logs","Defense Evasion","Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28" +"T1136.002","Domain Account","Persistence","HAFNIUM|GALLIUM" +"T1136.001","Local Account","Persistence","Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3" +"T1547.011","Plist Modification","Persistence|Privilege Escalation","no" +"T1547.010","Port Monitors","Persistence|Privilege Escalation","no" +"T1547.009","Shortcut Modification","Persistence|Privilege Escalation","APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan" +"T1547.008","LSASS Driver","Persistence|Privilege Escalation","no" +"T1547.007","Re-opened Applications","Persistence|Privilege Escalation","no" +"T1547.006","Kernel Modules and Extensions","Persistence|Privilege Escalation","no" +"T1547.005","Security Support Provider","Persistence|Privilege Escalation","Lazarus Group" +"T1547.004","Winlogon Helper DLL","Persistence|Privilege Escalation","Wizard Spider|Tropic Trooper|Turla" +"T1547.003","Time Providers","Persistence|Privilege Escalation","no" +"T1546.014","Emond","Privilege Escalation|Persistence","no" +"T1546.013","PowerShell Profile","Privilege Escalation|Persistence","Turla" +"T1546.012","Image File Execution Options Injection","Privilege Escalation|Persistence","TEMP.Veles" +"T1218.008","Odbcconf","Defense Evasion","Cobalt Group" +"T1546.011","Application Shimming","Privilege Escalation|Persistence","FIN7" +"T1547.002","Authentication Package","Persistence|Privilege Escalation","no" +"T1546.010","AppInit DLLs","Privilege Escalation|Persistence","APT39" +"T1546.009","AppCert DLLs","Privilege Escalation|Persistence","Honeybee" +"T1218.007","Msiexec","Defense Evasion","ZIRCONIUM|Molerats|Machete|TA505|Rancor" +"T1546.008","Accessibility Features","Privilege Escalation|Persistence","Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom" +"T1546.007","Netsh Helper DLL","Privilege Escalation|Persistence","no" +"T1546.006","LC_LOAD_DYLIB Addition","Privilege Escalation|Persistence","no" +"T1546.005","Trap","Privilege Escalation|Persistence","no" +"T1546.004","Unix Shell Configuration Modification","Privilege Escalation|Persistence","no" +"T1546.003","Windows Management Instrumentation Event Subscription","Privilege Escalation|Persistence","Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29" +"T1546.002","Screensaver","Privilege Escalation|Persistence","no" +"T1546.001","Change Default File Association","Privilege Escalation|Persistence","Kimsuky" +"T1547.001","Registry Run Keys / Startup Folder","Persistence|Privilege Escalation","Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel" +"T1218.002","Control Panel","Defense Evasion","no" +"T1218.010","Regsvr32","Defense Evasion","TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda" +"T1218.009","Regsvcs/Regasm","Defense Evasion","no" +"T1218.005","Mshta","Defense Evasion","Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7" +"T1218.004","InstallUtil","Defense Evasion","Mustang Panda|menuPass" +"T1218.001","Compiled HTML File","Defense Evasion","APT41|Silence|Lazarus Group|Dark Caracal|OilRig" +"T1218.003","CMSTP","Defense Evasion","Cobalt Group|MuddyWater" +"T1218.011","Rundll32","Defense Evasion","HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28" +"T1547","Boot or Logon Autostart Execution","Persistence|Privilege Escalation","no" +"T1546","Event Triggered Execution","Privilege Escalation|Persistence","no" +"T1098.003","Add Office 365 Global Administrator Role","Persistence","no" +"T1098.002","Exchange Email Delegate Permissions","Persistence","APT29|UNC2452|Magic Hound" +"T1098.001","Additional Cloud Credentials","Persistence","APT29|UNC2452" +"T1543.004","Launch Daemon","Persistence|Privilege Escalation","no" +"T1543.003","Windows Service","Persistence|Privilege Escalation","PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak" +"T1543.002","Systemd Service","Persistence|Privilege Escalation","Rocke" +"T1543.001","Launch Agent","Persistence|Privilege Escalation","no" +"T1037.005","Startup Items","Persistence|Privilege Escalation","no" +"T1037.004","RC Scripts","Persistence|Privilege Escalation","no" +"T1055.012","Process Hollowing","Defense Evasion|Privilege Escalation","Threat Group-3390|Gorgon Group|menuPass|Patchwork" +"T1055.013","Process Doppelgänging","Defense Evasion|Privilege Escalation","Leafminer" +"T1055.011","Extra Window Memory Injection","Defense Evasion|Privilege Escalation","no" +"T1055.014","VDSO Hijacking","Defense Evasion|Privilege Escalation","no" +"T1055.009","Proc Memory","Defense Evasion|Privilege Escalation","no" +"T1055.008","Ptrace System Calls","Defense Evasion|Privilege Escalation","no" +"T1055.005","Thread Local Storage","Defense Evasion|Privilege Escalation","no" +"T1055.004","Asynchronous Procedure Call","Defense Evasion|Privilege Escalation","no" +"T1055.003","Thread Execution Hijacking","Defense Evasion|Privilege Escalation","no" +"T1055.002","Portable Executable Injection","Defense Evasion|Privilege Escalation","Rocke|Gorgon Group" +"T1055.001","Dynamic-link Library Injection","Defense Evasion|Privilege Escalation","Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda" +"T1037.003","Network Logon Script","Persistence|Privilege Escalation","no" +"T1543","Create or Modify System Process","Persistence|Privilege Escalation","no" +"T1037.002","Logon Script (Mac)","Persistence|Privilege Escalation","no" +"T1037.001","Logon Script (Windows)","Persistence|Privilege Escalation","Cobalt Group|APT28" +"T1542.003","Bootkit","Persistence|Defense Evasion","APT41|Lazarus Group|APT28" +"T1542.002","Component Firmware","Persistence|Defense Evasion","Equation" +"T1542.001","System Firmware","Persistence|Defense Evasion","no" +"T1505.003","Web Shell","Persistence","Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda" +"T1505.002","Transport Agent","Persistence","no" +"T1505.001","SQL Stored Procedures","Persistence","no" +"T1053.003","Cron","Execution|Persistence|Privilege Escalation","Rocke" +"T1053.004","Launchd","Execution|Persistence|Privilege Escalation","no" +"T1053.001","At (Linux)","Execution|Persistence|Privilege Escalation","no" +"T1053.005","Scheduled Task","Execution|Persistence|Privilege Escalation","Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29" +"T1053.002","At (Windows)","Execution|Persistence|Privilege Escalation","BRONZE BUTLER|Threat Group-3390|APT18" +"T1542","Pre-OS Boot","Defense Evasion|Persistence","no" +"T1137.001","Office Template Macros","Persistence","MuddyWater" +"T1137.004","Outlook Home Page","Persistence","OilRig" +"T1137.003","Outlook Forms","Persistence","no" +"T1137.005","Outlook Rules","Persistence","no" +"T1137.006","Add-ins","Persistence","Naikon" +"T1137.002","Office Test","Persistence","APT28" +"T1531","Account Access Removal","Impact","no" +"T1539","Steal Web Session Cookie","Credential Access","Evilnum" +"T1529","System Shutdown/Reboot","Impact","Lazarus Group|APT38|APT37" +"T1518","Software Discovery","Discovery","Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception" +"T1547.013","XDG Autostart Entries","Persistence|Privilege Escalation","no" +"T1534","Internal Spearphishing","Lateral Movement","Gamaredon Group" +"T1528","Steal Application Access Token","Credential Access","APT28" +"T1535","Unused/Unsupported Cloud Regions","Defense Evasion","no" +"T1525","Implant Internal Image","Persistence","no" +"T1538","Cloud Service Dashboard","Discovery","no" +"T1530","Data from Cloud Storage Object","Collection","Fox Kitten" +"T1578","Modify Cloud Compute Infrastructure","Defense Evasion","no" +"T1537","Transfer Data to Cloud Account","Exfiltration","no" +"T1526","Cloud Service Discovery","Discovery","no" +"T1505","Server Software Component","Persistence","no" +"T1499","Endpoint Denial of Service","Impact","Sandworm Team" +"T1497","Virtualization/Sandbox Evasion","Defense Evasion|Discovery","Darkhotel" +"T1498","Network Denial of Service","Impact","APT28" +"T1496","Resource Hijacking","Impact","Blue Mockingbird|Rocke|APT41|Lazarus Group" +"T1495","Firmware Corruption","Impact","no" +"T1491","Defacement","Impact","no" +"T1490","Inhibit System Recovery","Impact","no" +"T1489","Service Stop","Impact","Wizard Spider|Lazarus Group" +"T1486","Data Encrypted for Impact","Impact","Indrik Spider|APT41|TA505|APT38" +"T1485","Data Destruction","Impact","Sandworm Team|Lazarus Group|APT38" +"T1484","Domain Policy Modification","Defense Evasion|Privilege Escalation","no" +"T1482","Domain Trust Discovery","Discovery","APT29|Chimera|UNC2452" +"T1480","Execution Guardrails","Defense Evasion","no" +"T1222","File and Directory Permissions Modification","Defense Evasion","no" +"T1220","XSL Script Processing","Defense Evasion","Higaisa|Cobalt Group" +"T1221","Template Injection","Defense Evasion","Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus" +"T1189","Drive-by Compromise","Initial Access","Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM" +"T1190","Exploit Public-Facing Application","Initial Access","Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom" +"T1210","Exploitation of Remote Services","Lateral Movement","Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28" +"T1217","Browser Bookmark Discovery","Discovery","Chimera|Fox Kitten" +"T1213","Data from Information Repositories","Collection","Fox Kitten|FIN6|Turla" +"T1197","BITS Jobs","Defense Evasion|Persistence","APT39|Patchwork|APT41|Leviathan" +"T1219","Remote Access Software","Command And Control","Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak" +"T1195","Supply Chain Compromise","Initial Access","no" +"T1204","User Execution","Execution","no" +"T1212","Exploitation for Credential Access","Credential Access","no" +"T1211","Exploitation for Defense Evasion","Defense Evasion","APT28" +"T1200","Hardware Additions","Initial Access","DarkVishnya" +"T1202","Indirect Command Execution","Defense Evasion","no" +"T1201","Password Policy Discovery","Discovery","Chimera|Turla|OilRig" +"T1207","Rogue Domain Controller","Defense Evasion","no" +"T1203","Exploitation for Client Execution","Execution","Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood" +"T1216","Signed Script Proxy Execution","Defense Evasion","no" +"T1199","Trusted Relationship","Initial Access","Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass" +"T1218","Signed Binary Proxy Execution","Defense Evasion","no" +"T1205","Traffic Signaling","Defense Evasion|Persistence|Command And Control","no" +"T1176","Browser Extensions","Persistence","Kimsuky|Stolen Pencil" +"T1175","Component Object Model and Distributed COM","Lateral Movement|Execution","no" +"T1187","Forced Authentication","Credential Access","DarkHydrus|Dragonfly 2.0" +"T1185","Man in the Browser","Collection","no" +"T1149","LC_MAIN Hijacking","Defense Evasion","no" +"T1134","Access Token Manipulation","Defense Evasion|Privilege Escalation","FIN6|Blue Mockingbird" +"T1136","Create Account","Persistence","no" +"T1137","Office Application Startup","Persistence","Gamaredon Group|APT32" +"T1140","Deobfuscate/Decode Files or Information","Defense Evasion","APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER" +"T1135","Network Share Discovery","Discovery","Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug" +"T1153","Source","Execution","no" +"T1133","External Remote Services","Persistence|Initial Access","APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18" +"T1132","Data Encoding","Command And Control","no" +"T1129","Shared Modules","Execution","no" +"T1127","Trusted Developer Utilities Proxy Execution","Defense Evasion","no" +"T1125","Video Capture","Collection","Silence|FIN7" +"T1124","System Time Discovery","Discovery","Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla" +"T1123","Audio Capture","Collection","APT37" +"T1120","Peripheral Device Discovery","Discovery","Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28" +"T1119","Automated Collection","Collection","Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6" +"T1115","Clipboard Data","Collection","Operation Wocao|APT39|APT38" +"T1114","Email Collection","Collection","Silent Librarian" +"T1113","Screen Capture","Collection","GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28" +"T1112","Modify Registry","Defense Evasion","Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8" +"T1111","Two-Factor Authentication Interception","Credential Access","Chimera|Operation Wocao" +"T1110","Brute Force","Credential Access","APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla" +"T1108","Redundant Access","Defense Evasion|Persistence","no" +"T1106","Native API","Execution","Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group" +"T1105","Ingress Tool Transfer","Command And Control","HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28" +"T1104","Multi-Stage Channels","Command And Control","APT41|MuddyWater|APT3" +"T1102","Web Service","Command And Control","Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6" +"T1098","Account Manipulation","Persistence","APT3|Dragonfly 2.0|Lazarus Group" +"T1095","Non-Application Layer Protocol","Command And Control","HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3" +"T1092","Communication Through Removable Media","Command And Control","APT28" +"T1091","Replication Through Removable Media","Lateral Movement|Initial Access","Mustang Panda|Tropic Trooper|Darkhotel|APT28" +"T1090","Proxy","Command And Control","Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla" +"T1087","Account Discovery","Discovery","APT29|UNC2452" +"T1083","File and Directory Discovery","Discovery","APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang" +"T1082","System Information Discovery","Discovery","APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang" +"T1080","Taint Shared Content","Lateral Movement","Gamaredon Group|BRONZE BUTLER|Darkhotel" +"T1078","Valid Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak" +"T1074","Data Staged","Collection","Wizard Spider" +"T1072","Software Deployment Tools","Execution|Lateral Movement","Silence|APT32|Threat Group-1314" +"T1071","Application Layer Protocol","Command And Control","Rocke|Magic Hound|Dragonfly 2.0" +"T1070","Indicator Removal on Host","Defense Evasion","APT29|UNC2452" +"T1069","Permission Groups Discovery","Discovery","APT29|UNC2452|TA505|APT3" +"T1068","Exploitation for Privilege Escalation","Privilege Escalation","ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28" +"T1064","Scripting","Defense Evasion|Execution","no" +"T1062","Hypervisor","Persistence","no" +"T1061","Graphical User Interface","Execution","no" +"T1059","Command and Scripting Interpreter","Execution","Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang" +"T1057","Process Discovery","Discovery","APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang" +"T1056","Input Capture","Collection|Credential Access","APT39" +"T1055","Process Injection","Defense Evasion|Privilege Escalation","Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM" +"T1053","Scheduled Task/Job","Execution|Persistence|Privilege Escalation","no" +"T1052","Exfiltration Over Physical Medium","Exfiltration","no" +"T1051","Shared Webroot","Lateral Movement","no" +"T1049","System Network Connections Discovery","Discovery","Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang" +"T1048","Exfiltration Over Alternative Protocol","Exfiltration","no" +"T1047","Windows Management Instrumentation","Execution","Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda" +"T1046","Network Service Scanning","Discovery","Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390" +"T1043","Commonly Used Port","Command And Control","OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390" +"T1041","Exfiltration Over C2 Channel","Exfiltration","ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang" +"T1040","Network Sniffing","Credential Access|Discovery","Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28" +"T1039","Data from Network Shared Drive","Collection","Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass" +"T1037","Boot or Logon Initialization Scripts","Persistence|Privilege Escalation","Rocke" +"T1036","Masquerading","Defense Evasion","APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0" +"T1034","Path Interception","Persistence|Privilege Escalation","no" +"T1033","System Owner/User Discovery","Discovery","Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3" +"T1030","Data Transfer Size Limits","Exfiltration","Threat Group-3390" +"T1029","Scheduled Transfer","Exfiltration","Higaisa" +"T1027","Obfuscated Files or Information","Defense Evasion","APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28" +"T1026","Multiband Communication","Command And Control","Lazarus Group" +"T1025","Data from Removable Media","Collection","Turla|Gamaredon Group|APT28" +"T1021","Remote Services","Lateral Movement","no" +"T1020","Automated Exfiltration","Exfiltration","Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee" +"T1018","Remote System Discovery","Discovery","APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla" +"T1016","System Network Configuration Discovery","Discovery","ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang" +"T1014","Rootkit","Defense Evasion","Rocke|APT41|APT28|Winnti Group" +"T1012","Query Registry","Discovery","ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla" +"T1011","Exfiltration Over Other Network Medium","Exfiltration","no" +"T1010","Application Window Discovery","Discovery","Lazarus Group" +"T1008","Fallback Channels","Command And Control","Carbanak|APT41|OilRig|Lazarus Group" +"T1007","System Service Discovery","Discovery","Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang" +"T1006","Direct Volume Access","Defense Evasion","no" +"T1005","Data from Local System","Collection","APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang" +"T1003","OS Credential Dumping","Credential Access","APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom" +"T1001","Data Obfuscation","Command And Control","Operation Wocao|Axiom" diff --git a/playbooks/GSuite_DevSecOps.json b/playbooks/GSuite_DevSecOps.json deleted file mode 100644 index aa38b85ccc..0000000000 --- a/playbooks/GSuite_DevSecOps.json +++ /dev/null @@ -1,4034 +0,0 @@ -{ - "blockly": false, - "blockly_xml": "", - "category": "Threat Response", - "coa": { - "data": { - "clean": true, - "code_block": "", - "description": "", - "hash": "9baa524d3151f8162cf7926657f49e8f2fe828de", - "joint": { - "cells": [ - { - "0": "S", - "1": "T", - "2": "A", - "3": "R", - "4": "T", - "active": false, - "angle": 0, - "attrs": { - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - ".title": { - "ref-x": 33, - "ref-y": 8, - "text": "START" - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "ref-x": 13, - "xlink:href": "/inc/coa/img/block_icon_start.svg" - }, - "g.notes": { - "display": "block" - } - }, - "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'Get_File_from_GDrive' block\n Get_File_from_GDrive(container=container)\n\n # call 'ip_reputation_1' block\n ip_reputation_1(container=container)\n\n return", - "callback_code": "# read-only block view not available", - "callback_start": 1, - "callsback": false, - "connected_to_start": true, - "connection_name": "", - "connection_type": "", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "", - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "83148d28-f8c8-4ec6-a672-e8ac3cb413e0", - "inPorts": [], - "join_code": "# read-only block view not available", - "join_optional": [], - "join_start": 1, - "line_end": 18, - "line_start": 7, - "name": "", - "notes": "", - "number": 0, - "order": 1, - "outPorts": [ - "out" - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 100, - "y": 100 - }, - "previous_function": "", - "previous_name": "", - "show_number": true, - "size": { - "height": 54, - "width": 80 - }, - "status": "", - "title": "START", - "type": "coa.StartEnd", - "warn": false, - "z": 1 - }, - { - "0": "E", - "1": "N", - "2": "D", - "active": false, - "angle": 0, - "attrs": { - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".title": { - "text": "END" - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "xlink:href": "/inc/coa/img/block_icon_end.svg" - }, - "g.notes": { - "display": "block" - } - }, - "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", - "callback_code": "# read-only block view not available", - "callback_start": 1, - "callsback": false, - "connected_to_start": true, - "connection_name": "VT Lookup, Prompt for Upload, VT Upload", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "", - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", - "inPorts": [ - "in" - ], - "join_code": "# read-only block view not available", - "join_optional": [], - "join_start": 1, - "line_end": 212, - "line_start": 199, - "name": "", - "notes": "", - "number": 0, - "order": 10, - "outPorts": [], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 1460, - "y": 120 - }, - "previous_function": "", - "previous_name": "", - "show_number": true, - "size": { - "height": 54, - "width": 80 - }, - "status": "", - "title": "END", - "type": "coa.StartEnd", - "warn": false, - "z": 2 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "c299574c-5abf-4f75-8bc9-fefe61917ee7", - "router": { - "name": "metro" - }, - "source": { - "id": "83148d28-f8c8-4ec6-a672-e8ac3cb413e0", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "98529e71-c430-4ef1-98b8-8f111235014c", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 3 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "8f059d5a-cfda-4bc3-bfb1-dc6fca5078ee", - "router": { - "name": "metro" - }, - "source": { - "id": "98529e71-c430-4ef1-98b8-8f111235014c", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "91ce9fe3-376f-4448-9584-c2ba0a74cedc", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 6 - }, - { - "action": "get file", - "action_type": "investigate", - "active": false, - "active_keys": {}, - "active_values": { - "hash": "Get_File_from_GDrive:action_result.summary.vault_id" - }, - "angle": 0, - "app": "VirusTotal", - "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", - "approver": "", - "assets": [ - { - "action": "get file", - "actions": [ - "detonate file", - "test connectivity", - "file reputation", - "url reputation", - "domain reputation", - "ip reputation", - "get file", - "get report", - "detonate url" - ], - "active": true, - "app_name": "VirusTotal", - "app_version": "2.1.2", - "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", - "asset_name": "virustotal", - "config_type": "asset", - "count": 0, - "fields": { - "hash": "Get_File_from_GDrive:action_result.summary.vault_id" - }, - "has_app": true, - "id": 7, - "loaded": false, - "missing": false, - "name": "virustotal", - "output": [ - { - "data_path": "action_result.status", - "data_type": "string", - "example_values": [ - "success", - "failed" - ] - }, - { - "column_name": "Hash", - "column_order": 1, - "contains": [ - "hash", - "sha256", - "sha1", - "md5" - ], - "data_path": "action_result.parameter.hash", - "data_type": "string", - "example_values": [ - "BDB97B8DE2D22B86B3BDB4B43B4C50BF" - ] - }, - { - "data_path": "action_result.data.*.file_type", - "data_type": "string" - }, - { - "contains": [ - "md5" - ], - "data_path": "action_result.data.*.name", - "data_type": "string", - "example_values": [ - "BDB97B8DE2D22B86B3BDB4B43B4C50BF" - ] - }, - { - "contains": [ - "vault id", - "sha1" - ], - "data_path": "action_result.data.*.vault_id", - "data_type": "string", - "example_values": [ - "1052507b5c178307bf333e48237af2530c365d73" - ] - }, - { - "column_name": "File Type", - "column_order": 2, - "data_path": "action_result.summary.file_type", - "data_type": "string" - }, - { - "column_name": "File Name", - "column_order": 0, - "contains": [ - "md5" - ], - "data_path": "action_result.summary.name", - "data_type": "string", - "example_values": [ - "BDB97B8DE2D22B86B3BDB4B43B4C50BF" - ] - }, - { - "column_name": "Vault ID", - "column_order": 3, - "contains": [ - "vault id", - "sha1" - ], - "data_path": "action_result.summary.vault_id", - "data_type": "string", - "example_values": [ - "1052507b5c178307bf333e48237af2530c365d73" - ] - }, - { - "data_path": "action_result.message", - "data_type": "string", - "example_values": [ - "File successfully retrieved and added to vault" - ] - }, - { - "data_path": "summary.total_objects", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_objects_successful", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_positives", - "data_type": "numeric", - "example_values": [ - 0 - ] - } - ], - "parameters": { - "hash": { - "contains": [ - "hash", - "sha256", - "sha1", - "md5" - ], - "data_type": "string", - "default": null, - "description": "Hash of file to get", - "key": "hash", - "order": 0, - "primary": true, - "required": true - } - }, - "product_name": "VirusTotal", - "product_vendor": "VirusTotal", - "targets": "7", - "type": "reputation" - } - ], - "attrs": { - ".action": { - "text": "VT Lookup" - }, - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".message": { - "opacity": 0, - "ref-x": 5, - "ref-y": 105, - "text": "Configuring now" - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - ".title": { - "text": "Investigate" - }, - "g.approver image": { - "opacity": 1 - }, - "g.code image": { - "opacity": 1 - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "xlink:href": "/inc/coa/img/block_icon_investigate.svg" - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1, - "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" - }, - "g.timer image": { - "opacity": 1 - } - }, - "block_code": "def VT_Lookup(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('VT_Lookup() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'VT_Lookup' call\n results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'VT_Lookup' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'hash': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['virustotal'], callback=VT_Lookup_Error_Handling, name=\"VT_Lookup\", parent_action=action)\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": true, - "color": "", - "connected_to_start": true, - "connection_name": "Get File from GDrive", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "VT Lookup", - "delay": 0, - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "91ce9fe3-376f-4448-9584-c2ba0a74cedc", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 67, - "line_start": 44, - "message": "Configuring now", - "name": "get file", - "notes": "Uses vault_id (hash of file) to check if VirusTotal has a report for this file", - "number": 4, - "order": 3, - "outPorts": [ - "out" - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 520, - "y": 80 - }, - "previous_function": "", - "previous_name": "VT_Lookup", - "required_params": { - "hash": true - }, - "reviewer": "", - "show_number": true, - "size": { - "height": 100, - "width": 180 - }, - "state": "app_action_assets", - "status": "", - "title": "Investigate", - "type": "coa.Action", - "warn": false, - "z": 14 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "d0f3ceb4-0e03-4ed2-af2f-3ff462bbd248", - "router": { - "name": "metro" - }, - "source": { - "id": "91ce9fe3-376f-4448-9584-c2ba0a74cedc", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "3443bcb9-197b-40ff-b430-a228726bd34c", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 15 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "fe020871-0f2c-4a1c-a0d1-eaaf9b4abf56", - "router": { - "name": "metro" - }, - "source": { - "id": "3443bcb9-197b-40ff-b430-a228726bd34c", - "port": "out-1", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "a83e5122-6184-4296-8a39-c22d30ba0da1", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 17 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "0cce17fb-4fce-429d-8893-1ebe7f435fc9", - "router": { - "name": "metro" - }, - "source": { - "id": "3443bcb9-197b-40ff-b430-a228726bd34c", - "port": "out-2", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", - "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" - }, - "type": "link", - "z": 23 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "d0296916-3c70-480b-970d-95332f16309b", - "router": { - "name": "metro" - }, - "source": { - "id": "a83e5122-6184-4296-8a39-c22d30ba0da1", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 24 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "b9a9b71a-6935-4d3f-80e4-bed71f434e63", - "router": { - "name": "metro" - }, - "source": { - "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", - "port": "out-1", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "0a14803d-bba5-44ad-8192-c21795f0be7d", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 33 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "297e8201-25f9-4dad-bb8a-9ac804c8c765", - "router": { - "name": "metro" - }, - "source": { - "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", - "port": "out-2", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", - "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" - }, - "type": "link", - "z": 36 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "5ed13a85-9142-402b-9e58-d9bfc0172064", - "router": { - "name": "metro" - }, - "source": { - "id": "83148d28-f8c8-4ec6-a672-e8ac3cb413e0", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "d709a2f0-7ec6-45d3-b716-79fdc105d9ff", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 37 - }, - { - "action": "detonate file", - "action_type": "investigate", - "active": false, - "active_keys": {}, - "active_values": { - "vault_id": "Get_File_from_GDrive:action_result.summary.vault_id" - }, - "angle": 0, - "app": "VirusTotal", - "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", - "approver": "", - "assets": [ - { - "action": "detonate file", - "actions": [ - "detonate file", - "test connectivity", - "file reputation", - "url reputation", - "domain reputation", - "ip reputation", - "get file", - "get report", - "detonate url" - ], - "active": true, - "app_name": "VirusTotal", - "app_version": "2.1.2", - "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", - "asset_name": "virustotal", - "config_type": "asset", - "count": 0, - "fields": { - "vault_id": "Get_File_from_GDrive:action_result.summary.vault_id" - }, - "has_app": true, - "id": 7, - "loaded": false, - "missing": false, - "name": "virustotal", - "output": [ - { - "data_path": "action_result.status", - "data_type": "string", - "example_values": [ - "success", - "failed" - ] - }, - { - "contains": [ - "vault id", - "sha1" - ], - "data_path": "action_result.parameter.vault_id", - "data_type": "string", - "example_values": [ - "6c1948f7edf115cd1f13cd170b882077930be150" - ] - }, - { - "contains": [ - "hash", - "md5" - ], - "data_path": "action_result.data.*.md5", - "data_type": "string", - "example_values": [ - "494303294715f5ffad7ad3f43b73b00b" - ] - }, - { - "contains": [ - "url" - ], - "data_path": "action_result.data.*.permalink", - "data_type": "string", - "example_values": [ - "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" - ] - }, - { - "data_path": "action_result.data.*.positives", - "data_type": "numeric", - "example_values": [ - 64 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.resource", - "data_type": "string", - "example_values": [ - "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" - ] - }, - { - "data_path": "action_result.data.*.response_code", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "action_result.data.*.scan_date", - "data_type": "string", - "example_values": [ - "2019-01-21 23:18:04" - ] - }, - { - "contains": [ - "virustotal scan id" - ], - "data_path": "action_result.data.*.scan_id", - "data_type": "string", - "example_values": [ - "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" - ] - }, - { - "data_path": "action_result.data.*.scans.*.detected", - "data_type": "boolean" - }, - { - "data_path": "action_result.data.*.scans.*.result", - "data_type": "string" - }, - { - "data_path": "action_result.data.*.scans.*.update", - "data_type": "string" - }, - { - "data_path": "action_result.data.*.scans.*.version", - "data_type": "string" - }, - { - "contains": [ - "hash", - "sha1" - ], - "data_path": "action_result.data.*.sha1", - "data_type": "string", - "example_values": [ - "6c1948f7edf115cd1f13cd170b882077930be150" - ] - }, - { - "contains": [ - "hash", - "sha256" - ], - "data_path": "action_result.data.*.sha256", - "data_type": "string", - "example_values": [ - "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" - ] - }, - { - "data_path": "action_result.data.*.total", - "data_type": "numeric", - "example_values": [ - 72 - ] - }, - { - "data_path": "action_result.data.*.verbose_msg", - "data_type": "string", - "example_values": [ - "Scan finished, information embedded" - ] - }, - { - "column_name": "Positives", - "column_order": 1, - "data_path": "action_result.summary.positives", - "data_type": "numeric", - "example_values": [ - 64 - ] - }, - { - "contains": [ - "virustotal scan id" - ], - "data_path": "action_result.summary.scan_id", - "data_type": "string", - "example_values": [ - "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" - ] - }, - { - "column_name": "Total Scans", - "column_order": 0, - "data_path": "action_result.summary.total_scans", - "data_type": "numeric", - "example_values": [ - 72 - ] - }, - { - "data_path": "action_result.message", - "data_type": "string", - "example_values": [ - "Positives: 64, Scan id: 27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684, Total scans: 72" - ] - }, - { - "data_path": "summary.total_objects", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_objects_successful", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_positives", - "data_type": "numeric", - "example_values": [ - 0 - ] - } - ], - "parameters": { - "vault_id": { - "contains": [ - "vault id", - "sha1" - ], - "data_type": "string", - "default": null, - "description": "The Vault ID of the file to scan", - "key": "vault_id", - "order": 0, - "primary": true, - "required": true - } - }, - "product_name": "VirusTotal", - "product_vendor": "VirusTotal", - "targets": "7", - "type": "reputation" - } - ], - "attrs": { - ".action": { - "text": "VT Upload" - }, - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".message": { - "opacity": 0, - "ref-x": 5, - "ref-y": 105, - "text": "Configuring now" - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - ".title": { - "text": "Investigate" - }, - "g.approver image": { - "opacity": 1 - }, - "g.code image": { - "opacity": 1 - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "xlink:href": "/inc/coa/img/block_icon_investigate.svg" - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1 - }, - "g.timer image": { - "opacity": 1 - } - }, - "block_code": "def VT_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('VT_Upload() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'VT_Upload' call\n results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'VT_Upload' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'vault_id': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['virustotal'], name=\"VT_Upload\")\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": true, - "color": "", - "connected_to_start": true, - "connection_name": "Prompt for Upload", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "VT Upload", - "delay": 0, - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "0a14803d-bba5-44ad-8192-c21795f0be7d", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 155, - "line_start": 132, - "message": "Configuring now", - "name": "detonate file", - "notes": "", - "number": 1, - "order": 7, - "outPorts": [ - "out" - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 1240, - "y": -60 - }, - "previous_function": "", - "previous_name": "VT_Upload", - "required_params": { - "vault_id": true - }, - "reviewer": "", - "show_number": false, - "size": { - "height": 100, - "width": 180 - }, - "state": "app_action_assets", - "status": "", - "title": "Investigate", - "type": "coa.Action", - "warn": false, - "z": 41 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "f93d1a7a-fc94-42f5-ab59-d145b9505f79", - "router": { - "name": "metro" - }, - "source": { - "id": "0a14803d-bba5-44ad-8192-c21795f0be7d", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "cdde65ec-eea2-4fc3-8d13-17805cb07fea", - "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" - }, - "type": "link", - "z": 42 - }, - { - "active": false, - "angle": 0, - "attrs": { - ".background": { - "fill": "#000000", - "stroke": "#637282", - "transform": "rotate(45 30 70)" - }, - ".inPorts>.port-0>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".number": { - "text": 3 - }, - ".outPorts>.port-0": { - "port": { - "id": "out-1", - "type": "out" - }, - "ref-x": 83, - "ref-y": 40 - }, - ".outPorts>.port-0>.port-body": { - "port": { - "id": "out-1", - "type": "out" - } - }, - ".outPorts>.port-1": { - "port": { - "id": "out-2", - "type": "out" - }, - "ref-x": 41, - "ref-y": 82 - }, - ".outPorts>.port-1>.port-body": { - "port": { - "id": "out-2", - "type": "out" - } - }, - "g.delete": { - "display": "block" - }, - "g.error": { - "opacity": 0 - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1 - } - }, - "block_code": "def Prompt_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('Prompt_Handling() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"Prompt_for_Upload:action_result.summary.responses.0\", \"==\", \"Yes\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n VT_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": false, - "connected_to_start": true, - "connection_name": "Prompt for Upload", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "Prompt Handling", - "description": "", - "hasElse": true, - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "54f98738-a615-4dbd-abeb-7525e5f95cdc", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 132, - "line_start": 112, - "name": "decision", - "notes": "", - "number": 3, - "order": 6, - "outPorts": [ - "out-1", - "out-2" - ], - "outputs": [ - { - "conditions": [ - { - "comparison": "==", - "data_type": "", - "param": "Prompt_for_Upload:action_result.summary.responses.0", - "value": "Yes" - } - ], - "display": "If", - "logic": "and", - "type": "if" - }, - { - "conditions": [ - { - "comparison": "==", - "data_type": "", - "param": "", - "value": "" - } - ], - "display": "Else", - "logic": "and", - "type": "else" - } - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 1060, - "y": 0 - }, - "previous_function": "", - "previous_name": "Prompt_Handling", - "show_number": true, - "size": { - "height": 82, - "width": 82 - }, - "state": "decision", - "status": "", - "type": "coa.Decision", - "warn": "", - "z": 46 - }, - { - "action": "get file", - "action_type": "investigate", - "active": false, - "active_keys": {}, - "active_values": { - "download_file": "True", - "email": "", - "file_name": "", - "id": "artifact:*.cef.doc_id", - "mime_type": "" - }, - "angle": 0, - "app": "G Suite for Drive", - "appid": "f091ded1-3d9e-4402-aaa2-1f92fae51e96", - "approver": "", - "assets": [ - { - "action": "get file", - "actions": [ - "test connectivity", - "list users", - "delete file", - "create folder", - "upload file", - "get file", - "list files" - ], - "active": true, - "app_name": "G Suite for Drive", - "app_version": "2.0.19", - "appid": "f091ded1-3d9e-4402-aaa2-1f92fae51e96", - "asset_name": "google-gdrive", - "config_type": "asset", - "count": 0, - "fields": { - "download_file": "True", - "email": "", - "file_name": "", - "id": "artifact:*.cef.doc_id", - "mime_type": "", - "ph": "" - }, - "has_app": true, - "id": 6, - "loaded": false, - "missing": false, - "name": "google-gdrive", - "output": [ - { - "data_path": "action_result.status", - "data_type": "string", - "example_values": [ - "success", - "failed" - ] - }, - { - "data_path": "action_result.parameter.download_file", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "contains": [ - "email" - ], - "data_path": "action_result.parameter.email", - "data_type": "string", - "example_values": [ - "abc@gmail.com" - ] - }, - { - "data_path": "action_result.parameter.file_name", - "data_type": "string", - "example_values": [ - "file.pdf" - ] - }, - { - "contains": [ - "drive file id" - ], - "data_path": "action_result.parameter.id", - "data_type": "string", - "example_values": [ - "12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA", - "1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps", - "1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z" - ] - }, - { - "contains": [ - "mime type" - ], - "data_path": "action_result.parameter.mime_type", - "data_type": "string", - "example_values": [ - "application/pdf" - ] - }, - { - "data_path": "action_result.data.*.capabilities.canAddChildren", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canAddMyDriveParent", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canChangeCopyRequiresWriterPermission", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canChangeViewersCanCopyContent", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canComment", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canCopy", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canDelete", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canDownload", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canEdit", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canListChildren", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canModifyContent", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canMoveChildrenWithinDrive", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canMoveItemIntoTeamDrive", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canMoveItemOutOfDrive", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canMoveItemWithinDrive", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canReadRevisions", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canRemoveChildren", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canRemoveMyDriveParent", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canRename", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canShare", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canTrash", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.capabilities.canUntrash", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.createdTime", - "data_type": "string", - "example_values": [ - "2018-01-10T01:17:40.409Z", - "2018-12-21T07:26:11.898Z", - "2018-12-21T07:26:16.188Z" - ] - }, - { - "data_path": "action_result.data.*.explicitlyTrashed", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.fileExtension", - "data_type": "string" - }, - { - "data_path": "action_result.data.*.fullFileExtension", - "data_type": "string" - }, - { - "data_path": "action_result.data.*.hasThumbnail", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.headRevisionId", - "data_type": "string", - "example_values": [ - "0B3SKAcU2T6x2ZlNyRm40eHNlS245VWZiTnp3QXh4OFFZRSt3PQ" - ] - }, - { - "contains": [ - "url" - ], - "data_path": "action_result.data.*.iconLink", - "data_type": "string", - "example_values": [ - "https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.spreadsheet", - "https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document", - "https://drive-thirdparty.googleusercontent.com/16/type/text/plain" - ] - }, - { - "column_name": "ID", - "column_order": 0, - "contains": [ - "drive file id" - ], - "data_path": "action_result.data.*.id", - "data_type": "string", - "example_values": [ - "12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA", - "1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps", - "1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z" - ] - }, - { - "data_path": "action_result.data.*.isAppAuthorized", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.kind", - "data_type": "string", - "example_values": [ - "drive#file" - ] - }, - { - "data_path": "action_result.data.*.lastModifyingUser.displayName", - "data_type": "string", - "example_values": [ - "test Edwards" - ] - }, - { - "contains": [ - "email" - ], - "data_path": "action_result.data.*.lastModifyingUser.emailAddress", - "data_type": "string", - "example_values": [ - "test@phantom.us", - "admin@testcorp.biz" - ] - }, - { - "data_path": "action_result.data.*.lastModifyingUser.kind", - "data_type": "string", - "example_values": [ - "drive#user" - ] - }, - { - "data_path": "action_result.data.*.lastModifyingUser.me", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.lastModifyingUser.permissionId", - "data_type": "string", - "example_values": [ - "03385014771683713179" - ] - }, - { - "contains": [ - "md5" - ], - "data_path": "action_result.data.*.md5Checksum", - "data_type": "string", - "example_values": [ - "ccdf997e20b103b9215082dcd07a86fc" - ] - }, - { - "contains": [ - "mime type" - ], - "data_path": "action_result.data.*.mimeType", - "data_type": "string", - "example_values": [ - "application/vnd.google-apps.spreadsheet", - "application/vnd.google-apps.document", - "text/plain" - ] - }, - { - "data_path": "action_result.data.*.modifiedByMe", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.modifiedByMeTime", - "data_type": "string", - "example_values": [ - "2018-01-10T01:17:41.700Z", - "2018-12-21T07:26:14.638Z", - "2018-12-21T07:26:16.188Z" - ] - }, - { - "column_name": "Last Modified", - "column_order": 2, - "data_path": "action_result.data.*.modifiedTime", - "data_type": "string", - "example_values": [ - "2018-01-10T01:17:41.700Z", - "2018-12-21T07:26:14.638Z", - "2018-12-21T07:26:16.188Z" - ] - }, - { - "column_name": "Name", - "column_order": 1, - "data_path": "action_result.data.*.name", - "data_type": "string", - "example_values": [ - "Untitled.xlsx", - "New Google Document", - "New Plain Text" - ] - }, - { - "data_path": "action_result.data.*.originalFilename", - "data_type": "string", - "example_values": [ - "New Plain Text" - ] - }, - { - "data_path": "action_result.data.*.ownedByMe", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.owners.*.displayName", - "data_type": "string", - "example_values": [ - "test Edwards" - ] - }, - { - "contains": [ - "email" - ], - "data_path": "action_result.data.*.owners.*.emailAddress", - "data_type": "string", - "example_values": [ - "test@phantom.us", - "admin@testcorp.biz" - ] - }, - { - "data_path": "action_result.data.*.owners.*.kind", - "data_type": "string", - "example_values": [ - "drive#user" - ] - }, - { - "data_path": "action_result.data.*.owners.*.me", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.owners.*.permissionId", - "data_type": "string", - "example_values": [ - "03385014771683713179" - ] - }, - { - "data_path": "action_result.data.*.parents", - "data_type": "string", - "example_values": [ - "0AHSKAcU2T6x2Uk9PVA", - "1GR9Ww4_AFxqmRRRSDi_EP5sPp8PLX7Te" - ] - }, - { - "data_path": "action_result.data.*.permissionIds", - "data_type": "string", - "example_values": [ - "03385014771683713179" - ] - }, - { - "data_path": "action_result.data.*.permissions.*.deleted", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.permissions.*.displayName", - "data_type": "string", - "example_values": [ - "test Edwards" - ] - }, - { - "contains": [ - "email" - ], - "data_path": "action_result.data.*.permissions.*.emailAddress", - "data_type": "string", - "example_values": [ - "test@phantom.us", - "admin@testcorp.biz" - ] - }, - { - "data_path": "action_result.data.*.permissions.*.id", - "data_type": "string", - "example_values": [ - "03385014771683713179" - ] - }, - { - "data_path": "action_result.data.*.permissions.*.kind", - "data_type": "string", - "example_values": [ - "drive#permission" - ] - }, - { - "data_path": "action_result.data.*.permissions.*.role", - "data_type": "string", - "example_values": [ - "owner" - ] - }, - { - "data_path": "action_result.data.*.permissions.*.type", - "data_type": "string", - "example_values": [ - "user" - ] - }, - { - "data_path": "action_result.data.*.quotaBytesUsed", - "data_type": "string", - "example_values": [ - "0", - "48" - ] - }, - { - "data_path": "action_result.data.*.shared", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.size", - "data_type": "string", - "example_values": [ - "48" - ] - }, - { - "data_path": "action_result.data.*.spaces", - "data_type": "string", - "example_values": [ - "drive" - ] - }, - { - "data_path": "action_result.data.*.starred", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "contains": [ - "url" - ], - "data_path": "action_result.data.*.thumbnailLink", - "data_type": "string", - "example_values": [ - "https://drive.google.com/a/acme.com/&v=1&s=AMedNnoAAAAAWlWZqdpxKYbzlZb-ko4BLBo5QZYPyz8c&sz=s220?ddrp=1#", - "https://docs.google.com/a/testcorp.biz/feeds/vt?gd=true&id=1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps&v=1&s=AMedNnoAAAAAXByxw2buVBlu4JyZ3PAtCNKDXRCoXvkM&sz=s220", - "https://lh3.googleusercontent.com/FhnFtKecgZ1fCEMgJASrrS9nh2eKWlONj_QGbuGkeFSbiLYmnJVspaw-sKkstgJpLnmo8SYDjd4=s220" - ] - }, - { - "data_path": "action_result.data.*.thumbnailVersion", - "data_type": "string", - "example_values": [ - "1" - ] - }, - { - "data_path": "action_result.data.*.trashed", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.version", - "data_type": "string", - "example_values": [ - "6", - "5", - "3" - ] - }, - { - "data_path": "action_result.data.*.viewedByMe", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "data_path": "action_result.data.*.viewedByMeTime", - "data_type": "string", - "example_values": [ - "2018-01-10T01:17:48.669Z", - "2018-12-21T07:26:14.638Z", - "2018-12-21T07:26:20.302Z" - ] - }, - { - "data_path": "action_result.data.*.viewersCanCopyContent", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "contains": [ - "url" - ], - "data_path": "action_result.data.*.webContentLink", - "data_type": "string", - "example_values": [ - "https://drive.google.com/a/acme.com/uc?id=12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA&export=download", - "https://drive.google.com/a/testcorp.biz/uc?id=1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z&export=download" - ] - }, - { - "contains": [ - "url" - ], - "data_path": "action_result.data.*.webViewLink", - "data_type": "string", - "example_values": [ - "https://docs.google.com/a/acme.com/spreadsheets/d/12wNhYsdgesIzNyXfXZqI7l9GCs4yjoeZt-vSJaLo1fA/edit?usp=drivesdk", - "https://docs.google.com/document/d/1_x--TqEi4liLds9ZXjSHpVXoPuKEI2tUU9t4enGvOps/edit?usp=drivesdk", - "https://drive.google.com/a/testcorp.biz/file/d/1S09PXDLSIi4RiE7j5C86aB6Aj7ZeRR2z/view?usp=drivesdk" - ] - }, - { - "data_path": "action_result.data.*.writersCanShare", - "data_type": "boolean", - "example_values": [ - true, - false - ] - }, - { - "column_name": "Vault ID", - "column_order": 3, - "contains": [ - "sha1", - "vault id" - ], - "data_path": "action_result.summary.vault_id", - "data_type": "string", - "example_values": [ - "2fd639e7bdeffe563d13770c2519f99a19bbeef3", - "88cc2571feeaafc30d8c5c11c1d512d3be7b25fa" - ] - }, - { - "data_path": "action_result.message", - "data_type": "string", - "example_values": [ - "Failed to get file. Error string: ''", - "Successfully retrieved file and added to vault", - "Successfully retrieved file information and added to vault", - "Successfully retrieved file information" - ] - }, - { - "data_path": "summary.total_objects", - "data_type": "numeric", - "example_values": [ - 1, - 3 - ] - }, - { - "data_path": "summary.total_objects_successful", - "data_type": "numeric", - "example_values": [ - 0, - 1, - 3 - ] - } - ], - "parameters": { - "download_file": { - "data_type": "boolean", - "default": false, - "description": "Download the file to the Vault", - "key": "download_file", - "order": 2, - "required": false - }, - "email": { - "contains": [ - "email" - ], - "data_type": "string", - "default": null, - "description": "Email (use this drive)", - "key": "email", - "order": 0, - "primary": true, - "required": false - }, - "file_name": { - "data_type": "string", - "default": null, - "description": "Set a new name for the file before adding it to the vault", - "key": "file_name", - "order": 5, - "required": false - }, - "id": { - "contains": [ - "drive file id" - ], - "data_type": "string", - "default": null, - "description": "File ID", - "key": "id", - "order": 1, - "primary": true, - "required": true - }, - "mime_type": { - "contains": [ - "mime type" - ], - "data_type": "string", - "default": null, - "description": "MIME Type for exported file. This will only have an effect if the original document is file type that needs to be exported (i.e. Google Docs / Sheets / Slides files)", - "key": "mime_type", - "order": 4, - "primary": true, - "required": false - }, - "ph": { - "data_type": "ph", - "default": null, - "key": "ph", - "order": 3, - "required": false - } - }, - "product_name": "Google Drive", - "product_vendor": "Google", - "targets": "6", - "type": "devops" - } - ], - "attrs": { - ".action": { - "text": "Get File from GDrive" - }, - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".message": { - "opacity": 0, - "ref-x": 5, - "ref-y": 105, - "text": "Configuring now" - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - ".title": { - "text": "Investigate" - }, - "g.approver image": { - "opacity": 1 - }, - "g.code image": { - "opacity": 1 - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "xlink:href": "/inc/coa/img/block_icon_investigate.svg" - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1, - "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" - }, - "g.timer image": { - "opacity": 1 - } - }, - "block_code": "def Get_File_from_GDrive(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('Get_File_from_GDrive() called')\n\n # collect data for 'Get_File_from_GDrive' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.doc_id', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'Get_File_from_GDrive' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'id': container_item[0],\n 'ph': \"\",\n 'email': \"\",\n 'file_name': \"\",\n 'mime_type': \"\",\n 'download_file': True,\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['google-gdrive'], callback=VT_Lookup, name=\"Get_File_from_GDrive\")\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": true, - "color": "", - "connected_to_start": true, - "connection_name": "", - "connection_type": "", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "Get File from GDrive", - "delay": 0, - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "98529e71-c430-4ef1-98b8-8f111235014c", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 44, - "line_start": 18, - "message": "Configuring now", - "name": "get file", - "notes": "Gets file from Google Drive", - "number": 2, - "order": 2, - "outPorts": [ - "out" - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 260, - "y": 80 - }, - "previous_function": "", - "previous_name": "Get_File_from_GDrive", - "required_params": { - "id": true - }, - "reviewer": "", - "show_number": true, - "size": { - "height": 100, - "width": 180 - }, - "state": "app_action_assets", - "status": "", - "title": "Investigate", - "type": "coa.Action", - "warn": false, - "z": 47 - }, - { - "active": false, - "angle": 0, - "attrs": { - ".background": { - "fill": "#000000", - "stroke": "#637282", - "transform": "rotate(45 30 70)" - }, - ".inPorts>.port-0>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".number": { - "text": 2 - }, - ".outPorts>.port-0": { - "port": { - "id": "out-1", - "type": "out" - }, - "ref-x": 83, - "ref-y": 40 - }, - ".outPorts>.port-0>.port-body": { - "port": { - "id": "out-1", - "type": "out" - } - }, - ".outPorts>.port-1": { - "port": { - "id": "out-2", - "type": "out" - }, - "ref-x": 41, - "ref-y": 82 - }, - ".outPorts>.port-1>.port-body": { - "port": { - "id": "out-2", - "type": "out" - } - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1, - "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" - } - }, - "block_code": "def VT_Lookup_Error_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('VT_Lookup_Error_Handling() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"VT_Lookup:action_result.status\", \"==\", \"failed\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n Prompt_for_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": false, - "connected_to_start": true, - "connection_name": "VT Lookup", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "VT Lookup Error Handling", - "description": "", - "hasElse": true, - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "3443bcb9-197b-40ff-b430-a228726bd34c", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 87, - "line_start": 67, - "name": "decision", - "notes": "If Virus Total does not have results, should we upload file?", - "number": 2, - "order": 4, - "outPorts": [ - "out-1", - "out-2" - ], - "outputs": [ - { - "conditions": [ - { - "comparison": "==", - "data_type": "", - "param": "VT_Lookup:action_result.status", - "value": "failed" - } - ], - "display": "If", - "logic": "and", - "type": "if" - }, - { - "conditions": [ - { - "comparison": "==", - "data_type": "", - "param": "", - "value": "" - } - ], - "display": "Else", - "logic": "and", - "type": "else" - } - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 780, - "y": 40 - }, - "previous_function": "", - "previous_name": "VT_Lookup_Error_Handling", - "show_number": true, - "size": { - "height": 82, - "width": 82 - }, - "state": "decision", - "status": "", - "type": "coa.Decision", - "warn": "", - "z": 48 - }, - { - "active": false, - "angle": 0, - "approver": "Administrator", - "approver_display": "Administrator", - "attrs": { - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".number": { - "text": 1 - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1, - "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" - } - }, - "block_code": "def Prompt_for_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('Prompt_for_Upload() called')\n \n # set user and message variables for phantom.prompt call\n user = \"Administrator\"\n message = \"\"\"Should this file be uploaded to VirusTotal?\"\"\"\n\n #responses:\n response_types = [\n {\n \"prompt\": \"\",\n \"options\": {\n \"type\": \"list\",\n \"choices\": [\n \"Yes\",\n \"No\",\n ]\n },\n },\n ]\n\n phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"Prompt_for_Upload\", separator=\", \", response_types=response_types, callback=Prompt_Handling)\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": true, - "connected_to_start": true, - "connection_name": "VT Lookup", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "Prompt for Upload", - "delimiter": ", ", - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "a83e5122-6184-4296-8a39-c22d30ba0da1", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 112, - "line_start": 87, - "message": "Should this file be uploaded to VirusTotal?", - "name": "prompt", - "notes": "Ask Admin if file can be uploaded to virustotal", - "number": 1, - "order": 5, - "outPorts": [ - "out" - ], - "parameters": [], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 920, - "y": 40 - }, - "previous_function": "", - "previous_name": "Prompt_for_Upload", - "respond_in": "30", - "response_key": "Message", - "response_options": [], - "response_type": "list", - "responses": [ - { - "response_key": "Yes/No", - "response_options": [ - "Yes", - "No" - ], - "response_prompt": "", - "response_type": "list" - } - ], - "show_number": true, - "size": { - "height": 80, - "width": 80 - }, - "state": "prompt", - "status": "", - "type": "coa.Prompt", - "warn": false, - "z": 49 - }, - { - "attrs": { - ".connection": { - "stroke": "#818D99", - "stroke-width": 2 - }, - ".marker-target": { - "d": "M 10 0 L 0 5 L 10 10 z", - "fill": "#818D99", - "stroke": "#818D99" - } - }, - "connector": { - "args": { - "radius": 5 - }, - "name": "rounded" - }, - "endDirections": [ - "left" - ], - "id": "108ec0ac-b84e-4df4-9ae2-d7200403238f", - "router": { - "name": "metro" - }, - "source": { - "id": "d709a2f0-7ec6-45d3-b716-79fdc105d9ff", - "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" - }, - "startDirections": [ - "right" - ], - "target": { - "id": "ad2c97ef-664b-4275-8667-7ce0ffe822bf", - "selector": ".port-body[type=\"input\"]" - }, - "type": "link", - "z": 51 - }, - { - "action": "geolocate ip", - "action_type": "investigate", - "active": false, - "active_keys": {}, - "active_values": { - "ip": "ip_reputation_1:artifact:*.cef.src_ip" - }, - "angle": 0, - "app": "MaxMind", - "appid": "c566e153-3118-4033-abda-14dd9748c91a", - "approver": "", - "assets": [ - { - "action": "geolocate ip", - "actions": [ - "geolocate ip", - "test connectivity" - ], - "active": true, - "app_name": "MaxMind", - "app_version": "2.0.23", - "appid": "c566e153-3118-4033-abda-14dd9748c91a", - "asset_name": "maxmind", - "config_type": "asset", - "count": 0, - "fields": { - "ip": "ip_reputation_1:artifact:*.cef.src_ip" - }, - "has_app": true, - "id": 2, - "loaded": false, - "missing": false, - "name": "maxmind", - "output": [ - { - "data_path": "action_result.status", - "data_type": "string", - "example_values": [ - "success", - "failed" - ] - }, - { - "data_path": "action_result.data.*.continent_name", - "data_type": "string", - "example_values": [ - "Asia" - ] - }, - { - "data_path": "action_result.data.*.country_iso_code", - "data_type": "string", - "example_values": [ - "IN" - ] - }, - { - "data_path": "action_result.data.*.country_name", - "data_type": "string", - "example_values": [ - "India" - ], - "map_info": "Country" - }, - { - "data_path": "action_result.data.*.latitude", - "data_type": "numeric", - "example_values": [ - 23.0333 - ], - "map_info": "latitude" - }, - { - "data_path": "action_result.data.*.longitude", - "data_type": "numeric", - "example_values": [ - 72.6167 - ], - "map_info": "longitude" - }, - { - "contains": [ - "ip" - ], - "data_path": "action_result.parameter.ip", - "data_type": "string", - "example_values": [ - "203.88.139.34" - ], - "map_info": "IP Address" - }, - { - "contains": [ - "ip" - ], - "data_path": "action_result.parameter.ip", - "data_type": "string", - "example_values": [ - "203.88.139.34" - ], - "map_info": "name" - }, - { - "data_path": "action_result.data.*.city_name", - "data_type": "string", - "example_values": [ - "Ahmedabad" - ], - "map_info": "City" - }, - { - "data_path": "action_result.data.*.postal_code", - "data_type": "string", - "example_values": [ - "380007" - ], - "map_info": "Postal Code" - }, - { - "data_path": "action_result.data.*.as_org", - "data_type": "string", - "map_info": "Organization" - }, - { - "data_path": "action_result.data.*.state_iso_code", - "data_type": "string", - "example_values": [ - "GJ" - ] - }, - { - "data_path": "action_result.data.*.state_name", - "data_type": "string", - "example_values": [ - "Gujarat" - ], - "map_info": "State/Province" - }, - { - "data_path": "action_result.data.*.time_zone", - "data_type": "string", - "example_values": [ - "Asia/Kolkata" - ] - }, - { - "data_path": "action_result.summary.city", - "data_type": "string", - "example_values": [ - "Ahmedabad" - ] - }, - { - "data_path": "action_result.summary.state", - "data_type": "string", - "example_values": [ - "GJ" - ] - }, - { - "data_path": "action_result.summary.country", - "data_type": "string", - "example_values": [ - "India" - ] - }, - { - "data_path": "action_result.message", - "data_type": "string", - "example_values": [ - "City: Ahmedabad, State: GJ, Country: India" - ] - }, - { - "data_path": "summary.total_objects", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_objects_successful", - "data_type": "numeric", - "example_values": [ - 1 - ] - } - ], - "parameters": { - "ip": { - "allow_list": true, - "contains": [ - "ip" - ], - "data_type": "string", - "default": null, - "description": "IP to geolocate", - "key": "ip", - "primary": true, - "required": true - } - }, - "product_name": "GeoIP2", - "product_vendor": "MaxMind", - "targets": "2", - "type": "information" - } - ], - "attrs": { - ".action": { - "text": "geolocate ip" - }, - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".message": { - "opacity": 0, - "ref-x": 5, - "ref-y": 105, - "text": "Configuring now" - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - ".title": { - "text": "Investigate" - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "xlink:href": "/inc/coa/img/block_icon_investigate.svg" - }, - "g.notes": { - "display": "block" - } - }, - "block_code": "def geolocate_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('geolocate_ip_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'geolocate_ip_1' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['ip_reputation_1:artifact:*.cef.src_ip', 'ip_reputation_1:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'geolocate_ip_1' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'ip': inputs_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"geolocate ip\", parameters=parameters, assets=['maxmind'], name=\"geolocate_ip_1\", parent_action=action)\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": true, - "color": "", - "connected_to_start": true, - "connection_name": "ip reputation", - "connection_type": "action", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "", - "delay": 0, - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "ad2c97ef-664b-4275-8667-7ce0ffe822bf", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 199, - "line_start": 176, - "message": "Configuring now", - "name": "geolocate ip", - "notes": "", - "number": 1, - "order": 9, - "outPorts": [ - "out" - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 520, - "y": 240 - }, - "previous_function": "", - "previous_name": "geolocate_ip_1", - "required_params": { - "ip": true - }, - "reviewer": "", - "show_number": false, - "size": { - "height": 100, - "width": 180 - }, - "state": "app_action_assets", - "status": "", - "title": "Investigate", - "type": "coa.Action", - "warn": "", - "z": 53 - }, - { - "action": "ip reputation", - "action_type": "investigate", - "active": false, - "active_keys": {}, - "active_values": { - "ip": "artifact:*.cef.src_ip" - }, - "angle": 0, - "app": "VirusTotal", - "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", - "approver": "", - "assets": [ - { - "action": "ip reputation", - "actions": [ - "detonate file", - "test connectivity", - "file reputation", - "url reputation", - "domain reputation", - "ip reputation", - "get file", - "get report", - "detonate url" - ], - "active": true, - "app_name": "VirusTotal", - "app_version": "2.1.2", - "appid": "11f676a4-f3d4-4db0-8587-f4e942c07c7c", - "asset_name": "virustotal", - "config_type": "asset", - "count": 0, - "fields": { - "ip": "artifact:*.cef.src_ip" - }, - "has_app": true, - "id": 7, - "loaded": false, - "missing": false, - "name": "virustotal", - "output": [ - { - "data_path": "action_result.status", - "data_type": "string", - "example_values": [ - "success", - "failed" - ] - }, - { - "column_name": "IP", - "column_order": 0, - "contains": [ - "ip", - "ipv6" - ], - "data_path": "action_result.parameter.ip", - "data_type": "string", - "example_values": [ - "8.8.8.8" - ] - }, - { - "column_name": "As Owner", - "column_order": 1, - "data_path": "action_result.data.*.as_owner", - "data_type": "string", - "example_values": [ - "Test Inc." - ] - }, - { - "column_name": "ASN", - "column_order": 2, - "data_path": "action_result.data.*.asn", - "data_type": "numeric", - "example_values": [ - 15169 - ] - }, - { - "data_path": "action_result.data.*.continent", - "data_type": "string", - "example_values": [ - "NA" - ] - }, - { - "column_name": "Country", - "column_order": 3, - "data_path": "action_result.data.*.country", - "data_type": "string", - "example_values": [ - "US" - ] - }, - { - "data_path": "action_result.data.*.detected_communicating_samples.*.date", - "data_type": "string", - "example_values": [ - "2019-02-01 08:27:02" - ] - }, - { - "data_path": "action_result.data.*.detected_communicating_samples.*.positives", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.detected_communicating_samples.*.sha256", - "data_type": "string", - "example_values": [ - "95aea1163cd742d895f048de9b7f7ae83149ba2515b174dc6d5cfd910cb07ee3" - ] - }, - { - "data_path": "action_result.data.*.detected_communicating_samples.*.total", - "data_type": "numeric", - "example_values": [ - 61 - ] - }, - { - "data_path": "action_result.data.*.detected_downloaded_samples.*.date", - "data_type": "string", - "example_values": [ - "2017-09-28 14:00:34" - ] - }, - { - "data_path": "action_result.data.*.detected_downloaded_samples.*.positives", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.detected_downloaded_samples.*.sha256", - "data_type": "string", - "example_values": [ - "2b977b6342a624097b669fd2347ffbcbdc8a814369b5f431835793dbaa2251c8" - ] - }, - { - "data_path": "action_result.data.*.detected_downloaded_samples.*.total", - "data_type": "numeric", - "example_values": [ - 57 - ] - }, - { - "data_path": "action_result.data.*.detected_referrer_samples.*.date", - "data_type": "string", - "example_values": [ - "2018-02-14 12:35:57" - ] - }, - { - "data_path": "action_result.data.*.detected_referrer_samples.*.positives", - "data_type": "numeric", - "example_values": [ - 25 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.detected_referrer_samples.*.sha256", - "data_type": "string", - "example_values": [ - "6c16bbddc9dcbf447c44afb11387115ac657852fcdf30cf068cf6e11e8786212" - ] - }, - { - "data_path": "action_result.data.*.detected_referrer_samples.*.total", - "data_type": "numeric", - "example_values": [ - 70 - ] - }, - { - "data_path": "action_result.data.*.detected_urls.*.positives", - "data_type": "numeric", - "example_values": [ - 9 - ] - }, - { - "data_path": "action_result.data.*.detected_urls.*.scan_date", - "data_type": "string", - "example_values": [ - "2019-02-01 07:31:41" - ] - }, - { - "data_path": "action_result.data.*.detected_urls.*.total", - "data_type": "numeric", - "example_values": [ - 67 - ] - }, - { - "contains": [ - "url", - "file name" - ], - "data_path": "action_result.data.*.detected_urls.*.url", - "data_type": "string", - "example_values": [ - "http://vanmaulop10.com/now/index.php?mail=" - ] - }, - { - "data_path": "action_result.data.*.network", - "data_type": "string", - "example_values": [ - "8.8.8.0/24" - ] - }, - { - "contains": [ - "host name" - ], - "data_path": "action_result.data.*.resolutions.*.hostname", - "data_type": "string", - "example_values": [ - "*.o365answers.com" - ] - }, - { - "data_path": "action_result.data.*.resolutions.*.last_resolved", - "data_type": "string", - "example_values": [ - "2015-12-10 00:00:00" - ] - }, - { - "data_path": "action_result.data.*.response_code", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "action_result.data.*.undetected_communicating_samples.*.date", - "data_type": "string", - "example_values": [ - "2019-02-01 09:03:52" - ] - }, - { - "data_path": "action_result.data.*.undetected_communicating_samples.*.positives", - "data_type": "numeric", - "example_values": [ - 0 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.undetected_communicating_samples.*.sha256", - "data_type": "string", - "example_values": [ - "414296de0c223c28910d99797701d4fa192208f4e30c32b0dc07da7602d7a4fb" - ] - }, - { - "data_path": "action_result.data.*.undetected_communicating_samples.*.total", - "data_type": "numeric", - "example_values": [ - 57 - ] - }, - { - "data_path": "action_result.data.*.undetected_downloaded_samples.*.date", - "data_type": "string", - "example_values": [ - "2019-01-30 20:23:21" - ] - }, - { - "data_path": "action_result.data.*.undetected_downloaded_samples.*.positives", - "data_type": "numeric", - "example_values": [ - 0 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.undetected_downloaded_samples.*.sha256", - "data_type": "string", - "example_values": [ - "23926e9185d8d43c02807a838ffb373cc1977726094a4e46807c66ada9dd7660" - ] - }, - { - "data_path": "action_result.data.*.undetected_downloaded_samples.*.total", - "data_type": "numeric", - "example_values": [ - 71 - ] - }, - { - "data_path": "action_result.data.*.undetected_referrer_samples.*.positives", - "data_type": "numeric", - "example_values": [ - 0 - ] - }, - { - "contains": [ - "sha256" - ], - "data_path": "action_result.data.*.undetected_referrer_samples.*.sha256", - "data_type": "string", - "example_values": [ - "01e110d94eec3ec8abed7c9bb34fd7bcc3bd06c397ec83676431fc193be3b68e" - ] - }, - { - "data_path": "action_result.data.*.undetected_referrer_samples.*.total", - "data_type": "numeric", - "example_values": [ - 55 - ] - }, - { - "data_path": "action_result.data.*.undetected_urls.*", - "data_type": "string", - "example_values": [ - "2018-10-01 03:53:53" - ] - }, - { - "data_path": "action_result.data.*.verbose_msg", - "data_type": "string", - "example_values": [ - "IP address in dataset" - ] - }, - { - "data_path": "action_result.summary.communicating_samples", - "data_type": "numeric", - "example_values": [ - 100 - ] - }, - { - "data_path": "action_result.summary.detected_urls", - "data_type": "numeric", - "example_values": [ - 100 - ] - }, - { - "data_path": "action_result.summary.downloaded_samples", - "data_type": "numeric", - "example_values": [ - 11 - ] - }, - { - "data_path": "action_result.message", - "data_type": "string", - "example_values": [ - "Downloaded samples: 11, Detected urls: 100, Communicating samples: 100" - ] - }, - { - "data_path": "summary.total_objects", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_objects_successful", - "data_type": "numeric", - "example_values": [ - 1 - ] - }, - { - "data_path": "summary.total_positives", - "data_type": "numeric", - "example_values": [ - 0 - ] - } - ], - "parameters": { - "ip": { - "contains": [ - "ip", - "ipv6" - ], - "data_type": "string", - "default": null, - "description": "IP to query", - "key": "ip", - "order": 0, - "primary": true, - "required": true - } - }, - "product_name": "VirusTotal", - "product_vendor": "VirusTotal", - "targets": "7", - "type": "reputation" - } - ], - "attrs": { - ".action": { - "text": "ip reputation" - }, - ".background": { - "fill": "#000000", - "stroke": "#5C6773" - }, - ".color-band": { - "fill": "#3C444D" - }, - ".inPorts>.port-in": { - "ref": ".background", - "ref-x": 0.5 - }, - ".inPorts>.port-in>.port-body": { - "port": { - "id": "in", - "type": "in" - } - }, - ".message": { - "opacity": 0, - "ref-x": 5, - "ref-y": 105, - "text": "Configuring now" - }, - ".outPorts>.port-out": { - "ref": ".background", - "ref-x": 0.5 - }, - ".outPorts>.port-out>.port-body": { - "port": { - "id": "out", - "type": "out" - } - }, - ".title": { - "text": "Investigate" - }, - "g.approver image": { - "opacity": 1 - }, - "g.code image": { - "opacity": 1 - }, - "g.delete": { - "display": "none" - }, - "g.error": { - "opacity": 0 - }, - "g.icon image": { - "xlink:href": "/inc/coa/img/block_icon_investigate.svg" - }, - "g.notes": { - "display": "block" - }, - "g.notes image": { - "opacity": 1 - }, - "g.timer image": { - "opacity": 1 - } - }, - "block_code": "def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('ip_reputation_1() called')\n\n # collect data for 'ip_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.src_ip', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'ip_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'ip': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"ip reputation\", parameters=parameters, assets=['virustotal'], callback=geolocate_ip_1, name=\"ip_reputation_1\")\n\n return", - "callback_code": "", - "callback_start": 1, - "callsback": true, - "color": "", - "connected_to_start": true, - "connection_name": "", - "connection_type": "", - "custom_callback": "", - "custom_code": "", - "custom_join": "", - "custom_name": "", - "delay": 0, - "description": "", - "has_custom": false, - "has_custom_block": false, - "has_custom_callback": false, - "has_custom_join": false, - "id": "d709a2f0-7ec6-45d3-b716-79fdc105d9ff", - "inPorts": [ - "in" - ], - "join_code": "", - "join_optional": [], - "join_start": 1, - "line_end": 176, - "line_start": 155, - "message": "Configuring now", - "name": "ip reputation", - "notes": "", - "number": 1, - "order": 8, - "outPorts": [ - "out" - ], - "ports": { - "groups": { - "in": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "left" - } - }, - "position": { - "name": "left" - } - }, - "out": { - "attrs": { - ".port-body": { - "fill": "#fff", - "magnet": true, - "r": 10, - "stroke": "#000" - }, - ".port-label": { - "fill": "#000" - } - }, - "label": { - "position": { - "args": { - "y": 10 - }, - "name": "right" - } - }, - "position": { - "name": "right" - } - } - } - }, - "position": { - "x": 260, - "y": 240 - }, - "previous_function": "", - "previous_name": "ip_reputation_1", - "required_params": { - "ip": true - }, - "reviewer": "", - "show_number": false, - "size": { - "height": 100, - "width": 180 - }, - "state": "app_action_assets", - "status": "", - "title": "Investigate", - "type": "coa.Action", - "warn": false, - "z": 54 - } - ] - }, - "notes": "" - }, - "python_version": "3", - "schema": 4, - "version": "4.10.6.61906" - }, - "create_time": "2021-09-14T21:01:12.409927+00:00", - "draft_mode": false, - "labels": [ - "events" - ], - "tags": [] -} \ No newline at end of file diff --git a/playbooks/GSuite_DevSecOps.png b/playbooks/GSuite_DevSecOps.png deleted file mode 100644 index 46a1bc362c89a507dd5aa3bd151949f1400873b0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 239611 zcmeFZ2{hDi-#;$dN|DRhRT**F~k_cAlpzxc4ito zQ^eSJ#$fn=#(jV9<@ulc{CqpldG7l;=Wz~mnVHY^`Mj^|y}aJr_3W0uCeu;Qqf}H> zOj40OOdxLfTxR8+@YA?oV4wA9skZ+XBRA#M&-R5zc+o6?&Zwy>vL zym|Gio0|32iGY*Yrh?~DRMdB9xy~QC7oChuEI97pLgC$W0|3Sb0KAET2|2{i+Qo&$;%qDalP2 zy{WEr(->vazO_u({qp?93%Xl$+jVW*TvWH$Ou5-C_s;GWy>H<7=10Xle!lZZo1Z_6 z+~J2s1g&fm6$@Lyi#*Z^TCs35)1!wU`IS*S2`=l?cHSDxIh4}qC)=2K=vJ0TB}Rlw zdO;0T`Y@5!Us_pxPGs^$Bb9UX!>bSZf32K1X;i)-4lAKfRCi;Xzr@nu_t3Y=H`P3J zyzBHB!K3ua$16pLZZopBT&x_P-gAQNR{WZ1r4Kf1&|uT%8)G9iaE`VnorTvMJ*{p$ zBU$_$tUfF}COmtbN}IKn?@ips2UdfoC+mlgJxwDGzY=&F#e4iDq3Jqe?M%{piQ|p; z%QCUoNvYSLuAjHQ`0DZH4{owL{LP4ZcHt`I!XW3M8 zZVTw@hP|aOb_f%Yr?X{xnr1J5<<`opH{NjNmNa+JR{lI%E8nA7&RFdZr)4!yWF4z*IW7PDF!_kv( zJZ||%o0|092$p&pkNzw5_OF<(Bdyl0mh|OM(0x)pTJn(UYQA)Y)EzpF#-(Jcqn|Ta zjy!a8wqC0LKy^x$oOm9&GQ)6%UW1X&@z=v#7DAZ7E5^l%!=;Vtqi;T+{J=_XP~?z3 z_fn2S_UmR{AG1px#O&5dB<34E=!y)z=(Bf?EVeX~FP$T~#twbrImc9__OWto^i$W} zbNIO<21lTeG#|}A^7%5a_1+)D^ZqQ;;Q7$E`Rr%#ebg0CQqTEGEHDq8m+Gu%3gcTi zPX4&0IyG?EWg!0(oAJHfdUC}vbRegYVu{q5OU!)quc4u-dH0HbN;ba#uufdR-IOe8 z1l#ET7PC8mH_l+*{=g$ze53!++%ccCijgw+)*n9OZs7d*qMw!a9N5Z$&ZIB1Vl&Lo zgEwZ1XZMp(#&hk~RM%9+G!^0I6xoGz^QBqdyB>{7xvaXTPNp1G zr|_H;v$LXhKe)mrIzzD?k%7ZD!+1P?O^;*!$ioQ7``Z%GKfgiR=R2 zpT@2|gdNfQggy4~$VaMj2_DlQM|M5Lxg-4*UXvhk3dc}_ZP{D<@>DzS*!A7Yju?jM(?=oZy@!g((~deY5$xbal+wX-ay zja)}muf2A@cuwmE=C#Q6m)~9|eGAGyW&X^F*W#7SFVkNV9%tnvQRgdON8aRLp(8!A z6=1{Nh`R0Sb#W%Dq+39mHSM9}JHzg4UWckqiE1LcN1V9>&elG()*R|dbY`ZL@O~MV zbT9g?TvL;6v9!p^SliO#69vZ*UtEecHdBji=gl}aSoz1iQlBY)VLKbf|5GXGs4|yL zxakkYWrdxKA#9;feaCH%NQbk24*Q|=gQe+234`I0uaB;L@%eK8i{Ph31%}0E*Dpjk ztFMIzO2)s{OI5SHHmo|V<94~6mFHyO&5LgiwS@gLcz)@D7Ae~nqkwV8NMhLT(C3-z zS#=n77>nwP>gg588X$F{iG#Pxgk8G6Z+!#X3zvw?C$#e$@Qd@o_~hP*zgGMfd1)QDn=Lu*@Hj&k!CV2N01Su2b>M=(H-C8X{l)h-95FA$IP}Br>wNXH+>*TUJdc?> zGsj(|)@9d4qclo$XnQcuBorLwGI(V0Ft~`$szECv>vP}RtlN3Fb06FokH2h=)sBVB z-!8pXs=NAd@=}MGXh}jDyTuEHj0NJ(?8ja`KC{zPm9v*-^{|NV zitqb6>reL{JIz;tJ+MLYi6N65XZn>n&O*gu*j1Qc%M!U^@$@^54UJ_Dsh8!PR?;() zvXaN;5>6LMDc>7*_#$!SN{g&H)Z=?LHqM>%uFw@LXh8cKtzk@y?c|lVB>tokM-4|- zM~_lbN2Fu$r0k^DE*ntj~6-rEITgI<+=EGr{Rbc2+Kl^ePt+=>QR=WFIY=4AV=$~EUfbB{OTHxkd@ zqBo#_-9Q&v&iaT|nXi#AUt`!STcPAE<5}0UJPMMj@6#sbaf-E^5cw<6U(a7VX@q!h z-0$=roeb)`(R>Nxkgk)}#$_64n(hjpm61!fcsq2qg07-(;rIeIF>0YgY3f`Sh&=%1 z7qq;#5*N@L;1ggT01reGtEQ2&+=SZ3?E>b{{QXYR2C-e5HU{`0JQ*EIlHZ!xoL>o4 zZgq^i`@Q^j47r0`xofdAbolL|=|d@p2M>2pSB4pf#e|E5Z>kMNq!-Vb4HS$Nn11g3 zjQOGdnWrB;XFfN{B63kF`(n0?5x=w`>cX1ZTYobXGd(lkPnw%AmnIpmT{mic{xs#R z-SHU1j_K&N=c#P|SDtgmvlz3k3k)iQIY+K?a&yZE;HCm4O(e(OZke&PJ+op9RO!6z zu00I1dulhgMWU;@izc@*42e+diR(BWv!#pQ+vbCLHzH5#s zQFt8o<;uOpr=s~RwVl!5M&rom`DL9n^+VmY7ezfThv|+FAbb^LfMH|Zijk!8nY$vZypdxzYs@ig#EJR<(N$G)**4j7`Xy&=mGp-U)R0+1iZID9X3!u(T@K8cEi2?ToKX zgo1U8nc&smLr?DQB}@y-x_#MUPqAxtck1K0VHBbj!XOl9ey1taz~d0yDuj`tlE z<&R)_h>}8~A?;!C$Mxy*Ur?uzk0*}xt=YilVg~UZ_1miRYKVwg<{sww@8`X-vsJT? z*XNn?n4pn-%oWmGGUv8BrYpGh9QEQg*P=xfwdJdRIPVpIu>*CynJgSPZ|14cb*T)r zoqOiW-<;|OV)LGvoBoL9@BG+#R&h48d^&ZpvVlv$+;RG_3)|pe;Q~84t?%nX@d$Sjyl5LQ;_tfT)2vAJ6$L#2 zF^>{z7q@R=T)V4Rvxv=78F!RHvng9iYn3}MMiQHfZrd!b6V{13pYANw7g5o1B_|!J zPvNHOzH=zE!IR4&bw%VV@6(kXg@^T_Us_kk9{N$=VpRMJQ>s4mF!-Z6hnjo;sk)_S zYE<5yTrNVd9jYpYDnBe;ygoI*80vbADv$M{IA(Vj%|s^Klz+YpJKU{w!=KKWfi?Y% zY@|T;GC~r^V?ejA|2Q5pw?|7y_v)0!x8xz7IW$G4flnTP)v)3^bjQK=cKYiR+mhISqf4(^`LFfW~(reeSwNABM=_oSj?zeM>x zq;=;a@TiCSAx36iW_r2`b}*>eJ$sm~gP0%mK4l&%B|imV2zBtf$Lj}mbN5v616|nv zh5|6Aye)o#cmFG1uAmEMdbfDhVIB^=vSJcq5*L(@^78U3dDuHD+_|pt*UN$bKo^|7 zyzVQAi~IWeiup>3!91MACFSMi#U-wYU%4U*d_&aJ-`(q;pQyVh-(M#AW1i~{o^~FP z`(6;3J1=G4d$urdFVKYxlpFo+=P%Fc;0O8po!mYDN)|w%IOP*@NihlWzs(I?sziBL z;TFWt!Oi?S1PZJfa1UikNvSJJ`xpHGKKlDD|KU=zzh5dPEqV1HFa3v){_Ca2o(>-B zFeq?SFXg{)*k3RH#}EH{p^`X-_J3H5zby3ryTD2-A5{|n+pZ}e&2kx`Y~@+Vbps>d z6<{;U549}tN8m57z?fPiLMH@qnTkr4O6$6sk>8=Y5&Bea<68QqSU1@t7r#FeQ_haK zuo)zK>eb~5!5a$H7oJ|=KE!rIBqrw+(+39T>#B!X<0i9&t!`aUetJhV?iMX}2(4(k zC{a34Tj@&-m6NN+`)B-0_nd4G?F=GZ{u!*iy?RVX(Azkqqc5w})1I@o`x>P2X=kf# z6()7S6SFpLh+TtVCugeysw>wwE}xX@lxr%k5DE&6eRhVxHQsN*hOTXCe7PF+U=Dc{ zKWcB=L~6RaVe%LTyCOLrWOp_Y@ufm8>FoowWOS|Z&!H6E_N(~Q&7=8C^Lm#ZQ(-Ud zV8)yOj%h_q&X`QM6Ekt&Zf9ZNO4?z8*E^=Brpcf{pJWC9JIPlZJRTsS*z(a{^ig!s z3u-j;ji^moydT!~2Ks-&Xe0c`&}B8mZOBg%XPFfnHH5t9B+9?LHDG-2Q_XEj#$l3j z%}>^mF)mSXVROYC>&W>3mQj!Ei%es}x7Uz&kDIdRq!ddsai~^z6T@8nXMRmfoV{H7 zV4-gnjjW?T|M!hB5P&vKO-;_8fh2_|zD7Lx2!wD)s*F@evb@x<^I0#`xYTnyY&!kLB!N!Ni`D?-x0`_h%#>_8t@e8>z`!zvc$jHyGhwOu=a+B)mi3veEGSOt zB22_@Z2>Sxx9K4@1iG~{`cLoQUuX_fe^^v9w{ zXsC9(bk}GzU;E8fRJEa{L2d~V6n>YL>7pKH;xhf?&prCxRYV_U0IwT&djAG1t6DI6 zd3j~Wo0v<9mbH68etqbH*7l;s+?&=Q(_f!;!E-bGq&w0<)kO}RRnboBx=aRR0}{B0 zdZ$pF5-xHVeq-C{w0Rke3${DgvHdqVxIS2P_HFA1kjvKU7Z+U2`=2|_%}$(|J!7ob zEu?*i`!^Of6G~%ZPDVl=%hkc5y;3ZU{*y%paQ@w$$b{kNP9nlxW?dg#!cA_!nfV>I zhw?3rGRf-jX-2uHtRHK<=BS&Iuz)7#{P)cL@uwq?drH}{U)S8Lr;`(gqyHP8m-pL= zZ6Uvvmn_c4EE2X*b0#%}fR^_k{QoC-Caj#5<=FFJHYI-zKy}>^$XELvk#WAJD)He+ z0bS0D8&%#jL8X*>&iXtb6sM|N#cy$whU%+Jy-ECC42Kl|@0tEJN7MaBuG8Jj2oad| zgU4&H_eO=Hcq;67AI9<<=8|>j1ckomVJ5WZbeK{$v0$WpKL}4Q^v#Ji*mO}>3MCIo zLAruBV9xHaSn$Na5ILEf1Lb1U9`rkUY@U|x%4t+(A;LReF0)B($hxI`$r@!5Om5B@T`+V4|?HvoMRe+`iH~n+=i727Bu^d-3JN9&M=Ity$Bew!*rFs##1eadhZ@ z+Jo^XII?_D2wJn;1X;(K8ia0PGcX-;cuVB!45FyBv~zcRF++LtGjk4`iP?EFsVh|9 z)bhcNs;wCW!GABw&^P9|#@ zEOdJa(!eCAJKh{)@ItiQ4D9^w@f{~8r;zE!XD6{GZDJ|JS(#qzzrUE5jxVV1R)hmyp_tUcB!I8su&uq62$7k|*^E6IZWrex`AewEn-=JO6si zq8RLd=E4)LtNQYy=#a|0%Q3k;J3r_JhkEiyC7n7`QO)N9vtNj#{R$!6+}zX5p_}Sp zyC|7Sg}&e)KO=ecXA7&{TW8o}a?=BZkSL7y*LQceSK7o46c;|(K|~mnqBv!QK&$Oi z@MRMp8leeytMuO*cAAYWxN<`cu^XIdsrTni*^?U8>)k?(g0&li zuDFkPSiPEFp22ZDKUcJOAmr+$Bs4{Hr#N<{TcxJ!%TL64HL_~PHI;P62^wO)Fp4Yn zZ9d~qe~aGyDn2=$;#Q(nMVd@m-My4(`6gs7iw8a)qk`saZPm9|w2e9~`TkUQz^~Vu zm}J+&q)wH+9n>OvJE3#pYdF{8GsjA@jF;M6vpga|&Nz#2GkLjtZ`cdx&=u`hV2`fT zA_u2lKm`AUmH(^KysLKV>SE0*X3(`LO+5H9o5{_AqQRbT(I$BEf-m+E{n=a9*_=j$ z!Nd`)LC8w%j9GbvF}tnMf{)C-FOR(X??q1Zy*vj}s0Cyz?{sUx)VoMbHE^kmgfJs` zByh17f-LK8Eouq3d?8lloU9xi;63-~r2b7!o?x#sGDb%n4o?8*4|ZO&GM~TK@Wgm~ z(Z4GY0}EMAaS7Zb6Ahfw{T<8FaA%|(+bs`$oN4)i2ew%4k1c*1VX}VBB$As1mkwC_ z;I);O%>>*Up)r3Ne{H!UGX_5`YxTANQZy1l5y=as_bTf3Ez-pxt5x}<1@ znGZoCLpYartkwAprdc?*+3utqi{2wInhqg% zMTJhIc0Ag0L|&C_+P>JR`t?QWk-CFL3B!nxdcjRWSE`2*9i zQ_p;u>5!|vWtb)|=q*yTx9rwUy{^Dzcp_H3u)26U52FijkXbxXaEqKhxm-F3~=e)z|Cg%?6>20gn7}u)cbD5SQvq^C>jB-u1^FG!yT--BEnV51IRdc)C|xl8<33OPrtL zV25v#-+rm!@nf=VtvHk&qWg1*xrR<`Vu4g2E3vgjw^nzn%1b#&~}N z5tQYY@UEX^x1F769WoL1Ss4XpvwyZ^NfH%?uXZYDF&p4^E*XHxeJElGy=>^c3gLy# zi9KWASF^Iii|&t{Y&eQ>k+OOjDl6SV^i|-r-1J?YR-cmm#|19qI-)Yl^B+evF==&Z zehSbk`>7l}>fN>u-?`P7Di4k4aRFjgPK0mLRV#_ar>tq_?fEB4k`1+*^!2cN=u{li7|+kEH_xlxqaYuJC-XyiD$g9cf$?q1W<1ng2_o8&HF*>i4i z%=`Po=PcPj<#R6vF9u>k#9_nv-D!hRZA1||VBSb!4z=o;nLhj1ez2A8L@ zVsgrQ!HB^Tr;K1sB_Z7c>J(OFY-%L~BK?ZR)%OBBcc=OyvZmE#8VU<^t(s{SUa3SB zlxPDsId?@K>3*HYyksO1y*dvo56JT;!_s{Mw!W6hO_I^lgYwR0gayT1gAm&;w310i z;lTWOhIW_owq-^k(#nfCFPC#Bo_peb%+p0Dn?A252tT}{XtftJQTw<+JC<6Zu6jG6 z)lqN2-7$WrJGD^St_hW}x#67$WkqqyyLfR*Il6J04;+=)ej%%KPd`m5?@eLaa38^C z+Pin?&S)#Kp7<{QOOQogN>HdpTU#Pbs~+!kDSGKR{yyf88v5To`s}j=z3d#1B$h_< zr0Xj!KiZMs-6huLvYA>+E^=^nDXr>)Lr4>=?+zco%A4jtnS|Q~_A!~=CTMwQ*k=fu zSXi^tT4UpCUv2JC4aP;!RRMcdGH7M{>=K4iyyn(`v%~dyuhuVCFGNaij&^kx5i|DU zcbB>k3#MdnJEcC*Q26yqeMSCo&r^ny0^&vm{77#4RhBm7=s4;KUdPnh6I!>>*Qti6 zB@T-Q+ZK&%uLpHl))164v;ZZGPpPyotgNdXpKL9>Z%E)=TvTl&mKM35HYKep{rr9s z^Be|#2e!?;W-`#Rus5HU=lScK_N)z;j9!YuB|YShOJbH@xJee~i+Q)puexv(PobfZ zGG8FxZ$YB%r1nKKBTr5aDGU`{u|eNBgpYi$5tIU}ffQfB|3{3fxr0&|!BN_|sU9v0 zo0*3_UjitwrbG(o;$PSAH&@)8U#*L4LN7(oTcZm?XbA_y7PUa9HrHMVb4wRNLVo=NF>b!s>-&<;q26 zoM%zZiZ-X5yCq~))$0OKo?-&4$zw23Lzs2R<;&pnA0r(*Q9cl4-{dLW zB*PYO@(C-hdpqoz4)kbu=hHWeJS*?MX1AMmQzsr-H<=BIA1N3Vd~IS`zRoT)HWW0j z_kxY|A3REtqsR>@Jzxeh5^fS>9BzUj`i+M%fF0yUowK4a@`O~w5p!Wim|mKK3}|aA z3(_~@qm!j6o_g-n9$MPXtXxi4+X7l<*@>uHBMzAkFLF46IK^%8NRn=tn zbbOs6xY*9jrf-B@5$p{_ELqdi^6dOH*X66Kgv24e?b3)L#<^K_4I8K0p7#?0L2c)H zKd67V=x6}? z*I|G$bwrB&s^;FWVxF?{Re>O`RrF^AjJ6v1Vm1()P&q4X(QIJ#)i0hA#5!?qB2Ik6 z=SBCjR_x{6n1w3SOBZFbY`hn1CaR zArqln^F6g8rQ~W@og@>FY|V*A-S|vn?b4E+TZ};|R;JJp3mT-$i)F1p?>5m@t4gUM z+Q;Gy^|dt5KDgewLQvV0M;1460up}u12^(HQKVdDJ8n(XIWm(}OLm_?$)U5tc?pJo3f^E^2kmjYI@o6<0 z1oA?Z$efg`&*Hr_3L!+G=#>@c@ z9j7_g1yPvVDerl$$gnQtOUwCp8P>2{S9|h#+f)PC&pDyxIE=cG6~juw3#Ig?KGCi3 z)nR9y(mX?|ruY+UB_-;SCjJ_rCz-}^*$RK&G0Z#^<``kZpXPOEYloncVcO|~1P8C< zRzr%H8&4W!Q=$kw3P7|0E7^S3aNZz8xwhm*_qUzlCtU7t-RsC3fL(PfX}LT-nF1^H zHuSNo9Z7aMS*mKxp57V_cz@E+kDuwL2b?nW($dn(1mRtwJL5c%oy}#)#@qmW`9r5F zT?7sC{U~@F2QilTP>1hQKfYtc+0*m7a|gdFr1&-7_vx&t{rY!os20Tmq^Ro@ST}Oz zWdQGQ2EJ7fQ+LoIH-KmITBsyU#%F}?l2Ab02#BHZDFSYG+b?y%q4ibR+gU}BIc$Q8 zIoHsGXd*Ox18xug4?zB=&)^uqG*=;n&ZB6bQrX5U!Ozr`HoGceQ{XJum zz=y}IYq(q zuKp_3?tm}bu?>>31~{D}%rkk5K?KF=9}&#@;&nS7V2_qd2)o>jkN}0XZgs@G4SB|N zI)Z2CZW+1$Fmv`C3H)G<{~Km503e*r;{IgCUkDF?g<2%vpLr&4E9zFZtihEHL|%UY zMu?pwVBBvdFBkh$lUvHhwLMJAs@%@k$M9{JP3D%Fz|22fB?zyR@PZC}4O zi_tgfAzRa!{uKPqgN-#NivvkC`oAOUA~W{ z|3o|lP+SOa!d9xpy=xSlm_JT|9$=R|cs?;z-qVp&()PM{&{sB7-O#;lJYs$<+B|A5 zL8gz1>+F=lEBI%NUsxKX$8)tlXMp`x@LdaPh-2iU(7?;c&76rL1^akpsd2jb{8ROA zp=-C9{(P9RJCm~S1#awj!2sS}QM7-T2dx;9U37|S6RQ@P|JZPx)K5XnivsaX=lp(z z2@XN?eZ0KA;S&iKVtT1pi)G`QVt8!knR%3zcocs;Jd83ubh!R;^2NcAwpV4}< z0~Z|>O&l~Ooy*oRI=K{)Q9xt$72!JKwWvXMRQ{DmyS@3mI-%ie@0hRFe;w>8&CN76 z5Sd5C8bgDTD+Rd4Mc|E4S}TJ;Z-0_mrgXYpfEZGS@Z8#J#-0*4AfC99tdcG(p8+`P zIVIFPJy+T#7FD~m(gt6`Q6hFB+w+O;pME}}2xyLHr#ycYx1wy_Wk$a!E;+G9Uzif$ z08%1a`Ny4P$^k1Cq|Lqt4qE<-AR8KhWVro*y~g>JtM>w70Yj(?5KDrjdH1#yJ#zzc z4M0fkHLS4KrEH(6o%qxcKF7=*VCBZ?xAC06ud#vwY~ir4sQ?8feLpfTU`WuV3q;iA zu)MFPE>ofvIA3N;QA&Yn8INnrhuo_vmez&W6_c$+8dhAakwVt(ZsB$Tmc)pMlG=bk z+SD50M5*8p0b<{&ZT_@?O*1rHq@z%?JKwyR)+q!Lu0|$>bP7Am1a8csn)x>jx|E4Q zLuwVRQZs6_$oCg5Nl$ z#BqfWxrXp!AnYZ@eZT$?yf|H9(XUxC|2!hay(-Tu03L6mZJ@M#ol`l;4^q?H;)8AV zX-k%cf}sLyr7CI(jvOU79XLL=iOZ`1QR9+k9pcDd_uA%3gAG5ifRDy%31Mq5Wv2~l zeb!P_&_lrQoRH(5R5 zk^UQWzN=3eUCTjzWw*!{3GxQ40=#Z_y-2UlDPGZ=gJ|HIhaXv9*#DQ1`@XQ8ri}%hRP1VKPt^65IvDazv8?Y!dq4 zxY8iOU-AWhBLk?K=^M67V;)d6xa$N2(SDxUUf3S5q^N=yA$}&DvLZvFdArM7vwONj z3!BB#xd_B=;~|Bi{6(klEA!55m-3GP#!b6rsmVu5P#x-P_s#>Ey`{N^whx|Kp&`!juLm_ml!M@ml%ne_jtVprTYmBSfI9yn15U z#%k>8dg!PAx&(RVOp+J4+eP_vwdn5c6JcvZ zYmm+g)cCMIclpzHo5G;UEG)-ds1ad#N?fWgwnw`zf26yg&yA#G8AAT+)YQL3#bIHr zEcVa5CtIYh)kpu|GyUH>{fF?A-y&TK{B@Rw+=H*-D&CaZt%V_&OH0JkONaeps*dR2 zuXp;`Is?-at|5s+OVh*5zDb1!3xSpiDyUy3N_OV{O#vFlCsEJe7)AbhbHL)v6&4*G zjapFbGqB^ZDuDKWZ+-knEtqzxQmUz{L8(m^V+1`IQg5!u`GhT&TM&k?Eeo+|D`@= z%mykNsY!z($p_|%cAl`FEDr4#B2|7fr+Ws*sh_~-G*5C?cMroZBWJf z%*z-;(!SX$zi94^k+&#rhT$sJ}H|1k;KEtz>4< z!+y$r30*|}Q#P)aceDIPcm5x3AJ-kYeroS0@nV4*kmMYL6!tw6Y9TO;$~Nsp(CiPI z)G@AyX1O$Yg{y~hH|cnL1wU6D*RK~uAA0Joy@ZT7dH?zU;8)qD@$dxm^U#v7vXHee zjI>I%C-%3_jP~5-2xxj)lShcGwE6N3c1Ovto6)9wcl%zL<>FLNUe+roXX4`Ght_}> zB*s~$tp*dp*x*o7lfO^VT2UR35FQ_`9pY@3z%%1gy>kl)cxps*rU5`S1$Z?c=@1%f zahdt01!;|I8POYh4+A)X=|6-MhUV6mQH`G-d_51{S3=!c^|f_q(b}aQDO?79h7|v{ z|56KN=DQ%MGYucHyZx>VcK7odcdUXY`nA(rla?ze&-8mgA2-LXaP)E!(+WdEh0$q` zgBbC5@ggeH9`+6?Ic`pk8*R*GTHP*2;7>=_i|XD2z6o|xO?WnH+wO`lT;x7sTcSee zI|E*zC4F{je&CWz94yYh%X@QU?u1OMoOTI8At=!28RrDor2$WFG^qM|)JoKwxys}C zbgTCoBn_<%%Sc$4*zK&Ktc!t#4HZs_A8w;>zXA3A94giMF7SKPa$LlF<4I`LX!WRR z@Y)~1MUpv}CoE1a1q-+|R&dbZ%Ylp%Wb%&` zj;NQhZK#w}hi<83=gUyxLu^Pns$%^kXz%;f`pZnJ1%}};?$n2dL5Epp<9=As^Zz)7 zr)pHVwAuUl$kng^gI{HQzF5*$^tQa;F?Z(~Ez;xYesoQML8N^11f*qIXM)dMfVeQ^ z{$YVyN*ItZ^U@X1`R``8c0q+n<}khYG8sV@<6uN<#pRx41N3qskZgY*D#CW~cw`v* zXhCJCA|`OO?m%G+E2>pcn)1|{yu8lF_1zZ%+a9KN z9_SDeu+EA+=<^?y6*uVEtfL7XLdizT26flk$lL=rrFz{sI2Y{Ya-U$jxrS-#V zh?eOR#xBnGm^sRVsos4>S-usHxn;_K2U##6X8=4z$MYm0FdOy`fRQrN`0Cut0G)T) z0Xo}ZeWeFZl!Yk+T?XriIxbNZayT%p`Vu_Q9-!@*2e2z@yWyaN7kE3H0L@zFlB+_bt41Dx5=c=l^{N!6%`Ol8 z6DzBFH#6LXp68>@;Dc?b_66TzZv%z#K&M;+Kl&D@4Q#|4!@n^YTzIROS-j?In(yZu z@JiM+=7PQSwRO9gP95%m#-8bSDm%r4b-ObeIh~!IE`ei=;yEK5gW?&cu0byNm|QF0 zLG<8!{-bBIBQD!spDXb?Fz`LnO#jO>QrLu{IinQot>Mr*gX}clep#OFvEpX6aLLqb}==S{!S2~7~&TsBy# zG~HR#g!J5Knk4(nh!tAy)v0{q9r2p)S{+QZNw1o|_QzQO5A?Pch+TqK3OOeh6m}6d zx~|AF4Nj1YQHVPwO5R5tPSIB)Spe`JLh>Uvy?-J0CS*635%V#$Xb&j2*H>IDhCv25 zm&Y-16@?0E*`iLT`R*yl|V_UT6r2KTQN_EM?V6^hgN7O{5YzM)<+Iqf(fF>=NlAeXg$`09QtxaUb zv?I=v9@}AIp~P*MJySW$_{iraVWpk&DpqT;Z7Y@L<4@I@b%%od+JfA&I#k{$hc=#v z%!b*XC`T{B(th z?4n%X+Es3lUR(2JlWWjwlP|WwF$h|HHlF5!4Dkjt@COqzeL2|6LE<9;<2cgG{fZH< z)<-pa3%<2dX-j3|6F*Tq*WXEc_7Eoe@0zB(q3u&HpN%eaU-yhLn9JBT8DK;B ztgWTxr_Ii(TCZK>Ax*i%xsw8pf{`D0Jf`2T zc6BD+pPl!G+tr2Gj&^YlxEu5t`?TlJ53ha83e_Gc)EQ9+o7Wdqj3-tMr|YLJji9ia z6?*i+ld*6}QSC-Rvh~0XfQOqBn?nCcw^S|BJLOzTG`pZ82Nc^&+crL}0nUO_soKQE z&AZ?%fGWgqucv1+tc;Gr^wO_fBClq|Vy?tFG2V!{W%|_L5Jpf9W}&4msw4wqs3Y5 zWr;Wnwp$q@&QYvGD#fU;)&>Y2T(>!e0ab2nzR+YK4>sr@)8q@EL3{R$8z?1h0I5J_ z6_^1BWkn0?W*6|;S#>)q{(0%)CIc%4$ zZQy*CE5wa_ScdXHMwr2f^PxC0w230x6C8UVr4zgZR%Vq2hh#*z(e};4MK#Igc!#0|!!3J7Q`W;Y zPd)&m%@VwPE(H+n2r~e3u+&+`{0Yc$p?fCNn3(yU+jk@uy%s;744$cUN=rAfB8ie@ zYH1&?9MO|aW&%4*lzud2-)fB>4L8XEtvy7|M^@x_wuH3#+;8>q$ma&A&;|!0W%5S` zN}X~$gns7A$EUrmT6D&JTeW^L{TTA>5_?f^tItTQ3tNnv=+F)^fz<7zIG?n;JP1^m zxUR`L$Im;KOqe_K13EaOGpA* zo_`TuOp@-tJHPK}bW;Nwk3CapznpCqXzX`EuT;w)7*05=gqhGIdo6s^q<_YpT%q6l z`IsYjRqT_%q8#Sx=0h?jdI%P4Faj^(>s>u*^KF|9UAqK4a%0^5w>a)vT4YsZyVzEX z!*qdXXIEk%woJt!jZed9o0;6n?LvgvV5GI$>zxrVS|r*6!WR46S-FbCy)(gx(8_1e!vWO_L3ey&Ul-!mtW3 z3t`bKK5pKf;;>3k@cbq$VUj~J+~fumlzJHupXD4Oiax5}VPioh*X=Io9~g)Z>fcpk z08`4Ev7>r*^ZNZu$JTqx`q~?==jv@*Q*zFM0E^6SkqpFc z>WEcd_kI?-y)6X+l&B4~&aSp17nTteRF+0gpnY1xd)vp08BFOxz%4J-k;ewPFlBPX zmfRuuz|nYpg@t}hoOyg2vP1%VBhflN#1~J7dxE^T0Ko+^{@3o5jfeB>T}<0<;K5Zf z1&h@UmrRc_?#g8Ze($l-qV$9f`eiX2HRtFiC6^ES5O#uy8aCl3QT;x3G0I`@fDNCsdXSxOv~vw99(wspVVUIk=(Dw~~C&+L6NPSBI73%SlTKq&v@N z6@S$mz`4t}`vR(gIxf0&qWx*lA#7yIm_ZC^(#|;7((4K?7 zi=Y)=vjPo1`J)Q8S36F5`vgjeO~9*ah+Q9Y;&cfG zs&C)|?^B>U7?3lyZ5Pn#1IyM_iYfxg?&rJLF3$u#=rRa8KVQ;}_OE;0v}g4|3usi( z^`2>LU00OzC)X_W=yuN_nuGbs?@Q8qvNVj_M*UVrDL|-}4p~M23V=mJ(^aivMy56) zx4~XLH}YjdLiZx3KW3rh#7m2Ss;ByrHj%Vw`K@m=ofZv|4k`*@ruV6C*tte20Ei4SJ$ z{w1n%V*vV2xHRCpwt4&nC~~c1XP&E~hIpVOmK3rPySkdJQnNG`L@dw%%ID3eRWQtZ zL`Bm2-gX2dw#dDOC$Mn=rAq5x%l!J_Mk zc42b9Q<^k``=Wwj2*FHDTbu6MiCdiQCa)R#YRgQYkpY8h^tSpm)Yh=SBk^6n!{ zoCt3m?c)nEKoRReZRk!zDJI3l4BhMiD3;(!!|iMe;#ZJkJW5_$5yqxhFIvubrOHb| z%hxq^ysPMuRei#GgZ*#YPxtHQr3{5s9 ziJSuj%fZ{d@@KyE9KPC_ypk}4?Tg-XEZe!G6J?+iwQbt%_9c%$`!%1YN%IRuaByV_ zqv^&uPWj_SbGzO)mp=BADaC5mqB}+0*5R!Sw`w2f_-sv;`t0c+*#vZxGBb>9^MY6WG z`{LWFtx~;`T$3S#UV(SP^^`xUDVOhk*34E>-XZ|+ZgHWiCJ7w5H=3f6y+P}^(Cm4i z(NZIoS4Zqw0Xc<+0To-XN{dXea-3d^DAhNxYpP*QZ9QA^u>;V$R^;}r0WqNbw%ELN z(pROVav<8o{HE{T+0<1_JWE8>nlq&c6llWe^Y*zl9%8A`k$a$?;Cxu6H1iEH5xlBwOc zT5NZ<1`kxuR^wIp7bzu_R)IJ;WbMOkTrp6TGcVJ3(<%Ldw({a*4jXOYpsS8;bGvDH zf;OY5bd^FcR_yM;5jBKR44wg{3k19zP)8|#e|^viz=#_xxgR_(J7`RCtp`?}&gWwd zK=%qi8cWF{87$Uioa1Sq6jqMC`7UpJeVP^UE9NV@tRXQYK0+NSK&Q>%PMxnnltUVz zN}MtRLki`~!YtgY`O>^QNsups{MqZhR=Kj4Oy;2NIZr`GQOdajBz?nyM}meqImq%6 z`3wsRnv-$-`4}6YNEYz+@#)phNwf}-2a(on?vzUnw8G2jqaVJm^FOw)~nLi`h)!nND^lG5q^Sa=U&gHX?numRiJ^8kg-~e!h{x>aVG->+k1@oPO+%GL@Q-diq;rsn|-Q_qj+5R6_;$Z%j#Eo*9%nLYbG4h}fG_7MJUzl`dlH#bS^3VXX1R(d+!cUv@ z@fi#T`-yHReV+XC-4lD{Zm``yo!tmzAiaH}b+b6Y0#T=XlD-xQ?S1If!sZ(2VRQ9f zgpNIY-uoX^;_&wxi#*z|zG_Fo4n^?5eivH@`hqlKzub=~!Tm(w`u-Z|r@h%-ByhkB z<*gu-FQ*|uP;gx=14dwv3ypDA?X`$??%>Dwe(KF%L298UV_`L}|Ejb>P)EArKd8dR z{41>}(A6u?Xu%y+9}=ITc{WyG0YLPFT<)Du_DhAjuZ2}cm>6QCO!uT66wUQAWM%Xa zJ1)%)p(>~im4p7p)9a&ZzVbaUBXB?De%l>IK*sp=F>Z=?W zWf=n-;Hzr>H;pPXH^rU;3ZNS364OnV&I9d5j=H+80bz=;&lkE4yJwyt#E|ajo>4Vn zm7?L+#UJ4-ctx4RvwzuGS4&r8Qt!nvwpTpY zJ2Y7FB@uQTXz2dHil5|yfeXG>{5wX;#+I)lOpvU%<0%L(;KY=mv-e1Rq7i`7E2pu! z>s|vvJgazSWH9YN)z|p3!bqZplB){%{q|8(rDVNcbIeOp+_*;orBAxsHa;BOjiZpH5!b%o zOrs`@-`}j$Zj_Msd{n@>19L>T0WePpbyX@LZ|c_pik{Xu$51rOc}jNTk#)J|!Oshe z0!Wg1Z@=I9zyKy4-%se>1ximi-C*BW56S{mVIh=*EKhb%0E=<@0wr$r>qek1WgE{^ zwsEZlBy?cbbOuPuXT9V}*=E)5R^NRlq)P!f;BH`6`oW8p*9?JqG9HRilHn|r^HMK} z586>!oPola?-J*4ADG2e`2dol1d{gICfo#ln6l>*{ghPi5ZAiW!8srUn1@W`MF~(p zc}n4F|DJP{x)k-Bz&0|}y2SwDlLIakCqR&YB6HI|5uho55|!iK@w7@P z{8#GZ^MuUo^9{$OBqWZ-HuU~~%zbxUQ`@%g7C})&U{j^qQL3mE>4=JghzbcEgh-Jp z(jgF0u~34FfYKEKA%qfow*aA6Lno2miPQig@aDpOZhQ9}Iq$yr?)^vO4_qsA%rQs# z#u(qk=0qD0zzBqa)DlbyvDc=E67M^QYVp>YU&_!yZGV;j&1fv$0^1PwP!Mc`Y7Ee} z{JM)V(3$Q9OHL2v>eJi#E-29{%$DfP6it6eXD*t>a_gwf+v4-tx0m^HpO|@p*h%L? z^}RJ(i{?Q9`9>*Z#%*hG030Z^T|VbIv;QEGzc1{Ux9`-p@)QmVO8LwRAinb&b8kAZ zh1aO?@f|G14vR0EM+>FKt>>ccg||2VF#B6vpD2QA>M{MIYp32B zoL^jdyEWo2MSdl^U&SVJR7CEVy=XcCOr6QJ#rd7<^Lx6auHKU;9o*dpTVgC%MW(rS z!$prW8SXQZ<}h;s(mrr8z~>R%u-k4T`xaZ^uvVBEo2!tVtQm6Rk=iE6;70og*vj*X}G;i6fRzlS2ufUiPW7`;FY`T(%2O zN~{ywt#-AogKU8+Oz{;b#`;$p-co-QD|sblZVNLJYCZ{FhV2|NKJe*t_i}1Ybg7?Q zjq_&j{$bX<^oJi_K-OW31A-Q7U%t0C}Nq8v}E~j?dNS zhx|7Bl7 zK{3THBWr5M3Uf!5z9u8zF(bca9I;`&x6`XK5ys442pxh%z5ot24A0r)a4|1sYctme zjm6aOPQ(eBZLP3{I$#ifFknS?Xdr14XB@siG4R|9M|>^7yDd7YVVoZJgA&jm0lai+ zz(ZMH6^mcI*;q96@hxS7Q<^yOYii=3f79iFIM2RZud>;cXPbg zTTT(Oc90x)(f!l=mw4*texnFEUd|$;Eoo91p#Y^dDLuds3Zc6mK(%OkJI3=zZS%dF z)#pbTgq|~;bHdJBZ*T8IRRlQZyu;}`4+KuJPw?l73|v1{#9LXnE2oXEGVI8=E0Oh{ zu7D0;PwjSt{HG(WpkrmFWZY@_3rAl1?rYrJn|QSKQzBvL0t=qqru+n#vL`A+*8VR!LcTZzlfJX&4rKYS`*vQ$Hlp0A#wr0lKDX-rUwR!e5jOcg zeorR6Z|tqXR=$dalG*sJ*7O^v2DT61Bh_P%;jUx_(RexX04Fhh+t4tczX80IOM%GF zJ6sP2#P7jsvUKtl8IcJjG{F<;JDDRN_6Y8NadO){ankc1$}>9aY^}IK-EBF!VaQ3$ z`0HhW&pll#GaUkjc61a1&IS;{%PyBNnK*j%2TEC&n`#bBEABTU>`UJ6DAZ%My$j}_ z2N0>17six)E(glm{~FB-{Xf_*fDGTx(G0*0B059#%f?rD&N}F&8OLd;VdUStL5-sU z`{_at8Z{Nobj#)MvJzU|4Qh}7JJ$#P1vnJC1$Pk{M4%3hAE!53J--aTsG?qSO zC&DCK6}RJ=tv_wuTBp{0H#u}nmn?|C7EYp%K58rNHqpu>7BZ^ zC*x=8A(fiGZrEUhtmF^s%dV@aX4&$46-P;BSJquCCbbti*T$sV6Bf0dqqAydvtDh+ zI{S1WFIRYnE{!8QV#Y)ln(RNSjK>hqo4;~4J4U-eT1r_9LN4-7wydSdHtCPV{8Nt% zT@e7pdDnfa;W=yI);F0xvdIDcZ*QDOX(xz^SnvyHYbDg|J-x$p#n} zS#d^!!Cd0cFEeqc01i^#nwZ$UjKid}=n-yYcz7h|h;hxUjYrN8+HsGN4RWu|e`?<_ zg1>Y=q_MzMQFpCj|AP4NRsS!t7w#FVRao)YNv@t078k883^}&OKpOdI#jqCXa=h}# zf8n8$t~2>$41!EM7y{Ebrj6E|RPrrh%`3Uxntn|mpACgv2q z|C1Gb;6%oN?SJrnf=AW~8Nx4}UIdVih4<(8sG?W&s5{(&D=kuE zt%i9e`WW62CF#777%_ixtMG*W8R)W~5!F8v7PJrarty<*9DX6Wc5=_G9@<&>WmOcC z{jrA#zL5RukXFSDHHC=bzJ15%Pmrn-0htDcD8K2F}mtOcMVx5D`lJd0I3jg zykaDVCr|f6MV#uN=Ku6#^K;2pVy*|3ulTx4*%DqP&pi0Du_iU%V>sXMn#+Xmk@D?q zd`r7Ns52;6`BUgn){6IE5sT5RM_8Yb_rzw=#s}Bo!LKfjMt#-R!e(v5ylgb~yk3vK zSxbCeYSq_3rlF9^_|9RM8$>%yw^dh~)bM2L5NJ$#p)ar+E!b77@^h%a*rmD0W-KN> zo?J@W%o)7Ghv$qk<<;RPnv=(0c9ko`6N;{wsLb}hRi?f75yF&`{8*HDLI2$gGIE-4 z{+kdoYi>L`XL#0g>l~oz;z7wRzgeA0Rp|*)KYtPmoS+;9e_xY0gn^C06 zawD3~0+y66tF*Rq1-ogp+UZP)iO2rv+dk?VT$?x*2^?aj4h$26I8fZ+Or`7`Gpfdm zPpdJ?+3Yjr$p3S5_8SYSyEa!aUg6Sx3*W{6;~NW+yKunGuisUq^X=#G@OhO{Tm$VfiH_2o!f}X7X#u6IiT$0l~kDc)VUANUAuf^cY zycdTsTg%m}HHDRZN#mmKL@!#tsI=$3(v|fXL{g|Mxaw6;p@%ij>SMtAXpgJW(f_$02!DC$#1@~6KFevdWCIT|Tu`lnWuSRHe|_l?lP z9Q!Z-LpESl(5rSZhZOKkPoTftlL$YcPg{&vz^tT=Uon3SkD!CEQJfaWaxMFx`i{m- z$&rEVYrmqN(>5o=s$1Wy57&!IgcZi$cMw1r_nhdPJk>XUin=k{vc+u^yV)hTHcc|| z&i$$)+jF;r2N36!0j?%+(Le{M&m}RF?865yOb|H9?oMJ1Sc%G|*Ira(oe5;=RDL21 z7A+w=V@n9Uv^yY@4f5!19q8v#f|WAG8bOsR$A$DlAJrJ|7XBh$v5(arO!WQrQ6a(> zOx~wT74N*?hj#R5$}mw7;5i!Ao&yiQE303FZg^z&$U3RUxZ z|EOPbgM1jU4)uFnYYfM0GE22XPiS%B$6_1|##fIjZzY%qQOd}>t2ce;WKP5*7hXiS z5FbznayonM@$XOyO3DjgC|xtgE!t`rpEv8BfcMDRKmO#Imvo^AjKsY++um+c^{a8! zu6rK@5x4o|9RZF;ux4^9*=aaKK}KFcB?r2CX-S56k%_Tvknd6Vq*A*2-8KvV(~KC*Rm&VLUQ1)bgSWEWHF1^wiD!JD&6ujkqTg(*qaVVDTJJH4iS{jk##-!&$n?HOx zsUd)1tm0?&R?z9v87@9&+%13lT6 zxvDIkhTvjnxA&BpsSk8cUB=8ySmNBgv-dKCbon$LJlP_|6lLe&)lIfs?UvTm9^j{f zuI@m;%;LF}p|=℘^^osMW{O!=kef-5Z)@tNB=b{hBJ0W10l>>L0;m`ycp9DHd!g z`_`P$HxWp>5-P%6IkWm*SEt6_EZ@9L&eO@z*Q3p})o%Q>?ob#?SqYa7%Wu(^C9>j$ zT=fW_`(!JY!|JEc)k1l3SS}aL3C`9;L$gG;BVqF*kjtOE9-X9DEWZFD86LQ-yHp-v`mGhH(Un# zf_hXlE7uAPP&DSD7kHttat~7SRQF2X)LG7zBB6phYo6CYce`iK z0<~VLQnfZ7&kpG5%UyohA4Id0)(g5lN@o?O$R!;frjKr~J=BwVO74dX#OIljqLXw8Sq3dTs4hF>y#xpaiZ0-y_>B8iE*k&Ng53 zwb`2N)m4h9dj3kFWuKAzO}QhjXX!#2jl|!2`zrc<*^3x-r4)ud4uGt{=O0jQM$!J> z$(`ETo0osQW#1An=u5NzG`?PG&Nd!be6~?{wC!$FGGKHCDj9$_wC^(@{}8I4$k*R< zPjfaRj3$(~{<9J#ro1-U!u9N&dp&yFBR*S6?Pz{pzCsipYe^6SZG-o!l_PkKPuoU> zZuOBid^RR3D@j%&DzqNSq1JB)B@0jsD$2a5%?_c4_3!(Q27K^JIb%ll)vr$k4|gY# zIC`34aVo+nnz74JAJNQV6IjDj75)qQ@+II*iwVBnG&mqh{{iA$_FCS|nkkA>xv&_^ zWLYmEx>X*XSGOm}t?o6t&oI;>#PFp=(9 zEnmN;*k&V5%QuO)fasKJP;|#%apUH&=Y)aZvqHSjUjI^b+7hbO?)#@()qmXJ%3Pz7 zZ@g#$lSZaBh6mOaH@psj_Qz&9TGo6U3o217!HyZrkyo;o!Z!?}MyyOk(XVDesxoVjlU~nwlF-_n*!ixGpz(-JmoF!x@POcuTPsQ;RG_d=#4J{! zuv^@|Va_VSkJ76o=shwx$Pt^W~Bv8m6u+H)ubvf77s03WT71U z{rj*2lm%hKZc!#bDRUw$n|g&xvJ%0!C$y#GI!-|Nrl(iuSwfh}~q z6@I=~RPqH=%Z2h`pEL0prCa)lp*IwdbNQPrMpnD!r~8=@kR@9iAFn#tcO9IhVbVe; z2$(B$9Y{7U14B6)LbL6uM(UyrSX|r(oIp~#A6Q5WelJ+m(5z!&?}uZI5z=~0MyB3P z?o#*K$D{yh<6GP}8G>e3M)AOk%a`gX&X&s6!0;j2%Js|h$i}x)+oye0G!pMU9&4Ig zv!szAHiwLueI79z0$Vqkr`*d~8#At&G0e5BNB2cWiwcs*vABXSUQ(7DdvaEkg{z-9qBEt+1NIpSZ1k!RaaSrQ%Vl;|u1LFd#d*F7ogZq* z3Pdp>(bL9=qBdHym8>y?Sc=*#2c}ki)P1RyN#~}*mj9Q$YPukk_*XWA> zUQU}s)qpFSKwWJqmep1uKu-;G!Zig-36;i_&#a=93!A5SPlI#U3l*G|x&|_KSa~_~ ziQ!5JzagWcpPbCQr68O)(WArNr6vKs2U+iQpgp+F{yJKkvZ0qzGHL;{mOG<{aX6El z*m{E7oQLc~HCCvR^^brJ#iNvY)Sn*s*Nk@9OiB1LFknrTHenks@rwKHHbZYn8zqku zN4k1Gecy6TSi39bK$usJ2*3SlcBRiL^qbjMZ%{c}d93?w2~{ws4W!ZF@*sh4Pg%$l zg@8Ae6W?{g7S=mCWlUN%+E{(2GBII3d8sx1b&w2ni~!(25~zV#aVMe2w=NWUMmvOZ zN^3%p`QPf&kSqON#1Wt-e1G+pa8;&n10lnglJ&~6-aLfT2Rye>HNfP zd5GICx9k;qk%Pe3IQ!EYR)@w_y3}r-w#|o(H`cRXcgA(~eO73nQ+a+8DnFbQyFm3? zwm%pooPa#K((kBgSh(%*s0t(j03V#T&vJXkV#F*Ue_qhr@=8u0b#pe(Wz%~c?(;E8 zyEXms*L?wz>=X8_c7qwE!^Ot_ypsK%@P?*=hmdOAxepCYH@i!V?m#S%=<=|i&8QXf z2QO?);MOF~^3L2i{Uk%scjP^8#iN)<+1m1Y|C&bfh;@ zPn1-{c(a)DvXq#QImCUuB3ia7%`DsU1q4g^6lItrOl^e=V z6@$?dv$LINEEhO`vFbs`NOGXw%NcY&RyXmjL)&m#l)A^RGmZM<5=&y zB!4jNG2AB3*J4J|O7nWc=FOQ(5Q32>=SINst9f}ueduG0zsL=x(L#X%U*0?s!dhdh zG6?-?WcevQ&<`prqp>$-3Y1q^mWuMa(kaa=M->*Kc zdQptg<7dEL4o^Xh-ccqGt6f>mYM6Gpimd@>jg?d=t&K$c(nlL7$^sK5seH(lOf@dM zPd2x#D@%>>eRO5Jec2H(hY&opoWB14NNyino-(>D?*X(E!u-%>r za^LzJK7)WC&jJgHJ9ErmFc1z z?hEre{_>kNgizRMLlizTTn3%xx7as7hCl~1FmY9lG|5g9>~HVIR+#a0>=UjK|65dM zis<#3b{zW9kSVs(^wrStDrRZ&TC0eVqQcV4$3x8u@VO@ugmkVvk-#peipd(eg`etL zSy-<|j}PnPkHe~d4t^W1tlSz{ohz&~oT1=Vwxn0QM=PrD6X03hVmJY8x?eg2)~S4v zXyDo;J-p%C@`6%6Zb}f8EMPJsjJSlW>M|`Ix6OBG>winBO_rj(UqpP-6;;pIR=V(b zyZBQ8*kJ4$tYq)~1N9@?MDYBL3*g`W+5u%ip@--2%#F@ouR_-~A*Wuf&U;q&y3CGP z1q>p(&@dT=Gc}H7&LKT_!g!SZ0zqidl7TWwM_lTu}tOVhu9tzRATdU*U&Re^KcHy*TO$swm%C_!9 z^Y|*5zS%7g71VsL`G&k1Wj(?o4Kl0_`e}A*81v1sH*ym{)b|GzbLLP4OKaG}RN^HK zJvK+fD+QfV_HsKgzt!XG=d)DZH}#-uP*k6>n~?7l**ds+!>pd z+De;73^ppn_+I==mnDHNubA)pW2d^zPp3=il_Ub}ss5yETd_@*w7!W+=hz3#=h}TS zH52&-!ME(41di$ViJ9ee;=1qle-jYk%TI!>JX(}2IbYD{{|s>QdARKTm@)g%kAi+C zh&-$?J1^`G?hm80QjoC1i=97jg?AjTE_TJBry=JAd8uGZs;RFwKY$Ia{1(BiA~9Y! z6^gd%*Y9%MXXeBEy&43n2U46$=AU|XusNTa))lvvb{VRw^$6#cceCwxZ5fzff6OAb zr=ng^!sL2%p0|llH9-nl^}J|!rEiEiOQ9&KAxr0i^g(3P7b$WzHzKAk#xrkRN2dGE zx1x~+OwgC23>uY0^O)C3(8kI=EvAI;MXjHea=ZP&KxaSWkU;I6a`{$ zP7Iu@as8);GB3auD)HcYm#yVXRsRxZxWvU>FCC2RzMm8Ux`P(bK8wxI95Lz(&NDz!e-bUR`SfP)b*yJW&y_`kIn|0tOHbn1-v^z5)W zdGk(B`8|D8F78-ABg2^Bb^7&lAg!JFq7nc6)iM329{#J3$<>|}`DaITNwy8X(no=G z2hSx?k!4$th0sUTapvVA2Ebb@f}0KJEswMo!YwFi0CdV9CPF|zR+yg;f}V1mH-**` z2?L%3hW$+#1Lw*1w-*psu7mV}N5vnBKc=$QhQiBM`ai(CPkw~Aiu5&2rK(Ubm(8_C zd47pDX5_EmnHJ@ITTsU``oi|aAhj>vT{uT zcQ3dUW{4#&CvR;akxMGdY|uq+Chnu0F2I1fDJI0-4alhkSEhsrC=?_$e`R2@{629@ z;0RXCpzz}v^o%J`a3rMQpglxOEL;tOAXHgEYl_dqWYL|(snGA7PyO5`Tz1am?b&>X z`&)~&tZH4IvNA259&K)EhIIwog3kuS&#mEsg~WJ7SC{r8*!v=jOowkXZc@;a2<5+!)Q+&i9}AP0uUOA_j$|mr9elU=jYTJH z811jCNL$jiYI!38Rk&2B)mexzC5ni&JHL(6;&tQ#yHIe0WchIkP`!k(pksX(MEee5 z7KNEC;(*PD5=;TLybK+#g%WUW>kz;=cu*H;jgKaqAHn11P1tRB0fdap;JEsB5GDv( zYnPvE+3ZwTZDj&-hHLOPl^bz5ivjn(ruit+7A~XdGL4QVke80S+thK6$#ho6o$~eI zt!a+k>V*RjT<;Eknp2K@3};bVRh@q&_R{T#+FpG2`)@<9gC#=%6MsSJZFiE8w4Gkr z0}>68bAEMGsZaK@Hj8M0mEFAwPnkLi3-X^Iaw6~i;fpdZSpUXn$Kr9HV&XD>i zjUC$YuJHz_A5;)o=_P+g&o{XSrR`R#SK z!>tgR9yVLEW*eqe0)XPwi^z%{1_g&(-ROi=CPxe$hj;~sOK2(6!%Hf(g5ln4EnwGu zoZw`3p!sI~Uef~AbAQW+mX*^Xj-_a*L25Fx>LHZgCWe7;;YYtDw^K86Aog?Zt)w9) zb1E6P3joCzTt-ifN8}ezyaT(_Qs&c3g(3({Mv2|V>{5s2mq!drekLf${)B>G=nxAG zfc${!Q6P;=FYEu2PXNF6FD+H7TTBi`Z7K7_F#nX9>Qvfbm&-U-Hu7Iyy99dLR7*jM znm=71BMa8DCkx<-KTM6!?T{Ytb0T;5gX!6!Do@lWhxp3Xwn6}Er2sYjYhC|WUT`mJ zU|1VpndA^pQdnD*8ZYj#a+L6a%68`@%YlZqW`fO_Em;@?^}K*D5MhH?S7+mIQHWn# zcV>cNrI$i*sU6htY;>J`eZpmdd-E7BNrwz+g!4F*W9Ef}Jy5_F6ax>Es08%97ZKOA zjlb^TC690a_^f^~jCN4*Bf<&l;Y3nK!sRpLmLPrdbczSat!gQ-rTKk9F_O?0KumT& z%n|2yQeou*lOXE*E2DK+&pCAeG^lX6=Ryy1yyK7;d^ z20Dn)X`pZ=RFK_py4B*F<@{F$a5?yl0nYYTWAvKdfkX1=;f!X>4fS4iKe*&p9LX;n zJ>RxV)uH*Yvi#XzIpjhW4FtE zaTc<0W{#6PjxWj_=>&qkc)&QZ+~3F!cF?5u~0yDK=?pMOAPp8eDI9y>9P%p5%O zZU+4KYhUFwuk%%}!r-&>F_GfNytxVQ*g7(c4x1q@Zitzjsl-bwswT!Uc=TFPygKH| zr;e>oQf{DA6Od)VmH)D$WBZ^plLVca%#sVxG}V2G6k~2#T44unCt%OM0|GK)2jypq zy6=ZK?N=~ho?eKIGK=MFh?EQlBplTrE;9xB!40i0W}I4T^vJ76S#x_7mTaa64;A;c zFdC0q#IjFZ`O#fiE?h8Rp{bE&!?bmf_G5ah2e>T?*tzn;#pB?h^#UG~^f-8*31mV9 z>9hguMuDc#cK@Q&yNaW@*|sQ2W3Gn%sOWh_S*R&z1#*$Dg602FSK{Aq<7pa;3CuXy zd=Vbwbc<2DT(KQA6JA;wPZJgj9^XHhW_T_kWbm5?7wAAjEK7I2knS>*?KJeH@l;OP zNqO{(NU9jfi3VcF6ct3d8c}I8W=WFKO@*avyw08%{Ypt96^I&ia0_zM_!W(6u--2> zn_l!Ywu825xbGtiXn0lr;r#{}0mtJ2KwTbfK^CnFao73_flB(Qc3PVVigbGLkn^<< zQW_PZF5<9J2|J{_Dim>r!~YW?EE)v`@|F*QOdTz9YL|z# z9~vallX&I!InDpKeVkRY%zsJPh%yVAqznkOG{pnhHkTu+Wd+JYc-0{6<`TyHhim!87)(G+KTz&Z=66`Ymhd)ic2* zs*ROMdFj738WE4+q>U_{>Y!0k%etY*;WERc6NL{OJ)RoMd?-V7J`XhbE;bdLpbi|aYN=3OVhH|=M zS#vp4h(s(VP&r6G$v$0S&gA|nzaZ!G+vU^vLQkh<QgC^4$gHFWZukZ>ME3KE?t*@3}lF%rdnWBd8=po5QZwY@&gU~aQ%JkvM4uAwF ztSUmZy#;KaIP%tsbqSJlcOzz(O0uD*;!Xd~|JYR=4*35$3oc56zcLRPSs7oF0hcO! zb)Y!SGv6}IA%)CVuKLx;=G%HJRg4OzWv!-giD%&p`;RSilD>Z!U0#j!{a7&+W0Y4W zNO}yxdc~QUTy?geW0NegGTyR!x!I!2AB(IU#f4zdcVtb zs0$&Pn*){8M^1=nTbjDqny&942n7&*`vAV|N5Ke#4iVeA#0ZkU(?}G7gyKu%t7dlE zsPG#O@k8<1#K4>wNZV)g!dbvLz}+K7y{m=^3>?Vd5_@Z2=2U>OTeo6YT$HQ~(@0VIL20Si^FbZ4CHN}nKoMIUy$A!gf)>%j^%x$^ zEfI1#m`mn_M(&nh>bdB753XyzO|n>VMnE&ak(J0&ZSM?&e?XeF?iqpZ^u! zqI~XHX65>ar(}mw>P@528veBuccmF^Cy zu#k*yC{HE@Cc>)Pt+Wt5?aA7cgWy6*Q?7sK_+&1(iqP`(b`qQ(ZuJb9;f~}zgcAwP z<|&9ibL5~GO)6)~j$Ny%8i5ML)|*W|QVrifBWGpD@BUSx;R>ZOBy~t%g=W@>x@Trs z8e9Qk3{5Q^P-w#)0Ls3S$PK^Qvwn-)2!z@x5P30j6W;6~3a4L}Xf;2AX}=nX)%+7p zFT#{juwLbbr>bzVcNt(ZzM0>kS@pY9n?Po<4k*G2p6Z-Xpmz`o^s?*6K(ZOI0-fxcc z>?Bi0!`a@zp`|Sk)kokTO6diQ=Vhd$wsdVIU1m|7`nfDC{?HVhI4<%6PSBLfm{#IPU{>{xM_b2~lI^ zJfI!cw9#uJ$IH5gJ$cMuWxw&VLNT{Yz~>m!LgvL#JPz9iUD$6VU452^9&A{&83cbs)&2pcIf>7}8er9%CXm-VA%#|(I$j!1;3O4FGmlT6JVyN{Mdev?4s?$-`iI9>cvVd3l zeO}zjEs?7B`}2&ztHicn6#~7g8A#DCDs8}}fqA}5Wiv&q^l1&iJES}H-Jx^91Gv?XVrsv5)hYtVc_~E+*B<8d&0cme}39?mJz>};^I1x}+ zRzL-S`IaxYc z#{kflh*1OPA&~^}XvFn1ZEwpLAS>oQ@SR-xnRtPIj~0;C>Fon%6##-T4PZBXqfYn# zYE8K@*`E1+3uyUzOK%LM{`KJD*fO7*ZS{`;KM+Z?-3d&@qeu5x{4UIh-vUS%A-W&v zpSI|e4F9emU0yu|S01lk!@aYR)ZPNC_sy0QI#L0`>Lu9HY-}u z391hKeYoS-kMeMz@30s~bY9uE8T;u77vY8d_Z?%`qI8Wd_B%>lQNt7%Sce1eq?!Qj z%k@v&PdpESeBt8H2X}(oePpwZdI`IRvF^6(3@O^23LY*tJcszQ5v3U>_veIX0MHNn z{YNk)3e~GDy97MgozD|GC_k*gI-|@O;~`{ zLFVSJ1qNKfEp6sLk@HtLFr4dAAhLMB4Mhi2hj-DGn%Ad=)}0R%^$NiX2lSvO@Ye>n;;#gS(fA)XiyC}>F~$mm0A{|v~|HzU_@ z2dcgY`|u@fHkq>^eRkLhK@V~}r=pd5IZB9%^jLEGNk9gmS)T?G1cP4$9jK;8?2w1= zgP`Qu_Lv>O;)%-)Pco*A)h#gVu}hj@8L|mHx*nubt(@ts;-k&fzJ$^|d)pg8E@LL# zNl=cH3&IEKz91eJXrq<@|95)UqxhYW1b}%8fRI$FJrm&LbJ+I3OxynV-+IB}7q?ye zgaWa>o1(3fe`s)AgqP~=H>8!b;^cK})6Kb#v}w^}|5OtJweY|0km2rLf_CmHu!@dF z6Dix%xBvJI*t!Sw9>Gk5!;25h5D^2-?F<~+b&zZ`snk)I&3CA4D}sURpl?4N6L)vefjfDl!^ zW)s($Y^uHpLQd%|-a|)#K%>>b!wBh^PA9BB4nl zq6`NmpJaGoS#h9wC>b;lp{l=s0P+zpx&IWx=KTR8Ic0M{3-THPPocNRb~EkdC1CEw zF!?63_-Qtwfved^^8RX@FxaB3ncF{l0nf?BBNzz@>~|n5O^j6r5D$+W(3^l*M0Pa%ix7nN>TjYXe}VB;?8fj;G4H* zfaNunoUPerB`pWXVhS5OzLO=bUskP6&uRP$s6qrX2rR%MdSF;_C1XLs!yjB*crrSi zFy8x&@(B-O#DJ82fRX(xReK0BCLp=VuRJ@s`cw7EOV}2Y=?Qin@10#Xnw^9OJG3%; zRse|XxcC5gYI}ptPavfUSs*h1q?MzP$R>oLe>_^@-HEQn?_)GvZp37j2V&Pnx&>Q= zR#JdT$^wSI5-@n1Ac>^j-S4%nL3nhM$uSywIs^?1?NZtfB($L(H8(9wRq%t~dfj);mRLKGpuOmBj=XaYDp(@f_Pt#)6h>^Us- zjs2S5Qihmv+$LXpSv2R0hsDwQ`3mdPUkTu|&K`-BF#L0ItemwWQbN2rcT~9h9v%Ds zX<7e`^!b^YLpk@qY~1iP{qu0E9TZ*_Sk`P$?hgQ4=Po<~-8uCSzbh2KR6_FSb8q6_ zXG|EmR~q9ihhxR{mfF`&rE5t(*OFw#@n)Dmw+1BFD%>*NUbh{x+dlFDXyfwSAsr>b z4svBFPg#2R`+a=5-q>8?6$t<5{07T^Do1^HNNRBsKh$G*&d%Nbov*?S&NBnf*ra66 zSU2F^kgqL0H&a?rV>G?ua~(`xh6)QMm@)p*Jm=2L@~5pd5IEdeY8VRO0_K3@D`9_- z@LSmf_ht^<+j?N}TvQ0Jw8+WpZ&?9r{dLe{GAeO4`B|>{3b+R7UqhlM^y8aQ(o(P0 z90qQ=^JQ)Bexpg(1d>31iJ9yMvw=OYpfQ?b13uqi+Cl~C!g6q<$IW;LGz%x46_&rK zeyp-<^BG6#$_Sz(cyUs(C7`4^44Z{0A`|;8t&jXMp`IuJzI(4lL=#lko;}eDprQBb z&uX$Qz9Fs-^5h(a2F)6x#DlE@Rhm|%h&7q}%`3cjk)Hj3B{v{l&oy^ap2$WZ9&5{l z9qDn-+n8Q#FDrKGYU--)2sDSsO9Ka&i%{8j-oCrO(m9ky_XcV1SrvomQd*f@z=6*E zEa2%%QM`Byhfp^STiiacbRU^u`PAO3) zmZ+BD*TRFtfWl%@%`r?6cDZ&=NMhrP7YFKBZQ;UY6v}o6_j5Fc`=?*+FaC$T(~scC zu7rqfs2oHbr3y9fm%@ByA&lnOwmmY)yKk|6NcfX&*}t1s{WpWF|NlN>trs|Pn%RlW zVr?N780+=TPIXeyu+ma30#W}xBH-}`e^$|I8JLM5+h=Hnu)j=#ulf~RGaAk2la4@* zejEDPeTx`L$L6@sPD4}@u%+Wpcys4x-jWrpo?Ks5n^+6#{n5_3!%l&w)m$9A@8pl2 z@$QR5#4XE+pnZEIxZT_aaCgFKzAj_|S?2E81<*j@AGV_OGkeGcH@;vm?m)!{o+J;PK`A;A}yOB?AfTCoT$FSQ;v2XiU-7i{;mj2;XS z0}H_|v+c^Q%-FF$kzvQDiLldU?crpD0`@j0S8K}1tEZHvz0UHLVoaJ%Vl%yRzMUao zQL+C1M>5V=cAsFPff1)N*4`euPO%v}*ks263(U;;>cK$M#G0(L@8znV%~dMIBOQE_ z2f6xE=KSusXkRH==r#PC0h4mclwwR zz~kFgsK9hsyT`9mq8j&*kkmoO9MTj~I`7li{Z^0hC~Ut8a4->83dYP;sjjtlfCq;O zQCu*E*7FWVuG(6~l`~mjVZj|dpR!@~i7**9;HOvNKI5v4|9c69k__9d&^>#G`1%q8 zjpQ3PO0O?G{%Wop7;&~^8Z~dFhL0*(Cy3eRXJ^L{9-(MahuXDewNDId4;x_jlkCpk z>s?E6$$$qsOTRlmi|mktW4;zfUyt^vxW|uy4H|2o)K(y!M-$S2Vo!#r#5wcg?O?0$ z@M|5-vZ0845hSMWdLU+D zb|7xt)4!fF>%^UgB1a>31>J`6N}TyY8zluV(9|j#HZ=P=037va)j} zYbBs55)YbRgf*Mc+9IvMtes50S7%Y438Kf`i?t$s)lJQ zuK@3TlzOf;VP<^bdpV2PrpAO8qVCa6Phz{YBCI4qV9_E$VZWdG+j9!2Qm=}&$UaUK zddzvLtIU@VS0CSJzoj0e?!S;T`D*qnY%&+ONeoo&Ot0=+G(*0(?G!qKE29yj;!W>) z!TPpcR{6MShQ0?PpU@>n%qmE!j@eX8yvzU<^nT7$@+TY)Y;(~uUIL7^T>mJl|66Xc z6s)?^(6JY`-;mRzplC62+Oj4bASc(4VEhe3=q1?-G#_@;pD^=;>T1paq<)eSeaB^w z7vpZwqngL3r*yof#k=6=xzS#q5}7=md)!GIT2uSfN53iOU%a48@zw^D|0zjG)J){} zzLzkW+AFE^1W8On6DBDdoB;Y>A8-9{!(9}A6*kDVi7_xme-*`zm*$A z%@q^gk-ytiu+l^ckfxNpHOdUnhBb&A_B=HATx|m@!8G*Zn4s*=u?IZ4&?<|g?48Fb zL)$>}^|fpr?9Cg>MS8rGN}l~ZEzQxlO0N6NXw{1F)s8rNqTM_DKFMu0zAtT2eS%$B zQ35xlEY`(mt<-rOY4Dg#&rc!56K*8-02nUXFEC{LQdl2w;TAzxinbGs%m>2Bk7Y(q zi#ZS;Xu>?an>_s~drcNr<$oX4Gs^i{i!mO2PUj3dej>!$_cw~1f{FE@Y zC%XLDR+d zOnoIcoX~KzS!CY?7atfQMi^oQOQ$Ghut}_58Ast z^-mk;TyQ2`u+1k2JcA)qj1c4b?0M-Yll{&B;F;KEf?$hII|R_(*|PGuSCvzX~K)j1Vz z9tNfjjamqz_C|r>lFS9 zZ_3}u^7|G8f|xG1L*M__!x-hkOn(-XdyPT`&&l8fUf~iX3Cg)lyD+}M8(Oc8>{dvY zg6;3to6?_35D*1JW|d87T?F9InYFbWLBo@ymd^hXK}G@jb9&_ayw^*glG?i7Ia%TB z9Q;m4$t)k0&bPJ<_(kh4Ix4N*RWJgfWrXsh?aCe0LBOL=h=pt~5dbi=<(t+!Sku*$ z045B1aFgTD0z0%72hI-dZd-lpJh*r&S2R#B{ld!K)Q@)3w+qR>KP;?HU_xCWBViE1 z+5_^9D8d9%$~~d0YN8DxADw%@MV&$#a2fa%9#8*X(;{2U?fh&#Q;EQB9Xn6sjAsIN zU>H5i#xq&r*@z}-uz7ZX;F6#!3Kd|!iX7UmRW3m!>cU3rJ3#dr^*C5@>9y@Ep-{6( zQ~aSWb9Wa-o(=%7ly8 z3F{OMDlkowA>IVEzLmlSD+T%F^$~ToNbp~b_%S|=`TYq{Zgx^4s_2-* z@;bs2z;SPy^t;nTj!g!>gxzi~5bG3E!-(C9V8Gh>S*x5oHdje0sP)jEs+Vp*LX=)BA6ryVjH7G&|y2{bEzH z0UYYPTJ#de^2IId)R|T_OdF!6rY1%k?cPQDG_)!&D`9d*MX+RRZb-sAjtnc2VDQDo zrOcIC87(}#Ewh>CD`c=TrAMx(v+SFb%gOUp)rf}2AdB$W%bO83wa==T8LIhw;e zJ;sUeeA!cqo8X2!fWIloMwvQi-?Au7tCJ+lM2P$WTY3Gp`d3^c$`WK%>OA0UL*9L> z=b*X5hKjEz-C>yb7I4`*zlGZdyvVK75ue-iP+=^4U zHb#tj@s66H5PkiD^bLOLlXlnj{$#FU3<{c2I3Ii-=aK8CPNw>k3Zq4uCyh$dr}eth z(#h9)<;lLy-Yve$&b!1rvl4okPDq`ub1S_M*L?64>n1HOVAK)s(-Bd-gtWI$w`y5w z;rEN*9P~=Td_R|#&!S(e+0vljYFEcx=p9|sRgpQZc3Ct_kN-K{u1D}&+0PZ}=ok+_ ze0c3)V#JHbd!WyM{Qi%JDs)dWHf{~YX3{;umIN8}oxE#>waEzMLMKLK@_tmmX{vr{ zGxM@%fS}S1;u~bx5ed_PPxhQgQRL}aMN@+2v(Tl4cQvzLi;tdGEbHnX?W#Cg?<36d~zc^?>jY+ z8N6i48VDEHZvMrA>goKdBw9qHR#RW2Jpi-Yx1fklnRpR?V*G#6_TBMR|NYy|SHS@2!&T?btJWML5Q>?l<3WUBBzTzIWGk|L*(u zkH^P(93JoYYmeva^$DEY@AaX>V^vIu<7|{Nsu4~~n#FQBRYlFSzfEV8TrM1Z#KwMfp7H~INhKSabl!dKHi0F(zN2K7DDFxRS z>HZVx1J~mK*V~)=BSiQh@_lEgUCoax-NN*X-Pfy7(yG`7Y!=YKP#90}`)?dQ@c>ym zly8q1m=mGj5YAGjgq4^mRf-7t5wpJ78FLB3r+0cFwf17Ud_juN!lr;D7j8z=rd-6)`oViHWp8JV;ypJ!n;mxG0%?K;lHL7Q@TM z6@Nyr?-&)m_APS$dAB_1ElJ05iHmW&LJ%HT0L#vl`ylCkNLn<<)6m94r?>gfcxK_g zsS=+~EN5{3;BS;Z>FAElysq?f7r+p|fRTe3WOECO)jm{K=b}*Hn`Du0`85TGzoA*R z9Pm8HY&n&!00Pk|wl)1KPP>M2G4FHzMTK*9`uGf7^12T<<$rcZeLnBfnG%K<`;@X& z0*c|6f+OZU(-=8ebOlD^GU{^V;@FgA><(1S?(ow(m{iDHc;qY-x%=fhz6iSlkNesb zUXp2H`h-43H1c?7FF9;r;C{sgQTL4(BgH>RDo$ipX)Tc@q%{Wf>$dB7Y!e(OJ85NL zuv4qTQ-BahomTZVRKPM_LRz3_)_Rzgl8!B_0e^dG1)Aik=ae+N3h6!uvP?v(zl9QV z6uhpm)SYZHQgUoJhCO%Wg5UM<<8AOhnCwp?XEznQ4^%L~4>Cvo?=8x?%5q@HdX%JF zcLjxWeZRDP@4M@}K;<=CzoHSkz7O>SgX%UqE6Sd?kj#U!y1iuLEp1EJl8%9{wt9pJ zeRtgc>gVe66jBDi!)YgY-Hhr@9)>oTIMmz4#hzr0&$J?&N5Y}9j9>7 zwc4vRNh~&KHKyo_>Ns4MtHy%rK~mr;cZw?v_*w+m`F6STb;9CsKjVcaiY z!v}aZRWB(=GC*?J=^RqNFlNfQ$@`QJ>V_`B)%tXxw^55u^4f-y48@h52Y#@M962ao z4N9%GE$B@!E!Hg-(+nC2b|^m0@G_1rBNJ2Wdqlp?6|NCRBV(PLR99CEUJH91?naA{ zAM5(tSHhLB>{!{_(&6925y@15TOX}}gs+v~>cBp87_?7-gnz=d75)z;oa6$P0C~)5 z%+)wlO!B=g%HowJ(}+iA5iFNiGrYz%xr}lL{Od1k9=xO2G@~yrW@O~)oOLiWGlRpC zB-9}u`;%kE#O!Qz`=8Bftx523E{Dmfg&4n;32`JHi zxqjQ3myiGBAsZjDz_|e5(g6bShLg7c+-LqJ9TzcDb9rxjPrJuTtK+m#?+7sN<0gwau3a zrk-3qWQeCyRFsd7w?2)V>(6g1Rp70O>58xhY za4XqZcI2;~^BbcSuI84tn!Mla$>5vEq#V!alCM~WG4uw1!qK&dv>S2x2NH#fBgCig~^9`gX=YsRd?~jLwmM6^5-~DHnvGVfO z82jk=mCL7cI_{}sTzmN4bZlXcvZ1`OlnqZWeMy9fmT4q9xgZcZQJ6L5ExvY=wncNf zC4x&Dh}TfpTVcfIxW)jDQ}jut6JA_@BZT!O>EixD z|B9K80iu0|jg#Ps$Br<|#J*@oRpxLzdEHckAW^J z=HhEDa|Ib7Bo3WqMw+fv3$Bg5&9!vd%Gq#9Y#!v~ZMg*b(4zgZ&1EJ{S%h)cb~{0F zXf$ZBMnL6Hy?yXPZZb!YHn$Z8Gxqg`Wd}TILKMPI`W*5& zuyZM4dG7vsquLbnN77Sa@HDTx?eCr#=h68 z3tm7U57NHypC@%;3}QX3;n2XUbK(B?c|~dJR;*j58H>?80@AkInf&7Ng1laq^O0`% zq2^lE?%KY&_B`;))=(((xre(8%qh29kNAI-7hbgF3Zt09(Bz^oaC_S(fkM>x99Kf4@GX{mphN48dy`S@6r#(cRH*e*5f9`2Y_4Mc zR@>$H-YHZqBNfTK(V>o+l`<4;PuD23eUrZ!G>UfR;w2?bc6uvx6-{>rNRH*8XnRzh zH?F1wm`79xJYnUwPem>XEtvCzo(0HqwvDsrB zO&6mNCD9k3chze>@2vUiP=T&?bvfkYtR7waQ!!GozI*M+#@=`EyF81n>~^XId9@6LB;oNqL$riHSeVxH=@~LcPWJfyXQ4>}~Mxi2B-e?KZvlea+ zOTo`6gpCemebM!FNN_)h>+;wZ6&zJJu9%v<6O@77fqlnnnH73qx6r;Xt0o+*(9%YK zC9&>yD4#>-ohR;f%fS|t&a&p_<_aG7&*}9{d%Bl7Im)JrL;>ewo&x2cpWae9i$&RQ z^h^FuF%vKvrJuLoMezujr0!7MeTV1Af&x9{2y%Tyf{K;yqZ zDRj$P8#(aJ2{|v+iLK!p89i^~YdEOjHhsCcXQ*`fHB{;H)AQ)?mI@##L;g)WssA%c zy<^B)8eHGKZ@EdI_H_aN`P%vlHfl9_VBrg-*Y} zBB5QfyO(kkN^~`<7232e3B*5rD(C~HO2ve_Ht5!6dyp2dm|DYTWK9^DJ^dM)cm(o? zkazh!ilIu>g78uFp?}YdNsyQ)MDiI!#rQ-D-2#`7UaFV&Z4Zhzd2N+y2LBOcCLT>u zjf-UC6w1QbluW{RTkl5}*$z-%a=c zp+5f4U8$tKlJg~?hmO{JuK3vC^@`qt-#s4rl6QJdT25?|vD^_FkMEy;dhSYjueG$a zgfg~UN7ufKxU4nu(j$iW%!G<{gD?v<9?bT;_}se?N5^Sfm)myW#&Um!-p9QmNWM9o z)p$FLM(&`A7%~Cpo#v`MV;T;WmW5GLRke?ipGPyCB!ZEPPL?>FSlt+`@;=ymU}imZ zfq)dx%p!WQoYxHUsR!hIW~Szme${dM*4-$aNAF+J>u(1&Q<3IYE1?_1DKd(YLwgvB zbZo~KvZu=axs(stNP7n95ML^J$**}SZ4vV!Zi;mV&p1db91DMr#;U2A?Aj`?NP(4z zhEiA^?R)eu10Q7nQPJyQ)c%!Jftpi%zERmi-Vg@9CV4XwR?MnyTCWOWGhV%RBY|K1 zx=xLF-Y3%`0_xjlG@MzZTNy>{lBi`k6vVJup0~ZxwzVs-V8D+FnnE;cCBHeH4!z2W zP;Y|MN%*&hb{MQ+HcL?HVPX^fut*RV=GHge6tYiOhk$B;dfy-Pf|Lj@#eI6c}*RJdRd=iNWQ62LW zS~CaZD$B7-CAn@gLAbU9Rp5Cb`d&;`H2~M|YWRCkOop@u&vmwCk3)IaSY=)9}F`hZ-+ll;MWL3s!J*^5LQIfGvH$1+9yg%qfjL?aQV*ka{rX~h|@nyjk#m`5Ar z_N)nDLLjUUO1<`;_bcvjc~uM!UeC$P;ZC#ybJSj4?p52XQ+I>LBBV0V!e))qUc|b- z0iCWFbX(0^gDP^&RbuluoVqLKTbIjY`v#)!*j!#w`)HF0%d_v1OHAj6q9NT)N5?ip zBV~gL5!lSAuIfa7mvN#(^j6PFet$~PEB1@|4f9ImFyX=Lb_T@f4B7>`tZ@U6fz znSK?56ubl{s3xF{%<gHgZiF#4HfxAuA_L%PXy&-fwhh z<=s6!gk?;Cu?q3em0q;5C%ha^4yF5V3omwA?(*pq0#6 z=NpG?(CU#$N>0&3T*nu%W4H3R`BtQDodEDSe5gfKTD@8?Z8Qkcz~+G|59LAV5M>X8 zJ~h>2`Mqz6GUl70!@Pv=m@xc7TzyfCxlKc{KV1S+5)i1Yst0PraB~nx1Y2k0O{u$8 zDry_TghCIC{OJcBmfIj*tkA(A^G=x$N5>s; zfQYiNXsY)2QHtuSL?f)NEu4-bo0#IGNT1gWdo>=|G1i~lMjcVQyIC!E!}if>1KW0+ z>s5)O8sAn!RJ*%BRV+H5=)5Zsl@k`lo=O_~Z~lRcXfv3>s;`GCQ3~IlXBB(AZ|q%K zQCdk58cN%U#D08_8{O7XB~K~3KII&aul-`Ga*}8OUa($QNVFJJBEpe|u6VZrw>` zW?Rgt$5C!9YvGUoBqs$n>o3Zj{SuaMH1E{|FRRy~PT0(uCuw+DE)z_1sH&7K#KByT zR^4}x{TqrdKhWUrX$3y;?HFarc;h@)Aey3ZchU?*anKEBG@O7g9s$Hc{S& zpXh%5^J@M%E~AVS?Y2*KV{@<3cXxch^-sK~UGbkp!QR)C+pf0>st=pTEFZnx^Z1h7U<@UB4(nV{2Q~eVAN7b=F&{05v-9$!>_D74 zlB#CA@TDl_`HjF0|CEmywKw!O^j-Mem5EJ`68A{#+u8tnEUgX+>4hsl3!GzGkMh2} z2%(}S{j91DoDSu9g#?IC7Yx^?30x4S^J@fi_!Od^Q})%Q4-w;+BjzYV4!3wF`Ya^; zbIUEqX|)@M#irX3s@?ckJKLgSHP|CTEDrHzB~4Y02g{qSo-)8X$!}e*j)R@ZU9(ZI z=v&MNJ>BQ?tVFBF-6abF5nG$3!ofC}2hug@akWJBg-gMlDB&8r26(Y}fKsyU(WaU1 zgmuk?_a_1|PrR$26HV^gjOhFp-rhu0M0gXKE>u#~-ug z;jec_)S8WlH;HT~0w7FplaIDVG#@>c8vt zh^kO-=pkaRD+N-+N@BK=Lb{Fea=;Xg*prxk?yci(O{?Xd9BBPN^NhwVpkqVLEZVW^ zLtN`yHoPMuA~L*APi)r}oe%`gzI>KVho3f#S9{;>@4oHa2z=I5q1SN24N@7Skj}7< z8T#YhW!KdF0Tng1JQ35U$OD6IKLNAcyod#~6e=Pw9*LbFhh)UdZ#TEM5k|%8&Ne&t z_w_wG#x_Qs+RG{{!s5HTz^Km#_?iYesV+uKgF*JNi z+k%x%H>BS3fORhg8RA8|zEaCXT3l@10~}b*b*_to?q1h1)Eh(hZ{8Iz47A31j3*)W zx`6#PRCa~)OMl;va_!Qc**qU;5Ihd1d#Z0-@8{%#sgL^q+X=_d`9162=FWd{G@1hdU`cKd@5SZO9ZeB z5`HbyboAK`*IP-Vs`Y ziY3kxhkm-0*XGo4n@r@?+ipKa@8I~3sdzHx^lAk2lFuj~56=Wq_G7Q=Y+T0mV1h0_ z_(tMd}dq!5mel%%ZamLjWKJ3_| zI(_=V2kLmd{Tg_z!;>a5y|h0zu+#idhx=OA=3wCcHCmqFxD)z%o4F&qq0mA_)FvAO zgO$#Hb(g4N{bvUkME}j=FJJfn_9!}D{{csnA9e&*Pb6_VswdezHAGoddSH4`FHmGZ z(O;aUh|x$fIh+-g@r|&Bd^A7$!U8u}H-WtV{=Gk+6;tPd_8Ja@?rrv{zHdE{`eiGQ z$zT&Bqm~|`k#PPy@_s=r;TL?|H4?aj?TXSL1=9#JNE3X&2Ua&9&aOJD+z^bhHvQo? z=G0Q#5YZtywY~K?@gbYXV-1?HU|vY?tgR%%5z-6lal{ZLJS|UCYL6wXNYC{;b}03vCO8VbWKUM$%H-E&~9~8LvVckc-$x zmb9bbY}&%7}&4 z9e$le`XBFD;4fkLT8ve!TJPYdq*-iQIdF|&xL`i3AUaJgsltxNQya7xC$~RQ@9gew z5D3SlE)y?Ud@HOa%BlYmtS6o5t)r__2sx&Y~<&Ki9@YJKaa-B0GextJ4ApqZe`C}Bm zRa4&r*v2x*D;^NHl@8AcfwyO3Jb|Y|bdErFgRi+vbCQdBYlTheSUDq)ql90tGa!#= zaeiO}Dr<)#-@c%Ao;9BTu);_JujX+^+f-~X{n^E)RRw(y$u>DI&)!KxhmBdIR0HJA0&iP%MnpLIbDfW0EkzOi`T z0UQQMI@pB9+k@XAvBWw6POPQvo!oF6%O^IBBDxezsM_ppg`*|CWG?-|c+CCg1E zP}FoNYn1lsg6zggy$7xfDN)s<60pqp45==L<%8JdGxUeeI;$n}PMWF`q7Z4;|KtOX z_5rR|tktBCA6T{Tx>Ah`%a@ur)7~DmD0W(eD*G#V)WZ$2h=;lHZW`bf&>;ptsP=`k z8+T%66akCW2gz0EK{%rr&Go)H@F3Vo^S;?b*y{LMwU$E^T_yug_FoMo?6+(`bp1zB zPXRPiewMCN#Xz0)+MQb=zw4idaS{fH!qkEaVQQ~6E~aYe4-Eg{7WR5tL7K~vz#e5N zP0;r4b7OB{Z)b$Dkx|>591`QBFJ|FUQ48B^oCF)ujc!h|iqYl*BAnl7G3W?eZaAe~ zt=aVt7c#9iu$SnOW6oFSVFOmC0UiL&FGS9_K?Pot(oE5LP#GZZao;+4Z*WKV20{XV zeTohnsR2Ci@)PBoMZ~3Y0Km|!4nfS&OS>3t@mZF=Y(*7s?G{u8^$tJg1Z$$-FRl3W zRs*DTRTRsFt}L; zcVi2xI6n%ezVkMA1tP+A6?;3gBlMk`Nn6UNNw!yIrDd%%!h*(A-`V}xMkG`Au!Bq zgaYdHZM-4U9NEgo)y~MgIkeE`HrMjWV{375@;mRH3`}i9yX|}(XP1q+AL1_azKi4N zv=5DLE#_|{?;}DX+kcpuet!um?nCCuV0o8ZdwRI z;A)d1+Mt8}d7uJjyo(%?dzOm(<&D0DrDZ5p{Gh-7ToS>u@-RFrjgNPreY;z@{{%?!qj?-PP|aa8%4meZ0n45&7sBX`GA6+*^&kmwa|cE}V|*>x z`cZ78`w!*1n^40cK}@gsTDA8^uX$cjcluZBLf9XsjLT8M&ZA>QHY3dh0E`y7b*E zmwxAJP`c-sHM6jI0TUK1Z<)cY5u(Z@xX^x)+do8|4w1!Br>xf>(*$cR z_Owo92&t0%7J=e|^tOT2^Aj6ssj436c#xKY#(f?z^ba62a9!-YQ7t4FRkeATGfY-C zUzAnzhc7pWTgoyuRK2{<0P#t}Uz@tz+%h-1xbI3T!g%Dx72{#^jjp_6(Ck>-ZMo2G zvio|~s2uldGjn!IqyfT|>K0=ss}V9=0{TJ&l;!j@d?4Sl%`+sRiF&Lq8M_XJ@a=XD z9>kU|XG_zIZaHncvYFtue-Lq>9`uxH7`x83{VfBaaagHV$Iqta-)ViS_(!`IxRh^h zxxcW{{6!`JvY00IZXvuOY6I_p&?qP?DegX)xgsfb1Whrs=JnBw@FEjg=;Qo&`nF|pW)xPzBn-|`oi98J3umynzv6`NsXh^^}frs zw$vzc+d{KHLTE_gst?(0pk;jp)u}*Qt03j(u*^XJ^xd7sK6lT+bY{Nxfml1EZv*bL zd6ctMqYV=Hpsm3@xyVFG6J%56Vmp1k7GVpV|@^);)@$YbSpAae(r({)7WQ?|3HN_n922T5e< z3ZP}JO<~FKN&P3ayj#u?=KK~-3g?dd2=p7~lSxc|6W9EK5ry*z0C5je{&YS1dfs2Y z7*)CUs*;PE#WlflrKt!bi({k(AEr$JV<*NW67%8TyZEGS(#y?%Z_Gazo)0_-yQj-zEO}(y9}`c zWi`zpX6l>Nq3@h;PA{@=xSue^hGKNfD9iuCrSMF(`05Rz$U+zqPm70cr^QUTF@T7m zqOkIB)uqBJLXji)nCB4mShn9kGs@oZ3^ID(AQ^rbqQcLr+X}z;68T||WWaNLKJ<)T z0MQu758kB%=5|v%RUwYfKmp@`P`pB7Qf5};%P)=`VgfO6iZ*8mxV5N-E7->@TGAFN_xJ@_p zLojIsb!fGD^Y@(JD_z7O>OqE51Eo%9uw&%W{d6{qK$_?N!sc>oc&Y?z>oJ1}3j~s3 z9=)5%YKGv9j;g-$l#|hN9>$c7De#g9V2gWK1+0!96*OcyIYoT^ddX#1dMZMSv@qyP zUQH;ZH>V)IK7YHrWT1l_t~F-6e9x+iA(H??nw#LwX2QruS{xAKq+V*PUKZY^54&fC zv|oO!?olNL$8TU~FEgPJ3*`R=lPd@KMq|XhKKD7*uAjvN*J0`YY+Le!C?QXR0;+^XTaoq!YD^ffR5@f+)f#_Bx0|P@0_2SXUtpjAkX*_&a&0>WB;!_C8Hmaf7 zYt5=>7O+G*2-?1Es6ANWtag-sRFg%A$R~&%FsWo9pyqtH!ovkQo}@^orD9j?8&s$3 zL;{G%w{&1g?Caj2b#4EQ172aB#jRpSIOidm_GQ3dr0reup8?v>8j_;xWLT7n+^8XM_CV%WE2=DI0~^M^4~p{w25g7;5#?UOC+=AkYrx0ia|kslRX;% zFIs0aBzQ-=NG@Ny9&S-_pO?3#L=>HLpLd{!s>ID7K!<8XnYVvsdZ}k)Ql$lVyZr&H zz9a#}AN1l!BjF_mZ zsjWD^58k{orx;6jC2D-y=2mksWh8rY!SoAzPZ6nF%L5Q7%KT;hM3d@W3Z~bL+E&vALz732xx8-0DV+!Qr z9b&adf5V2K;cyGd+pnQ8J5o?A0SSJJ6R^kRobpz+n#9B;6IRYUJt8B!O_#u&$Qom4 zEWh0KJ2ek4UA-~KTXZi=sbvArD{5ikd4-`p?OhAdAGbp_5|d?#PTCj?y3{`Q-0tg^ z)F`>K2sW@f?a+8^v5-f{FFKacWAC-c7o2>~oBB@mCU>n~yyI6Gg>!~*(tnx|bgnX9 zKxKCI=%2s+jmi))5q1KVQTt-=&nMMA%QBe7~; zDs1?8)YJ}w22CpxcFr0G3egiWI4e$C<;)lTW@KPg8@xeleRobe=Bp#rogf#Q~$}8n_GfpLcn}cGu-Agxh+i%*qF<0c~5r zv&bkd9az6X6-Iy8aM!&xxuWOAX9$cmxDax{I5>pI>?d%Yy-o!>?ixKtLc=l4+;E8E z%&4oISdXC+z|r=#B9$^SZU^H(XI*&Paidi-in(sDBabDk8?VDIYx@2Hqx)5Z_~%5r z9b}7|QmtaYJA6Av(T!r;e7?U9Pd^RnZ(6nwc|DGpb8>Qu7Np)2L%nNR?iqawrx;&& zoblP70x1x!SG@!@dx`9c>nuB%7ObciHvKfIyVVt6FwAQ-pKuraw@0Q=n{(h$QuvCl zv5OI;p5BNwZVxlA>cI(qg%AoBv`s|I*lBW{CDV)-!&ic^&&d ztqzWoe&2w5mFo`&E1xrhB?`dLz%I#WadQ z(p_zJ==dT63~(}0QBmm>8X}E4xNDUB{iP zteRd}Wf2$K(!XoNw>CgrS?q3;-ZcXznH9whAN+IF@xd6by`c( z9JZkn7rnA+fz}4surJN=jg2PV384kS*JS>TMl(%(>_~r}{S^qLakNHkHDj)weI!N* z%)c`p))iX#sb9irs&*ZdXL5SKs{bv! z_lR9V*s_N1`fg9MM=4Y(`Hnr%Guw;A#Kd!}AwnD^%*syjJ6ez?tHaE0P>ag|Az^85 z`r;z3(fo+-)1MTi1-r<#nm)5`zdxg|B``(-d8h@mUv~B9_x_>x;4K4ha$RwY{Z{ci*X1m=#NCPQ_{cw^CNMGuErZ)!lmeq8%}HsxO-^gbIX2*b#_e#^Mi6Dy9WX+!g>r2Wjvpz-V+fPR(*V{VrX;# zuNi+{g*h%ElO3yR`_ku&B%H1Hp$1T)c)cVA16hR`)iz`k&z4pC#b2G%5kB7 zBZn6APVIu$dfhRF~5QA)`D?IF$1}!6_By`fHVP`}1;|`(!mED%E&g59MDeYN`&6l$$ z@2XXOd3LjYqS$V1F;nE`E~yN(;XBRApp((guueb2*x1;7BA;H^>$)0+od zdA6nTRtixfMqpH4F;pZO0K4;#(b2Y*`pG$>Q8(Y@-Eu3ttSPyR=5qTff*<7oA))5n z*Uz-*6%~-%5d+c~%-`tLuo768z7z%a@+?`Bk4$2aFm;Cd%3I%6EY2xX5pmw*1A)5X zN|yI475%Sk2jQaDAByD75eVZv*9`z@jYXRcOVcVsZn@39+h_yB1O4eB%9^VvsJ{)O zt{Al8nXGbaB!)ta@+nGwdC>psFiKzhf;jYp-c7Jnfo}nSmw0KYpkds0Pa-@a!6R*ly5n#_fAS(XH}_mr z4RvJXfO0jrfP8_ADEH-|WRF&CxD7J^uNp^lM4u?;eC^4ZThccKYR3DNGV|PC z_0WUggrCjc`kgp10dbhoQ~V5mU_K|j>FpAjAAPoE03~y-UIuepa^LYfDJf)uIEFTMkMjzgq2j;5^bEW(CNC>vx_q8QLMtfdgi%DIoka*~d`_QCZ5fgphyr zyT1&c3L}WhMA~JC+e9orDdZB}5D=2Ls-Jz@uU}Tiv-N$I^GsFdrm@j1H`+Ctaf1nPqlD0 zRUr|30II1)jdIQ-()@*~37nYe5HAb<*!z`<-I4&uHOeI^InU=e^*&yI$adWC23$L% zQeA+(3`p!sE6QZ!(Z&CRIGUvq5jsRtmG2g7jbGkA>UtZ5>>YH9!n#Uc>Ujv)j7QN7 zr)_Fa5=}OrVx-?XmQYhUm%%$Gwyr@%g5x@sI{i2OOVC9(EydI>FX_Vh^dm^2vO(;%Kg*NTDT| zrC`wKi=G|BdmQTj1CO{czWvAgrQ0oy`Ge=>7S>x8l++ZX!hLH@keT=A3#3^^{o$Q8N~a z8ChYQ|M-|i)m<1XFUe!U?dUKxOA;@YQ+1M{OWLSj>0M9lH;S7Yi`n}EjN;ojFV~mj zXn{FQIT}=dqJ56NF2I2ln`a|nXmoW?u0m)U_rFl-e}D<&O7$SK(Y!-JS*|_YrnI5w z73F_$j*mb3q3f`R$?YtYxy(e9@1iRwFAqXLLL4dmlW)e{HY<1f3Ee;s^R@7pqQ_T1 z(G9)XgPF;SRriwO<~I6})5P@j%(%C3*7o`JA-ynAXFrqgWfywYM(C8=0&{p=+=A;S zS(2MnS2DY8DYIfC-JU2qef7yfM&MS2*NHcRsw)w3og?DNWhmP`;&P^0g0P)o6^>4)BpHbE`8q>SL^ub z^eD93$4z^fdRMyb@Y8{F#}ErqoQAu^>C(ePe!RMgEqcPIQIlUT zb+UK5Uy$!u=~(NRtAq$eMq}A73~)6sx_sto$lnVp-=L`$(W@NW_jAPBY#O@#@$gf& z!LdmFVEj$#FGJwb^G{B!>79_B)|>s%zICP?&CmZ{IhJjg%*;G=jC)afbG&eKXtiZE z72g8IDCE;WV=5_$^nSuC|6d-x4#C1QyW)P$Gc4>Xd+A1i>2}@mq;<iWp|I|i(Xf!rtv(2 zUKMaAPKV4;)P5)++C*iL9C5k(@a^1x4V;1U>E7w|6rZpGR&VnmAC8bHN7E2NI<3;D zU(bIi7lA<HPPxs+)B*WMrId z-}kGHLK10h&<(*llPjy{bJO3~ZNIOXfkbs~Z2|clpjXa0V;x|+g;MW?>rW|-l&lB# z+~RgsxH7)INy0iFvA}JbT@XEWik8$Et0Ykb*v@Vw#bK38#JqQNJ^QVtLqOG6s9`bzIMpV;`}tieKOE%VERat1 zR0>Ep{ga(}Q&s@rh^I$BS-xPZX|>~UNUJ+PZD#Bj)Dv$i|JJ7pfcC^a;kt3*HwiuA z<{c2AmB^=~MnMV3?0E;D5Jtu1ap={X++Q5F%gY^IHu9o#p3f5-Fkiz^d)^JJ+P)s| zH(6p>a&2wI3Iu6(-e*DB5Dl2bi{uJUZR9FA`NrJW^VoXrx#$~=>SE-phZ4qZ9sJy8 zTAtB@Blj$M%vP>eo%S-E!cyt|ZU#hCu!+f8K`zY#1q?NxjSXn;^PS3e$#pEZO( z#$~-vQ~^nmIfBi2?5l$+Shlk=fG(yZ#P{Z^A~9YLs)(^tBaa8O=^MG9Ik?&W3kuP&H2=ML zwCP2ryTV?<;~rCKR&%4dSh`b5xZtri2sb(d4Sld4#qD3kgT8I`v!`i4 zc)6q@25q{3y%Hc*G*KE0xDM!mG-=%P$_-f9QI9=sT5x3_U;7>9XoDK=u66W^e6*{v zm27M4mJiKoJX^MgE`;TD(cjCudQbFZyZce{;`j+l`ji$VC0);Do`TlX8`#62B~q|7 z0I*`)`obS)9h2;{l~fM$ZJ570wg1YO`2R)OTSrCpcJ1Q^N-5HaK@1ErLnsmo(mnLR z3^0_Gpp=x-AQD68NQ0D81JVuBB_K$rbc1xm@1URjJ+7074re)Q&AIP=UwiLs zUwfa6eX$(}_GP|ebS;xvp*t!&ue^&Jt2BVcO#k9~60cp9zJ}uQxh!20168N8`iksA zm=lGy7%v3Qth@HJKionVzOmZOu)hK3emvyxfB&9RbGum%n4__{Y}iuyB_*A&-Ct|N zMquhyozUTUo;&N>+S)~3(O1L(9uCYI`h%yA|<%_Mjo+)(DuwisO-+gZ?TXK*+ z>aJBy15Zmy3G#4i(w#YNgHsI2Vfp%Rf`Sd0lw|ynrQz3udRJv36F6lr!L71xrw(9hV6WH9Rgp11k_E6-LdPHLP&j~G{ zCF-tPv;`nGn^5xaVR+)GYP4ApC$Cg1?kx~ZzWQ*t=M|O4$BB?ZcD=dRAD(S+I4*Rm zi{0_Gu4KJ0NcvfIXt~bn%;bVX-?_)HoDRHYDWn#DStaS!vkk@Fh31ZrwpeqZstb?E z|NGG@0K8s?i2Z6lpz8(TPx6R>%l&@=32ne`18XmH2n*>$Cvc}oZ*xCZwLBfU`f-$M zb(Gb)#8rPeRiCmosZ!(u2+9j_*>$FtJJt0fn|+RGwC`6(<(xG~gonp2JAJWjk}Pmr z8_nevSika12heXnT51+|G0e9r0#!%g^5QjWaz2@^=r}&Fq2oC@pu@}G* z1iivHX&u6*QMC$_4s`}5jkZB+5AgM&?`B-)1b}==Jfzhb!ltIF`5ZtK*3Zj%$PS=r zU17aCQX)IyzHn0vY00&>@mXOA@oj&Hx9qsH0UWG>qMU%J}a3 zO>2d`qFGOu17AMC=)PY0bI{J%3(*xoauM8)q`W~vA#N0W2MkpoH*|UrOk9wwOI-U{ zqhZz9)YNA2W|Gr(p3^3EsAlPr=CN<-7*HX)cexT!${A3f9(4d=w1oRDEt{zvZXRC# zTi&ynP=t&I^+nn8H{5-B2M|=ZSnPfsABiI1Nzl4NO#d@MC1OrMT;ShnzrUY}uXPA* za;zh`afe^tvUfx#?pOgoysGWn|GdDLu9T1gMVLx({;n6E*07Ufih&JuLxVl0LAoMwuD1z(_+xzV zm#zF^`CrFg=x66A>n0wasZs{t9u_zL(^$|Jdgh_2zI!o82H0eA+}`4^ z1KmXFdL^H<1Q;?O^EI|qX6JaUEJ4s!tmX)qmle;?bkn}LS$y>`T^-;#FO1^@KJ~8^ z{sO!p18ZJFC;vY$`emG_gv13~t73Upm+O%=u8&7--}dd;Q4BbYaf{TguN9aqJpXlq z|CknB*-PRn2+Wgv3oTK6>rCSY2SNj#dlv(y7FG;PQL18Mo-U_hEymNcOB`eiT_eI( z;88x;dGoD1-dB2PN|t$z?BU)y%RseeN-IwKuTf(4901e3D);60e*DW@{C6keu?zTz z9KK!N=|2WF!GMWEGm*e}uvv`W31iAT;C-1@Sl-h*yjl5Zwtzgn7k8!`cxr)2#^BfE zRFf1r0euIvX#`~X_5^IYC2*T9rpm|5%geI~lP8tg_vHkDjA-kN;pBVmcfM|C!NEk1 z=Lvj9gCz?2jUYn_s73`=spYrm7d)@Jbb@4X%P&B zXVo~J7Joaw|G1)i_4eQZN7L>2WgCrv==6?ze_2)k;DAhBqJ>S(L13gVi_Popmv22v z=_I(-{5Cnw5p4Fw{gg6X5^02tX**Fusg$tgpDw_pV+0&m>AhDV$#On_-}$Jq)OH?Y zaq8G^^d}{nh;E^yi0sbbN{`Y>y|M09M(>BHtH zCxf(_Ljqb?%)I|hufvku3zl)tAn>umg0vIE6R;%BpEc0bqSDe10jnC&HRm?~3*YD? zQsjlj(`;%!#(erqCbtUMX!|;}@#NQo|EuxqzuTxt9-f^~&Ka%q!sXkNnDb35CozI# zZ?B0syKC1jli=W}kT*5FCP*aEQ0hBpbxNdhaH5H)c&f5`lU(!(Nu-V1H3_E;@LLfX zF{k0x^XlP*wyt%iVXnAw^BScn$BoW7z75ysjslF^!;=;V2{f286EHSzxF zO|r1)=!^u`hQ521+m-&U<|=sjLB#b4a$=^EWOx-sRDYRi_MTo)RjP0@BcFmmF4Oar zl+=g%y@sYERT#?yI6xE3yva9N;MEZ%EDjJ+h{CdH_UGQ>4_~U>5K)}QiHq^`9OAIMr>?DnS@LgR{xLWv3X{lICh3O}Ah{|iB3;T@ z0@O7g6LgukG`UXFId5Ev_O~sXF@rHlxg;t?pO~a^Tjbs?Xfvv(qOE#&>ilMTSu-O6 z=Vg|;WLwtj8oeiGq;!}6_~5Al>vd(f{gw9b6-^}lU^>V8ghu-B75;0f|8?W{y4+44gQOE43CT7H8+yE{+$7X}$7Gg9GdKX`BxNdt=M$1i7fu1r_V>7h znyj$Em5<*l`!2N5ndqJBd+YJIdIW@3t3NG!ZZzLVsySJAzfvV{R7dQFh1nY}=N_0; z5m%~Y8$V;zX;v{iD{IrjMr|@C##+%M1!K!mle_jUUEt_ucv1(@o7g5ZOYW^{43#s2 zN*2LETHaUTB?R~sv~$U=f;$WauigFQQ=#nwct5ohh90->Yr$>E#%1K>y({r=E4mVPNitic3UZGOKlBoQs0SagS&rf%E#bf)|LcbZ zXW5=Q#4C4(WONlqg^rX%qP%WXLqC3H1evgj^g5CCW7UzRh-g7GA8}WOoSzaU{+2`3JvS@qvh<}T7>mR-5}d@;(3j;US=wa9 zH=AZyglhF9Jcs?K?@8$p?(9q2rE+9UI&+b7QtQ{gH_NE|EGr>}jy9+M#GLdfKZ}eZ|DO?*Z7_divcA75 zSU6O!P>IfPMO%A_SA9^4juKFsdKvLh+>E%h;-e0Sdn(P>P?HyYwlrY7E%pI6{Iccw z>ewEXBT?9@_3-JMS2*U=ti!#3ESm=>KJW{`I(rJg?C!@cz$#Bf6BZc%w9~%~_Foro z>F9|uLzKHtr}(=~9mQ(-MidaEYz}?lWZhO)62cA$A6k)Bvs`K*0?Dcn#{faeh$+J5 z|x*WT@UXn$`n7gd7;jbgXX$n&GfZADURdgHxt0Z*fJgZLGW8MIpw?-||tKjObd zNev^yohc7n)EV{#-f=sTC_iD3UjY+qe;EoQ`8 z2o#!kzrDxWa#Ec+;WfLYoJhooju($(EqAogZWw zgCCMDwVNa*4;IJyUQG|_18~XsOim;MTcPKpIPNsM4&SOgWdlswri?M?p9_dbd~y0` z#a`Y1eYSl_LTfi!&lS@3#|s$#28n-uDQ;wP4MS=_tF_{- zsc4i66Lj`~J_is}q}kDx!oo>CVWJ%w6z#nGtu{s*F(Ip01MGL%4njoC3(rjL=Dv%? zSEl%jKK4hd%xmwkoQ15H6+_({!>&5p*|RO;%UBnxC%GNLXd?*-w;s+6x43?@?Oflg zh})28kdhr?{%N<)6%kn2Lz=URtr9Y!!HG;-arC>lhnhYq}PMGE~o0)d=d}(OS z6h*WoW333xZ+Ce{mtM0CYXO0e;l1Ea36Ahqj`_h~N z_#fsi;z9hul!A`Rv*GvhJqYwTk!6vDHoW>jm-#2{+finDWMfp2nYx&e>3Row#MoWg z(?l`zm1K^@=Gt&Xp4{<|&NuVrj|bZ0PCpwx)ODH~ZohkNNS7M(vM<`&2Sy})i}p*^ zaN!m6kBPTFaSdm+-t#q_?+CL{+|wut7ZaN=xz%V!<6jWsB&1BU#Pc>0h&IT4)rK){y3c$WR|P5$@71$0{7bgSFw9dub4q#c0K~ zTY?Yjnyj^Av7=S0ZBI{UQ=|7zZUC8jGE*Bep>nTrXw%&*5*w)4t&m`37v;9rJy?K= zj}Nr8cl*B5sx&@3SUxZi;Va2Rceos-ydN%H<{^@!!xhsx9S5D`M}C}*=qO2+Y$NCp zT1ldduz2}q#ye5yhAB0E@DQO%I99Hn-q1gCPjh_zFPYS z`8k}5o%MG@uDCBLjOUeeDjkAeWq=}Oko5X0FeB(F8W|dfC2xaCZAHW)%1sf-_<%xa zlIVOQXOYk;=0$Yh?R~`<|FQ#|abiH&wOQl9nU*Bm-(M(lC6^eFeAqu6162>O_-EjB zq5yc=+Pq8MO23f#88;B#Ns$@5|GlpNxzfO$AIw+wZsi}t%3w4*e0{a6qEseJ?rkul zKD?fnB1xA1i$CYxg@9?y{X?5??%ru?-%HsTFTS7T{-C7X4btb!2_%r~i9`^_U_SElSK^G?9kphdM1%1YwC)pMV zu%k%|f*SQcSIY1^a;P<__b)^li}>*L)|xV06v){I*`MwwxkQr1GnaG zv!I^zS`2)==|fbjQfg?@_P~e&7@Uy?(x&I`1!>E+!5qC=SK_Np!2*z{l~-Rtlf*qX^HsJxAM$QHhL192DKF6on?`VP(FzT&qh&|c=Bk*#gQ|=L8l_F5bUz1L4E4E_buE#9Obb+DN6igCT6<()- zPV~&)Q3e=loWhH6;$)2~EkTF_q#Vx`n4*$`xfdD;Q6)2i>cNoS-q#$Q=k0*=`(X9X zHMlgQ4JrNg6o3U$d=T3ePvYEr#?a0(8~)-d!|YeDJM~l?CWLzfzKb4a7TAvxMYBlY zGYmpZR5QP)g%r3+GL^h88I?^4G6knS#$#>w)L^6F%iu9tF?qh1wApPUSq?B z`^Fj-M){-)-Ti0M_)p{rP-f?)1gr|NA9Rj`fiTyXSz#x@9MNMEnZ0fO>AoaX8nr1a zds|>naXk1P_%sZuL6t0)OMoAd$3piNqWdBRQKqrb=){x`mt;Z=@^Grb!qDzfX>M!?y-8CD#6lbT-R2c@jl%k2eNk2Qa&wG_pm9T}DpI`+_k9MC4qyOw!r03{%xL`p z&jcyNeuj!v8_S?vRgr|+XHDcHUJCDxMkeQ_=!Q72W%TwKCsrmkVodCq;ps?@V~-xY6~x{Mc__sjl&uNt}l7JV1%=c=MAvqTeL4gUmLW zUJ|+xx}LaGX4zt`YIUz$4$hdZ%!<1$uA|K3n>UqYYupnVqH^%oW1LD z1syosnKs@(Bg1q&GfkVvs*BCYSohln^h^+ESYAL6pL)Q*g6V^Imn5O?$_r0qekO$Yxk8QWnT^V&GeM?KRIo;1~M;q(4 zDrVOzDJQV`i4zQUBu$ls4u8U$&*fgC57|eA-%3()bU}HKTWMF40`Xy{@@M$1ND`m4 zONL3o_k}$6O}Y#6h}vz83lQ(i@rfdDO6hAB1)=F?sx_`bsV_?bbpz(LPnoS_ht^YDOzznE|VIDm= zS#l*6tL@2)!wWEy7m6ndg|eSQXzP+)1+1qRMagFuMppIT|D6H>j^RWJ*oE`F%hJD3 z!ZS9&A2e?nS^Z!BfbYsWuqnBX-;5gLWU7p+2)83_Jk3ACkOk&`IAnKY-@T`=P1bMK z$0nUrX|JBRGW06aNIQ+NVkcSyIVGS^go-D};_qn-q}7Ir?`7mIM)Nx;%OJV#UyCezVe`_mk*HL?({FHlHAIy|5o^w~MagX%nWIqn?Ow?D`P|25 z>u9)b^v_#4VOTqmr@19XUJ=7?jAs!$j5|6dC-vxlafVu$X*%fD8!SAeaGXhR7qqO$ zKU~u8U8P;Qv!W4=u7C5QXQjfBFZYldcW?DuKegrqSW&p)7I0E}DhwE*!|E2{qT|MI zPRlA)YDEth8lI>^S3B1}NE8vMq-C+l48zE<5)x1^|5l{pVChydHYe>8Gu8OpstB|3 z`{AQ&D@+3oS3}Ndr^!g|TN0Iop^QIbT02>z%It4y&|SWYcYrF%k}2S~KY2j3F$x5o z9%ii^|8(8Jbh{LcRat@h??ZA<0yrGuy{C`<5t#mkeE+z(4f~?g0~0KVl8Q@clND9C zQiG=3CCPRjPLclj1j-3i~~0wCa2M9@+YB-*>os<$VL{K~m!m(4(98ri+dpK?MCOBtcnOj9_+FGuam% zLhL$Km+lVae9j{}vQe|U5gu1uPjNL*blhn!yx!5)>>gw#WV)brD+4(_j+McO;oSE7 zs4bO&*Ef8AN3_V+yM7q&GwAnv#;?{fCcCK06=hMdm=>wYdKCw7D^h^t5k8d0hP?w}=K% z^WED5f&T)He}tyz)*PjOOX5^;GdMZgkwAF&6VS8=O%cJ!#{uk%7;~^IQ0ER!AY|ueqGn z-Gd=9-|jzN*)A)IOi~EGbHOKOP2Esd!!LJeG_>4R+ z-wL@(6TB#*s84A$5jXN{kbk`~lSjq9dpCXujF$oWiTYBQ&i~Fmg^JJ-|3ntS7k1rDb>bh-WH`+j`szO0P>c3y-Gg=v)PK;H`5d|HPNVmVY)disyZS(Q zcx4L4ziAkiz7Bxxt)sikdV3!%FocdkATeGrv#7CEynf)FN(GcFjI0hVKp0 ze6_&nTrTs3@HMiHxEs{P%ks-Fd}qSrxFumQG6&M7?&L>&5EqL6_WQ|wK~vWe-=PwX z4Z%@6ee;o4urKrRHU4T8kh!c^K-glQEQ5rXgok4yu|QBZ@PJ+m!H8;83~}Md@m|W6 zeA{3C0#%`pP-&SVJ^p7&h96#nRQ~3~enKxFM#!vK;h*pmCC2~DMgQw-zd7(P za#y-=sI4m4*xBpaW~8lQRYYFF5(#^Jh@J%UY$Gyy6l*=^PG>u#3zTfx$0WsY2-Qd@ zw=90)n??urCRdLrL?h*>IKTMtK(*IE zrlUNt7k=43L1L#qvIfEQ(+M>Gg~n^vU;DHqN=a?R&_U*4uS=3LpKq(fj@!Qg?~Nes zIz8HGkHuLN0`Q1J22qa)(5jKr4#@7C=di@qicy%woG8Ikw-9+d4@TlBSB^9ehPCNY zha9oNpHeW98I&&SyGN+;6vVlx_(PkokME0H5yG!0JaLWHGD|33$nk6G$Z#2V+UxPr zRYT&|YOivhu+pmmky5h0SP`jK>mm}S1{`)x-CQ*Cg|JZIS3$j(r_OP*mc2Jh$4@;p zZ0|m?1D{XGwJo2N7ZM$7h+e4yeaoDgTO8cDPA?l1sg5W>%zJOQQi%OXzFMh_ghZOt zzohUp&7GnrG3}{IMRP=Z7}0lhxY@}{6u`mR;nN0l+IRWfd{bKjDX8rijNblh_p0as zI45*?8u{xk9UVZ760~;Ii~gOZ{KHrOefT|`aX=u3hjW`ROouY^opCFMjw&0*L#f7- z{RiMuq33e+bs(l_Y){VDX|3akdet7@RVoP|jkKhcdY2r%d>r7#VPv;L{S95BA!JxL z?P3yZYio`KLG@PhL87HRvuqe~KXnfTATZO=xZecctoiA>9xXMeQl>dPu-aoIQJ6|Y z&GjM)wBREVx5_$ZEhX5Z6yf4`B_$>G528mydvh?n?*a?n52^ECN`FqWBuPSQG)r~( zrHBPe@~jV!Z5b(`7S;CTr=TK7Oh$G#`!y>`C??|36hs2eu(mPk^OOH(|8ow@raMd# z38wwuif&oJ+&`}to*niG6xtc55-#7Fu>_(-B37-oRzw&4m?+_A>x>e@Spr(#EbsdI zdP=Hc{LPNk3V=nM_LbZg6 z&`2&Zy*Uyrmz(QNlfmwv1TW0Bt3vBI#0P1jQULIOZ{L^O0x*D6*-8`Q&zl`91=+$q zHt-rHTBc(4-6dwE*q;^nBjIHPBwK0{YE5C-S+swnV9W`rXZW-jJ-1K5B0?XXNe10( z?Y>iad{wf5fGjMhUEH3C=lh5 zkPqYjb_=sC6VRQY&D<;D`KtyBfhb)AS>e`sv(-I6cSDoI{73%-R%iqQGy z2P=UdSgx^ws~p#wSa$DR#n~0jqTZW*xyr*8rh|Pyr!($aN!Gp4X49}Dh=}-L2)SWMXBHWcFm{~P2 z9Z2Kp4OzT;1`sg~yO01#?%o({6s{VGK~odJ6Pq@O{K;4B37*J)9;!c6kyd3fK=Zi$7T z=lDHYB1_UjX%&v+5cA0bMb_i3kan*t)cs%%p^5bGNwR`L+?!U!qefo9&{A8zvE5I& z7L~g!Nf^h=&?whDiR7(}t2An?ZyT@6-hMhQ#r-ng9FyT;r+SwjwJVm~24VKXBN2Ui zgZ)g|$jgRRl#_8NDI?6SncmdkwVn= zO8!UzFVo$^bv$=JB=Gi}I_%6wUr>5M{m41C{)AJgCswV5<7JRbGiKzyn`5i-3^b*%|p-hm2`2@bUI%c?B=?bkI!MX){$v_P{7)itS;wx-q?c zGhMpOMQ1@@TRF9krc=)yz{Gc-(Ci_O@ovz*zBN+3mhOj~E5Pi!sf!v&$$K75zk5Z$ z;N#aFL_A2-@-WKJ`8vHujK8=F5>61|;O#G?3C}HXU7IMpyfWafdi=w-`JdUtWgwqN ze9;3Dh5oXGFA7&K)1%sGiM{=3yV^sSmpPx!m1@K`LW#**Rz|bMYG%#kJT`E(?ldo$ zfhHX`FZEDd^`X;riR1WP6}^N%ME3agfyb7`fwA%Pv*UW2V9~i)hjZocXVt8!_PP&$ z+~I~P@-AlO-~E-JynP0G^=i^`&h67j*Ba}p=32sIT}KKjZ9dAHz-Q^f6`w^UkR4yY z6c{Fu4BM2U){ItIz$`YNcuvCyeSFufZdOQ0zTDZ8fiPP;CDm`(0&i?b$S? znJgDp^4s(%9rtaE#nE#}9upgbOREg6d=10557uPb>=M~WHzOh=(C)6&Ihpr~DECPp zj;1{Wr`8UkkzxkQjjWQeZ-n?=QjT)%APKMQ^BXPkL8VN6#^i%7Tej-X57ZXSP_SX5 zA{L$GU1s;|n{Acn1MM}f8D?LBlGlTc@!=6xrr(ii4ko)@re}GHnWiW9&_<_E5ia}j z{6q5XC(pIP>{%1w)ctBfTc`e;!(#N`lI5&+?s99SsywGmLA-~cG(jkDFDVeWHX39j zNEU`oGY3Q1Y+g`Yd7;@%G}beIz(ZE#nkW>zbbz&fs*%rvU|^9}b2b)NQvgQGIX z)fsdE7Ald=m0+HZ@eYN~K?{fUm}`i>>ObEcY=vlfw_`gUzovYsYLvo5vJi^uzD{(o zl#+-bgIi^UmQd6|hYX>(Po7FNM2UJUgJ1 zs}b^e`5k;X^5v)Kdl%PB{U7DFir-GXGgp{ekuN$reiQ=HYi(Mn3vxE>i`;+5Zy2l& zo{D2XJo3pNfgWZtx)fsZUFJe;w2ukyPdHb?29*>U+kG`|X;EFAh3 zfcz`8Ov?72N^LRt(U0*nN9;4^_1AL>iw$@OX5B6Hmd4>&6UG^L+NB6LEV6O&dvd2m zu5!lw1z}|LToeHcRBK9t9V5o3g+9(*BK1eo=*0Nn;?geSvXCbH4qNj&Bgewwv2^9K zsupYr<5h+&LQ^yHw-no220wa;%Z7hQs4}1}_Ql4d@gnfo9LvD@F7c zS`m##fnWQLniM(+eJuMdb8<>1h6%j$$=v%H7!2jflK`Zj>Hw+2+?6P38PfE*K={Dv zkwfs{T_*&sTn*yU*2imyPU3mXhHa%Ur6!8#^sE*Uu55?M&ek}}*_E5s{vq~Es5bY) zZO5PfF^&bk8+u9^kVp_k8sgRKo2`IhK3%`#qrH?av3vb zdsb=BE-aMuhrG0C**v1;I}Fcbzg$CW{^E90-V2vJYWqjAC8jT);_dx*y~K7n@#|F? zf6f93rWHbu3-AW$xdfOznXBb&tYs%4*t%+y$g{Q`J+r$uYC0ReDMNaz{ox;Rz6b(` zXl?WzK&WlHeS#>{0B@f;PI%6aGOV9%A*NUQPo@E`I39%@vmgb5p7x!>+}e$7tk4;->=pp3xc|LAO?PPnpw!sd}71k+bD8qc1;FP5y)2{>0*U_s;`g z)F^}Php#rl!4fK0C7`M!PGgRmE=i;3@zOxXR`zWCdAw4~CWEh?G|tv( zjOB-cD=jO5{?_(qKb&9WP2GOHNICaNR0<0>f@W(N`xzKxzt2LgY1uZs=LGW)R-^VC z;q^ozfy8jk9HDQ+EEP#Wl1@i!6g-ze1*9%J+z!!TCE;SXK{%>qE3=(1iLZ|DXIqP` zIc?$URnnIsW*x@s=Uy9b+24)P!VS&SDjTzuud!sXUAeSnPZ%{C)HY~gWO-kt#&XK0 zJpWP8h0K3;`v(V^9hQEwHrINqh~m%*)>S;yI>@7#SOU^hYD2had!Ugj84Qxp%?^D) zX+{gXR$|(;i9C6~<)&mre(0o>KTXqGYQQVCO0UPj!oQJfU#WQ8u9L-LA#rlV-T$%yK4U^P;2qP0hF2yJ~Z^-fo+GZ>;6~%5uZB$A7=J#${$8 z?YNLgry_OogBkZd=3tr<7sA{vy1lbQPQWEr*|>-kV*a;e4YNkyqI`W~NlLzG;(Qd~z5xnbhZx4kWL=9q2vQ&gf1| z(RxeFrmEd|YnXO+a?vx?yw4p0~%N%}Jf7Xj0O ziM4u`(Zs5+EyjWPfFe|MRHSP1Mc-rUeZd_@gGRwTi}sGry55c2=AL)BMM-&+Hpe)n zlG#}}&{5lx+uN+uBf+1s1#JL>J%B3@n5|Y%mZikySm|}icb~c0voNc(KPK)UxOSk7 z5(G@Xf3nupBe*8zhg|PMo>k@84$_DX(fTi%26z}xwk*(A&0x$i8nu`C^?I+~9n3A- zs6b+z@g7d~La)d8Kd55)s_2 ztkjC}TMm+yI=OkKf@XaBWT2Je*X6Ww;sEz5{@tyJ=k&vh*_4TG7z3lc9@su8Kg5)0 z^NcmxVbUl{snTMF^6AbO9Beh`pyV1O!iWWhxZL_!Bw79s;=tU0^JuJztzk9k=C#!Gf zcS&Rq>bfNY#u@lE6);XGug1jn0E|tcYn1TmOsk~j<2H#(ryj8*-*gZ&ILjvj@Un8UG zyZqSZRTA!`NY;wywcpth9Rr>FL-yLsS_+3C|Nii6v>lWBP!(c8u-dP4xfsiu)B@oK z;%NOJk#3^B3j*$xaiUp1Y$+AuxEoIx#1?}W?h@mN-W*LbqfWu z71U{gp{d>xHn+M~B0DmY>9*r(P({8PQlru-odcw2ykcN{db@l>mwpIAk(^hsEy!mN zH?A!24i-s*UQdEhU?&6=Bv8%L|NG;r{3CZR^q6(mVsUsZg>30uB1w=_vk zGulAaA6Dv8jSg|>=>U5!!aU5u*brHOqImhz<7zdxulxMcP zK1#yPi;k;wJ~*?FigsRW8x+)CFJaPq<5xbI=rTSt2V3zV#%fcujQ*y1`gE@Zg~K1b zT(#i8biBVRVU%_tCCT(h+Vq(;R3)3=ekF5evvXmCet%k0=RP4LF&Zb9+ssct)oS48 z+K-y?3agI6wLeJj4@goLQWAavzgC`-rPMbQlue*f$o#uN5wUTJvC}W9GB4v(I@yFd zZ`n?sFn1*hWcO!MtJ7%Y!DN(=ZAyaBR{qZi-O#%Y$A0EhsB0q0Y^TTqfAO1jRK>l|y zYUZRs!n|wUSf^C22Lf~x4DfUYp^+aw4D48_~OJGWR6}1 z(WPz-4NwDfLwE`>hdBKo_WA-^-o{FQi7{>Bl+JV<3}ayW1vV@|H99N)n(c3n=`xJ2 zT+=r2wxA+k1u&C?9#Rnu2uOcp+lT_4FdtRakPAazTE0Uab8Gu!^~$Z9lUD~ z9Lml{`}a4-y<71%pOO8^E@|M;F3h8k6Xfil)*S5!lF!5021W71>pvt98Vs?tuz-Po z4jWkYFsEg&?=eUwR5^t4@!HVG0=I5qddF5_^Ot=&wydH+y;B9t2C)3tv{wkPvQ{qc zAb!8+VYvN7MOaRwY=Cbp?@rh`wu-awMBvx!kzo7kfToII)(|DtfQq$WogSdU6xzW1 z?tD(WOP>UEDFLCEarQ_!Bs_;pA?Ve|GB8KvfV7IA!+|CRX--d$m;_FJsInY4G>qhy zOb2rodx%w|Tv1B9#{=x2b!s76R66T@4L)13A@?2;*^F;7 zwPm;h9QtkNri~lg3htWNx??tBF=S3?O!`NOB^b%(NW){4q%eqk9<9hWBK@<+{IJ5*`sC+Vz~_ zx1s!PCv!NnR%AJ~V3s_i;6M22D}EyW#8@9ypw=N*|Ety^B66Y53yt!AX9KiiK&eFY zsV{0CeKuFRB(wLuO))whZ8(EFhBMRFD+&843df3y%zI~}kE~bGsnKb?uK{C#GG@3U zif-Nv5slE#qfg$}U{;9yB!j&b?(Zw#ArA`2piR?Tk)SM0XwFw-%3+vPiGK)(ctnP( zSPB2?x2T>145#-Mgy&BHIOvI}AKp>FMZ5Mz70Gt8#c)#NnEKtd1OtnVF)^Xz=Wi}S zwdMWUUT~|#-=8s?O;tRe-7+{Z{D_5xGDLu|4OSDm$SJ1g5%@g4iY*1R^`pou6^*2j z6Z#Z&f6zz1W7JB@Ytl-2KvZ}ejFa7^<2JQSx3@s($utyd!s`gj|lh@K672v@~ zl4V=+Mf`-7uUpUMMBYXi7*b%_C^0tYD|C99$C22Z zB-y6MP?b!Q2kcjnj^t2BwL_sFao*?6J%;O&hQ&`F75;Qm0PLF1>wkF#@z<46aDEqmlgg z*nT@NybGf{x1gKLvVJ2kq3zdEiPp(I7`?D;g*;1$d`I6 znn9k+7LEaFv4*kEiuZ!VyyY=ypY@!EjIdDcT1b^mnw;898^Bz)M}fGBt&i%)~S4f`{s->1b9YfMlv#}x1AfQbaX5t z-}3@KX`O1c>crgT?9k3g@2S<3ME8GnSpBzN3TuT!tIIc5-rxU&JoB)=5XZEH3ts#! z@__6W1mz0Q{oBCyA6DRYjIp4ubzo+nUJw&sN^#=-klVs>zMk=HlZnyQ$MGVjrWt54 zJHhKWtC3IjUbrsy&gZm*(A2Ao6||RY*za($4z)7Ua!2(Dy2Ox<1WEONF(J{+!*;%C z%)1wPo*qf}2vFueFAOv{W=7$+wdY8bg%?mr7y;6-`}s>9;XIH6gas)!P3`B8K9dBg zv~aaKXG09(Mi|iNK^dm!^jMpWRa15ta$7Y$9AT{*crmh(0C88{tBvLGCgX|%xz z@TbAAHO>{GN^$`OGm{(Ps}VA%OAlugG{^!U>m;g50%qcg;YVjQmYBY7@I}8|d}{Dv zB-h34lp>2XzY&CLyVhk6k?iihMeKbKyVPY7m%kfT45;Jffp3;BY|d3=1S=3Af&McR z&wk=o7kkFhR_E%Y9aWI2qpc-1zOqyYfsfrnbqF0BNIR}QvzOy>e1thL(YLN$x2Pc3 zLW~hH@Swb=tysQNFF(hOI!?D`*#3L5TMYf%XN<2#4@|!0yl^%K8WO>TFLm3I?F(L8 zoBCl`wqtA(bHN9}M8m_%)bV4paE!TOWj91$bA^a@*x!n(n)U9V^yqI5gop^BX{1n& zdiUH&pOBH`tMAEv;@;%u1sq0?`;N0f`QJND zzwJM~Yb|=xF6vsQ_BrN!I`(YkMcJC~#Y10kQCpZ)RU ztt-*O&yQkK7{7oJX+Q`XZks8iouBZD{NvvGNN~>A8%F$&lZ}my=nQ0p#jT#L63{!O zX2T2h+2PweY%g~(up&w-MNrUI=UTDdi3_cABWG}SH zerY^$cKR~ynK5CJ{-ks$_m3x|S+K2k1Ezt8)b0|qfR2LdF)PZRRma02?L`aClPX#> z_oF-{FTbj)B$V|@8!mR%MAaUw#R^N*lPcf>4eyyrxSuUD=(;EdRnG{GXNJ7rY4)pf znoGfGbl+n@`DGvhxRPAhpWX?%mGZ##Q?3=I4BZgk&c+*t+*S9~==XEmq7*rOj#>LF z%gDp8pWPxeS~4s;N}a-BWOj$Zs(aNujVff=U*Q>kqgm7C}Exc zZzR7h1#Fl;%P`4r(L>%v^8|(F-Y=O$-9@qcl}`5v?_Gan@tVJF&4pw6K@A9%6Rinn zQ{l0^Enc!A^dA*-8Xj!h*#1mM8-R`9i6~jK=SjWmU}8X;V|-;WxG=1Nrwd3e=p`70 z()5A?-itvq#<&Qol6#lID0`8cWOzBFp{N>zO~c#WebYfgMYZs)l!T(Zyu560*-gsM zSc6sycD?I5pb3!Ggx-cXg(I%UW5RO$mqE2d5KUGt4AuzDh$C4-s*+<=L`Fik0Ih>H-KB~1`Z!o)tdrL_;$L#Hoe%5<3nhvH z_1jeK%f!d3qPpMOQ&aQm43^Zf--32o{|+NaLqtB`&sLjYeCr`DFUzPrp!QMfpVmp5E)-WqD8vkSCby z!E{(t0)ju}JKo|ivRr(iV`Y57706ij_9g2vK)TWrrBJ9W5*_LhUw{;$zPYk}YyLLB zuDczw*a+j{0uIL@GT@C@&B&n&Vt7(``>(!!{ zLRfLfo)|Z#I_=*1Van5*ej(7^3RNej8OsoO?eb#)A0*GpUE0cONB>7!_4diq zgP|V0g!GQ0Marn}GH!Kp%o^U>7e1B+I`eb8LUB~riQ-KnK<;siQlOW?o%yb>;I%Ml zqamFr#CN!6>9t9WpkJ%^Ep&TCCp+i9{j=+MpA-@A_k=oJnr(X2#|-(i#W>S$`ON+0o_CQeZj0k(!5QTCs+)JCr z?G8nHJ=)IOHgs?ZvzjCdBf%_)@Sv+%+Y`(SBwC-V@v_6P!FlZ(jwxzzM&ciEFemay zhbc2u-T({|tBD(SJxJUHIn~?!Cqmq?rEZV|c7OXp2}_~aUB|)+kCO1aYoho#0O7!u z*CU@o1%*RBqxj;Zj@iE+dKCk^tssxdY?k;raC#{vr+ld`a?n}D*|pNgg-oQ+-6;E2 z$bnL(^+kA{OjKiLVRTelm;=jLcXF4AjEoGvi(~28(D+s(RS5s$Xah5G$)|SR z-}b2tq!2smVFG%)Q>u1jWBC2vx3u(*60@C;>DLAC8g|Dn1?0L+8NvCK(#F5Xm@d=P z2h^YDTy~s3V)(^yK;s4G=lj0B18U&sV$EBG1H0FK9$b{2EaIB=VKHgvW|2e(cf*r~q^>ZVGtL3YA&5f-Ob$<*zxC2s%FCq>UU;^@z^+;ob{40Y(A?CJkVEy*GMPFhKIX@Ozj|*Og3~~S9@POc_cbo(7`yRh&ufdrt z=cdF}^*1UK^3EVnQ;U*l=%A)N(N8&UqP)9*Siavy|NbV}hLCyD&<$=`1jC zyU*$2J59)YSZC= zrh-y&Kzl&;@*!1g;NFk>dBGRwpY8JPhB?|wEY^xwJBAW47f)%mz-EELH}9g>lO~k< z`(|*4(+$=S$MQc)9Tc!vRfUQ+d9!4Jnd-Nn7@zjSa&&(dPD%7;IlC}+bNPH+*AhHL z5*_Y!XH_so+h2QuB9vE=eO{!=`SD_&({c9gu$+<=t2*?&`1W0ABwSUG5JnP&OYjh1SX@gc+h9|kYn~AqYvd5e@ zUw=e=l$9@FwVm-Di}5Ac*i5Z&(nC@oNMk^ed>i1vfYek@H5uh*MjMD*tj_9 z&KGJbIvi3WDo>f(GK-Bmpiy%>_D0LOyuFngsKplJ4R6S;O8P-DohCjiaO)kO0wjE} zecm@LCITkKl%?s^TtebgKGcM*QWo{7y@OIi;zXbW`c5FfdV?lA?W0p@jT=Sb(K7)F z3lr&P{75~_koWFB7fHewNk>pt{+;@2&~Z>5DI$%=88g$@S7y^{K9x@hRzQQ*n$ez- z2|uLEgd=uazb-ny)Ei5VQt0$kWi5>6Y==@teXO$Un6E6chUab`pMQQm^|g_ub?T)n zB{*iSUU{}^u1?bq-gz=R-`Zdx8AF(&brVNxG9Xq zP&}m+r+h7oKLu_;l^t6enLFU*8fOJ)Orp6Wks(0tl zuNk=;C;WgS<#M1UwEKT7^RXvjhL)T`GU9F6&WKk}v%{p>(u^Sqxg5)H5nN5e11x@B zCGh%P2PEWtdKytyn+zR-U7~l^UWqET3cg0_fG$4E;*RMne*J@ouWR-F;K~abySw(^ zxx=G271P#Agrp)mar%p~*1qk(5q8D{P?J2&D~xdH;#Ch@kyoTQ>VpatgE%zb^QKGhX30)|RtwlG z0MTQ{N4+MrD-A$J@{TcHI{@jnI`e9;tbHe&SnsCkMqprI09KoT{W5BZ{W217!Kg!_ zEIWIAz*pal@F?ET`I#ufLvVM$kruR&+zdZ7Lxlp|pRk2F^oK?yzCT~JUOtb$9Vu`@ ziYH$;>@pW$T11qJ2l|9cJh5S8QOrWOiT{jgwYAkB-RJA;D4}Pw8GArIWI0nt&vG-( zCD(lgl3knLjDa`p9IQdaY%(zG5w3_FeJZ2A)eRN4P}|dQLS!DQVFNh?qQSKg&gzR_ z7awR@RQ(`0(c;il95jd*V~sIBF0DQzP88kpjN1pDaVIcs|83p(4sIq4WockEqnaA^ia z1c8e~^k2;Am?N_tFlTTfyR`tp9f1Roc0ycoTx@S)=d#oLUM->$P><)2gB$FT z0qRR$&}l!gNhwThs?Unk*zp2vqELGSJXbQyfC?w3SG@x-S^SMKFn>dSl?#^=lX0XY83%Q{xk+x<))=x2 zF<>Vaf%rnYTQh6A)5g@Z%&yw?9pa>{p zpud1#qSC8;i5XS&cYGCu`F&dXQ0+>+Kp#gYkt;3x{-L13x`<8JB-F9+G0ZGo5`N5T@#tudIjw$Q~q5QK)~A zS3(mmx5f5L1E_bF__efOGGgW87%*a`R5+oE6&*+agBb&eq&nj;fupnep@T zx2-0X`(;R*!1-iWyT>{Ui~8$_1#;u)UgWi1&zno1_aM7D2QqI8C>tD z?v}xZiucO8Mk*a(syX=MLxR*v#&oz!N6qHn>705^Kr6d)h1r*;P{q*>y!N-YhE6iR z-M8~~&v_NF@xk`Fjhvq}hZ<(-!a3pAVCG7&G3}ND`n|rgbn;Ekh2$ys#=Wy*y;y+j zWX20*Lp6F!ZLo?>CNU1yX_Q>tjX!Li(-U)-;`w4(wzeyrb1&n*8S ztuXy42I_2~cZFQGXbu&RZ@ZEbr(A(kJDczIW-+D_eR`u`GlUjm>ghM)^W4`f-RRsh zlSq?!^?Sy5-PJjk3r=PJudn|IXaDS}^=fuJu%UkBdV=!}_}zt(5K=yEEewM1reHLW zit9&k6JJRh?H4H6nEmASp^VK+$Dy{Z0x>t4532%Bhd--)yb~tPYdU%A=B&8@x=-d{ zMFp-^vVfEnalGGCr658Mp@3)-xeOT%VK1?cTVI|sF$rqAK9V8kb_c5ef$Ml2)A4cVq299W}q)&RC5IkK5Zw~2H z(oPs*y}@pelR-dnrFA>F{v$HzbjqrnR;hBOs?|IuS*XGKyLsyhu`KF}eftwikV5=i zDqT`P$>lHKtA?b+y7e_>tB_j;j7Rnr{bMS^***OBs7`j~A2W#R%D(F_9!X;F-(HzC zx>cz$ro`C;nhO~_URPFXGoyGK8&vU4^69X0*=^3cS5uC5)TT0qNAWCG{EXPZ!WgkW znsWJ*4HuX^u031R(>F{S9xOn>N<_%rL+$a@rl&sloM`?{Y&d|hcy9Vz^WBi(A?%p+ zuV~sMUt+^(&v$Gmtot!2Jt1aM&e8Wq*I=(dh9x8@8K`mGyl$HWn8;ea&LkJvda^Wp zxSg|`hQnQi!FV1IXq5g1s^xb3E>@G@y5*3J@gpsRtG52s>wy;x-{gW_x9Mv-4!_Ah{!Omjqe50@ED1*Gq#r%9-jrx`BRv1Z^c$b~fKo0ItOW@lOr;VlFh7%_F@b=iP5)$zDK)pO zrE36RZlfXo#=QQ&qz=m@s&^- zFJ$!fsl$l^oN^U1WUJ(?^L`#B2eW2EedQp(&gjv!v4J7*_oKky zH}u`6$=0q2XE!4K>^toa3UlvoceAv$dWKB(b~Ge?pv6Ac>ju5&Lebbl287&~7W-@c zd5typCOMk0Nyt_0P!8eS3C!)zZ0wP&^N#e?KQ-*dt-k1Xdh5EiG5n`g8kD(N_#@dFahmcJhc~VdYk2Y%WMy~)?96>j2kk<{X!H1AQpA8 zb=Y<1m7{v4kR*2uaq>3A`04I_;)VWf=H8Cc3rUe9Zr0tw@&Y~ky7@+@o`f?J*{#P* z-Dl+;XCx=zZ?Rn-KH#$3LZf&3DKYiY{M;tMPv+2aGf8sNsA};dmG>#LxAH|=DF^Me2dho)oyN;p^pQgxfpZuib z$i3*(RgK+z@J`u^ZTnuw-uMp#$=V^_5wofu71y2c@5j?)7^DR@LuBg+_y7=QJlEc; ztBgyS(V=c{kPa?nF}OcVr#16AgkLE@ri`_6aQ(_rqAcWyn~V6Z7mF<1j;BH^_TY5m zE!^((u;L+0&2tPK9Gp{+vB(A9;lv}Jnf?2B^x3B1BlWt`D9C=mKisN(V)1~65A3#c zyu_cxN&f9}AN6pvZ?Hi70YC{_ta858$Q5RNQDS=4LX7vAuGVYSbyELuW6Gz?RB3I^ zvt&k!e7jZsz6f+tc4JR)s@-Xq4Rd^BzT+C$-JF|OGv$2xo4z8#>$x- z(R#j^Gj9B9UN2$chyXqr_r_AwTif2CQa5Fa8AJ+xek(EKZ+1hE$ZmdhcHda)Kyo>f zv?!OC*}#s@_WqQudg)BCI-A#`Z$`FJ zL*AT?h}buuu1YTrQ(t$Pe$HblQ$F(#qLym;y6(c)(88? zM8w2a)9fYCyEt4oGs`qXS*TI%v#7P%x2@M_HY!1Qt=Td26O&Iqgp_`%CRNn<}n zyxxbN6J#=f5lnY+$y7v&K@xt8D>H{_C67X*Nj^p7Bx*3 zC_QH+c2gB*lE{N%ppmEEN6tr^zHwyfJDQmES^y-&zh;+rf z2JY_EbPLg=KR&K`L^((f#YIhdTmVKUtd2tB@S!5>dwNIDb-}TEjMo{njeofZ?mecpu=@Jv}`IMfT%Qmwlf*E?Ak@ z6+I=xAmXU!)N;-&k!O2dQSrp3-yGPqLl#-SyYvS?SF?16vsKJZSqdr|q1>?qxS1dq zR~_8t6u?M!wef@I^_-(R+QPHKPMZ>spijEQP4y!R>ZU&&zBcTiNPh;myQQ@Cn0ms0 z%kIb3Cc%U1!t*zci;Pg6md7kC_!2By> z0p<=i#TotEtG3Mo9=u%aDf$~cfPvYl9jQ^OYp>znfba;XI=wNWSVMU>7kbZ&oUvWtD>^pf64Ntnod+N1z)@c;m^=!o+^z3F57G3S}Ex8pbo3gM? z`9rV6f{NmpzKl^bALn{?QENE`VPTZ$t0N+&%ILs*wCSHme~6J*lW|TP<9w5%#WPFS zp5$JYC+1S$X~N6pc_rQ35zVnjJwpm^bZbXk;^KFAr}78G`BK>Q&m03r)6tiJ2BT@9&(#wvNoNOfU#O} z@)U%_&+MGt)pp$93Q*giM5{gCr+SLhn;PdV>0TIRd2&|}9+`tY%V6~&TtHvyfyLQ8 zwI6mNVJMaFk=~~4)nLbOu=f>!nlBDZt8hq2<`2m^ay7nyiTM;-&=V68`1p#M*s0Z} z@`Utt`D0V1XM;D%*}v6<|Kw)d{0Mf|-6cl4Vc@^*A&5GX01)R=EKO7p^DmPT~?48&<(!bJT=YXJT7tXSQ5%I4aYb ztH<%3kHyy27ed2i)n~M0#TMT;BIJ{EYjnPb9|_+jj_nYv|Ki5+fk{Giq3^Dlbrchk;u?5M^BW8y>r`DWU$?sfSKx@$?f@Qaipsacl(6| zD2(N(*F0kReVmb7W8M&jn!&4M>V&x@k-`Cj7f3>$Yge+9O#pPApESH!x+Qz z2JCvcdN9&iWcwGoTsJr}-AdFYT?o>Ak^xq7y zkn_fzlVN9mNgGuAIMw9oeQGQoqx@PQnTM zaZ2A5ffMhe?vx&mg^#t8t6ZuauvP5X<+ziw)!D)4M6mM7gpgUi?NjU=IL3LWWy3D& zw9*D|yX!F-$S2=L1Txqhue^A6x`ldvV9ofpjo!C@MOW%Gx zH(#N85h2STB0r4TG^m6jx3;@?|GD*V*qG~CAS0HHQ{&Jj&$9>tbAat^M#M((? z!&-t!KKs(D>61!Kg63q;3)j}Dvpen6P@i`q*^UReQH~W_KSKD=?!n!Te}12tORk>& zfb%dR%sm-s;x3*&i!2z)cC^Uyb8J*JM}VqCYbM+{G}$IXU3e95Qbg8m%N>Os9%?(R zEJ>Rd7_A#}I_mVVk&{!Ye}8Fym!5y*NAZ9HaILriTFLu>lVi3_vBw#d?B~@i4C7*4 zM}FjXk_t8S0WBD(;0v?(hIszdzkQ9cT_Ju2nN!kD##WD5q<-SV_!mBT4)W3fs4pg2 zLrny!jprCd8_qP>AEF3>Zi-d=B8&O(n!{+L9h~AaQ=eOKW1mfHy%pWhEeYVu9oNVF#ZZ+p= zGNtdZ!f@z^EGN8Tnn&&h_z##&4vF`g^weG;60EmZyB@j_jw0UKUjdJ8!rGG@&vDc_ ztz-MX2?rj5fwt6fn#7$U(?$85A3Uejw(wD-@t|lsP}G+lHKEh-K`}vq;3da%s0{WHXzO`A4=eu}ewjUK^-4^q;dVfIZyJqXXQ{0r1w^~W~ zql6+*e2HY27*XwgScF`O3B;7$UoGcptQD2V=?kXk+JDd>A>7_GmI>IGJ3t|=_>u0x zCVIZ|{@cx2p6q^cG}HH)Q}e6;{!7tQ+bgqtu^V;eMUylBjw(|6H|%-}7U{w?olahZ z1bC7wIDt;8ar7hlkn{U5d3;V}UApng*%gj82aUM6-J->WysngdXWJUZCMv~Y927e| znl2aS59x}-HCnn8yz}$rzT43khU;c?YB`}#=53{o^s%u%Hyh}Bt9q$G`a;gw7%j

Thjpy{%VRsF)Lpki&VOs>=Eo{{&yBgN@vpl&f+erLVo7-Zl{f;!{Q%GM`Sj4At@4@&SuFQ+yPrhS=9Hw#S z+P(BMCPz}hN%_;E*gsp$HjG8&y?*yW$xvP7CmhSGGcBNSTU2u4BWr(Z6Gsk@xTxu9 zD|;vo7g&+}bJRs!?oUXixD1o743uPK4M%l8qU763>1cU?{zO81X1gGBJS8kEK+Em& z5xvARgaa`)IU(dO$arLB$nvkb#g|NR$*_1rcQ`&untTrDe?{WfIMn>|Z#HfJ0Nfsr zVb;o1!~@672>$tC5~i4$l*nlwwTki_^_fPSeOU%;BX!2cuL_33YS6=N{{HZVDfq$|j=0%T}0`Z zR}2PF`u?*EAPa}!O9g*Vez%u;y356;6b<-l|8){ZE?V*WVw9)FteXRoE3wWLZ)3J< za%^N0d4gr9ohIXr8f#FVmRhq|@;a>#T&RB9`oM&YJixN`+GY0%=Ka)(c0J!;MAi!X z8{y_*?wu$MO1Xgrcw0&uc83EJ&orK^8R+?-1X5z-L&$_It8pb14nOX1Bjsomv}H1n zG6Up;9%YT)I1u%6$1O{hU+U@!81GUXMHFCeyy^8-mKM9e8h^`mhAfNX_xUN_#(0eo z;&X2RULJ4v2^WnO`tCm2n>S5U&tRrP7CUA``nqZ;)=L?d*lel~0?IMkbUW($V zw68O@5?R*xju>0i|-i>%aR4L1U#(H@+7BFLNs~41Ha;+sCmm8w%daLWimi*MJ{V3m9?10a zF8_w>^A2%$=RE!<7EGxsaTaf|H*2S2R%g=1Ree5|(D#78IS-QV6P|R~?S}pE;kR$* zRH`3p(#dD}skKcIcGuC--^QZxo9~}OX>QY#2A8Ux$rvTg1sx{sMspO(^tBX`1We=U z3f~{HqNRQ0FT7Lj!v^Ik3dcmkqUa63$S9-jZ*V{9QY!&XhaWc@RRFA~gkT~S8rW9# z@CB1MdnU4)1uTzhb~+*{o6Y@FmL)FPFyNc)oGPsR z4&N^@(DMM~5!#G}Tz1Sz^P7$2<625X)!BlKZf6iyy1D-`fpQ>r`ge zc>88B3lh2hjohU9342T-8Vvd@Dd24s1HHM$Xz6WPo`bL9rRV+gYq<;`hFR*E>d(kr zEa;)#i}QV}&AsyRL4bW+IKZ@3y$XlL zp8m#9jsKp+MwHRnIMm12Lp`$&G;#NUyS}Iu4sM8g!MKLXdy#cFEb!@jH?S7P+C^W5 zs?9n*O{KlGVv1f%n6cezHjkfDuv$cmR6?RXR9L?v@4-k%zqrunOo zrJ`H1g!`+W7lSNhjr4yg3&0Cqh*-_%z_j%2^)2ci=90NOd*OgmtTn zxD=12`C%_AymjOS73_q}HU4u?-8)Mj#=Ji!&G`+nr^ii0e3-2yzZQIxBy?he|n4wY8fcI&HDeCZ?@q8Sko+O2h-rkblpF-Te>m({i1#Xv}l^pNb6}uk{ zb9ciYQ!mX?s@5DN$5`2vF%QMX9(3|J@2|!TRX?0>?N0U%ozebfhyyfPPoxYCnsn z%1iay1x6d{F8gOf(F08kW*dqwQ5?S*n{;iY{e-ENpnO0*TALyrlfr0Np| z8R^qNFciF*$ME7(TA2R`U3>9Z0w8;S1CwjkiVtFTok23el_MNRzL@qsiUyKq-LyP`pvRJ9T~ z7DHJxHOj0rNzBmj5%9Zc`~|DZ)>)dctP;rp?X_tZUdCn{-iK9zUhKxr(rxYS1w#?& zPB_DCJ$3#VM4Ug@B1McBAE*HWhPq?nf!N2FZu-8@mP~4tIvki{o1l>n{6Nt!u<|MT zx<3p&&mQb8Ia>x%Gb|sRpWOH3wpDk~5s->#frdprmsG9&i^FN|FLet? z`T2F0+@jyDnEf#hbC7J*G&U&U=8~l74<%}$7wM6@K=pY*IFlLQ!C~2;TYYv($B^)Q zg#zrN&&}h%5@45+7HbS;OtYxj9aB@Ta{Y{^$J<&-@%nP${e{ZONTOCKHP?f}e` zK~ja)P=wmA=@9cVn?k6ptmH2u7MYTzxaX)y{;=OKuu3)M^bI6Gzn7)?W4ZnGrCD0A zNs0BWrC&(M-T+0fB_7@io7F4b_)Hp%|j5IjxX2XAH?$=mpYtOW+$0T>@NPO(g6f`+f2sscbnSR9@M`^{MnztJ$ z8e-HQ8s}{o4gY-1A%vWZ)7I6|_-kRW{L`$b>El8U^w>ZF5i}UJ=gOG;6HeQQr~4Zo zW0dA@In&#Zqo1jH*tnS~dO?FJg;wZG3n%TXpW42jaz1kT^*xS_PpqcWCbBpXn|*1C zdqd;b{i}F?q>J2=F)fhw&oX7h-zaEa-Q49WO>O_^qq zz9f&4zP|2C=FSioZ|;`A7+K}?T2YArwSKX82!C>LRQB*#JnX%b$8cv}%@>I2kV+@h z7esy#7B(2QvC3xjA=_The{+^a*hrS|^7&n@X<7WuH=@~ZAI%juiOrD{NTjL&n0kAs zxGX28=lGINDtYHKyJbQsPJ_Pwa|h)#ozdv=y&8)d@o`-m4bsy17LeVLQ2_#mNSDW8 zlu>#?aZ}mW6GuNT>zoB^fXMMKyl#(7=oeHSehb7}3lmYLQ$JNp?rFL$Iux6X5+flY z?cy%B;py()*X=6*&_8W&rz-zaA=mENCwp3?J%sHz|ERyNV{H5+$@N5f=e4uQai#fQ za_m|EgK-n71TS~aFR+D9TQ03hycb=nX|{=uPag*MBy$I(e?Tp8Xi{y1^Z#}RlC?CN zYMG1emphF8S#0WCCH1TnkM45UI}jXs?Be=mX^{zush?nKmfCG?ynlAGnX${!wGO=M zC(7r}`}X@Q{nKNrrS`#BaHA`oF1DLY_omncPQ?%)m#Qw_i&L7C$1u1`N<7wa>}8XH zAR&sEh(B#>t}h!Q~+$?y}hAji9D>yPb}@V(t8Nz zInd`Yw@TPwNFy&&KDS@67aq>eGtry$|K-OGPR>B2B`I@g1C}Ew5oAuPi}e#^M%v@k zZdqmssQwe?6d7jpSJe^aU&RCKFa7vkAA$&3KnBXevwD@_yv}k_k}U1A zo3wjkdN(zysF?)FmgwTFp2de!^r4$!n5R@oAXFN0;Gds6L0N((c)a zpvR@E_=*$9=RX~zIQVqHHnysG=3Mu#8qm#%8?)OD*|kYYFF9sxD6=cA6-@n9{E7Rc z_E-z_{zOwTvfZ|tqq*-X z!|F~oYrDtut@*6BxgCbdAC@jl>V8n}?GG!Tf(1^sSbRIrOhh#te$Mwcp+3KexFQ&L zAW&Vtkh^QltS(r~T+bi`*=4%@@-Z`o)?@9cRECpir1<+Wp?UZ7JLICAJ8yM)OY#I+ zhD^DzpDmP{sfSD(y1^SWCzS^KkNdRr;266!T58DEU=QC)@*zs?4{TLP)FGaDXM!-#Gv(72p zn#)U0rm7N*VX8z4VoS-=#-1ed!thX@*~^kdsZ&!)p{wE|=c4)$ zWEaOXrnM;oH}X99n)X8q+%g(O92jPe5JF|n|3ReP&WAeu{^DNj^ zX5R}U+J|lm{y_6e%yxM6(Ngh;xlbp_7d7~W6@U7RB{|BMtg46>Ij#>HJ@`VdsOfe< zwX80gG?z!`54(gfmSJnYZsfutt2>LgNxvB6&1-5aC{yj6lO=94>YvJAVq~4Ar(|qz zQ`pk#bner-kFM9sRhi*5&%Y$PO)xi~1&Z$emgn$^)t zKN-`wt)h*a6g$G? zX%af_b4HJuP`RC@zPr$)((?nWV8yj5o zw4hw8mHRl_t4FF#xPsZj5tcklj;(D8%?d+CNdQN)o*Ln}d5s=&uoqNPB=XzuNc~(p zVk*XnlInF|2`oO37HPH2Q_Tu}q@ib8-wIcw==16vPiD=ylNRzGs+H7c;f>i=tFl!K zo!RP+Pp^l5HBKtauLY?Ulz&l8SIc2Z-jwg zRxiKTwM-A@PGG^tYy|CaMmrA0U*U(0+$l1X=1a67?k7&H)cD*1$s(sr%c3O4!09Pv zxO1nWrw7X|MweO4# zmM%oCHQR?rsuHeuks($(|3_uPVpEKZ{)KFQh4DvB&X#fZWNYkZW@=t1A6@I0_`C3D z$AK(wXvI8V&0CA^;}xo{q=K-E*D?@S8nr3eeS7Zx=dJ4-=IJHcp50I_=UB+`3+NFmA-#t65d(clR=x;kUs-L1oXoH1Yj^6Q+xOE;hOd7@unPAcKi5B?$T>0B6t+6MxMD<3Z}6>l>`S3Z{3 znYF93xt2|4?hE$lV!A!^{#>fN7-Z?l)LNmZ<2i7}QvcuftXl0s$wsGBywzm;i|?li zPsZ?iIb~~4cZ)59oHxI$B+zNOIE>8{m^HZiLGKT z^`mC)3#_C~x{g(6ZSt+^qYfhSMVk-4m`^R`KUQKusXgvd$@$TCsj52l^mH|`u+@dK z{8Zp@SXf+C>HHnJ9oysE`DZ2Xg&h`Pq?JK7BC?$^ME+pN8YML|_)v{$Y9uV0CwEP^Yn5Lqjc%yg3 ze%l+`-D3}?fO=bGZV|i9J%ut~4z7x-*SIBGjHLMQ50mG|B+zIb?ba*?pY?t_iCR7^ zJQAt93=CRVB3k#0fbF?j;VKejhglLdymlZs;X=;}9BeBKocUTE=$wcGX)#$)6Sb1j z6s?uFD=Qk$}j(A&^~S42!d^yI4G-*3z>y`>!>Q z-~h^*ocd(??E#^Dxy}R%MC{BCE^H<4hbaHVhPekS51wXWG7LYu+`Y{_Qaz{$X#8IA^% zyEvKn_(4_R$XGuH2!uCBot4Zqngu!9 z-8*=>cOKE!)m|_*5%*L^-{y2do_MOPGcqh^qTScUfztyVY@F&6vz7IR_A7V5h?Y^7 zS#4}s*b$daRSVZX5IFKz#~p0SqQwk?3j9Cr+hKc}pX2g0 z1JVDaVxZSwwc4pybj@dykF2R)zXH+EeO2#1{k*Fibxnmxh^OGSogywm^Q z*bo?l_kguRqDS$6uWO~LrjtCkKAK}K>)N@O9?>EL{;gQ8XQ zgdx4Pf0Q`;Q`?QR7?{({Zm>81$y9ifar z9rtO&gswlH6B|$mBUED}?L+^g*jK9*D0fh^bAPvYx1d_qc`gJzRiKsY>I0WZS46-KcN_&NMzH|w6la>#{WLG zhbK-T+4b{t;TVtan0(soRa>;SuwZ`l?3myuIyysDp5fEtcRkL_7BzozCGDbKuu_vR3t7nZUK8T({}6&Ib?_ZUF_&a&)asHy=6iHd@i!2>e-pAr1KC%lEw;x*l#z{c zSLhKBD^i317{Y5S;kJpDx)YlbieaAmL4o_9q^=e;5US;Z^ifl+{uI=S)Z>xH#Y<5O={#CSxaRKXKZEy6$536SH{1Y(@n#ynbYt zyFul;j02(R=S<=cwwKsh?0uTlW#S>9a21-m-Hss0gvGvu<#gIlU) z>zM@2Su}!XC0}(JF`f`2I18ZQNN_{UGa*?TWJ0ZhN*V=V4iA*OegZVY9c)xGHfT{v zmF>m_(xCG0CcCed1}0)U$xW7w*BhF|_jx}V@i~7>@yxKt6$HCJ2^PbCIm|S4^px2F z%XpHeo{O4-^?|zC+Z{N^t!#PZ)YJoSRqkE!xgN2D5dvlNt+#Uei_Co+t$64tzTP@3 z7@X-QC2I^v^O##rm5>641Qs9!4Dknjf=9D?JzyNI9wrvWUmr}Z#B z-EYnBU2}PAP5n^KVad7A^uI(P_XtOyU|U3g`F==H;r(LxiE@#1L5s|Pdh8V+0tTv+ z%ce%%&sQG&gb?@1$UhX15w-!Ch3g?0GFo5*v1Dr>KLDi(mRMoTYgL;N0My_VVE!K9 z`q?M_Y9=gR^_}{`qL?KW`(pTyz`Jl-ZQ25el{gxy+Y&^)AZjrbx&FOnwfn?`dO*9m z5#YN|Jc+||kIDlgof*G^c$|%~LIO3;y#5iFc7arUY#bbqOQF^@RsC-!YqH5aK8pcM zH%O5^hX?RUdVjWG#J`a<`~F7oKlcKN0d`Yhmm77=3z`kSV+)Te06h2nm*-vxo@)bJ zc1JnKgbP@@IE%L{q4yDL08GJkc>CW<20-;6OHuk>!+RD8_?U?NaldzRGMP_EEy1MI z(cr+Vk89MmCmX!_-!e=)jJGk64RO>akG2(Gn)NB(t^s{5dJ#S<(=J~C6#eQMV_q0# z_Ac(iL9H+dZi82t)8a2;)0FtVNXd5PLSsx;g?GS~ z0x1LL^y&>2z|7IQ1fGIIbLzk5uKqq6Sk5}{_dXY24d$2VJFWD*uk5kZi<_TLDhn9( z_(v$XXcuIyB2fBD`cxrigb@d1xSq)2lLD_HOLAs;!sQLseEx+P8KK?f9)MgH?i(rh z=?e+%&Zvvm2OtWLpi9B|YOod5gN7n|XVg%Blb43~=1`grSreXH7S%RI*Iimw))wK@ z7g|R@To0?qN1n{Bzyu3zDiA7MW=1hLhiS4=tG#WL3Q6{8!U354>@$9TEYoOa;qx!A zw94q`}n$&XP!km{qV~5vs_5<)K<>jvOit#e^KBP#EuT=f zUJEDnOe*50b>{wK$N}4aB;ax_AS0C9{a4m?7}x|}vpd^<cjj(brv`Gl3Bu^IYw46nFneYLEqDIekdj{%Bbl_7k36 zLxApP5X!i^B1Qk|ek15y-LbVvpoOn$vp)D36n}=K;D^#~x~))`Uj^|p2)q0o!(-id z!hQWNX8*BJLDXIJ|G1&+d(ae^$!!lweIGCsANG${yAuIZyohXeb00qtHHg(8UYHdK z;{(K*;o2QP2e;{Lzgwfd0s!p>YHPIX`@M?@WRP|jnFR%#ta>6__O&iT%{-?%^S7!HSHGu*EA&UfbXJadv~%QcC<1_{;G zxvG{ql*ooaJmgJ4DLrNf1C~>bdR5zL(D$YF22qpW0js3JE8i#sOT#p3=*bZOnBxUp zD7FUEHMY45)7e+_r_TfI-4KO-Xru7|Z%1UTM<^xol|bbUQI{W1LWvIvs^7VkQ)v%) z$poW=p&@UOlj^N5p1}hLIAfb5fM5f}j6$R1fGM*GG>y(1ap1~4raCrFIaj6i2aen3 z&yFl_p>+f|+)EU~2y^&X!>U%IeDQ?n3+-^*`QZ$=y%YMLb6Xw@~&}-!wxp{lz5fZ~t~K z+apz=>`PIAeVG-zj_}IP1$_785&3;8;H^Tg>?f-%oXmWNJ{-^^angR&f8R4`tM?3B zb$oFU71N3^a)5Z2lB=ErXt`~!|ELjh+F|MRU&3r{ZP6b zvg7icb!6vjH_%Xna=6aDXE5OYgL{`*;J4CkAk55>88p>-WGTcVU3K?K8xWPzIneEx74hxUSwPKceGEh6K)4k0rT#Ar07_o>Tr~);SB9+6iuaWGEk@?DUXmyv zZv0y7=g#hA{r)m^sBo}#IoNbYfz{C#9u*;aoZ_kNTBLewa)}3Ul~h?>paiG?EAO~2 zQkqN@LX4=SfY*$-Q<;GIp9TXD`T=okl`Dtn8OzaBBL394d6+fu%j_N2{OwQLT&zJ& z^E#II_xJzk@Q#HARmb~=viZR_uIlz;9l6-l7}Izlt(^(;00gq0&Bf+RJCFPFosgo0 z)QJ)a2}#M(f)&~O4jmo5w}@h*kxkoVxZ}k0aJ(Zv*dzDK?W$-`f*(0R`MS(NYX32Q zCssVNSPzAPnBclnJZy{%JW56?0DOcd7TOTt2~!W#>8Pc;y|#%&Qw#7f{7|v6X0Uow z%GU)HtG$yjrRS!w3y;wv&)O7aAp$Nddnfb4XBi=Kh_7L$(UkbyYJOMLdTtinG-Nhk zn4?;~sdB-kr)v%9>o%vI5wbc7I_`C;{t4^iuzq55!3%dUO?Ce**gb`NXbB?}3`yd~ z&|tcJu`|hd@!uiD2>NZ1S(Szbi?&}Q4>vAiXO3UBdj;Q63b4b{brmW!$c4CJqdDZz zu4a)c3|^6M3ICSQ`r2tvfX~iAmX8*sTr}G}l5|oaL-BR|Vd3_}EwG))HHF_B<_3jG z(94S?iOtGi^mQo@kIRlX>6hh|9LXl@=1V!@N`VsTnBR6pozW8t1{Vegk;Lh@;B~JB zrOTDOU74HC23G(bNAEfVI%y3uEu*%Fkw1&YcQ{S*r47>H>wc~*?+0^G{N8k#h)3Mv z0_Y#olt+qykN2|~r`_T#v<4GI3>miz!Zgrxqb^Fs%MkvBFY3-B2MfGP_Xk)z#5PUY zU)mlIG+%Q0K06`?>MkuMJg-DGXH@$3|;h84~XB(@HE5K6L6}NF!I|#O8KJ z_^oh!3?0`n3?Sln{^g&DZL-x?BZtcZsA1BJdigl`1zQh8&GS=-H}C%$YeWGY(iPAD zkv*i~_G>Tn*sMLlMm+&kK=AOd_NNC`QfK(*q$i}P)8>9 zBcaXL%h55IiXYeiz!Zu8Sw31aR*6t-zzsZg6aIAz`5T<%q7CcLS#72-h4_mP{#&eG za_qxu2xUL;B$3JtItrjO(r}yg&C3g^2f=jhNm>z9J`Qa6^L=Nfelz4(uR6*D>^s^Q z7`~Q`8V{^YaPL=4l*y|4D+4<=B~KY{j^mh;R@)z%$T_sI3Z~M$&J8W*PHQ~bsSgTU zPzZ;IHvx!-Wztc>tX$6oSU+!sMCQAtUK{{n-TX5qFcBY*jzXM@nH4bQ|zfUCbv4n)(x z#X8-LN#74zpmW)Go6C%M0xjJqI9S0#^11Sbf@z#z>;Q$p1S#on0p-mA+75Bq(z_mH zj;EWfOCfMyzNlvmW}wqgKJ*g#pN1L7p2!wueotFYKk3;PCee!STR3i> zA^VV-FV7&U=y80BZlT>0x)^WXlQ2p)Y0nG)3UiQUoFyf8VSm2vb@GQ|j=a@VfOyo( z1{WAk6sGM7Z+5F^@E?-2FnP7vvVcXE!9CIK(G3y{9{E%CPo=92eQVybVl!37lqiQV z3p0>cOJc*)(p839Y5BMj8^Y1!zO<_=6cMHtQT_$4B4jy5Q-^4CklqUlgQKHEGPAq5 z9gYLMr8|ARM54{^ue@1wPvR_5cIxOg>ka4dKG!{v0Jk0xL-L71QWB9ZcO*TH+1YHF z;Ksjyle?CF{TA69NUcE|<-7eOuV^!_6BMy&!YE_nNY0Aqb^j^KdN`h+6BmW-?o{*# zsg7TQWK}w3C|jB8aZiZuav}N@&DC z)P(&Opez)Xs;GNs)y+?am$>0XwmOzB&R?w_+`r1>-1^dep+r$-&S91}YIxT&5*TV7 z0=@03f?W*M!b1T9zrPe|O;x)x#b6S9dqcvWubcQ&6xp?|=1^rk_gz|gdy4-S>x_V7 zq%tlhC7fTGNk~wz5on7~&^G5FxHFDh`$L&~$@d-KAl_Vz+0oE%vy1quY5C1*woI;KBoYdsWi>QM+DOBzh>^6(77e9Zj!W#qghZ3MZKLK0yD@leyGqmvgil^OXWOn zPQyyeXr1bW__eT^`>*dA#!83-G||a-e1pXCkz!F{~TU(%Sh_(ABG~#$nUF z4!_ym0h8FHj?qDGi$0JyF-KPRuv#W4dWjzI3O_`gw-PP>d=Q(^?%U=jVlo8`yKj`b zr5xm}KYzrH2)5lE2O9^ckb^|gB*&SOAE(Kft>Pkgnf}4|~(0F_K z#h0d&Fx8v4@4xRcjZ}$Q&)JOb9b&SCl=BXxat4(0d!lZchSQt&1(fqjFEWe;D@j4sKmqo z@)apDu^?8#B6-Tdm5^={CFY0QBK*tcJkD=P$G~+|oJ?@KcZLh59kl`VZd(p7KZV5Y zAsLJo;^h@(`JGn&gjH6suH*Q6E{oV?#jFcZw3n<+<3Y{h!UUrdpxo;wW+6Dhb@Cym zQ=P{3fknG7@Ocp)?7c5}zL#qgre=1hAq`QfGi_yI0_T^~M|+sUX=1CZO>hI6^_+SB zm66P=G!6ry+dXcZk1t>07nt633{zg7hoMHLranHw(>F^J&{Fg?&9hnzcAaKuc{>d_ zSsc_JxPn5`>V!_r!Vb>T3-Xz>C?*|+ojl!+{CW6RdXO$Yrp$Gopre}=w%{cSv}2S( z$Kx;~DyfSDD7(64kIP1%D&i=gZp?(YTb}?sl;Vr+@{m`nO95@>tAENVu65{E?fZwl_efiLTysIybuMtYw`ueM9O&1jvlK zvQZZz%k)DztbDY|NyxeJC_#{c`}3bCA=XDK zIps|3+vjo#$pyvE%)w_eUdrX|=cZIJDhO~Y)+NQxg*7eh`|rDVh>;+>Z{PiswxR^o z0+hXAe0%yni-5W^l1_z@=6Z(%L~m*Q*HpS# zFtTVs-)K0tTcL$P%kP`ZG_$h3aEFFPMd3V4jK6|Emrm&KL$jZug;=pqH3U)7sWhFO z){D=RC27BQWQaKsOyv@Qx>}oC>#T+}#{TE8VJ=?##oE^+szG^MExx$I%O!l!(BDIws!z{giIkB-y z;Y9AqBbrr(pm){-7m{uV&Ce5#H~HD;fl4HRB59!cxe5v2?;xe|B9KT#kN7%)8sF+o z`r%m(E4!uYtCCCex~?93SAS(Miet2n!JMWF8@&pbBI^-7N-e`#Z5c8p;nKq4y?08c zoHM_~iLH5Zhk9Y?lb+gPHn?8O%JO387-!GCVrM%A8M7Gxc}Sr~Q_n*-3q6w&uE<1T zwryO<{NH~ELua3M@qo(u0VyPTK}=ipYp$m?hj{dO?JP~ER$fVx-u}$_hrfSPm>1ZU zGN2(R{Ee9y=Rkm@B~$63=T>=A0=>KmY%Mq_L3M-0&(66MHW7VG~A-z`V zw#u~*o)3UVnN@_Mu>lcQf zz8cXD%;@~WjG*6*3|l#coulVCJ#w1*}n_dT@&jCe%{-?D*&@ zp}#~}pYl+s5Abi%y_KEe6jD1_Gt`!=I)LC`d9Fd6c^|hS1zuisoh9&Z!1v%X9Fh5k zQs|08?SSq0;inD;Euk-oXNmJAhw*e$xK)+ms9Oi|oJMt*D;OD$!ha|;IU(#DO6l)E zJ*{#5JGKUkRzd4*P`?JqX5o1DVeOkuSQ_9U`qF=2O$HEcW)E<_6cy1{zu&nXVu60S z!^i2>+c2PXdsdWC2plla@V$FyH>C@u)B5`QP9!aQTx2t&XEop7KJQ>NEw1F=&P5b& zcKAKh&9vI3+k1CG>xv&Cd2Z?sc!iyQXUY6FybQn(#*U8jxPkC+Sj_nwr+JT`+ks{@ zfWWb`*ZsS}TcEApo04TG%k0meC;+uXC@=Z$3u}n8JN6Vi!?L-#{Psa6tqSL$d}w41U;?`xL{S0#rQP ztIihwu4%{8X8{YuodpUxk_j#c?It6|IpA#SGBbd?q+LA}vz`cGG(L$P%2;ZkO-Sp2 zM8+Sur0PZ_t@;a56V-%vC@=IY)9k&l*;i|kDhGu2XZm3rd&6ZKvi^Zwe@VT0P?A5~ ze~bM=_1w+)J2Yp>3F~%50LVa5=}Y*3tDv5;hYO7F?7r7CNa;xPuEB6Azy9j=xb|DY zC#*v}gW_=v=?NV}t_y+m;jyPTtcF2D9`GCElhCcCazL7O&|q!Y4(rj8jhVSnEwu$$dbDCG7HC2wT{<|kv5EKA_ zAB)4??F}1SjoJqP55SPc06q40n{>JL&%mUHTK4znw3uTFM&}6w?(UR)amby(WB8_9Vy7glD;Ca>)K1YshcD%oKP%cXex|#&h^0W zqtoq=s#>5oDR!Cc(69wGadeZhlRDQ+|i#n2%zq4@Ryo#$p-dP_nsV8d;cR(p!;!MH)S@86kv9|D%OA|2U3tBL6NPa{QKMPoAf~<~hQ_vR=eh}-d z{*A_4)N)xz`0TbRF%}xC?5Hd!=flaGr$1TU0s^3*Rz^5_1?Xs0Z6Egf6HrKH2&-(< zXE9)7&eL-bZ zTCLu$<>thRy0p%J9AaZ?Fs0mJ-e2oS;D$#%Wo?Xn;A)e4od5s@;_8MJem`i!teN-t zZa3_`=t>$E&*(hW8m#B{?(8TCTn^|IR=^L9>p#;VWJMn{$Fp?21p)CXEt+-Cy!TQ@ zyOW@h;Ls0S%A8$i@@MYL;7Q0Cv;i@nB_M6S$hGSaj7UEGb5g2aS|j~&wbarxd(;gX zBCN{rBTV{Z-WO6~?Z8!91JTHkz4%C~pBs7IOqF@)(dfS_?gsWvK0>Wo5fb z&^av@ne9NM`oQJ2)>JsFT8UstN#;~<>Yr)cN4I?%6AE;q*PaakH2LQ5U4XWR?Y{=| z&~dTM*O>9g%$+|2?8Woofrzs?zQ4zMGk53H{!-g@8DDcUFHhmTUDp2aN`;kZfL=_)O~%=B-{pFr``Y#EBv&sL z80(a4TPM@@>&({gixUFcB(HRh8w%#zyE5*;Rz8O}x(!EDBbDf1i}KCW1pCc%)$3{3 zpX~8(VW<@W2t${DLi3_3Ps|n01z`8p55}6$MaDMOPmhB~-aT3a#Kk%BnD#Mz$ORdG zpPj}8MK@j;mkJQ6W#jC-8_?5>Dal9BFfd>)dR~#s5b(ZPbLkiHo=? zl<{d5uX4wQ-ArVXsrpxVCEM;D9yM)`0*W)4dLdD*+9 zMw?#uuzi3c9X&nUNb8DugG;HVq<|c2512o;o!ylxdeu8@XT;)$(kgujX1P{SP#_+V zG;PcIMzK&n?dho(=Demmc)ZDdyW_UXfYR zXMe0+Y+*%#Q%d5a-%474UpZ&I<)6$(>=Rc8R38NBpu&Q#XyzVsnZ z->~G>Gs0zaH?D^N+64d(ME<8=>;&4ALKluC3|TaF2|c9|MDHJICyK%f__%jyIBLPI zWEn=IuwxcZu8QeK4l1w8BQTSn3v(Zz(=N*ANWyug9KE1dL1C%NG$r*41WIBYjZ&&i zFqRdQ)<^hzFRzu?wrY5G?X_QKqhA10($+lE#_Tap4ChxDpS^^kc0>ZEt-Vt^;A>OU zEj+%zIMkL8vJ&?*la68ww3*=3yFbU?6sD7}oL~8QZi;98i0F>9>Sd@c96lol9EV!U zUMA(Kb3t?{ep*`n4A_!^v9~ovC%*6@D3&+ehkJs%N_cHRo#JcWNzkJK2QUq!9}Q>- zD~brA8oj)7rdU7x64^S1Yut>RD*OS8ir zlEoN`7w85EOZApwZ~<`fQ-^>c)8??1ucMoou`KNajwmo>kvOR~naO%xsHBKoyVuPS zFb98OAvU-C{9NP@bfuS%DMC02KRQt6jr?bvIF8$Ys?d+JZ2U9O;_tkmTtj;*F6TZ$ zM`5(dY9?T}3Di8NOG=RxDK1$5CHnd*EKO{(+GB9i6{lPYuXl$IuJ1TF4u)aYvHzp3)8hnyW~l5*nBtQuSS01{)m4y#`n@~|{jFQm>V^(t zME9T=kj<>fex4WyKgh3pzh&tL_JA^qcByi37aXS&A2Y(EhF}F*YGM zb@sjkSYiqh=BLHw+HXt@P87^!>(+mj;q9(%M!vBaEGj7IfymC= zLMw_;MDW2fxj|daF6wGlz`OOQoRP4=NWbo^9EwltjLr3%kYHL=>8a@XIX`n`BM+0hAV~B zhtDs0zJvs$!a<@j<0xW-t)5p@el*1*&;Zjhl6L--rPLKFpBe-cL_GXq`il`nBFvrC zxiQ6=Z>H~zTuk!W<)BXLp%5s$92m#+o2+p8JoYWg=xK#kR1 zAT(j;Z$W<8eI_$Hdy(Xyf@s=aM{c6wN&ROaG!O42j zzhjh!&G0<1H43frV5&W{2gwyiyeZ-9>mA(X%d)2P`1b&ay%Yc^*kLSKOCN^+Pp29ZLaxnveEG53q#H=6SX+pFIdezmjob?Jxo4Iq?Ia4&>y-j`}H z+aCW@qy1Y7L4r`td_Q?Zan^%DnzyUg{=uzD@npLjZTyB4H}m6TeMTXw{782srH1}9 z6uf-yuSR4`E)eS9BgsDeq8x5mB)hyR`XFL#XcR22Y)!emYZ{4%oJ!>zgK%1J#P%i0 zN%+$zKEXDjFl-HC?nY8T?A@7W=?#z+-`d%igN^QPZ#y2MpRH|dAeJfHkC_uuF08q+ z-|kVUNkoJ6tezd0BiZOaEKXfcdJG$Xk|-$)2fU;Yq0(v+A6V^?Z3LN-iTEs9&*gdi zaUg~7TL&u*ki)je9I>_N=;@J$&j>SRnz{hBYAdI6NBXg?7|PP-FVA3p^o=?8;>S~} zZ>VinnVho}Ys}deL?77ogMO@0Y3((C)+| z#Rou|J6=DCtaR0Qrj#4MUfevBxzp1DMgqgkf=`i1B)s@>Ei0d7t4Zc~-T2^gTlL^) z*%~7yOX^UNl7m)6X&oo$<@Ty`z|vX*0D)i}vcdKzJBl7?>&wfjW*|T$F*UR#n}c7W z_gg+RTjpb-`G0NXF);W+&QpxE&1Mnaiw;5q<)u+HDwO>MR@6KQDI`?cuEG-WoYoW) zK;hTsPZ^)Gb4|vIsR_C(ZRp#+2lN8l!TguD*)RrD1-~4-{&+*B8cM&$}m66#8kw+~Jf#=j7B|jTP}_B+x=TA+1%Fym}kpE^cjvpgc`y zpJKtLknXL&`*6wk=VjQG8e7j3AkhEr6AxvJ2887Ni(V*-3>jI8TkWu}Nwk`C$ajHt z1A>3$zPQc!TAZr?#Q44Mm%6T_r*eyEH0wzOCm;=dj5(eyOG>-Xw`CGp*`Yy3`am@Z z0J1am6?!xLv6 zvZFaQ#c#ec(LM}tu+ITv^ipcRMqVOCc`q(H1GWv(xh~Dq zMU#SHvvEm#Ma48Qn2Ex%6VVq$1dMkw=$>fZjRCDw8V7=a#*(f5Kcb(Ph~I&lAlZoO zy+ruP#dx37p?(cyaTYswOqCHJFRJdhM}|Wd35{_*f*#!vglT8@P|?(YL;& z)fyzK&fH1e75w3FscK;Z*`*+QoI7fE^lU>z<5D(UIF7m@iB7~D(?#Wv^OE4NXhcL= z!YK$C8;6Iz0OvnfxCJGGq46Kz-pr_lo2}C;PSC)xP|NYsBfTbI z6PbS*AvgO;SVAQzH8IiG;pi0&4byWq!J$NOYJ>+lMt|SnCv8CS8qK7hb^u55_HD){ zO+Lm~`T#Pj&&8Nu1<@(|^Ol!Eas>(*Ma=oz#)gK=7PpAxKe+;h;GK$kpVm@Yzp)v$ zbj}uv-%lb}_z%$v56U4u*cG>62Qs_nP8nr*$tW5+MV7OV-+|b!cEfs^{*To(k&K@i z0$2M7U)ng!;2vU4q#!Wzl!}-WmOV4&G;r;KsY5@-uU+JZrPZ!JVvlcNUU0K zyzoHE9=r~`7J&LUOZ_!@J;v7}x7TRY!YbtCnIsZqTPv<9+@1u+gDD+Hl;N7|(ci`M zfKTW^4m{rrgtGDRr0V|!5QjJ1k&su9lz8L*Neq!Dp#t`L7KK++2&z=XsgR2|CIkXw zJg~s+Q8u85K^_Q>CxX@^(37>mZ~rF{DUfWDxYv3yPv zx;c_2)8*LAA+Mc|Xk@RaHaRr`$3cev0R|d=(@wDaX~2m^C~Cd$1aq2;-5F;9kQ2Hm3j5gij`-BJw+{q6bUdj}{xf*nsO! zq27g=lC%}KZE;X1M0cH(j6&@STciRoROKnvpSv^Oqpsgly;Y*Ois&AFtSHwSByKr6 zQq4K6^s=wBFDD?gc^3_-gGAVjv@lolDxzb%wa4`p0<_Z+WCAmtAl2tCX z?;F{-POSPeN-xd#Hvl!hVCxj?0sJwORmIi}xJT;%f%S@@eSC!e z3i|cl=;+s~t5ZJ;kJrp!sYn&AnUm}NnZ~@tskztUvBtSys9iYSSp-C zHTw9>uz%HP&;PBJK!6~LjM0n88B!LP1K2FOI(D!djIZw@YSdS{Bg!+yy*-9 zKDt`UIB_T_#E@reYfIMq02fQhmMwVRv$CdIWLk_gom3U7XO z3~n%`J$UiJ8Z?BR_DW10u2x(xcOu7gwH~_Ito`_&_Z|zX_RE=) z!PH=Wtabk2WI5Y&F!+jMa1r;~k3C?Bp7tZ$@-i45i>O%mzm@|;mplab4O0XtulsaM zF+A3gZIz0(ko7JkQe!ouDEZU1NEQ;i6MuAI^E}_*6ynz{K4iGbEj*~bDZw8OLW7#@ zghCo9)vKBciLcK{eXLZR#eQDSJFFe*?M^o#x0I?yDCVtb5h->m#iOTnEqa(Ia_KbL zy%_syPhX-6CC~|BB^A9R9S1?55J`jCaoYdQnel2niVYu9s((<7)%I7sS ze$`0?3Ht}_aqzz1LWB!fKcLF{OTn=o_nyqAabcJ{3j|zd34BGEd0Auf%Y%A5n_)m1 zqW-#FYynWe5Z%6a$FZuj{K^n-z7x8Ld*YSMkVPJQ@7!!iOnH;WZCp*>qEm^oZ5@)Y z@WTC^RGEN;&w$KnZ!XiD#sc68wQeBbF;_~?eG4IuRQfo1TB$@8B0VgDJFvRaDNGf1 z8qfhJVz7>~!Lxp2hKzg-jTLnim(>l0z$%5e@>c^R6qPa2MY|%(lGhY^dm{uyQ_foRF2`J-Z{jOgg>dxvN5Zd;aIf z*MkYJOSV=e7*elZK5+t^4f^S@tZBaR8F8VdYvASob43PJZ|^zU83IV2q5RtfmQ4YF zmq32ATjJgens4U~f7jQyk%J-80{DougTx(S%ND3t7J?+)H5O3)N?pIA>)%X|n)pOL zjd3!2Mqz!qL3#sydFq~ka9D?~a? zW;qzs5~9-YPvk39#pQKBrQ(P@Yw5*ZSEE% zob|?$PVRg)auJ8FD4OjSv+%I-8P^@L-!&4}msqm{l= z1(S8gx1^=Uz!$ySlq7nnVr)x_q3QZQfoewuY;}mF=ON(=?tC6Mt*knK50D$?tzkfZYej9# zZ$~S-UvCcU|2S^!IR5iP0O3_=hq8ham_-_gz8M*hW9s|4AE`rhT@Vy~;YWfMX6@$@W}GdC zc(whh?2>~%BtGOtP+*pVZq#wz8~zi!^7qkT5EU8IeQzjT^o3A9mU_s>{4r~-z-_{j zYfS*k!T*loR}01y7b7H_zar-q;uVgjwHnfFrt6s2-E`93%Ck+w021;4OWsoa@* z{hFW~YiFbL1X1;LmXT<#reTVU8hdlyTEcS^lsnm_@9qokYzfr&5?+5ZsZlPI2F$cM z)J?F-77lMZPpxh4T7QM6A72a=T)OPeRAJK5#iL=4VnNhvM8WhRu-#RVeM^^ zd(}GA+kThz#nP}3Ho1aU7R-Hm4WHDIv{OPzGEXT*R{0 zMR9KiTXcQ_%rdhoFbz7fmRLx>-Ev#NFNP736GQ5G|BTUWv41$pH$3x+1PNJ%|KNlY~4HWpwZeu^W79@WHVXtCeS zBN1Idb(3Rketpc87C}P2Rs`R|z-7N>@u8z0{m9kd1+rl^ zch^9Q58Iq6NF{G6dL!$KHpur7Gvf3)+fAliQKe!&W3J|cJvfXzt0Y6H1gO3y&-Q{2 zjP8rWzpPk(SiN8`a>R>vX3xCvv_x0;e7ooEveQy(t{V^(Boqp#=(<31#8?ExTJ2=KMoT@UBZ_*oFV<**A2-B05yw zuf}Pf+DF!#889*-DF*9Kd)&IiG3&jKrA^lud^c0a-M+XEw8w?^}ZvWw0w zYdW=5Qs$kAg)%|5u_nMI_YedP7Bby@{%f8U4&6HvJMf$?*F`r>8D>!)ppQgG*B1@M zsa)qQF_P245UfnFsEr|ID~4m|^EirMV9HEzlp5Vv2D*HOEC8|thg%ui$C<9@vb9x!`Z}$cI-PW5eS=)5ajiYP z`=P>_#7ADqoX`s(0B;ft$|4YN5pM;PH3es}iM()cnOwB948}$deF2wqvEcr?>0&{H z3@%2%$Nz9J@onGk{;m;CqJ)w2;;?~CGV2D9aSSoX$!_<~uQ?F8&M^pc=`15x&qIBA zHv7UpUv(Wl53^XU8KDoi-d*A|Qcg{<_HPw(y@523{^i0` z$z~)(`|~w(6qOv6V~}`4h03MV{?V&KU_DWJparN}^97sbo&RfC5e7n}H;q05B|NV3 zKjrjh#Rt>4zD1bFh4LGd$zM`J zm2YgPrQTWAzWJrkDpG`m&G2O_l>J!f4Lae(YC+ok+_$Pp#ipbApXqBH58+pY=^mH9 zv*!f`KTN>y*$s(1NGE|#DCQW(YoaZDhl_ex@{?wU0LBM3s zds*0AjJFzsm?mt`THMd=Ga{9Yt?kiSB`XLe`~$!Shf7=JZQBS$oNRnBZm8f z1=(M02>XtyzI;9|#3kC13(Red&|E5QQO8Ob?|t7=r+$jg`w^^cS4j^tV9@Ab&`5P? zp_?fZW{^mX2{H{cGsG+qW@8X3#wZ7y&>jDd0Z$#w)xk2T$g=4t?LICRdBQKnTUX%H z_AfB#`B!d#Ndi}M+R6haq9KgmqT8Rg68?k0V8G6&Z3iVe5^_a2`C?6*DZUh|F4S%y zH_PwB!6gg=uC;uO0KcHp6@gtjz{_05wiF8c7TPvv`Y>}0wDTZDxyq5U_gD~z)-Q^E z=x-G(>pcxgWn_0k-D^rUtQOK<Zca7T7>z!6cm6WM?`<~W>Ylj(AIXbdjK!>G zA1}C-R)Lm~7pt)L>mMt#6LMr)Ov`b)DOL5Z+n)UG$Lg*#*+Nn(P=CEKm@d>_KcMHQ zxJwrB5(}d6j0(h%1&TSP8!(i_lD>MzZ?4znxL073ld({BfOfnw$iknZ({y8+uJiufCzt6Ml8BSd-xWP^OoY{z^Ixq}tN3FD=FvqM*du~WLzPk0-U2X-E)fjy zq9*4lFQ5LQi6CTj2S6}!cHfyQ5}~lavQph)n@U;9@bZOYZD55rVzn4&s8o#Ps&rZ4 zkIL5!QE?{J(@N!X)M6Deqrbm`HJQIf^>#$>OvrY}L6AGiYM;*NKH&zJDvkbgA&RGK(N8~)@?pW;oG4;3n=oHv>wHm>t2=rPl3CvZ$u)Q>DnZn`o$Afy zRct7^X5x&$!WDle`{bsb;{i6SChzLd>@E(;wsd_X-dYHpZ`o4C4^`&UEh|_@NT5^K zn!Sf-hFneA*-x-$9D@t9Zbt9WQz-LB^=KlAe{C)Xaf035ee+OBcCd@bGzCd+@Lh|{ zq%5|bP)CoyQ~pNv6Gsga@DiXxGzw9s=xr}k+*lipygbA8xEqg04O)4VBhI&i>EHRh zuOy2nIA8GKZsR$RLeonm97ccli~Z%5PUNXFPi{V!2jY(I?%4qfl8#g^eU5So{a&4n z495K6UVX91shQ7dZ0O#1@7m&=<7rj%(VTV{SU#98{2-S}`M6(F*H<6OcZJ2IQPp*9 z*mpP{pFUlc+@Sl;Y^*pSmD?%9KB#+ddn^$+;6@l(V;(v5)2=6tm%Bu#<(ndn?8@Mx zcV|`r@|d*ZXBN$J&3(#9ESYM#`ZmkE64B|Q5tPX2y5lzMJy z-;>AyocYx8SKS%~byQKhc;2)}<}22aeD(9oNe2rnA)$i3t7rI!VGf!fbTsQ75S!f3 zqHYivaKA-+M@EnG);qOTnNM1Hnp1bEpYA*mS#@+|n0KGcNOy2vOP+!0RX(NhxZ3PY zFs1OizYNRSIq4>Cwl^Du-FfuJdQ&_K%0PAJW1_@2zNfW|bi-a$b}GABu3meBdpE=t z!bO01Xeqr6b1f5CQA1GU{$uPv6Xusfa=g7=g99F=h(3O6$)X%1#Lhf0;# zhpV!~g^uP|u`6fChnYfhi-bv(lcy}M9{spEA-H;~F}?#u|q2q&m?b4{@8_K`K` zufy1B2IPV3OXvv5kZ)F6iymZZA;0;tAY-OLK7+_K#-C@Tdi40+$VA88V^H-e3+7`y z@J1DrNP@0D>Zh<1dv zgNdHQpLSk5ny;IY8!~Amrc9Wz^x_Pp2Yq7UJ1CqfnWG)D zPIqo>1RwIlR3)wx*&JUId~h8rh@eIDY&yFxN?>)*HEJpntSB*W$^zpprd)+Vrx_{n zaJ7MFB% z^tV!#81meM1AAc_8yxE9ZA8+ca3iZ;G&<{fa=S;%bl=wXo)mH%jv z{&xypiPCw%0izE<^l=Q?C3cC`g+NC+>10@Ly48+3ygfd-*m3i4$A9I};Jhc?eQvq# zKrP{~UjC&jr9{3eOQYbjhW}o$TSg0w?)S2z8Q(1yt?l9RYTmkg3}2J`GGJQK#P`21 zB<#8itylb>`!_b4Z=itaphS3OD&05}FrGV%@sFF-*?4CS+ZiHE#7kn|M%S>V=><~B z($%^Y0|po&oMH?4qL_91WFPR{5)5mBj3iLJ&_=J*k*gPsDs(9`t58i!iOn~;6JpYM zhZLy{hGp0Nk97CW*ZAct(ays0RD@!kDlDnLJ2x6}iZqN*h0MQx4@2LaDT<`hV0R(_ ziHcNbnXFf0F&*JXp{5;|GZ>5d0XM{7(=r|tKt1DKkkQJV;Ek;G z1pzJd%k6E;kLhLlvgX`CTmHOmcXp=>6k{6b8O( zA^AC~L4wJ%K7Ic4np0t7ggR^;L1NzhR50D^E(c!u{ihzPsv?z7N=jJe5?SfNMAX%3 zO=(|)yQsF|i#q7h=UYd6l<=9hV!N!b*kLuL)LGA3WbgYE_~~mkIl$9qFDC)3NPe zETVMwVl%A4XNq)G8sD6MFGW8Zs)z~`W@D560Ql27`Q0-AL-0W}{`Rnq|K^*CPsN{9 zx7N;Z;0r~Hq~e)-(IIeoYOHyyKd?Oa7MiG%b#rfd3Pc!&yR&i_$#1kF*<#Mlc~HnW2Y^y%Kvcc=W#by3?gJ{WSe^PE5wA<(VXuK z_cuf!&q!6)H#_q%GrITHV{Y_lVu(lHq%uyQWC?eBM`iywNiLpwKH9waPO^wIXP2do8`n&m#>uEF>grFSHBULsKmH< z-*S825PoudWp6?eGSzF|Je&nqwJ&R?F#G%SprySUqOmqP%sgM8skl*cjMve$ksYzU zyqm~sm$nE5{bGq$#$kH5Zk^iNYaw%)q-+WperhrbbzmXem+vWs@X1kyYZzC&=$zEJ zwB?|3|C~yhg|O!x>0kY2!Hu|Yz_;lsph@1SpCpz1_D1}wBjNSYqMK=mtsf4_ROM5W%j&{~Y> zP3VE+BnI1siRS&O;x1(1a^JH^EL6FcK9r zcg96EEsE<47-u5xol`V(#Vj!36Ku7@yc7Xc%3}WILwG6~N>H#Sb(TwrH1Mf!+g_Yx z;`{})igg$eK-Y@c^1vx+HBllhwY%6N%h_S|uyf$uiyFn-c^4++#fUuhCa*6ZH$WTN%&2^-$c&JBBfN#O={sF z#abCDuRjE6cydjsv+y7hQ;d-Z6%U@_En@ctoD&;5E{G2|yU2AVwtieB$RCt3A>l5T zAF@!Lvp{}<5pNBz8L#w=*S!Q>Q?ZbBD@~}c9k7RsFIYVf&z$*#->BAk;9p;Oiprc2 z0+c3p!~}Bn`3OE=w;>6zp)U{eM_{3#h8ru5DNm1q?bADQVaOf+EsLmoyvPNK1EjDM&XPkW^Ay zx=R`q+;n$Hhjjk;#uGlz^FH7Ao$>f|&6&%_=aeux*~zi^UVd?Ywkj8xKaLQ$8Td;!v?mmyBtx@?+Y0 z+w^m>yA|?QLy25pD)5u63nq!EmKK!Lxj(SypnM=b>N^DHZzvL4YMe2$-hZ$70hvAF ztYV%RV;4?q39)`hgh+I-a0xTc@^c=~d{bjY=fqw=(Db0hM=v>V%kqv)5PEe%4=D<* zRxvqOV*GRlYb1o)jANW0=bKm+_4`3NZ5F zP*vr8mYFKBv2uc$>)#oNBXPrhAVH zO62y-K0%+3NM_-j_Y7D>Eu527Ytva<;B)6Fz&F=499!0x5s>P+U6yO?6X6fTcBl!ae{k22OLZw(iOpP^#a0{ z*>@G`54S%;5ebF94)4X*k`Og$yVho7sY9H9e$ zwE-(q2vq723*g7$9gj$b(ZraI@{q3%{(LavYl|%7{?oh0l>=ugZ7D|;%%5Jh!!dzs zA;yhXGNgYUp8hAy4&nV6|9MZM%(>r)?ADTac-~+f`A9$t9M7515eFQYt5Kp#l1&OO z?4OMr(8DU1nqVe)j}%HI{dhyWa`;8R7G57rDtVr2L!n8aLg?+DwH;LwPfGIZQe`L^A+G;b&q zf>lh+1Z!z&se~sst2WzfUGVL03{Y|YoUVqvmsG0Gj^{C>C1y8|&`F~}wE2>IFp6#A z$`g85%r9q%Asy+!&%HEHs-gT!leJP}rV~XkixU;-Q|SEZC3RN&s)+`3HE1#iQsA(L z2ncB%=`(8-PMbyH=68FJ*#;cGqrNXi9$9mo`{t2n@ZjX_z8aG30pW(38hcyg+x&EO zA0by)9!76C^c~e^R}@2FDNcvU)5CNx)khZj>b2HPT%xJY=RPr8^*wcAdJW$d9@yh7 ztZ{|0t)NZhh=-T!=<1NfKeBj$A{qd7NDb`@=bn>!fAKEX2iuz7h&rqQMvfo8;lPG= zqk385#J$ZF!AMUp9<48e`W83`UOoJ0&E`SmZaWMbB)dfqFZ`y;^C`(kNOvi8Y5o96 zY(o-}94cQd?YU@Dz@&wp5>ux*RYkZB6!61z#;@(}$l!!hv1p1W#_cClyB;1I`ITOn z9rhgRe>(Z$+R5ALZFMpG_M#?}?|L7w)P$5;X@+*(*2%l)-C`9^%wGf_&&vTQ?ML02 zXYk%%*AVcZT^MM=>c!fCq$kum?tLCVqHrmc?5FEemh7584kVJ*nwbrcNbr!)noj!7 zh4n;DK;H!h-SWNDRWINl?|KUDIPEOBJ_>gJ^$$^KYuS}I<35FEDQ^=+IU z_Ff{!E&c^KaD2pjr2Zw6?xc`HNTNM_S_&!?g>%xl3oDAW>GRjg%qltKE>Uwhyvb_! zyZd9=bwxL#Pd{(oedcFp z8_u{0V^^7MNXQpYRZ0rOVb=%Dwi9L$#{F?57`j^ zfcpml2F8SzlG15Mu9C9-?6AoJTT`cx3T8G@i6#<&--6^$Ue)t4bNU+sk_YbBu3Y7a z6SGbN!AEp{T7@n1v!}qr@Hs4GLk0&+bzMxS>RxQfkRlkFQs6(ND<_5VS#b!2k;D$A zlodE&>u@1c`|y0M0M2;2Gq(Aox3rpR(@2n%psP=JnAr{EE)9%kqUKH4{kqn@GrV30 z6rOllZ2JCbGkoJ+ulP#Csm)m6$6jS9m{2Lu5CJa6Sg=*w##zyo5}P(m+l{TQgDiC_ zqI(d3sAx^ueT1(-I$>UOtqkpQy=Q~K`;=6}O~0p9!a3*+y-@!MnnL#p7~RpNl`FEN z>-FWTc*olGo^Wf<9DlrbkK-Qltnmga6gY%ka247^srHoV{gg&_5mEjthXNWEhP)QH zt^oMlXNM`SbU&BBu?&EkrNoELTLlklbO+<{M&Ve z%a!b*e2bxp32ui+#|PwA=W7hr*7~pT=v6mg;2R&3vFUYWBg8?n3y_|GPs8llU-wlj zH~*+p$woYPHGqi4OXop1PM&`EdzNyQKxhC34P!(^#FLXg#?zxVa?>v%pHz+|q{Rgc zjoiLO^w#@DQIN$FsyPQjC7+-^K=)^nEmPyL&=(iZiP3Z;y*R564U3IM#~EplG#jcD z!VYKF?~V-t=Vrg;6Am>@_j}IZ4;4hk6%5lrbpBX{X-5zvveiP94wqx5=9!yIALbhs z-eZ6)xoaV8ii8y-%J@M~5THBmok@e-3@ z-e{@S+7Fx()4}F}@2a4&B&-p+F1R!uE1(ugX4k9Z9?$(GfFlixD0fyJgd=I4`5rY7 zoUnG_rx=05ovHL)qI{N^ov*+P@9%h7;; zA&w(AfE%P|*6kt7u81U})>VQ%LX%VAV8A{{Pf`jzWFXZr{Tg9BEJOe%lH(m)>^J%p z1>tgb@^Owx(}SEw%6Bwxv&F_>YiP?tPrfPt&Ak}ZoBggBN2_%K4GAKoqlUkDDB;_< zZ|N0NJ~4ByeDx7`S_9E2ll>2Wf%z+qt0FnPXqZ$MldiGsHe8dA>@S6_6LeueMMX+h z&ZNm*&nB>{Uek&^BYy0Re|~_t=uj+-Fx1<%%gcqcZT`X7WaC#)R7cbW;pY|Ue+!_Z z>!z?-{Cc>*TClas!r!3_E3;-|RLb?6sJ2hhJt?!FBjGnNTf@LYSd!+l!`q~CajA*^AkbUl&?>>};+aZX34 z@3(e_-OtWsZCAz#wzs#7N>(0C;}=75{|G>@f>0U5YaMX=vGtA&)=S+~Q!cwJ2!i;h zqJ}%lfl&4wWkDsSD1C1E!!dG?kGh%6el@Q5?2MtsCJw+%ff*SyMPACldd`W}i>j$gt5{qgc9mGb$(W(MEJFQYm74!aa}#6z z#tpdnMBUx{PrpV`hEB1560-**aQ_NPr&&;s>kn^yVN|k?+gRModE`N;2cdiPFYvNu zjG_)~QrSDxQpXKjQ`O?}txEY4HWCJIX)(ZA_ToI1)uRWl5|^d1Khy-uBwxvYzo{D zS_-1Qqtirgo{&WDh`#KrmD1ojR?u|fpX3HU&Xld@nN;^F7b}5P>D*z2W_#DV*w6X5 zja9@OXRjhn77hkX=A8b5Phn3QukJD!Oq!e`pQFCg#c%1%>_v9=zZJ{!G}Mp zF_oz1(yxgZfC=Zs)2U34Zq!>TR&CCRf_js7wZdxGdOW4vkZh^-lf+%zJke8DTv9H( zvdHYHsqH^w<=}zhG`KK?N@Fbehfo-Z2xgPS$M5^Rd#7EA&-)Mz>UP+i6p6fHXSLib zLic@T=%>9IOy}ai;ISFZ80&&Cx4GCOqKY|SN>ZyL< zw}2+lJF?|1ARqwkFBl`+TPcm%pednjap?`Tk55Z;87|U$@YF(`Vj^{X(7ajUU+j~( zm%v2~(2p9RAKL7TJ+GA(@V5%%esg?4hoG&KLPXvQw^$jQ5E5qeh|qjZkk*J4Q@_R! zaNMMU=`^r!37lkw;T`fXY;9XIsKYi;ZxS&F*-s>ua$88ID9`4JH

%jD6c@xpXX1 zt$W6)m@Q4O;kfR`jmj~nv+xNzl&?_;F=*xWTDuN;V6mXluD&dRI!{l{KIpzR{171- zw9)+j*3R4flY@1U>NZ#<`R8mX$Yu-#c>k;qUIJeA?c?JrLN`XN85dxEE)G=a_;R=LMNrfWKl!*ThhP`Zc!`tOiIytu`GF{Sx7c{d#gka%yY42!jZQ zJb7Em9!8odh%vZBV}*(rP7D%-%)nISqa$}j{Z>7dsw>Z&?{A< zASF!6wsdxKz-q3uL)YodNXpIp2B-?_(_hL0-fqqWq4t#+vt$37s$hLZZuyN$C$=k#0bl3j6SbqVwosoDcN9h;Tj_E{FuS zd>jQAdcI9=?^56{e7U7hukxl0)N->{I2qIE$UeNmzo6=(ZZcrvonL!As=V_}o13JH zjZ=z4Y-1-eJm;0m^3{3Q-k)s;=@*e{ZV@#ciY3Iy-y9q>Wci(HX0_)Aa-hyn>=znU z+H~#LI6dE7zeUN#MLdwBwDpOlO*Fs|4q7|dXacyPE>SFhr0dIHtPAzcPFLO{Oa;hn zUBZI1CskXSy$XW*+b0Y!RgX7aHnnEG=h6HJ+A`S9(hO;yVQ3`zY3B@@3#e9FQd5tM zs4nA{8L5I;8fXyS02Rz1t;=DZ*R!D^x59bhrm=E?jxG%@P@eUM@qPB{#6F|+PMe$6o~nt~H?p=kjh z2mU~wCb%IDMg7r!wd2XeJeI|9mEPkjhvgs5=fhbx?Q!go)*v#U3%6YlnY|Q&{>@2` zyPVeZp4@a* zjYG<2v5msX*Uu=ySp-UW^h%$ov!OrJS$>psR!ftX4XTZt1(3bHTQ-;JHLPMs7AfyCW8iU zdS?`z@5u?_{^ms9(et!-o@}2YXCJfx{>Y2$;Hg#T?X?MqD=Tw@`GE}}-ScW6alZW& zltf*tJfG`%N6E^H7~JG_IY@FFc9;%Rcd33y_!V%q(+QAC@oxuiP=nF6ud>P!RPScyx2aYr zGwiU@F|z_m(&H$_w%@grDPX;4GhkIO=}h2!yidx*c#9bLARwYwdC6$a0k+|))?kf~ zHJ%tE`wWkig6t{b7z_U$aC(qCQ)X!$FQO2y%wi${WVS|?bI5I(R5DOECTmSpHYI3* zfn%*>;W#xZ&zm|tPH393mW6DZ%{-Rj%I zu||aQyP|EUn<5GLy8IR%UV^;1azh5OKrq2PV%yg6;O_p~Wcr7Q13*oK@#nnG{9{BQ z_=4+!)9mc}S*x##zt{A*z)R$EfV;PiiGVG(Ol%@1VW4xXb{nJvsN- zK90BOvd{?dKtpF8+%A35!-(8$i(JaQ=$~N)z4GHaeuzJ2XpfhptG^pS71BL()%4$Y=li&K27{ys0{HvryH3v z>rLB{)m9th+MyxZmy>({qP4zDO;f+UjJ5h0Ca>j5Hz_A6$Z`<`>Kl=z;s?}U z^d#_-*9VE8KT=K~&vprbLe=kuKxlwNs6d&PooSfjuh( z26sp`t3i#q#y!qyYXZj9slff@n;wQ2=F)f1TtqRu47w9*1+KqlQN8YU)R|&9^X3zQ zb&I+AW4a(=Q`21am&T7NkH5uwv~?lOnqU0bO7>`$+WyiDqW; z63L8~EBzAHiYyv+H{lSK@UF$~_cU%*jZ*e|$c!ET9PLN_JlJr(1$@{!Hb^ulu%zcjOx9yIb<_|Rn7PY&}}VxTa^%#Ko<9e5!f zKUPN*K_V-q#B_vso!izMJFl76J-S)wg#XToMt4sA`v)+8RzGy6PJ0k!Jjqp&>fl;0 z*6Vub<{R>StwojpblNS5{G>p=S}c1g%pFSCIXh_4k2)j#Be3H|94Uu~ZHV9}7J(A1wJ3H&H?>!5#ZPI;4j&s$rewX`^ zBJFmxz|Q7c=R%}UQh&l%;}m$T5KI&Jo>ZVXH9^;`SwAYAuTsji;I=aka8aZCX5$^1 zh$!L1Wfo%r8oX7bsHcD;IaR6Rce484)E>M65-YxksJRDIZntaC|1V`6q*wE>Hi)o$8P)VUqVL-gmkGB7e0-WQl#)L! zYFol&vEZF*Xtw~0u12*lyoOU=)SX_RFA!L^nCYaY)DjUBdBC<))K{D!dB2dzgTFv7 zt7x~*@xue0;{GrFd1~7glx|z))$5_*7Zf^ugxm+jW673iD3+s@5kS2dA&E-J& zpd)_wd-Ngoojuz8A%mn1|0Z8xGtG=Z@*h!&jqme`zU-q=ou{ANqB)-6G{~BTKQ@r5 zd@1-v{Z*Bt#Q8mfp{zr(ieX$l+^yt;sm2n9$OWGImoc8vhU_ZGx@NlrU4x($ToeTh z-Or_SG1RVPP8(Fj%1{dSt7O4m@J-d#x_qxQGpV*&?Esai{v4R;M2q;okrbsl*wE2I z=DdRSl+=>_8Gl2XQPasXDR(B^fz8}fnQEFr zO7DE}F=74%Kn+{Cn6WrHAyn|(^1E3)7505Rs$z8DYki!V0n^`P!oT_aG_aceA&-6} zInr#^lIAWYMQ)zWvs7yKQ*`-gf<9d$d*2vge41u-m(w{{?CevhBIcoKd%0?*b7Dm4 zI@l{AWZYg}ZzK6hG&n!Q;F5>?IXz&=1U1n*za=_L{dSUqSqHBOM2h(q+QL=9P>=~I z#L1N?h+A$30}}mxvGE=;yHMMP?3i7h)*!wqtiCfp=zR%}I2J%@xpC8r^Cfzo(USMJ zRM~Dn-CrIH`z$MFI^vHk7PGvY9;rK<_j_TCGCQOEfTVV(_ttP7s2}p|H}k&2X0#%m zX{A)4a8+<$!U)9cdnQ8-U_OfimvFKBac<=&mHMloI-ByA=!)pZN|e3e)BF5Z0lQe~ zv-T-*pNLRKYB-CxH^wY}xPK@IoY3KVX#Kp0t55Vzc^QLpA}kUQzSs2LJb2J5Z}r5S zuiq`|gnBe&sZ5~Dipk3H*k*$Tn!ZcN2Z&SKAjw`j9X~^Cot#$>Zd;kBgwltDLMyd5 zOUHZRp@`$bbQ1?8cV4uMWa9H^$>8_w)FCPGL5Y^PQ$uO8Se&#Nh9*O~t$vyw2xEPS zBEREgnX*lJ#Dvsa%~oU9!7}SxmzW!0Zv!}#Y62%1b6?$Bq>o?CT zQzh#2Ftgo5@>=1>N!lkH;5Je54kwj)ctYH)EttWoEbi!SF5-$?AhK;@%< zgh%am_e&!>`wG#W#8>y&N(xX^IJq6VVGs(c>4$)5#_Y)brIMBm-RcTEYq@0zhZPT+&4K*0+PEFb)g8>hqS> z!$Xk!iNxan3;}bL#T(*)TD-JTf5wRW85cYm6m}=X=eOuW0NavA&1|ZMtTi?gL>VldNlmX4*YA}cxlngeUU;#z)awogUI;B;*sgoT z?gej@%&Se1lJkQqXSxf$^u(o9nxPbt*KnSc!O3l&%1uqjBCVyxP!RlrYo>0N!pF+` zJVb-$oOZJUWL~R4$u^hmDid#0tQJRqe*iQEZ`(BWaQdc5nKg~gNaCYwkMZ-^u=!*Y zX@Ns#JN+k#3yg(LG_`nym4?d!-h5}|ko}ufv;*z6Pnw{TzE_5#Rv5A;F4CXX`hrZv zCjdTgsI=6b)Y5njZT^SUihWYrEh2_Dw4qPoU&?OitVV-LZnG71z8$kFsiMIPhIoix zp>nmS7CVQkp)z41!QKs&-g#R)3sxXq?!*j2ljUb9Zkf1t{q@ZkK6&PK6RUvlALnV)@(G_XE#ej@3ZrOWDH6y-C6M+ zFqirm?}H)y{Hqf?nRtJGZQcK) z5hYRYV|s*XY4`K8PJ&TFC&oSDjhl%ye1iE^EN-%sCn<(@htuv)49At~2+gH>u*mqG zQNzPy*7#0qUQ}a}X+l)eu)6u(R;a&x=@LR$hvMX=q%HB@67Qi1FdK;5JKXKESX+!D zL`d59XN!O{Q#?Atb3;h^y_V2M#OjK;U)}&2X}v9!t=%kI0gwjd`m^&vu7u4(f^4(@ zT5x=68FwQQdCdb6g-TtOR_PUt*WQNkW5ka5<=c1#Q3@a!Q`>*mh++du1yy8!MqEIu z#M-op2h?;pAR|=u)fPmA0P5}szRdV4e?Qkg^gr{EMBKISy?l?e#s(rp2nbFj33b$H17Ji9+1w6!dh9O`=;vg`Kp)2n{=#7AA{i{l^c7%U&a1ubo5lq8{< z;8mO?C5^@YOc(>eWs;CtrriMTi6#zjf=yI(W)iaO^}ePhT@lIYFP;lWuIRKZ__?D# z`OoWsC?;W%C0*NW=V^5#EGIAps)xW>CXi$>6 zpyyOD8c78?Py9kj6VQnm^;EC|S0@@f;LV%2uPY^)4E^nwnP6^D=hbpw)yj~iL>m&| zN0I*2mySxcnW%QansDB0+Plwj8x+nVBrDk}=&stJgO;~OcnTa-)zp|1JkeKm+%}Fk zESfx_n)Mf7#v_mAH^I9Y7IG>hpGEu{SVkkyHlfD}Km%@Tq9l_vfMgW#q=Kg2T?ARY z!`$xRv{s;=wm|B{Sb$9(^@n8e#%Et0QGZ)xfmUqG)BDwI0TW{!y2s6|lF|Q~$lk(0 zk-c-ulC8uz_k`%A9r@avUUCE#V5K9Uu5*2YanS`6=4EupzO8Qyvf)F#jTm#-7+wMO zMe-xt{%zYE@dfScm?T_5jRmzPeunJ(n>h69*=gezfn|x|QBl;$6~_5jrC%~hQMT_` zV^YYap4G9SSm~r8r5^6T4+_uN90sa*M$k%EIm!}+$M3qHdsqzbNT&q@0hDadAuhK7 z3-WclBu^H3z!q4n(%;Qp8L;rQo>{;tbSITb2nmGbw&TR^yL0A0N-hlamKrG~% zS~8)3dkwBZSM(s{YH~8Zf8P@qh!iMuU64x~7;;<-*NW=4YR&pK8Ou0Kq$baJAd6V( zT#%};XS#{#RWX$gdXa%^ByT@+`m*wsrwu4;prxgxplI0ggU->tXaXA`aZoy^0kE^9 z+3BBT`N#t%Yn?yn_*hoPmytRP;FL9!Kp)1@#E|paqg+F)cE@yT%H7t+L#F zNSUuSUB@ zF45qC{5-LAUixq3Y|uonh{)St8-8PiCwg-0M)&WHq7;c3yJU~hM~cyO7w0{!c)2?J zi;2w6X?BL3CHTZrUDf2dhT*2l&#m(|q^gvQEPYNSdM^&-xU6^sCa2zwSK3gC-z>7) zYS0+>3wdhyRn$I-#p7y!)|6ay2AH}>ndx)aZm}QZ)iVdo?d|e4nM@i*jG2{^-I)}2 zR7ISNrx6oOL7<*{g zQfiK zzx-Da9EwaI#Y~C5|GZN)Y`b$P-{+mfGm|KnJ7LjI5;pOay}U?S+KCR4ZN9}A^^NE) zXdsu63}~C2;I7dq!JUl?ODTEEgpf2UH$}M87?l%I#=rrKJj|ithB3kA@cDjuJ4kI2 zAGgpM_J7D9AF8?&zlF#YN;oc+ybA1iE^6Dy7_fIpn_VSJZla?Lr!KC~k0kTkptOaq z^*w*{qBb0SYNHa2^(eM0CIw#UI>L>Fp2M3+3se+w&WRNOJ+ItIU`O8lK?D3E7S=Ml zs~1!a2MlKx-#B%D16=}?e7zjA2vhb>m5dIjzpd023{`K>7bOa30;Ymf0BrXcsh<*)zQNUm=%;H~2gbJum&8{CsD~}~&l?EFTvugI$$_MG z9C2xBOU`N(pMVs}J!k7$Ll@rT>;z_91>6)Yc|szWriJa?Ext>wdd%0L#jN=&;JO4j z2om5rC6AYQ!1tvpn?dB=56E?>Z5~cSJq^7wmAPBbz7zyN?vI_?5OcXr*GJzm%+aeI z^}=kJkw5h7D-3~}APmtHxN%d(39={bM-8hSC0-bN)7xkO%J?U4KCjCiqG?=-R!l7L zgBG%~f@%kh^sXp72$T~=E)e?sc_Tfv231fp%2PbhtnXbZwp*s&>L0$(c*`4+u19v@ ztf%?x9uve64j$gEJ*z(v5Hm}84(IeR(QTJOC1v1!@zU0|fo6x>d^GhFE7LyOU~EEI z>)__+WHGJoQ<1V70z4qk3PzGhIv@cj!R6=oa{{3Rj6>eo>CJ?83%L86lRH}T-PJdh z)5=;TJK3PkEAyJ4LG}3ayyI{4t%AKNrVC%c#Y+J%vD(?yv+-3O*tH8?lSnx=s35@& z4&Uu@0^fV=mU5AI1z3QhI{O#$VjPlRt&?5$FzLScH#g~7fMdy^wmuoMaBGQT#W=0t z#rvPX?OWXTD=5q&5WR;t&{b$gLxnd2)T7AQ5At6_zO^cR1hQN?ng|JvNzeIVBHw#z zJ|djudUQ)bxcVl8JT7H#B$CX+zJGrX|44Gz3PdKA)Utn$M2Cp_s0wag9K%@2ju;Z%Bp(7dYE35?D(4>V}_ou!g4y?fQr%wPcaJZNKuXXCB?De5Pm_VaNuAPbyQGCoM81#E!pZ`c4+$ri)n0t)mgu4*DX zVpX8M{7cUfo%}ApX(Y@_kJsA%!FQ~|twRIFf>Gr0E_PQzw{wXQ+!YZ zuQvVBQhCzyQ5)CE>_fnot19RCL$ktjn{7=7 zEN_NAy}$G2gt2SJ_QEDJMLsKVr5L7%O;4&J z0VWzg`-~L$64unSv=%f7#?lC70Ral+ZtU4PeUJCd{dIEuy=zf<3cN^e_hMiUUIM_iOahpUEJr$VmJvI@CZX82pBbJOFg~>!GR-Ua?DjLuyQ{{kFZa&eR7jNYkbD#iQOD_bjiy9~fz=`rj4Z%Bb0L#aSn zHpE=HM(LhM0^ibaU_z~Bg>sNiuTmcQ1}BPUaw~jNR`SavZ?)yo?DeLTr#V6aQ2p?| z5O)TcQyZ66R5$9w2QapXEK8^2FEdq~JjP-Ma0StJji+u&Ls1~MH;`0WcA4?Uk; zPQAR?6%b#3>i*r?Q+us_=9%5>CmN4r29tFrS5V#yY302PL_N8Y$P?4n zufCT{Ob1w=TZ}XwE`=srp8j}H&6e}JCYYtoWCJc#H=je>u=@N()8UgN;vS_5s-tY9yUDbg zbMLcVcAwU1FF-yP;ZJ1iz{SG2E%^47Vt*aFe(8aOEtX7e391^_MoK4gC}G#HU#ChF z#$f0*R=Q-^&fb82@(y zpkrl!V{%401>V!JB&;CPAYT$teJ_xv7tLTwwyLMzA|v3_{`1MxO{bh=p=j*9BKa65ES4DK^3Zu>dwLYqQS{8Aa*Iz8UN+^ zRUq@Vc`xha2=g54=Ry+dxGX9?|7 zGT1b8ZGu2Wrie63-?D1&qLYl)x8;9jyk{}jwH@cO045}6V{AFg^*!QyQP=ud`9Qqx zZ<)IJScrG@w!*)pK`$nv?=6}OI@anY)y}Z4J*Mdwuvnw$vo=r!8%=~Dm zM=xU^jfo1nZsH@TigX&Ksc9sH zpoS%uRT(ajf=%u;w0S=y8X1SM1$dSjmI~nJ1Dq~Wxa{2tTp_WmLsoOnPt3>tqI$9XfhwFcrtl=^&{3C3W3O2; zvP=*JY2z{|N;iv?_djU$n~cNwPIvvAur(RXWR^a>hU2nH4Vm~u??YJ{7Xp{84))Ce zg)$Z~cMv^=1r&YPUw7UQ3PnOg+5Z3yInmu>wo3n3_(hz)^a~AM{4Wa=4HjlyOZxDH zgM{nz(EqDO|ArF3qcXK7`<=PIc@rK*yU_U@FobTD{E(1=_>E|UmU4~;RrwVkal75E zt7~JWciKWoY{v#8B|+VEsaARd2So*T=bdq{uUE0CvWRJ3$(Jb5+iWtSCWz#yK1}3L zC(Hv{Z*oSm6h*JQDMOFX&rZa}r3G{Z-xw5&XF@?|Kyy^0 zFg-_+a(Gz8C%MWDY2&s(u4=9~LrU8IK0B z!u7j_e5T>!&FNw>cc0d6)a2s1#c1QJD}BMh&fyY)4c{@fe7bxq!B98Mz)2^EWPypu-@!yu6njJh?F4JZ+Mxli=CG+s

pjEEy^^}EXU16+asNZA2>~xJBQ&V4&7t|hybEr6O26RkXEv? zk4`*gKu;Fa;684<9B@|I@cCsgkATq-0%@~2F71+sFsE-_ledVnNw7Xvy08{v?Ztd4WDn8(cHD5|xB%p~vE?zlwUs}*z;E$%q+#QSb zyug`0i8?P|O!#$j>R*|h-!2^QUv-EWNFr7H{5&F;Ie}XjFs2|AcN5zA;b+ul&@8Da z!^;?#TIA!$(7)7{2ZDQ8^@s!-0DRqazaQGyazO2lcgUOmqsMfXr|o=BTTVX-nyE_f zcPuxd+0PaQqKl5aeIuXa{`h4(Zm?oR(LCnSHxnem>5z4J6OX^&Kp^N~3*&jd_ePnQpf5i6A<=Sb=iL$m9E_EwbzxViGe2~BR#Xnfa zB-B?DP;i)NQ~&ld;2xZ+LBADtE`I*=7UPd#Rt`>V@h63-FXw!g7ktegf)&}(OJSg{ zV2o4<(TR!nSVI8F7g<&CNdjEZ60QqcVCRvDCGpbV-6JlK4h$t95%cQA2_s(s`c*xQ zB=-KnzVX04Jgvq7(_@OwcED)UMlj14BohBlbNsnPf8U|t#i)qL1&NOUBfN8&o{z)b z3-qvi45}kClr#ZPj#LAT_o}MeUmSllr16G~%L*E98TEgy#u`D1n4bfk>5XlSQphN> zLvQ8-4>A#TOEWH0O$acA*ympaWX|&euR)#D|qDGS?S12XyJ&h^@-Ph;>5)qw z^_v7DK8)<)v9W$kt1-*5O!3FWVD~NN(<7;kf54$7|JnIg^y0j|(d{nBii%ni#_x#m z@7Lm>ID{tWTf}R2THbflJ0!tzWnU_bGp!cqS!2wCvfEV_jPQ+)?to7A^zZ2=i0mI{ zW;=y|)PCl%@kAsCU%Y6P3rU|DFg?R{L&p2l3m_vMvRnuf+2A!dP!y2_;6ET}Bt9sH z8pxH;q?UDvY1DYmOnI1hJ%0WhYw>Rz2aIvWv!r>sK3azHnD$I}f0=2>W2W`O_s!mv zr1mQY&}8x!jN1g@ED$j;h-4tSOd7*~fIO2V8q04rCJqvS9Q#K}7;3o!`Ny_v=Ot!4 z4zqLH3t|jsSEmLO{?Ee3yQ&f~(4BXm)n=#OXk|g>wysxJIr=|z*2d@@3qjH`$ns&=<{v*k zJ)r_hPwnYbkeM0tie-d~?I|M&Xj-_y01sopKaz%s{NA(hM~dsF|0Tn635&X?0k z0{NikGF1r=)u&%#LhdyRF|9z}4Z69ePc|NOw04?m7=_&x1<(vQ)utQHWP zu$q0D0^>5oxd99t8MKqJg@6j5Al;tFnV{4MLV9|W0OR>dzU&BTp*U_HCD@Cs+O2V@ zH)Fzt8!`7&rXwm9t(L!VnqUrhi2|p8{CevDv!m{bijM+M_k;2#yODu&wOWJi$V z`ahTy4%8KP<98tw$@a#D4nt3+NjW;R60Wx*b@R5^egrGnS9-S{lGxXg-hni1_PnpLmg03mhiVrX#3)pZ*yKx>~FySaOZ8!vJ zE>7dY`(J2ySR{iAc?-?wA<4+Qy}m#^yE9*l!#oRc=~X_mB}Ki?`7ljluUJD$9*U^P zYHImuu-^Ip_vG~NHu3V>2Y?$e06hj#xn}hq2lmor+`Z8TUmO9%1sQab^@Sq;hVHk= z_mH_JnWRLQeUV9&>tbis>Fi7X<`k;0;oRK~$JaRwvP(j}(vHAhO%LxhP9+ z(DgVRS-0EU%95VS081D4+xxZ2kc}`JXp_ijm!p8J?J|^F2DPBd$AydUK~f$gidju2 zI?sCPn*m2l6WYGk=@ix4ALls!w{rZAiA`B;8&$5CDMt3GAVD|v0vCGS2D{!{SAEL^mD~(4f%Fq$n;P;xk-{g zs_T1!!dV)c5o3y*gv>e|-_m~?=uBj%gYwOP1IFL~_mIO2OwUglQ#?zc0Ef=p!fQL7 z0pK%-tbf;zy(9N zv2GIGvLb#iy>{no+*Y|F=PdjBEdOF@`Vp)QqS;u zci&q}-G|4!oc#Z75x{*c^!`uktv54Fkm@4~md`RhF86>qJ zHB6zgL}|nl%=Kg?5Zl4V{d~jAu8U}3q8e` zY(Y8reG5#G7As?9up#23_e-%tz;8d}cX9ZMCq~+4b?V}YLRdw?6tz@BqlNSTvG?9_ zO)gvis3KBCng}Qz3n&QK=v`D41XN7uAXw-EQbGwtRA37NHi}Xe0U?CmAp}7{ktRr& z#88aX0HK7Ea3{L!*>d(~|IYc{_ukL@4?ZSOX4b4(v&wg^nbA3D%KyyfIdfs~9o~+x zne#)>yQ!jTr}bpziV`dB?tdr>r9a$u=>+rJq3EFKB9Yi_c7ae|*XytLZ?9*e=g`=+`A>gb zld2z<^NtjCJW zkG3c=nU;}0W$=N|4oiaOvvv(}YKT0l4hoAI*6^u|wpI^VELv@M^Vj8<`5~nj+Qaeuu^7g~i>wg(e=CRS%rRe0*7{MjHbE-zHn*70z+Y zy$_8$V^ksE?y=1IBkpQwhz8!jZ##U+9XZou*){y;6`cBRr9aNc`OYl|P2?3B^r5FF zLME1#GIuDda!mO_kLl=9@gHr8#`H|4buSjL-q5`8bmx=k#sbqCukP&QD2VLpaWGi7*K?`}zERudeIbq@%@mfo-|iacq4#@kZK4Zh z<|w>4p<@J$)20j%$4Ba_Chg z!=L2k+bGZLe*VfLK77eAYhdx+MXIeM#{wtV^@4F@d1pN&C!X z^KIz$x?Pc*=nN!X@q_yn&s%cdB!^G2jZTp@g;q(hw*h=VX1a*a)@@UIVa-KhE7iDF(nbf?>+W^?Dc)GRz2#q704@PPI zO9K(@TipCN1>&>)*4bH>;V7fl_s>HKC-lqK2)92?jPAsE!H_{qWe={{o&3S-)7TU^ z%y~fK;N!+x+0$<&_RGo+2eGgANm}{)NL>{UUtr$n+oprj?R>b*VDdpN%hAT;vUV)N zF;aJ`iZV-{DWCK5m2VisBMa|u-z_+CY*|j(`_UZWcgByB}?T1pa!$4!LI<+yAPtn}{l1?LAFuFQO{dy{LKvHXqzjZ^Kb&|#& zMiiCZD{`zx@B=^lvcl9z|_9|LW9e4LzdC z1|w}=Z?!}-m7W)YStarmD@is)$e+xzT)PwY@U>Zf;atoi87T+$Ny6ZZteiD|H|Z_w zXdb@6!a0u_@0(W*ydu2kLKZ4@Sd2z^d9*)GpI&Tj@1>%%va?PKyx-(UzeCopNcCze z?t?=vM%?L)gtBdp8$r@S4@2r)b*kRPx!Ez*7-lf1fHVL4ha;hS zs_EQbJ~3K@$6E5v zsdp~)s3$5=qn-1@n>KA)Tf5aFp7P7lFB1doS^GNuWyrNnXcFTt2D;+S{9Ib($D2vE zhd@0G$SkiEh}Sjyp`Q*!(%UdPsh^nW z$!iYN%O|tH(b%MQ>o7+>!}eXfnv!;3pYo@jNLeFKAZG(qrAe^y2SeW}XLb>$Y0KPdAGT@%MZ=r5b36U09gr z5+=)UVML6jjn_;KR4^9%Xx`einXW);y0|2PGhkwiy85l@Ub7q9WQe{2m*aTp`wqA+ z@3sv>A_i?4$`?M^pbZasGyM81*ZSSIA;OeqImPZHTE_DVnZE!|vW;WY6l0nvAjP zR2G{;5G_h%`sKUO(~l%;kC;V_qf2ZTk@(ksMDv2F{1bA8I-lENR)WPAh5mU4Iozb> z(KxEdOp!Q!pM>kB4@WeS#Vrv5oFZ+zH)|p*4foqcbsKpC%Fl(}O71Ld8g`1%YIBey z47_6I5ILL$KFhUP5Z6dP8)z6NqooAv-+IDG??vXR-;MI;;a;Yri&UMBv~EyWy+ofS z#9CoFH&VnEd;7V5Z(1^B;6Z0vvv$b)?8-FxDRCjc11hACEf=>~BQHklyX-6+o11I) zAZ$fl_g!X9+yq!mk9zj#P)Shj2^z&QdNT!5_5|0~$-mMDbtJCdatwDq&Ki|=QOD>VNBVe=S>y`0I?tE7BSy)TrV@PsSu3)oB`%Fmt9mfv%2d= zGM*%}osbB#R=6?Vl{-?3vaYSyLye`h{Bh2|bAzJ>+r4;qAP3Fog`S3c4+|67Bh{B( zd*rXJ>3Q@K%A_=r<)TOhbr;3?Lf4k!Fh4_2oQ0L;ywXW)M!K>ycZRdiQqWaY;JW9FzDTc!2vgstXx&BjM zopn(Ga6+$bEw9?55&nw-)_C=`2Moo>wx>-Na4)+#mb$=FxZjR@ttP(&dyx9bJyqMB zeZqT~AKw`RLlx?d7qeGj?`@tSvzjup3)u}A2T!&s5-bF;7qhH}jHfCoUDoWa;8IX4OPqI05DSQpqC2BF@t-E`4Z%1%{Z^bu?u* zL!JHjRFEE}bPS?Yeo~{&f%&Hxuw-BD6|sY8qn3|2Gn-ntzT?J|x%4wX&V&e;R?J%? z$srF*lHByY`xoz=j$-I4=_m;ci%jY(OX=VhY3S!{V9BxaSxTM$jE2pH-X zn(y=sMYGJ$9d$470s{A2@Iwe z6D;JDy~@2iyL6c%+I7#$w|oe{BKhtOMW%AN(X}ah$ajU$ybT@iLa~f@w+5wz%H7?IfBSGR9voMQKR;u@FT5NFgOX<_dA~Lio*%NC z&l^|UQB_28Q*T`sFZ@E1qem^fSeRYgHB<9R8S^PynPF~mrANxFwwOiQg2V=;G(1s_ zgcW)ZzxIQoqg;C3oO^h-Kxb-($UnhE!+0;0j6RfBi4e_LA)?c7c2lP#U6^>C5k{rY zOABgcC@X6mV6pdn9vo_fdrg#Tn6!;`wXSwg4_L^|1qchP!Aqk+`0gu?A9Z*s%oe>vm(-8eLSI!rMYg}91et*I=xz85a}-jRkk)IRubA_*~R_& zi&?Pfhdqb2=&orZ4F*;TG_9Wn<69LlCLaIEw-?pH@fkzgZ2)fYPJB5af6A`npW*hlIsKW@MW2xrnu@T!i)WB~JPC7ZCg! z=Be~Jh%29Wn9G)*_U~`J4VA}{#qsYF49GsvLD`8kFsH@bCE2POrJj?ABa5*kqQUho zD&wn%<<&7`u53aoZGP%h>uV_OIO$KSe*JZIr|KF|OOxCb-p4ptcMNZ>%{#*Dl_~R2 z#a(3g$|Px(Y<@7tyindfEM_CIqO$!5&hr#5_pdEHoxaIgs5FhH;Qeqbmi!fhS*^4B zx<>GRj>7U}ve>I30|mEN%=RQ-LcEP$Zdb~fuXym+AzyK7>f}pdH)n85l`qO=TnSz3 zXTK`0W^+I~cxZ5McFbU3vDA1%xu)cJ0@h<0vzzMxi>W`gpyaN94%!Lb@!9sdK&b`k2n6y@^hZO3f$(6h{0&{$tKSzpPnXij%51PwhLfOo8f%Bay4 z;PVrvDT&Ih;@X|o^wA8cg~}@BRlS+IUTrqv8Jv7bp!pSC_Nt0*?bj0sGtR=kTsK37 zFR@o@gTwj#U3d~hupdCGyP(Th=mO7);BY96_iNtPxtETN`WPs z48yT~SPOuwO_b;zQmwkzJ@W$pI84L@J|Q7}H{fcNOU@a5nZi^BW+4@OgrYWcd+e+w z{L@LW)R@P!3R+ofpy<(g#4!=toX$F1ecg&$;9bjZK;ZhxU%}Gs{bgx7tc(~f)-=}M z&kEN>mR`Sydj(n8<%#YPZjnYN`I&7qsgu=(tE_$Mux_Yb%<=9koeEo-I#|UyR#kC> zI9XCeF3x4atT|gdn-K5sD9p#2xGkfPq|(-`OaT6vwF@Ws%>G6@3ihnv5b{mQxzsXe zc-(*C@!Fj8V>Z(|&igyO%O@HgL;3Rs1TFo6F#tZ>C5GK2@lggg4HI;_cc3}EyB}gG ztLZiP+PZKb^VZH-OcEyif;5lA**1qO3Q7zpxk}E$(6zxrWxG^NSW@zK1Dnq+1ko)M zi@LMTSIqbdmrrsQ`sPn+B5$m&h}m^E5#+$STe)T=Rq+^7`B-cFT~**u>4=Boq&bQA zbLaGpW=;&OOi^bC6Lv^&JG!P*A3y{QD{E`ptBu!2v3||13zpJojiq>!G@Fa!NO*47 zJ{h$e5_a5-2c0_ANr?sp8a{1fq*HBUb^UAgxVmYAlo@QBaeAA%rq6o~ zHt0}W*PzFM8r(T&1s5Q$PRC)Wua7j{H{{rrLu1_9${?ZUy$qV8sw9_VfoQeMB}5{z zc{yv(rRIV1K}kD^`|TJ3sFzXpt~0(94_6#futCAY^5BjH*XXlZuwYh`I=02NI(HM1 zY`yUWvD;9$Cdzn%+1m0k{MsrGA%0^)M`q|DS8M{`{k-*+jqws;tIvD?30{wwXb zVO44|pczDQVx}VTnl*II(|26aH+#ojPK37e(&B%E?nH31eFfo^b7#6Xqyv1xpr8+Nyqad z7Oa8@iGIb4pVl~Ic>?p3J8f?)c>@Jg=bQfeY%$iJqu}LE+>R#<@-xo=l}EXvgLd2@ z1#_6@953`|pSqa1dYMy^R!oS+?yADH`ol%thpvY}nGUg?Fk#$(_695>9*!E;ADjTyH5G~gzTs3lXOXsR z-nqy=r0#I2)XfsCoUT&81Tg z5c#XzQaPoWOiit=Fn~nJ+i`0RAyKdZA`Br8$Ga!(o=+L^rbF!jmVN-h5$I$HQYrJ; zx^ci}x^P;c%gqRp<%pvCt&&<*1-(?@Yneh2$86I#aVRchzCvGAY4$>gJjH%|IYWy+ zdK;6e6!*+C0AI+0@Y^Ao)$Q%eJJ4&^FER(#8l96+<&MRa#@jX!>gOHGPpHWS7uzJJ z+?RI~=BW2tJ5m}?HQVFLod+I3wj0+aL*P#aG92v@V%)`<{Dr>6P9h6t5wV8R4au7* zO71+mgFj6J1Yq05+=4?6k0wKUiKNVq55YiceJ7u$do2WX=g3A#j3-d%H8MfX=rNtQ znFvZrUr9)6-dvrwU^`IZT0R!^8Ug|q-py8S^DB%kCi6940`CNSUjQ>{Fw<3%#Mz>< zvWo2;Oeh%?Eba0=2Xul5ekK=I7s zGJT8p;#Sn@l}&SN+4@nL)Wn>8>?pfK`Z99shYmH*eh}Zz#8bvG$}SjL0Tu7d&DnGO z5t2?(UCOnRTizoV7)|`KUq<)PQ!2^`T&aq9x3udp8seYb2=R;Wc zSY3mI)#pCpx1lT0rK2B8leFc*z{`&q_?DT2=_FGz`bp195Ss*^09+lmmG+d)KnaZ^;kAk`E+}k7~_64B^=O3|S{cLA& z8CH|5)A^D)%rm-rLkU?nn;cWMS6%vf&2OIiX$@um)?t6@)D7Okv8hkZzO4Y#qHtYa zrDr<62LK#QL!qZYnCClW(=Ev;on?_%;O|m+?Sn8;j=SN3Q0*t@%(0*b3QX?|!DQ0x zK)YIPF$F|~4Ql6CUrzvx1tQHQ*gjAa>~=={E9NI<>?poPhQQK}+F7`aVyAeKpBJ>A zwJm_$=qQAHgr8tvGH+^U9$%o&x0qhhX_zZ{Y)k}dn6(1CbccN{z#Cv1ydl=;f;0Gc zJHeFb;a~FY_`OX10Rg?t9azkWvgsa*shE-EvBU^n8KvsW`690~U^YrB$g{DgRRGCYWR?_9UF2r_= z%0x~erMsVgJt&Zt+__UfQW_Q6$5O*r zUJUiT201_51pgauup%k+kxNS$Z&-+G1x#jYtY+xcHiNYDG|esU865mEI2p1k=-2C) zZBi_BATD^<&8ij0+5!8FEPccN=xi9Ye0<~p;J|ob&!Tk~SM7bzC%K*9v;jAchlg+= z`z%r|I>IGY_DZKOWI-3aNsH7ad>5WV!1zoOe1^oYWrx;=&>~L z;tF%yQ^Il8u63Ptb;bU$Ow&gYQkT(^G#Y_!8tQaHd>DIikJWf6E2|-l-^9m{g-M#BB4sE=E9`TiQ2u z>O9X7>sGGC9?4|u0Ub~)?nBXgA^cs+AV9{Zse&vHd>E2@$1 z6eY!FD5ycV*4obt!#7ni{+==*w6yfAiBcN6xl7Ec6QP}7K`fO5d4-A|T)z0@%C8Cw zwyDXT!qgd7t*t2P=UR;L4eFaD8MY5W4PiSI&pijd?$jUK&YGd8iA;42N$tqJ_>=u; zzz`e_!iw5Fvj{Vlk;AYYa}~RAaoyGKCA-#+b1jRYe@S^d6X(pG`TMTVWG#v zD?b2nEl-`)*}~twwL~%jifEy6n^HG26_I=STz z6ur1ewipYa=IW`T?eP#+v$_gcy?;e9P2}^jyUDM7G%wSre1U;Ed@}b{foY z+KNi^^-cG6y$v-~MKfsMsxAe?p4BPYZ`WB-?YY8jeIp>CZnLn8tB8s>EKh{cUshPky%E^CK2Tj%Ek*BP@Z^;ABzNG>j#6ME~h*Va@G#><>_E80f< zF#c|u2B^*c9_*+rekurazxua54A3>iwX)L}{M%*lkS$w8#IA_$elyKaJq=`P7Ye_a zaH%a*zd94)QDM2N?>!t?u_7Q!H*gBIE?zVm(jvN9bRpjaqm1)hPc6m{1=96 zS03SC?kw&r^l|sjEk#1hwT#PIPE~TOg1~-~I8{yZSOtrk<*|VF#77-Xr26U*e=wWr z!0J79D*@oe@*Y%qdIHdNF#h9izV?^5p()w0@~EZ(xlvuufRW85?M#N0t<6p7YI`E7r(yKl6JDr$CQ+Z zI18U8l*wJBqdy9~jB9VCbRw1QJQs??Kv0(m^*cXfGvo~m^u~{GjWNG)*W6OF=G-Ft zN3(-hAtSd(0#9gF{=_?6uYA6a#c@S=CVPj03iZ4BA*u=DhhrjKi9 zh7vtAGB5@+K9y&bB9zs{d=~FnG6s_|Kox5}IWPce%Y0H-e~=S+u8;1;f3Uuv^CxYUz~qwBBq9s|>)>52A3-Gnq#!X9xUMN+Qhme&;x&;`bmwdD=fXINEV$92 ztaibqD#N?67keC1m6eBq!JStRe%Vqnoj-Ro*?(lj0?qPrD5y-Ac#gByWTxkj%El$M7ytco5Vdk<}4|&u8JS3{vqD^1LDxJPsC1EuRzi73Xm4GVp23G$m+j8 z#|Ki{T-+RmjqlZ4k~@p{-1WG~c_4Gen_8A$%cU&DSNc_l5>_J0Lsmd$jA z(xBW6cDrGBAs+w(c14#Hv-|ya5#nKP-tP~lLvHW3eJkO40PC|SxKYlzFJ7+GVJN7b zUES3{k~neRQA0}UfQ2`F+zKHE48yVT`H4YYY1Ww}{_K^M>GZXczWOnVlgX^0SLfKR z{;wnt1D^iuU3ZU-N!D3p*|;iVCuf`7TXHI~_e7C`>^Q6Ocu)3F>+w>tFn__3yxiOz zUdvEXvB>LN+kFYk!QK11l$%=~J5282D0JwCe`Wm_(f&={Z_u86)sN_y?R`!X?f(~7ofON)-`<-O(g++8YvHAsiC`lI$RZ5;xA{;7O z>s})<;#G|(u-@R+q_r5_HmfoUF~8F&wt64X)?&}6;`NyCAG4dsItCPbl??gPa;g&p ziU)a~F3jtf`*kZ!)j<3%D#1S|4S49%P=I%Gx2;x2thPt0FW40?Z{v!+3%tO69}^z0 zKZA;alQ9_aO48ta9_3uy)~V?jdCL-V9~Yf7kN09^RZeN~@QXU>s)aF0d`D7g!1sb8 zU{kuDevqM~SK3dTb&e9&PYn#Bxo^fV!{4&R}XgT=W6^c&?zCa{#6YB?FE!V90%5qP7Tvo5|Qo9;xvg?@Zk z653~-LGu)b@;L^f`gY`-D!Dh@=;e#(y=l%_s^t3_wJW!;02FbJy{}*>_5<~3fpS0( z71_(pT{8}p-im7PDF>jHZ_QbJj}0(Lu0^@I@|BiZFo2=SvR=>y?|0GOzoFyt)4DVF z0P>kp-&dFX6hV5wh0wFqqaKt)9YAgAuM}yM3oIzH;0PE-cW?I?f4veWa}P6){Pqpa zWs_?ORRe`!ir}%*unPo}JAG^#w9v|;ZwM4vv4i7ViG_|kpkE6ffJ)9zjQa5c@2(5F z&CG;IJ_jH(kw_r$LPn7F@eF4kvXS~Cu?CbYDYexJMyd%^1+3t*I2sE=b`PUBlHE>cNs`IuvAZQ6wV%84_~2YYD%mgRriLLE{h|s_g1qDD(nKO z@Ta-1uGYPNavZUDtCu~;Ywn3xDGK;~>bjPWSp5)ElTd-FLXQUSuM@PZcx^h_T5 zw7~j_9!Oi|JQ}0H@FI32#{m3q&ur@H!#0;dV;cuxTMaR#@)7uR`kKi!HF8}5BC2t@9*lN2U=#SWoC$#KKzo|ekA528?8ao; z{H2m#7W5GetO_5riMno5AaInkbhU9Y$Q|eNVQ%}|GuKaC?k2T{C}WmWLHR}TtVkO- z=rFtKNx%+~HV2wibnN|m<$-@Ne821eTuikIAyF7xMwz8m%yq~fPI;;pxK~tVd0M{4 z!fK^rls}GB4-J&lM}s_YJjP)*TCboE#m65au5qin5Lg~yGh4nWfXQ~phSQQ0wLsgl zN?u2-A1Zomix2oxhJRv+<%t+5mu+fp4&gA|EJQCRpyy9B%>T-PiiB25YYiYC6@Ij%`VxeAMga9#0scDKfx~z+N7Op$TWaHmJzm z!W3Y&-PQYBwlKERBXoulRh$TW;j;d&zLtt6i zv?OLhJ!F2oTgHpjo1VmGwY+L|sA}QvcQ#*sA1#Ha**Z|n%FiSE2UE8mb-xf^Z3jq8 zSyH5}N>w0ntHO6-7(zphBEd?*^+iG?#gIIP8&Jw^{s!yBss?(0n5n?6JjQ?Q(C6Q^ zdS}sJ^%G(-;hR0W9=KRZq=1cv2=C-DWg%+A^n6Z${V)9YqjN)(5*H~R-lT)+Y}={A zRH`H%&q%fY`GwznvL9$74Szt}vR4FvQmbib*q&3x;viLJLoP$CAm5J>2TJ5s(4>3Q zed9TY{93<>dF+kAG8=ER2<3y7Lrn!W%S+@jDR)Cvw`ARmWj( z-Xv!rC^(t%kwn#s+G7SFSf9E^?EOYjhZKjAf?1^c!PU>~3H)8CFhtafOk}sE|9 z83BFs;hVs6(OIpHIfMEs_LeustT)T)rG2}(@ij2CUpd3IEoD#v}6|tkeGz-73 zAb$JGPCpqW+dap-g678wH5X3t*F1C`e*4gs-1gk{6*)beozko<313=Z@fab|YQK6s zg_&`EOQp0*G^Ifj*{5`PfXLb}-J@o+KZK?+tB4#yz=iSBUQgYA)0z9cB|`#wq8j!(G;>P_`0~ExDVH0X2(pUCOqU z>8+=F#$M#Q4F#)+UyP#hOX=YBtZqfkmc;??M4y|4&%OlLJnT~9yuRUM2Xx1it3HBN zBhq@#BmMvP9#fp0PqjG!ZG(@!5;18Zz=3gA!-B(!#{Fur=$y!-#ZC=lE^>XA*1vJ? z52cOY1WIA~>y?_-U{<`Vo9&~HRt3rUxirI?Xp~uPFe|8(lv<*$g?p!6XN#1-=rfc@ ze(AlN_$juy1lftJB)tYTK(|`8F!fBWkpkR2JPScam=zoEg?>#W75U^2)TcwIK82{KAk~D{AZl9I4aUAL*i6a!s2XaqIqgLX4H~5f##$eC^QM z+<6z?@q}v^!*Aqb?Vq@t9I1MLhHs#{L(eu@DwJUq!DySXx@j z%`3e!v}!)#GP8pEN?HtM8RjwdYdB45UdovEc?;N_#G-~#3{obT(Ps?`x)TUt95;vr z;=?_5MJ070Cy0wr!bxW%P_SA5JxYtDCSnO(IQT_=s}|I<%E!mgO2Y>In7u4)oDq>U zMtVRG5BPCe?uHA~epKV@j4cA%(A)M=a~!Tz>#Tsyc2lXHumXp1`Id1PlJFa9D11fs z8KR}cr^7h!ke%oI2A8h`;A)0~FHJ)PSVvk)7)#@qAx{z-$2(KAM4rSt!<*_@u7p*% zHaDZ)7VpX5hO$_%QG?{X#uuG+Gh2&gl~ z-`c-x)ixPp!|RWNE!*by5cv&GIE_F|H)tCM(Lc4>-oS-?elJigr)Ti}UZnVwyGoEZ_u(XT<`?m1xa`J< zaOD5-%e`B1pq3KcNQbK^^`n%}t9E;LM{Z$c2V0!jF1ZPBWYr}woCru-dyq%uPPdq5bTi!U+Hw1`lZjU^!TRB;WHU$Euw6P<(DGPl{##$ zLeAb_6~jGbHj=7_K@uP0hLw-vGq;kn8;{M#!L`NAi#FjPKBog76W`uN@_eq4XnpH4 zEBMs4lMZe)vU^FdYA;u|=`CWW%3jPn*wq>c%k=t^c!tR3RF)x;9q_Pr62=bAnL`&j~@9e zuj0?Ne5F-Cbx+5G-erN;<4~h`f1`wels9dU%zm!t{2)j-1CRZr^u>Sg-u#&m5s-~+ zw54%@6+~mQw_ee2d@!-efSdF)3C}ixup5MViDk!k{Dq(OXF_82fa}^D4@(i#NVW!# z!J1KfH$FR80Di-Fth57w?+L(T?@-J+y*?=RXCl6TQUG>I$tt@$zocin3TC_UCnPO6 z`Ah%xkMHcd1DLYwLBego6foJ(sETqYHrz<;4Zw-fM5~m&8kf(3@m#s>#kb)`L>>Ua zm*C3E2T@uyAj+w^F9xk4b6JYuP?RmDT+;GEVK)04=6l-u44pUV+pu9_+VG;hTn@OB<`)niu_^EfP@mzgi=J;}A8e-6N9INL_J@m)4FO17GE7MhmaurS61 zNDDv;MFp6(BLtX3*af$Rgd+O>bsJ5j#p1(hR6^vpZ8Uq;h>ZkMRzt*pG5q>vi{(F$ z<%(IVP#|m4>cSK!=fdXhPC9ZOa(4$?2xVn4h{D3+bN%|8%w^?0pZP*a7F$5byYwyO z1-o_PTvi`X54VV~s+hgbYPp_-Q*!8x#G4Idwj{#GUqRG^T|ALWezT|)C}mewCu(fs zT}g!L{1q~^B(p&Lf7;7qiGT^tJ*5W)+?(>iQ3m1Y3X?izlSw~+1KRHT%%NT50U#KQ z`z;ttS{~M}HN^Feeh08BC6hvqpZkw*o&D$Y`lEfg0Hxb!S9C-`@D7w8%Va7D_KA%dS7=)-lMdrlihss4#QTK`XNhKs26vNe6)g;%)mtC^aC`56l*WJ7n8h>= zMhmD7&h;T35iOqKyaQ#a8^~Ii?2kKS);Z>a9sLY|gJdvAV0V|4Fy=W-TM}&4xAiC_ zSS+c$yfF5M{mTE0hIKYS|0f#rdR+oQ7Lc?E0hMF9U^5@~9Jq~TpMZk5hyW<;Y;C%4 z3_)nqn-95GIc^Fk%i%aT8!1!*w54Od8^2%NM^Ky9pFf_&fdo^f<BJc7R8{u*`qpnAZb-%38YEf}m7~=HYnQu!e2ef?ubVtX@y+(_rR!ORIe_H2Md= z@B`qRNnrAh0YvAwlZVrf_%IaR7&rwh6BN*k`b_>&G7I`YgJ991Q5gs(>B{Z4<#+itKd1>*8-V z_q7-dr-WcYWahBD2Of3BPRMVVkXsrwcoQ9Vhze`qH6t*!Szsv_J-R>n4`|`1(Gn|;-lviLOa0?N0L&Z# zEvU`Iw6%8$V0W1>u7YBujk34R5-@k61>}iE+C;%4n_hJGKLCel5Xz37aiI6#PUG6} zLi}AVqac8o#=gE8rPWGpa7g4TAgz%!Y2~A7>`fP#H{68CVOn_&^Pn;)Sn8l5imLAR z`!-64$l*9J%>|0Y(?Da>Rx|4ziGQN84}t!#yQTw;twht#y2%cz&IR6nK5< zI|DQ}h`ypYjqLvcQy2hKj)*9OqLB_zr!Px!ce=ZArVId1bf{uZ1JEFrR_jAQ`7P1E zF`P=|G0+2I#@9d*s}vxr_nAw|hLNGbQJS)^Qk308M=u887}?Dp>Fe)fTUR5n0^~#X zr;MH83_qG}t#Ef4-Z)cezDmcD$kUp)s_%kH7E{@*{|`W_(;&v@<7~r&{(k}us)2JT z*Cl(Muaf)055L!9CDVX2si#Z>ztf`Yh}WOG`CVd!0$QQ)CH_?j+Mm~X;1qKq$gG0v z408i0<_ej1S_(Tr-gXC@u+mO8?zO_1=NKQ`px**N;fkrfcr#_;MN$^xgf<)-)vCpp z29BuM@Uck$iOAsBGnW2sW6r#AaDLLWBpipFGgbhc*LbBVlWD&I+sY!5Wrde#wyEhS z$UN+1wJaN*1god=nf28Pty*fPe1#cjZNNmp`AC_ox|=kB4_};+t`<+Dn)1>J5%QN*m8%HJDnpRd0nJMi%rE{s*IMe~k>5+X5y)lpWQ9 z+fWEe1`r0NNSF-=AIvNEGQs>w|F2_RerG-c)qver+in0r;PU{G&diP<+ITA(%D{u@ zJHqa(c}t@K*i9w1!19gT&0{oYh9tas6G+Q|(5dt83%oMJ@0sNKNmeaSYX~$CNjlSXI`B!p( zHxobps_8yR%QT%U3Iu5xP+2aKp53=`rijqOwSX(OAmPLSX6pLoN30JwJf1XK44awW z{TbA=#{i;AUnczM6yqNc<5&M@7(_^oLzxnr>5hS&8?slpZj^3#Jcm8O92?4~GMv2i z>z1btH=>bDLxa8?f&id^mU_GHJsOnC6&>kF{Bm~5i2zEgqb4;Qe+OKgrZ7Uln6{oD!=vG*6Z}ne! z_cZOW_m3F+`?c_GSDo7dWw7(ykmiwL4<<@VD^z_QgoU`bU~)@8dk0jC!{lhq*ris3 zO7~iI)w%HL$i)D36s6-J*l|bO<6!PO6FJwVJl=Ko5&O6;ZTsE1loP!5kQr-;En;^;x0k zYkoPj+j>)>l+2tw@!a%Czf2pzU_d1Fg@0`yxM6~sb_Dy}nk`Z7GxETKT*R8;!RKcf zH$PEL7tu5+@m5FPlVjv zx39XQz%6FrvFbZT@q%{;G5+e;VYaq}CitTHG4fRHliAW6cY<$@?I!5(A&sLhKI#Wo zvILTOdh(p(nwD;sFDZK`9l1152pgzyUm^viH3&(Pjyaa*b>V^;1)W-8S=0jUZ+GTY z>t23eAAWRYd^Eo#xtg4l(FCi!uVcvLNMc+zdzNl7izY`qU3$hxjy|0;>^CFT`|7yt zv{bm|yTw7X{0sIDpUwEtkBD_8S5w+QR+k+2-H!`%d3QQBBhbZuPN#|&_b6P)a0{;e zYZP3jYCnHe8bej;2gxN%xUQUp9xGfo#c2Hw>TkPTqDQq$UV3u>zQiNT=eNtAMVY>n z5LedqnrxIdDHCvLvqF5Bsp~$-A&FzmN$w;s;+}L$#*m1|2wS8^W}f;>NA(qrKSS*t zCiJ65_+_F;CK~fw6*XuBKeIh>-`VK<5|I5%xG3buSB7h>L)m7elGW8(`T8W8k6{hq z?|pT%R}kSBZedYN5!bX4Qp|`2!rY`xC;KaFxv6;KM9ce_PnBO+kL9cHC=8|D29r$x z5uWZ)9oo_bx1Dd~&YvcfHNoKI%)_{u&7B|iRk3XsW}BJ+zxSvYa$!edrbrZ|O#*$` zt_ViN9$*)1v(m$sNe2YR3ohp2=*>ymKF|PSyl}yDaC{{`090kPO3|Ku-x=EA_*Ytz^AvG)^i!sivh6=b-}M|~S-I)`>;al`Mt`+Bg!=s)=K!x-&T zZ4y$d77~y~jv}MDZKkJ4VGriyXJyO}zy|q4FAjT7hkwd0RYrq?yM{{ZY`Z#4Yv^MZ zO5bj@jGUzy(gl}$y>r`MyCMWca)s_Yo0ugzb`_c~wmK|XFT~_`8+S>x8aGSG%Zp1m z$0jYU7~8yCj1S9xGSfc>IT8WG-gru; zj@#_i4O}Lj(hT&Mdd5a$)Nz}-lD^HdFJU;U^!;mLyt_#WSB-Xye-p)fQV*WQ?_-pA zwBLKxcJfJN1NyrxaY&LF9Si5WA5Ggv=BQ^wkz~^y)QOq-hE4}=E8UtT)hcSKDQeL1 zEV-beTi6H*fzuW?d3ng8C^Tn3zE#KyVUB{%6zyB>9U6~Bc1l!5-&Oa6Q{0M7>(*`5 z{}B1~skTPp0Mk=Iy)^1qgX4*OKOW1s=^e};KPiB?nBdFUxEsAvewy4(#OU}2g=Qbs z|8^hN4l|K%R$!)zp1KlIj(| zFfW&`Oi{5OPB`36#vz8bzI*@PJ<9DHUw?Ej)gL~42=1#3Z3?fTbsqz6GUE+dc)T3W zr@NR)sOYmObPc@p%D5L&&rB0Y4I7q;#>Pipf|0JG=a#=Z_ZIu4An$Y0zqpWmwt(m6 z#S+WxY|1sDrkPF4&M9buv4h+HV)AZ7Dk2ihw+mO2%7?Ez!~RbwV>sQG39b&D%s&1T zkeWB(dOM`I--~;)Lbsv!<|}tg0V+8%z=vl>O42je$o|NB3IZQ$Orpf4w-z(s4x z#^5@zy4feodo+<3x!S)8B?p})C}R;u?=_RR6?;S8ebtHOxP4c<@rSWP-6F;x8tYzv z1G}l<*0kB~m@aT3qbBHkX(gH2bZK07oW|WsCT|8*J)b60 z51gnnvb%w#08RoWbzE}-U*1yN3|3PJF(NuXp?}VwN$T5OY$AVX`%gVTs0Npv?I7ci zdC+sTfr}<}l2VOy=~0!J4rtNL9@9<{JMIHDK8I)`keYtVism-Va)I)rfCc!`zaEW- z4Y(*y=RTq70H;Q^E#MxNPTtPrfya1n!@Ou1kMx6W+>#YQdcT=iC-D6}%IX#Wx&Mc_ z_l}Ed$@WJTK@cUWh-4KJ1OWvB$)J)Y(+xC91te$54G1WD2of74qhy*U2T6_LkfT6@ z#70SyLrZAltIfIdo0)s(Gy2}|-uwRHAZPE|RjXEB-&#eAdAxtB*B>Ie9UuWJTqx}~ zSQRJ;u$HYMAs4U~Zm<@PY(*VXjHD*_U1)snDPkGY!cjZ=es@_ zmPN)W7_wtlfQVUiG1>q6Iy-1;e`mN=TF{In;4U4+rG7dP9?)H&7n;(; z!R3Q0pUI9U@e)Wk`N@~J03-0surabKfYI8(bFk`S!rR}W5JcJlHj#UPw4jA4f@q0G zT(g=k62L&SUjrM!W0GqA_;pY^?6I_mLO7WHb8!7AkI}7p=z(8-fi@LTWVJ3Ade0M* z67w%`r5+V#PAZ7iodF$q3fUb;X7=!iRu!3T%Vv;3J3mUt0q^^_6fSaR^(^s_ES z=!Vc=5a%iw9sS&U^vs3hqhs+Q)$QR}o79+DPM;a%# z0ZeDz|K!h0E&)~)h+FtS_K410U=f;dK(RKJ#O@=R|7QaI=S@=5h1hjxicu77Bt6(j zRGE_5G<|u#X;GokmzBq2Ywyi6RZwA9_II9aN)p|>B#BR(I<5?I9}Uax1Kzf9?Bbd~ z$6b^T3!UlA?5?g4Nm+StXqTPqMRVjp$r8ckn>>e>vNZqs_yaL^Ihl`_*YG3_dPD7kV{~AnY&94aCQPW&qakMCON`0?Ne*D4~Wa3(#SX_;a$i zYBbKj=($dMcK$W&W^%hZZAW$!C?$1Y@Sv3xGAeU*-*ldy&N zQ)B8cvNYXY+LD=8;J7_KDqil$)h#15%FnddtO%E6k`pY(}-ERIU zG|W=0(kalXUMl<;9h1+oW9t#I5t@4@+fWGWxqntyMNd;*714DjhXL*<|FE z;>K%Gohw>OMDxe1?rb_6Yp0>5@zrW+;sYCx%Ls{sYngd{Q)tJT`{oNcHVcZYiGZ)~ z`+Q#$9xtUtcy)RlY;F3if7w<}C8YF)i+xZVq;cx>=%-BOFE@REPP%5r7Iwr>UWc~8{C51UJZ_(Wv z#J77GtC>-o!9vc-@!hnt7Rm7h6sMF=t=|391y74g#NQwo{~WGKc8_zjS~+pg?(NrM zQP*d(fxzsltP046(KOr$ga;5iY-U4b267$<@(r8r(iJ5|72>Z<}hy zeVmbqpsvoS7| zP5smnw{30oPH*|`Ha({P?yJ5VkZ+(H$MwPGM{buU*j+oug_8BIA#?maJt=K|p z73OlLTgY4%+?-Qcr|<6OAKvOVoaDBus;V)J>=9*pgWBl8Jlx0Rkxo$~j@cBQi;=@+ zmJxUKK58GApf5jNNmovJ?VcD3q}}J7Gg0ew+@a~P3FLIgxG$%ZTjO^H)8XAv+mV_k zWX?~JP)dXWtD~k}bjfo9sq$h;_eWRtExfahQ<&^iDE2Fym2>=+LjoL;?;1cj_M~(a zo*yHbz65zlKTE;2-=_1%z&$i_Tk3p7mG9pWIvvu!S@h&7@G4pZP5n-z!=rg5cJJ8l z%nBm^R3gOvhgHy<+6)XN0h&X*wX2Josa#uBEp0tYw?O|(os83>W8He)ZCmeRFEz|g zf5srV@9`>{e?zLF>P+2?3c+vV9wyo8GoMHM44>g*X*4y7=^1Jdc{B~)%NWRvtzX#A zsH;F-U5jFV39d-5`NpA7CxW<9g*SFfMk{tCYz39elw));+KmN53+;|m-yUhy%u8s1 zwE&YT3!Gct{p@mmcM`xSE?t}#_G&a8s?9X@Pt?ur9PiEX5ZGm#kq~*|n{I|Z*M^ky zO?Op)Hv_Y=;HmHxGb_EynRhs9#^S$^k^I?mZl;6)%$a&z`A^+4tB(SwJ7Ll(gDLhx zc;_}i{r`LaRDS(?2_jD!^VQt`bDB3iyYr28ip`LO>1*l><-;{@Ntv11U(px$ZXQ}z z6UNCysQ`ygNts&SY*by?a+WV-{hE%g+ZsT-6ODt|qJ_MZuW@;ZeY`PJ!KfTES9U&2@bCT?#zc#LsH=(c3XbEYO z(yrIo?We2Y-WT$vmo8&!9&f&7&!$~Jqnvm8bE>BTWJwKXBSkR4 zBUSvmK`yoW3h-C`Q?a!>j5`wtDE`9gZ|+3fwXv1Wp}!a%j= zv9%=Ho{*FF1l}sT<1;^3p9OAgSoiNupHAz!XH_j>9FVTEE7C;Jo zIn)Ol8R}q@0gxICoc>Z8m;=a2I3nXtn-3WVXn2d0BbYblXlZ^@_mW8x227_IwiR^^8~!jq<=niZ9b(^2z3%az$x zrrS^*2WV)PQet+mSjMVj4C3l-62Y9H zFRdX~`b-0F9&^QKMXzVRG*loGy=(f!|Fv6WTADyks&k?*{I=DxG%0xm7*SYDP9E@!r%gv;o1? zkwQ>-FNbDGW4`>d+#ciLW*>kjn~~sWQ>T3;4!i`dEu|l{zx4H<$tFXZxs1Hc3FOI; zfRBj_Cg85UM>Kc=E*6h+sYs`we!GaPf9nOH&5kA1^rQ6#v4@Zi;N=~W9(1Oi4}tSo z!E)5?iK}B@qLVZIaG}-Suqqvm%Gz&6UsUL&Z*M!ydH4P?jKS$OJ8O27lTZVRGcXS+_|z^h`)-f6zsbd6Q~pH==Hl``#&#h$xx6BYVjPY?J&_##^&rIn+>I=}P)IcASCB?9oN= zv}`rRr|}SBv3JpgoU%O{fP`_D;<+sXeX-K{W0$Qq(?wxgJ zFVC+rGclTSd*T%~3C$d7eh+&4`Z~>KL*N}A56=2sqQyZ9VP~yJ>~|CbNPp6k(?nf{ z6asJ&*S8pBLHrVa$q5x~E%c;qH7AwN-HDaPR)9lMawb2+L?14|zcBvEckPatn1OV{ zc7SfaZi$i}Nf12$Q}em;cpjKwN6kppN+dA)3C%pTxU#JS1~lx^)ko>wGK>P&*49sw z2>u814h_40gs(f!4`w-xzZHT6LksW@9vh2nWdY?*_>u{A&d$JtwETw57v!puqaE+_lw&x%{5%wY-#rcu#xIZM7lPYKn4$TW7Gvi~@ z=^-dc>5oT8y%5BoI+Kas{banaGj^`+$O}W~og0tIhvmN+HLP+tS21ioF_Sz9t~}^k z|KLLc^ebtI(`(rwkWuGhwv;COr@ZmM$X0=@pEIP5mdh-sK)M$sx={)bBC^|ftlYk@ zHMeBkJ6Y?U4zKh+XdJv>|7?D=KeWx)d+TgPO^~bMe|T$MSL~a=VLc0^^)VkZ;nyfe z>jL3HEA_@TDK0J#VciVH9H$WVgeKK@@Ct21Ik|wJOQNzO4x{G&05l>`ke>Fi zfx#5D!7PZ&t0zlZ*{<-;*?Bl4@wSs87WXF&K8{J4TJvS8!~V%RAA@g{XbmZm`{L}l z)*E^R zDL|(405JZZ?@5rX(ayN|bP&^+o0WTuI%ah0@AX=z!OTz$3p0=h+ z$wU(F>$$L@)jO5mRJiO(hM{)o)gMRN$D&iks~6h>N_SR-3)erSqY%e=eFpjUSQqZs zZ=>Nw^FDr#jGmn+cu6(B)B=6OutYmiL`(^o?CF|plMC=I@v7dF7+u2vHZig4(jP^Q z(dKne3zBVEG{+8G+I<%5$oKAHeINAM1WO{u`C5Ke6D$U;TqYTRGBq zvVfNxXx`okg4HmE-F=ay*P~*bAm|sSi$-kV5m$Jo z`q15+P+WVlytJ);lc(h0?K++RNci66hqUY#EhdzBpLV8vc zL_#FeKkqQP7@WlPtH4C5SSA?xXyZrc42q~H~r{`mW$T0oF^lzA44yE4Ba5dW7 zpt=G?@zy6x-mIMGY83vzPByp!-KkKYoNppqXjxza>)p&N@rH$7=se1*=GT}?yPw2J zr*0-l5<6UHX2ZP*^wypaPZ0Dmw7A_*euaLyG2|zcA7qa5?kkOR4K+*u5sK1M7qB3BEjovS6Pi-|~ts+nQtElOIYo4~g^wfSMv?mb92m;UII*|M9%uUu(uX( zV^{d26?ke&vqx_4yu30Y1xm0?-eU*uyP=ATO32t63C9EM&>Nwy-2+9hC+6SgO*%a6 z*r;h=c|(rd;j15)e#3DK1Ewuxja+F9)Of`q6S2$E#$lDEkO}v>18N#m&nF{L=Uz(; z3%6vo>$L#)A||3qEgGn{&Kh7~N4JVm=ySLH-hEOhXYFsHxF#G0k~1iJUcFH7wW@-u zur^fIyne0}gcXX$0vjDvvQD5fy^psFxsuZd) zyAL4G{st`{Q{D%79AN#mwY520zlJWxfMiMQxRj51#G1x!ho6J^oInArdVoGr8Yt9p z?+q`5YUHUyX;1KtE^y#8+N$q^0F%|QdLKa=sC{>eR-nD+=-#m>wSB^bpQsX znZ(oQT_T7t(fm=w`PPFSTof3sFe8lD`UsM1TYPiyqjgclYC|}VgU?l*ma`%=5?SSL z<6X$+ytjuJP4~0AF08rP{E%tVYsf2;N2W0CM6BT)=k4fBbAk`dkQ+(jhJOzJH$BP( zdXJQsKh4w6i_Xl>&U=Ge)Ba!rARke6qelB213g#vanJN0oZG$-l=1B>mWfs>ag`F` zyWM45YC{w}@SXWa@1S)9sHU%VCeqie=$CbJq`^+mVxNI~8E0~0%+Yk^ZTJ+fT8|a# zhA)EegNO+YEhXQXRe_81C&{eD(9n=elNd05`yzef;KfVd>C1OK*Y#V6N&qshNkFNf zgT3H#-~Sl6=3gUrN+y^AS$iZ-q--S-mAvO^ujoh^Po zvc`8jH#UBakMm*V2nZu4@%}pSBBQQ`?!Y%MbXaWVc!fna*4NZdkSp!)Y?v=@E3bDh zdVM>SP;(Sa&`|(3!|v>z6S6|ZCvj9a$$WW#ONOwO_h*P>0idZ4NKmeLK=6)Z#|0q7 zMwrI6R(=kvMr5<a=fclh}jo;KO|Bkop;$j-QC5LVq z1(((WeCTaxD;b2c+XgxlN+m?~*4JG!qOZbdBrdS+S6uzMdZDZY~ zm)2h1YG!PaeE%9?2SL$g2+DL;4Y+~tq}H~X1VB~IJ2mVinB=M|U`Nx^^500aKa+h6 zwg-C(km=dA0J(dLO4DIH?zX4>69gb)`gX}pfx!Ao)ucM0(WNM8TYLLnH9mFn&%$7#Gs^ia6j`r!zCQtGuXG=L`;YDZ zNy`qPBW4W*&w_7!fbd>^^SvTqj9=383Mpp$0`yoSDRr)v>hgR4H|Pp6)9zU77-^UP z?vH_QQA6KCkQK6c*50=N(&iv!saF~1{p5|^NKGUE0TTBQ z+V_$clzE$viHLAMR~`~E+rkYEe*_xkd$9W(Wc-6a()`$>>QmCD2*4;m&fY2hA}6?7 zxogyEKUAlsASLwxI2gv$$+0&glM!0Ig4D6Wog*!Oq>Q|Gcq6mIe4U%y=|4c!kzYwr zyn0caiY(K2w-?*lEhZBiwIfrmgKVao@g!-06|Isw8XWOStdze0TDtB9S{2VoU^V+R z$umg`@$;n;vV7e}u%G?s-M;(<%>M;X$bJPR{&a2fBp58+ zGvG9Ty~;5AvR~`&&|^2MUFWB=ojbQElO`sjvtS?Z z#P@7_n4(f7JRqDqv`I>K0Se)Xt=FZxoiFbtkHFk#vXl-s8!Waq>7#4cXj%0xcSMTKYe|WRfe``hpm!z~*ubSoc@w}es`0W{qrsvIn2e03@9Z*qU z9O!$oYOGGvI#REklOB;O^Aj@HStDPz;l@)FJK{drp%qg&>LqcfYP ztJtBCL+`^`jv`Z125x>URBST8^7Z*NO6|y61DAtT4g+*U^diob+%b|DV2zd3F;`(p z9`QV#l(Q1o>GP{+BuFv0ANQRHB0$?r(nyA(oE4vow(Ia%FB4VjN)#(~#W9rHc8=b; z@W|>nIP?ExUm=dxNk^|$siuvN?TbD*+}JHz@A{!dK}Mk~_8!gR)bc_b(^=hw@_nJV zwd7jw3EYBX;W|g8(+JQEg10J6sA%&lMbpiUm3T(mncg;W$LxM7Q=_EoxvW`X;NgnZ zslXX1xQ-K81L5MC){ugFbxVR3)K(sSUV+?h)#3fc;7 z2I^ze_R|L_Ls3lni5kJk%ab1;N$@C$vp?P3GGL02ttS(EQT=5* zXV&8lf3$bE2L*zjs}+g>jvZIMGzxOKa)?e3cSqwV9UkK-OhY}8$mNnmGf3Wlt!BZ= zNeqeX9SFky^i;Xb9(VObFFNG5=vq*f#lcotXe^huT-HfNB@9PlybY$C`eNnL{7K#% zy+XTs{?%*2u8@F&3}d^L(m=F^`D8@5 z@^Y|gNVx{MV2x7Oen8D8kJuHEBIU4_x&mCO^mmZoE1UjG)*57rv1Mjo?hoxvDz%Q4 z=PK=<|22_;&G-S?jD6-0+u;0yM}VImo||ukZGMM^zEt}W`u>O@QyRCM#(NDO;X8sY zJ@uxNAY1Z0^zjiH;-9@vN0pSL%!}S!XP%Yh7fU#8yyO}v%S{4HO675T&3=P^p=Q>9 zcVz>b?6AO}kd1yO>vWtIz;U8yyEt_?T{kBSrWlhGd4Gc=PC@8(Id;j<3Lt+*|K6=f zGY?iG|=MtH!N+ zJ9O7u#vWI7|JD(gKcML0OT+On5Y@EZPj^wEXT1INepEM4cQLF{1;r_9sTU-LSw1)mY9u40V&lfdy-{<9>YGsA5kHWy z!j8yw-=oLIQ7*OMaFKdwbN1zrrrc*B2RmAygS_RNU!Y(4bx^BcY)2%|b(ic^G76qA*)D#^tC0B z-fPZUY_Mz}wm!irW6S#K7WYK*N-l8h1JG?$5hAk^);Q*u=~EDw(En}O<>Z)tB$sXD z?0PrX2@8#Jk>|gqC_I7VcIuG+7+7f=BHj2UN9M}(;CbTL4mVqiw(TwR>2*%|LZa3L za_y@PKH>vxpFcvWQ+?2YUF*~MZlf8v-J;kTIzu7*;e1d1JJ>h8>g8x+r{>Vl&jjw~ z^k;*}X7Eywj)GG7XMP&379Z@r9-jNs`H-1C#h>mY&ufb<^BbrywfMMjst|yce?z%( z?;U0y?#3~&9LbXfXHOns&86!_JU#LKm{+x++urUvA%YNM)Mq@g@x5e&v4%tsHP6l; z-tDKSEi|vM7GJ#OxAx{Axpt2dG5zG=n!iR}zdp`}ulLq9%~7PH-ULs^7w6vX#WfSkcTStpJ~O%@W)717ucXCOm7AM+NfNuJI0IP+|xUD4Dh=^ zz~q5zNV4B1F_rzW@n@c(ZIf=dZ4G6p&)V0Wu-=n}^DI8`{bHLA=xW-{BQ-)9@S5jn z+229c?MvY<;PIUiL+<7`vfP9e=!KN+$bRwprkmzqTn_(KA z@&wOyG5JKJoANyDp0T(G6h8mV)22aii3=KW!a7BF#hOSzC9K>(`(7nav-8c$gSZg4 z;TM-DkC^%7Wf)}jNiVDlSykA7^C@+2>O57@-t#+b0knt*B(K~a0ZnR&ZNj4X$)N~T zdwfeyOmmxzf6;oKN#Z9b6UjMI7$0Df_Rb)d#w+i_eVyW_EFG0J zjiJ)auWbp4zE6OsWOXTYWzvIxE_sCC7QCxxGV+OxFdd(UjgfCSoOcs@R|@LYmD1d? zA7B^`$4Ku(#>Zo4zyBqCm)EtZz><}mj>`nWLpIa$^x8KYW6m0hRR)_T64ki_&^68D z92F7uLJ!Wb5UJ(RHyQIFhwN(Zvotwg`5JGeX)8iZNY0J%w}Q^U#erHJk+HE?>vxQ< zD6+ZU?UBYHu)2N;hbcF1-qj=4dXQrn+Ftb5dD>N&8cpOsieSjxxy+ys`>&J+n!3;9 z5Y;gh!TH|Bj>@zdne+YwY_e=THlMGX;#}jAws@eB4>9X0o(Yd09zxRF(z%zj=XB#A z{SF6%!=NkBPSCoM7}svZPSzw}q33~94p;Fdi6jP~`I1E2X4Dc&oj-fGc6OdZ;1>d4 zGeltA>q+!F`H4n60}>ti|CQ7YfR`CGq8f5c5+>S8gpnx()}jxv&;z`(cleY4${W-O z``smDgWVy_sr>fh|2LfcN+qCXgX!WUv<^75-~4j4!QN0bl=7i{hmk;SX{k!x%Cp3Z zsnv|vd?hA#=v`dhTSKx!E%s~NN@pgTIfXOS?^H3n{pBlNxs75%CNsFqaAA}s3@ z(`!n^7Hx30O10E4ZI||5FBwj+z<4c2x+D#Te$XkaV=g|~JqigP32H-WQzgygVC6$- zY$R;*lW~f;9Q#S&13{|)-~M=|8gSK2_YgZxA3tfP39@vPhEh7>NwdRHDYO~8qRMoBzoL}u{2&5Zj$(5sK0$d`;^7ey#8)^ zpjFkbc^DjQDqH;yTSOLQ|0fe7vjI9dNrHdubld2Y-igPz)V7xlF#vR(J@%+~ zCUR4YwI&3W4%^?MnnDi|%vZ+iU5sWq%)v#IjgrRvjTy)A0npjA>rsF0BQc`n9j@;F zwI_?z0gHPof?|X-ipse!0p0~gSs=Q#o0jZ3zUc9Zj+AzUS@t#!tOocWKJ&51oZATPWr-C z+r6=KPbfTBu=PxcLHzw28=_-x&f#(mRCzy1PXfGCSKQJN**feaj;?%33jatR9ew=} zQK`bi=&#)VitA;&Yqzw{I#vHGrHAXyX)4X1BO=rMca*!98C&!1>3na9UVbL~>WHT? z3B0^Ai}a5j?-s%14(qS}G$AWe_758Q@jkGKx^cpOf_YS-nI7rJebVs+enLdNZ~}er zmM8P}$*M2TWTvbkA4fijz7K!RyFIUYX8a`fqy1B(k9sd3uZpZvIb=*yV#Ut~RRuUY zF|+Ee;@)1YqeA}sp}&kN#FAoolmIeJ&?IoAsvGnP&^NeR69oS`xG&u6lTG4*WdE5c zZul7j1l);3!ju*Ogl;f+l|bWaF%Xtl3Y_(_&Y5^$PWpM4vp^jRu)BJ(BuA3QD%q+Qxq{J;lUD%+u_22yj{TQ6h0w=mETo zsHozMpOnrFQc4wQY-Mfjkn;EINt7%4_Yq*rTlKccDKxj79SuqVG} ze`zA<8D0*(FKD~wPI=k{I;9_X3CmBt#IX$DeSPaG1d2l?>&BjMef@FJ&(34Lk)m>`@$Pg;-B>cILBCGfdkEiHkiIBP$WO8 z;J@$7v;BSH{KW1=e~(YWLgVCzXDD2IlV$yNm|^Opl;HQk0sjghDf7CWiNc-fj!$Mz z3jJVyteAJ()R;|{f8Od{iN?w~ewUz) z4L(irXEH<-KAHL(3k`LqwWkTJOPTIL;xiHf$9Zd=CnqMPCo|XO4xKN&a9TWysRfO% z0G*T45L-a+75;Rxp|k%sJg{BlpthrnRpN@{D+!Q)V1Vpg(oA?{hnR-diUc%f;mI{O zXDgYHdJ=hPIixYmu*ND*ecp!F6!hpghpdRHVfu5h@$EjT>3`d!G5V|FA?Yvxh04s% zQdV&ZA=38e!--@>?Z~vE{kK1?A`kwvkUVa!Di>fQKdo;d?iNw2Xv6NBJ02&A z>hQRGO5cE8r+%ZlceNuP(?`4Ymmfl)E9V({#RS~ULlQp#>zHy7osq~<9^a$~Npgzc z@%Sj9mJJkV8X@4tzN53n=TP*y6y^8&?2)a(;Cc)ooFDS-xX zDXHy1Y{|K6NxtGM$z_mF;C`qsGx?x;AysaDnxV}6M3?=t^S3d}@~Jg^?H9ctZ%9PuDb!&F7HguEI)zq&We_qPOyzFQuAD%=G(xj z*_AjLuU?|Xd^2m+*bSM(pD|u0qaGiyAMaQVr#QBjxgh2b|8-J}srq7HTk>Z9deF>4ZDC6Z3~`cfpZ^l>x$+=?#Fid&8s*FetZ zt^fMR(^!`N%s;>pM6F7@p~qc}*BA+vw^p#mc8C3qC#k4oKhj8FeObBkaBtkvyrW&) zy!kcj4D#`hdt2>$M41aC!FU40?8_>LzNX|d_d5j{{e{Mgn~OsnfD=(^Gu`oW9{9^* zVq#tMms#7sL=*Mpb{WNw%k1<1RJ4%nfb3<89cv$(MTU^<#o_42ybos1SG*z`NysU?D|DAyf1~J! zKZrfXjG3EssJg`upl!9}O}@AgUB50$U(!gCyq7fNl5Ocby?ZS58V9o?Wf z3zX&$D8WVPzQ=(M$FaJI?w$3v%w?n}Y3%e+VJ)))IcAh)*zXla)G#rb#`L2bO=nI-3%J^msW^S@;jPM$1wM zRS6O>VSVi$l}?W) z80f1_-~@(+Aeho&$u|v^VzCg)DbulrG~}+@8sR2d%2tLrsgadI*P{3FXPM7taY*Mw zoCks7O*b*~+-p=fc6<0t#RxqMx$WQqM~>Ul6^Za?OrWdE5BgPJD^!(NNkIbg#gx7A zyQh@|B2NrWawnXN{#M5P9|m(pi<=GD-Y;CVmNCEb}zHR#|WZO`9Mmg{X7eZ8M8t^(TFy2YWgS(!1py#7$-nS)B4oBZ(g5 zb%gO~@uPYcH&61i)Q!)S2>Od=N@{AtaPzPH-O_~ej-5TBJU>}Cu`)}6Ie#23Ixfy( z{M{#Go)1%_D(A|z(JFZ`y8i6DCi7%Zga-l?DB6b)5alfuBu!xnrpif`_MPqi7t!`o zVtco=1QgJ)x*9i`u`?eH1ibLxeH(&)qxxlqgfcd!om>{rhxhuXK7I@;h=>MXYX`SQ zb`YWi;WX5YHigS?dC>7FQ(vMy@#!#EbW#$p4Nj=@US zVj``Zk*Fbo4{S$A_hqgbWPr-xe!%&K#I123>?A0}yl95KG6JU;AMbJ^Ae?E1R%ir!~H!k@u=6N1`vjbmmShI0w%m}8u&jug)U|SRy zk@G+#0>hrQpOQa(9h@|~``9sp_+c?Eu^|suqZ_%~EpvEtmMwmxc9h!5akyOh^`d94 z7<P`~h4);$0QO8s|riHM#12 z6s%yH&pq@}hu<*eH&z!P(to=lD3qBs&ppc_&hn0W2%zaQo|%H)Y=qRf4zbU|o3X#u z^6QlvD0P$&M}G(dUr^H~-~&U18+kziH5}A4nV$NaX!FtsYZbVxKstAtv0Qs!S70I4 zO~He>5l>d=pqHig|FOmlTssl?N-)HJq1Uexk-CE-=(=gA%aF5UHpcxJPrQvdDmZUf!WX zJC@SWe)zrC>zhsI--oB%G!SR^4aLaP$xL6> z66sQ_e<*1&e8zgDa+ULO#e5KA|Kl(?TL;?&o>?ZIQ(o_U?eY%ul=S4ZeT5g16?UDRwHrlk;=_0x*G-nOyRdP?ICn5Ev>!)Q`9?kf)Uq%!phb*vPzsex6@5c}+bkL!8}y-2GFD;t;ik7+}d{$1pvz zAMt#KHeFh}tF6^}FgclnpF)I$t`s3d{>8o#uj;Rpnt&Sva#B5wQrU_4EB4{ubFjIg z1-r7n!Vz$=>RsR!6li`G@al*vFbN!z%cJkztKG)%Unl(mAQfOi(Vkw>VGz)QLg#}w zh=re_$|N=p3B~=A>)w`Hk!GNJ(k=lsDut%MPQzd}yj)vgGvB^#>JOLCZiAjM!VTAx z7!yC|*fT!nuPp2F2S#=UQ%|2Uews)A`6$&*_ZtJgBWkA8u%)Tv!JK(P??Zcdj|y3n zcj~yB-|hy(LbPoWTv}7$5_)MEz1v={AzfJ%Z_zVo5tc+gnDhVzd&HRcgt3dxI} zpVb7dR!_{Rj*^S!vwIqVb{RWPqxZ#TzD}x~`I42H+43%nSN=uAfk{2$wakoCtw0wz z^`i0e9)kWnsqE0jkFOa_Ux?ApFgv6j-a2BbQa{uD*Bf(Vs*tm5$u58`Pdnr9 z^4yE>rj?ugA=>;$adW4w2^wZV#pbbhYW+ZQva>I#utEKr+6~EpHDI@yZh+2UR5l0c zm4=R3xu%Hy7Rk+>TT5jIy@g|M-@&KFJ1F8-MoT^y3>@YkUti_;+%burO|va{M#Ky* z&8+OoTo4e_JI1^|u`jq&@rk~;&E;Ty{N-c^?g8$ixQBRwl2h0Gc1DEM<^4kLJ#`WL zQCZ-0ni=!BgG1Q!&Ft8C*Y0J;@)XV4B01&>5)ukh`c;7P_Zzr0R60?Sp4R$TbHHCD z)Xypdw9^$S`z8n{atDC_4B90}DlN(~`qMs#2pcMo6-Fqdf@)${kArMgJg^xU>Ynct z3XPj1-jDP!<4#HoGmQgoCgq^R=Gfr3;@5&W{aecRCkpF~vi-$7hn_Ed^*$x;RKd+_ zwXwT$dirNyP0jKtNrM`f@apd`ysP!=&F$>Lu`U~Ak6drbBweYqS$0Q~MDzUJDA0cB zWdg5o?&+6Rj)vyKCEzGzT#<=w;dwfh)wxu;py}Wwhg-Y3*c0;!`JIgAJl66r!CB)F zgzuHuS#yyt8c@2sk`B@iW?x7R4jUg{ZyC~^D&u}d6#&wsNvs<}4=t2+3kK!p(|*3u zbu!7MFnjXTK&QP=6t-pSy@*>uY)I(Y+u$BlcxMk6;6K~Yw`WkV zJd7jTeUu=c0`|HTiIa&=jDt^!k!@C~;PTg-P1`#j(^t|Mr3e>e-Pph;$Hu6~E?>dc z{H+%NXXs(6!}ZdJE$r^}4zr_3`$&cLBl6)8-Aqt3_;jI%wS2g8Rm$LS`r%Nm1n(l& z>BMi84N2BO(@h?>G#)c3(s-wtZqwJ7Ij$U`t+drnS zHsx%A#1kU98COe5GphhE{6;)~GrQR!Uwb-g|1Bp=E<>Va_wJX1EcgxrGJUUs&9WIN zxPJNqzu<@ji2A2qt~9t-uzJ3Ommx~OJC<#OJ`b@)*u77Z;3#BGnoIN^ah5%xYIrsS zk2F-5!ql2Oe7&T|Ha^Zj3l?>kp@*@2xMEpxXm$ETblE{pkA!UJbB5f3^&5HkX*y-h zK=H-Xz>x=Dfa&43D)pW8;IRGG6V>|zNg;FbEqi3Av((3G)t z&9*mmmFK1(9@vn8xk>8x%tth~XQ`lg*1HTH+kCgiVT%`W^6gU@G~@9S4!mbh7+fwp zHQC(8CwigbESmBYyNi;95DTkaR?ou}?xj6>j7vT|RNGMbG7@GvlrJm~$7@eF+P@{m zs2_B%mD4I|>VPU|H#T~Q8)l}Se zKt}f8B+*n>w%NH7of^ka#Y|r)k}Y9{!}!p6ErnNgbXyOVmrPAhCp0(i7n_(LfK1CD zJBs$-NHGd~9+^f?-{eaz+Aqv`S|xp#4zUIKvHP;%1j|--gZbnrmw9uqMj-NRBLyi# zuGd$TcJrH+Ox*&u%;+s-Gsq2B?0nJDkmT=<*mI1OroRA06|-X*w7*;R^&|@e?7jYr zFt>emm>T%I!M@IAUiwNN>#|P|Px~DxgUrY00tc~hPnY+STZ=-R!di=NGP45e-H#>c zoYu0m1X@6x&!Rc+n-9){A}UkcPXw)?MDZ7w_8-Mwc?Mv#HGyz3aMG@6NJD9$?GxSA;EeNX{T;I_pvm!wg*?n~EOy5pay zZ5B0Y4FG&l;QC>>w}HC!w63zcI=}NMsA&x1JaLBBp^x=5SS4GrQ2ws3xt{=Eh^H)&>@ltNDU!C0)cSX=iW1W?|b&hy>r?=zvEwo z>O!enqRpX=+U|gjwKg<@;s3RbGMZCBf6dc(pZYn|7t) z>*eP!4z%D^PJ?QH#f5|cip=Dk8E!ejoyFfKnbWSv6~8s#D9>b%QDJ3qMRsEG8v?pu zXQA)1wx%I2r+BkHsM``-XSgp;%4@AzvOe&KI~UBVax%X>5#wkNdd<-wf*2G{L#-A! z)nbPH;Kl2y7}mMs+s4$F_@MXA;DFGeDU7CYVpD!1i-8aFCH~A^Q{k5sWWZZmH4=^q zv2RHTjSc*)IU>uN4!TVHIg6e9i&h4>cyKJBfP)@1PHAWsLzN|-uTJ>q_YVE-rjZ9B z;J&O2Ua!u9YmPH4H&??(4M#lMS7(ZD6h0r2FjA*h%z`pxI_v>$1f2D?Gg`!!YH= zYCha*|I(mm`!hc-_@IC~YDqjQq6=0r(LDF&Q0zWD-8t{(;@ej+ePjVR;wh;ID^tU) zrErkRofyI`xYbw>Q!)m~Pp=VKSfDaiAT_SnD*yZtl# z@4FeJ##ZZLbBdHexSrjkr7E8lOK^k2V$XT?1+fv?_0@J|wQj%7Y*qWdjy9jj4#SQS z>l-kEuUf>bz<~x|?=#W3^9LUuBmmMlEMmGL(kN_hS%S%_&Q9P&eNVS^ihh+y|2fY`Y>_+=!FPOgO0YcV;Zaj=A~`6R=f2Ne<@n8VDp zw~D%+FLH?=8Ta=ME;Dff2u2otJv|~Tb7hSNV`=(Q0$4sIhJhIA(hHBgc|sxb7zm23 ztjvAZbetPxs;Bp|rrxjbq9E}DSykTe$gkuB{U-He*{!gQhtEW_RGAF-fqaba^{gjp z*%A)%&F4I%`0-xg@}1m0Ux3{r6K;j=?g>X0paou^l|!!(uUDZ68x^)!|b z10#RQ3fnH~n~|687`wQ)bftc)6(?SGZNIdnYGb|Ce96gr9E%wqIWAmEwCqxs)v-)- z?3k=3;*LpKVFM~gm_#mFB+D}kY19UeHFii6Ud2#WrsfL87~{vL_UNT}%^w?yOIOEK zWcq!0l|d+V(cPPEZhhnox|MD&Bw91#Ir3Bp#sfAknfs;gyI?&c!(`p4p-raexf!Yt zzXd94rD`h5@JF22$kq|Xz?tYSpEm|z1NJ~*-%H|7+@c>dJW)d$m6b-cfbs z7WKv}D{r$@#m$kO#`RmrgNiF|DBxw^(qviVDh=m>+?GfzdFO$YB~5AOWftzZIcB9F zJNX%0Nf{_{JT8OKn`*4kten1E$ju>-T@_2t3SIvBk3{iz(p}yQZpr?c^p(Qz%j+Jh zrSJ7oTd;3(;?fokGO#1{_>$KJ<8XpOq(GT_Mg!%p9Op#?F9-+;B|ki@a|yeSW!4wt zg-?%q&xiw>Hq~`{_Yehq`W>^}-}d16EZ6(3++;J!^nImOsG%zN4-t4BKNJldl<|_I zp%Ayco2N%~{fD!k(UI-qqVxs#9t(u7IRe-+n|3@*U3H=3-bi+qu(C(Zv}S3E7AZ-7*6SG8X*;o`d`NWG#i;n5(xMf|&Wll#1y?w^+tXGh1by z4E$78r=GMsEZ3$~I3#gF97F;fg!=OQRv16_%fhojaoE(8gE4-Y{j8p9mO>3xCpN#L zPxyxw-1-V-<`ae_d5ZN}TR4%;5a<2pT{`Ibb!TOSX&QlE#*MESG7r$x4apjm`yC zO94%}`>7`2PAmIct4Ky2Ztc8Bi$R=Q*XNNI+3HiP^JuGIBjJ58%5qj{Y|3&mclv&e zzyarUgEja%bp$LH>iT21z4Kn+0#IzUq-j%p{=4#u+$QGwvQ?!1`W%)X#t?VCYjm+b zt!|p#3!I?Z&u-vaxxRAThhBEDV7kba7JDnpHtlT2MeELa@i6;nYFirjC{9wFNl7i~yfed7^alCSt9dx9{61 ztGOvt2EmqvMR@3|WlQk1uH^1VO}uEC zl@-N?yP+Hnlg@=ZWSN!xIv>pO4WWf?u8PRq3Vkdvb46$nC;3fG%xe-_poECVR;U8)M{j95S|OU z?UuWu?$a)BGaZAjU&`n5v8s^V@Uqk3v(`0Ky&wVK?KNA5H&Hb5hlBk%5~F1Y=nU$p zp5G`#Uzb@+RjgU$GGm=OGPh(wJoo12YPkwUnstg5#!8qMlsv4H64is8Olgl1^Y0yz z?pd8LtnpdxR+&9kPz`+2(v+z&Oc}`M&$?cANn09jez%tlV{}%L`WZD=s5PM@7VD*U zY3jp|Kbe`+#3{bFT9(0uElO$qD{bq`iR9?Fji5>L`dVUyvpPML!>sLPdChvd`f-oe zb;c{4LuIDiQ=iq7>CF1ZWk%k)j-1gX6J5Kzv_|>j8Ur61i=3`}ihUzE>&t8!ulxf-@eAfLy5;W|=_i*CGjcx|z@ zrSLIBEs}g^3~_)J7C7HEuA35zbB><#Zjq<1AZlnqy5_X#7VJsvlv{O~c^CWXXdIKm z!U_mAd9*y!iZX4ZGm{0UI>62{@B8G^F@?r5BFH5L#y30=zoJqdoi~2R0#Uwz=v3X=cJ1%OW z$$C-ikc0dL-8P*(tb}bj(=KAQTEW0ormj*7sFaHo`7M+?h&q)|B6FO7<;DM(e;-e% zSZkrfQlcTlJ1Jd6*|a^BAG=^E9j{8y;|hxwQY;sqT5Rz`@0UL^7lx@_(`x_`VEr1M z$iLKgi};Mez|e^S?P@j@)Y6XV9gR)JuCeNZ!}DW`A%zymt9piCe6-LeUrxrTDWojE z^{fXj;Wbrq=Xp$6HKj`B)LD~*1$ErUH}9L}wWQaq#nxxR7T=NrR?nMuPO_L3u9id! zAD;{|ZTI6>&4pR5#gj@VhJ$_2Q3Vdx?-Nl+C#yORTE{g*e}ajVU(ct6)&d`Sa8ZTj-idaw(zn}3V$g%xIP~gtU<8*d zTTZ0Ml|yd~J|0{GX~dxc0S-3~53L-fbC(CiVID@lOtG~yEBzkC)<`2FbJlw#`+2(2 zBVK$9eGr8(85ZEmEOt_*1_!b5b7?q~F@C)A&JV%EZ10Rpm6>_5A;r-`{*rG98~Otp zIRIoo7IhDL@QQe_IY8fblu;F_{5q(ylQA-z4RVH#Iq+^#(>uLzaU@SKW$3Y2z-r@- z&t4Y0ENUnD+t?vv?v*{YCf>%nthD?neTO1YRU@J8L2h`aZQTS;ot0xd58ugnk!)Kx z89-#Z`F2fN35hyfW_KID*5RZ>UWM0;>WswQN*7v!eY#_N_I8zw?oZgIB?YoKncws+Z zx$7!{@VpLQ7P&!eH**FPq^wpPYgwG?aht{kudHRS(UA{k=-`&70L(F2Xx6{teyG&D z(I$3lR%XEVBci>GISj=Q?(2PsExz7+!rTkD@BtpGh@*OIy^$8tV>Ua9*|hG4Nnw3< znyyiBetN!ZLPUd_a4M>F&w-9=u%MKiv)Qp4AP91?U)52jds^)Z7YX#;6Qe5~d+>=6 zoDt}|C>f-Vq?Jh4rv=RJSEu*2hY;6NiI);fr>%UN+r#NKbQI6X_*fj5;#nJtAHBN% ziP+i&+DJnC$u;0ImyDQPSW|DA_m8q~jkW{JEz1$hw9cJaXD5_AuipwuJPq|wUHeorTjHVfeckaQB8NrwT4EmS91poE_)#D%0er0dqxvc&etk( zD|fb@L3dd(RwMM~=JttqTGl!lns^i9n{U^w zBx3wYdE!M}!>{K>M7kA?I!*nW5cU0Kih5Pv>uX#`@7gnGF>pp_f0@=}$$~0E3txjx zyWeb1bd{*UY!$6-t`&}~HIdIvJn^B-BR+3Db?L6HVPRp=49T5Y2jqrcD}~*6 zMVi}%z7tT6L@PD@pr7R`(<~b>Q;U#OFsrb(k+YN#GWO0zWYK`1TKe#oxy4i|KlbSR zbVV3)QPL{O$Gm@He;aTNuLF9#`c?98px*D{>OXwYfB^!peW^@@jOb0R4Ba#6>yGYC zTu;C`&{Vs9=Ye86%@4v`n#`48b+(%zA#TV^cL<3nSe~Uvb-|HC&hR3y+T*Vw@jvwU58s^o89ev1vgt|Ssvds>4P-Gb!!Rgt_K1eH zJGgdvTUOymuaY|R?fF0xc}DX7YTFuvd>7Zy94?wo@O`bQ8zx$j^%UF=B*oi0}<{}B9o4|l0x3ievp+s&2tjBwO$BIkJE zSl0-PIh(vN2U~Ah=N+CGf=kC(0kpTlENHDYuE66CIL8KYM?(#ab+VJo>C6UDL4zc? zw7CX_wg(zpKoE?DRduZ+7Y0M{95}87rhl)?*h%^N0dTNdM*}Apztwy`=_z8^?|j8f zw^>vj0n4O_ajGqJK&CLt6I>Fs6H=JHAbat7r}Bw;(7>Vfoj+tp041iQd{%w~(px)h zWy=pMcb11R$A&}4`Ol!&Sph-ZEQa3jo^rP#!L-%JE!zZXo>mpdp(~ngTIpCJ-JlWL z_9|%!J-`MeYp4P{=j{WEWc}jB} zg-CC?J_g4)%I)|_;I%1nb?U`~xxbA9bd@xI0kG-AVmeY`&bSU310pi|rhVSxj|ee9;Y zxx;h8r0&%11K;Y`DP7)xgV-bh)|AVBO%Ag8zvzJsYkK}eXpWb``wbtHpZ9<>-#e!~ zrH_C%F9QPId^RS!;ZSP<$Iy)mz7Fp+1ZExbjXew+xC2CFw@G-8TNHSJBU~2h^mr&( z&3(r?dBCXuL74w9b_9X@6t`cKf4}->EH2wJXy}pZd&HfI14?j4?gQ`A|KyC z47jr|0Hyxpg{H4ur4AZJmS2JheH@~bK0L8Ne#*nZ8-v_Z!MBpB@G^s7RExIerMDFM>f3@l|iWSqt&l2bJXib zqu9wdNTlj?FILS3zM4bM#QFt<$`WsGqG-N4x0t@Y$+#nT1#A2xpg`Ew3@Hcik#QJr zAacF7DadNNxA=KNtLP&lIV1~v@mYUuhGALSr9*%gMLQpD&2Lj<;_7>wcQ>o>`czSM zLmwa3qDr61nd2tzl+%tRncclMauCaFo3O75!}hXX6Dip!bu1FT<5Fli!|49?Yx{_M zAMNC#=5xP#aTI&_D6c5V?BLCdSCQIRBvczQXWu`3#z@F8@VyWJcEjzOW$dQX<`qY! zu2-FsGATOVoF^E!*(XHWthqj+HJRyRnKnRBjCGcXhd+GtYCIV)AOBAAqCqu(X>PZ^ zBM=b*qu`PZLX*`B(uBxvs#fK#-CO1DES>DO`U}Qv8(1F+N=}zxqp39`@po?P+k)9s>#DPru%3|2KVo?xVGmlP--W|1>`hZU@qNIj^(V zZwX1O$h@|EBtkU+>u0W?gN*w*O^v8pkYn&i&55xQP1*AKq%HUQ4ErS(IZ#Qq^5}|( zgx*73;X28pZ@W&S5^}Mq%{~>W@a-AudbAmyqJ|ly$`7q`r5S`>BZKFF1=z!Ll*1H7 ze#QZEvk9$sHlAcX5k+!%P3?)J*txnhJ*ZVeg9o^hOuMicbH0Zw%B$!b=sXli>UZ~RCRcX^<#-hO+wqGM)^y)YtKCtZbL(+)j8T9`8N(fUsbmR(O>B>BRn`54XH@vqT zW!8&zHIvqQAU5yQlEDC*DN$UHbOArx?1A{1l@hB6a<>l<64Rg0?1#MociaD+tpB@s z@!R6O{WS(SJ*uk^144rVetbgOM^2zDKJ$Wsr6Ss{M`sY!{KWFSHuC~YYj`J{9sKy< z4x~w@U#VXMMl)kM>B2YN8K9a=fJwI(U-|*O%l*X|SYoR)bVyK70hi(2^Yrktc;JHd zzv|Zlqi_Pgb?%~p;6@hR0mN2L{M1y)_&SM$D5hHG>Os)K$7`VdgrR5GEOr7vV#g@h z@W=k30=N$MaX%yh=lh%O_JPhzcmlpYv;aa5LSY6Ia*_mrA%EW4-q3#u+zT{weFj89 z8fD-+g1^L94E0;CLMfPhSro`$fmX|aHj&fL*Fr*F2loTNh)|$ya32~p@Y{3kG1&%*pi_&pl~B}kNCvn#B-uM- z8#uEXKA`jIM$xa+SpyVVl>8D1Q6vmd#9@I}R1VNElK`V?u!2|efv@}*3;pep&VX^u z{0MS5P=o+j$f@VB1jsc9n}YTUC1wV>+MrXJr{-TR24E9GD!&E|knvkkJ<- z=(4H3yb$Y1gZ7>Jq$LP1L8pmVWFVj9K46n*21mv+=-^xJ{$c?_7nS1e&_fzH(CFIE zs&uek&mo^(a7{HYe_yF!cN#$ktg-=MVZ;2a58rMPv;$4P`aT8f`icq|bia4RPKb39 zpg~Xb#ZN*)rF}FJs<3DTgFm;rwF3z{_|{0@02YZ)?cD-Blwk!L4cs~e1;3pjyc3KL z6zw+JX}a6F-H9KpaxP%uzxp%Zn!82@n0&59BLeC=8w96@GgUu_LW71VZt4?t$r}h2 z;qapt@ZE6|82lmDW(W0evpxF_z#{K-r@^_T0CX<|jpFXk0wJh#02(j)9E{6Za%+BA z*{!lDu*w9$Vun*Wr#6`TfetWvf(%Io>iVND7_^VYv$N2kA&N^^YrU)jLN&Sf-B&!r z0}Oso(56!m8Naor-__`MH40edyBhtjM!&1k|8;8g3MPXfQ!T^QVm!Uar_bKcq{hp! zvu1k_j9Verbtl�?}JO(;1koDo&R*DVi(xk?+Uccv}(yuGuS>R;{7FCh571XOtK2 z@}~0!gx%v*mr^aEK6R(*5GAV{G@9hb-T z;HriS1OqrNVYt}v%24kerrs*U5t~LCDkqN)9F0Z9sE&o$rtsspBwF3J$*+3vn`Jcg z^u!hbhsqxid6~4)6pElJ40uaG;auk)Fonrpo^&D7yX`|R9`hbU4My4tG92L|)CI?T zc3oxi+w$G2SpBw#3nvQDv`QXbb?KkO1w_qW`P=8``hUpD3Rmi@B}x~l-X6+r33obN z5~wo>s{vg!3}BvjlqiGK;$Gl6Yr>$SU z{q)R(OKAZ4*zx@AHVAjsP`)I;fdg!9z10Z>zKU?m$FQI?y*b5PHmVO|W5Y!TFyS-N zFz>;Sitxg@(E+JXD2MKB7A=F(4NfODMn(pa12Jaia@M0S`3VYxCG^1Ud@~b@Z+Hf- zV|b-)lli2~d*y!M)AaN>;WyZS&x2~7Qlye-mgFm}d95~2)aSj2c=)K~61&Gd6XYfV zIOL6aCS7mj*_WKAW(Hvf9I*AAIWiNJPBCr4IS{W5w8vu1+TZlsnXO&|xv; z9v2r?4`U``e8H)pnyPzr^P-;0?2EfE)dcu89g^`1@^P&zyid!)LZD9K;2LExW-v19=xT0zRAkX^HD8V4Rr4P1*uygNo<&IgO2iYkp zm%f_H_Oa1Q3)H`X+sc@L89v--vo!5?*2qjOVOA>WDyy&FzjfKHajZ3(IFf$3#$xbs zNcD}k9~=weToO6~9?fxbH+aQ)@DUB2K~+Ttp1y9Q_WU}RPsJ#7W}{BrZgxuKOFbe= zUlDzYkS~J;@|Q~-_Hk$53eYtEpb44{>X5_Ymu_hraLh)TOBq#j*lqtlA~Xv41zEKZ zQxpSPd%CBq;?rVFyo#rq!UfUV2MChYK5o3KNA>DM4sq7rJ5|w$n}Ve$hA+ZH*N*Oh zP*@lx<@i#EKRI=$Rmgt>_@Nb*7y@=$9F{VzsW54kD7YcN^rpe4EA#yP!sYarx$yKm zB5vaYo3h)xkiUUGCsoz5&!EkEh6PCJ%C23Zd7|d)8WqfffqFGWfn@&e8bmsZOTtK7 zqT0GZTrBG%-a|gOLd~5xWYansZ*M3a^YZOykB5uzv~i}w&X%JRqK{h?4EK~qO4?}g z+n}EXtl6gID-Hxmz+dPuMt((9wVyiwq6H-Ip>p=#SM)4Ki0mOOBXVH1Wd$MuFRz8##9&fzA_mqSwrqJwIs4z>tXusX==qOhhk1+ z8M|H8MPXK`CdDe5thM1lEM0jxLK2zgKJVCcXkdLa#OW)$O`FaMQWj`Fm55)yV$#@8 zp3%Jd3IY^^-e2#X2)v+U^q-2k{|yJ_x(k=SYsA4Xy;D1JR+yyj23EbYIEm2Po2jbS zbt`A`HyCr0c8aLJNoBANv!!E~9*1cwcfm|KSyxqlx@O8v`n<~4ha|Qka04kH`aq+G zQ9tSD?n6R0XrRC^gh#H8HNz1p$U&rQ%hvta1?34PBb!(}MgJo#P$v0+W%ygXAt+i> z84wr42bSy+P=J8m9^8CW5i2;Lp}RG?AwfFXx$g$R^M}6T`D?iCRE$i)r+s+YRx|Um zlLfa=6Bs{*y&0D^;U;;vn$h65XjFmjq#0u8lLv?-{7L(fqA^-A%5#s59ywJ4oCdMG z6~(u{H(06d)nB{&J6yT#UjtWezA@_>%knylNRvsro-?U(65~c84dj1(UqJrtvjMz^ z0NL6t4(X)>IlMEH+r6sP$CsBPN~za9?8DJG&$o}_V#xB2^Ul}JlEh1zox2p0Bg?po%O@i)zX^ThCz86tjSI6+((>3csY z38VXT-q&@dHPxvmE>I=8CAHP3-K&O2lPYH}ibqPyt~q%wimUek*97eBQjqdbb${pB zgq5;Z==2q1-<1t@NE=7i>?!SsjB+|B$lJ(Y|F6s2fLz?@h_M6&!|aNJs%Lzxif{S$ zdx$T--*1dC_3P78BPNo=cy#^F>?yctkLMM!B~oj>-98 z)*n3b#xG{2S$;gdE!y^zL$0fgxR^Mzr0%1^Vl=+%#pFam#Q3`-afm9s-)3+Azk}Po z3#(T4IIx9q?#{x_*-P)emA3erTfxocbi$N2%_+84^-#g)GJk@7?cl?i{sm^5=#^1l z@q$N$n%y6K$A9w!&DRpzy#*-mPdN}i{PIv%k+@Ln4qR#NHl?4f-64y9D}C|TA06Z? z@~?S*6Lf;mH8B8Ctt^BlL2w^PWZx4kjclFp{_tfV8%iX`CVT1aYma)z6yJVFZJYFo zv#0IR=RaFY=cNB)`0BhO`s#baXYviAGw|&n#Y+0fhZEne_*JP(R}af=zIOn4+3dA1 zV)S>s_wLA@rXzE!%EbyBe6ysEcF({q03*$=oJb!;A6`5;?8u7RT(v*3ba|F=Q5?EeU{lVnB!@r#cz|>Kl{b_Xd06++L z+ZN_{f@+XUdruDFf1wUDMSE|1VsNwxMMM>`xrC~VdA*o$$$R-Fk*Z5$Q0BE|c6oRg z>JFI4ApCcmdOJl?b;S>kZwG~FPQL``4Q=GPa{~-~+tb94zXEXRkj!!5oU|t6>w$lv zJYI|VtAG7C8-GYhY$v*);s%N7B?irq0-Jx#bJqO&0aq?K@_3`6XzuVzs+aH-k1;(G zT=h)irX5-@pQffDGNUTe6o2o0wg{B^er?$$!$6# z3E%u}0L9Ic&Wn`@`dL*qZ;fG;T>4hb1@2;w+=IxG7JkT zwkbD6#gnt7_xntCdDW@~p8*sUd@+2j$0xXw)3j-&bbCbqR4+>{1_8NOEtJbl`B#f- zYi^n2i}Napvol_LE4y{t@6W`dwG3-PC%i4Q-Zea1jN}}6F-oG*c4?O7St5vQy{M+N zCh5v`(w!Sb^~_1=5tiJS^zx6!sVk=};Cj}-K;+E9e2m`!4&HVZ@CSE*PAcFJkY4o$ z$(5>i4VRCUjZJo+3YL#2wuE$f!LtHLHwKlCVf>uaj}IW-GSls@Na$|XlQe4FQ6_hP zpSUvOm3-lc4pHk#uOM12wI4*4N1T6=>BIEA>bW>Kvv`VHp|7U``%P{v!F3>o;hF+gbqaUHmIm= zZtEmC?JQC}W&Umv2z6pIJg!Z?)0Ul7UhOKbQ`|84zm*# zn^jI5c_y_vRC!JyPFkEKP;SAX*N6o8twezSFQZ>dDGx!E~l%g&wlbYqm1jN+=F)vqpw z^o^B}$1NL-s;8?|g#$>QQMSru;%aDAi64gklF97Lioipay%NS4dkissTt_5GvwuohQ_TNypr%akoU3}z)c9fT#87~S<&T!DxS5%;Ax$}Nu6&sJ zOs+^WG$-UH8{)^5Z}8@PXe2LTBZsvUq^3+g8&;TR1@hF2(1yf=Ag?Z1!YNWbwhQEw za|v?eB`rx?&gF>8IS^{zT~$_(L($$no?tB<_f$@^BhL7W$Gjz(JWb~AH4o2wrvG({ z4-mI&wB8Bxfkm>JxH$8Ny!;n753Yie&1JVfLRmq!BWyrgBZFTGT#Mkb$m%b54Jc(7 z81fvi%8@yyCfX81U-Gwdv~k_ua`(#6Wvr{@&3A?NBd;XH74()rW%8sR5mOZMG7Wvs zc@W)O3KXuI1L5QJe$>9wq&>;WzXN#MUsVE!1IAb><~kGvJ8;p;t$J8$+X56^DqtLF4ixlA#C!ihI@ETTZsGDs)kEgmn7 zxNU;9jZK&|rsgS)DCw%Y4Uah)7B0QTx7w79&3*JbShRGp-%vn)U}65Wj;b4%X%nvs zB$x$JRjxBS(mW%;pGs;A-2zF|oz%>CJexg5z}2J^RK+76=! zu2V~XsRb$k7&&ExGVj0Lmqd_^BBYvfE-_yE3IFPr4_4>&s?FWY?K* z&A+*~$Z7W3SVUnfJ{hK{r>u+j3<*dQ|Cl+xpi-=$+o-)^&%1neK$b8A;Q}zJvATmS3Q{ z)$8FgCZ1yw4g`wtc+5aIAKFj1$6^Lh7Joor4K2mZo6f7*ebT~DBCN>n=&=~NB+L?V ze9W^Fh7hE<46E`PS*{Qq(R=VJa^{MO2hk?4e_sR&7dh3jn)r4TR6Q}rX@J@wM97Bf zpl7NtY=vA^>+*X>9`jB~NM-%C^9t(wj4V7Z7E3f5@B|Eqi)7vM=IOZ9vs9vI^Lz|I z`s68NtG*J_RoZfnI{soG0CZMgT*P~pRcU&v*{w^PR212tUHlqGm6;6){Ft0eOiGWZ zc_#S|s(UDPyS{xmYb+EYY0wy`3(WS#`al5)=r1-tpQZCkq%_wSxFz%~=1_`LO_z>_ z^O0IBzK$o3Mb5dv@6LU4GRKaW-pGnFTZxV(l6}R&r3<<}aIG`1=3>9DMAIEJCp$&L zeKcAg-mKCpsLquPEOgOg_R=3)y06+nV+h#A$?ijwUkjt-*lwzT=-n|gPUTir(~d%q z(GaE6rwZ=O)zu=xE0nL%6bLWKZuc}=?Y)_&yT?QHbtO|v{iphcfKqoXnf0=t4eEG3 z@=HTZlGjBiy7~4;{gT}^Nj>I;*9exF3G83Y-o)(0SV{zb=xF85D_{w>m5qN?+4=rv zheY(%6%k5a&BC)E4J@;$y1TgI^DFj84;cGBz`ra1!h=_#D!xKRkyCqT-I_1Y(8pFq zjk6-3u2ke-uRYOty!U{MV@(%0eF`(%tO6=caBYxRG%Ml_N>;up6*f?nN0{ZuZBQs( zS?2#bCDBxRu()S6cQh8(|RLOCa#+u6Ze$NMp}~YmhPs3 z-6K0aLL6@kN!Z<1^PhuFaaz~9 z1kmRO&-rcVtrhMWwc?^r@JotP1(eabu3v}@; zls-x~5HXe5*}4EIpHtN~Arc$(L}S(N&~Li~`oC72f5X&yLq$?{h1ooilUK?PR(|rY zhP!iq)e`$6{we7NdCBlcTlR@xqq#zr{4l7N%7=!`SD74UWmW^Nbmj0o+cmojQU#ax zO!<+My5pOw9Es)@aYsY}2xrLUJNvi5@^LGuQ6Z-aWJW%nE{T6`+w1hYK2%FdrA&I} zmS+u5(0Z)W7~?~oL9U)Gvnm#0D-f8z#wl@@a&Mp1C9=pFwB_)*o|r1IRN1&q{Tr3U zRRV6h%^~@(=v&zKN)((brWI7b)I8ab|74Ql zVu6p(yZJFgaOlwy(endJmDRaGR_&W|Zy5PzUotrD4Q8aYb=6-* z%dQm^bmz!P%2r>{DByWW+XA9yd3TG<`fqR!^waOVFthdD2w8NMxiAHCCz5oBH9U4a5e#a*tlwyGXg11g-BwKwEc${eg!;crNzQ_U7h$ ze5H~3)B9u!wcq5{p11wtlxUHNd4LcdW>|wV+GMJ(N&=`<`}?Y@Z~1D+Zve_^c0Wx5 zx;WToACMga#08gY^6TaDSNF9zaheglKX~xE8f^otH3kaZoMaZ&s;z?icA1KJ4!&J8 zLXZN%nt}2A7i{nCZ+ONMLp21j-}L%xB(xt-~aMP}dNi z+t|kg{nlo*pYr*mp#m7dS+MtsZv*r4Lok#P_Cv*g^}l)9cWHOzZr-T{y;XM#{L=MF z$uJ<;W``+3)D*JF$3KBDw+sj8ZY1kvz})Ae_;U_GLdI_Dw;iHxh7fRs+#Z?h8-u@9 zOAq{^!az&V;^HJ%*#^6Lf=3|79IH8n^)v!guw#9oM0)U56cF!F22H0MhOD-JZKqS>Z=Z z(D{`8O#I`<6uo3ls)+tvNAP45A=T z^a4ZH?0G2&4Ot3&zHY*+tPTFYVw-`sxCyueYJrnU2pd%r_k-yWuu%rTK%KMY*KC1? z+Yt@Oqj;$x2MzvO1e~h{-(8UfE&4Bp_kWu@V5b7)n_8ti?SY1@YYlAAE?H$VL3&1+ zJ{TJsO&=b({hl8zF1LVd@D@&WCDrv%81b(A@M$rQDGEKH^DaqSdMl?tDXsw=jsGB_ zDm9>cdqZ=ykXg*~S1bHn+I`OEd`PvO5$lg1lSgtiVh)tV_4Xz?MI{H+JH654aGqhmh0vDCvyZ zEy2nh)5YV%BQFd6UA1{}i)FH*Wr`NWzs)C34|UadUOy&9qgS>3Fmm!e*JUI4bS-objZKPayQM_=$-vZ8RpW3uMQ zH+i&MAVOqOEPWm#>cAC5u$4a<9)4Im;j#hbLhT+88nc6bf#%%F*XvwZTR&0AAn=6@ zz-teiBS$Kw@yHE?7<79RD);tOL44hCDYa8LVD;F@7qYH{A8802yeNbF{IJM_Tq})7 zK}~^59?;L0`d4~t($lO8eA%hhTnbV$uX5>Kf*qDS`&HczaTrW>@r#{lZpCc3Swnnc z;7hsTzTVq|e_;!0z!pkMDZZ2KVHQ5i6IL2~x5}(HYmICt;@nD)mu`3nkJLAGZ*eU?_TR0#RVbub?)6WyR^MGCXwXxa@Q}(y!NcP&KB*mH(q5XL{1GC7eRd0PGJ@qa>Lh)f1EC(tH%lYud5+KX)tEQ zMf_JuhlusZlJbuW${~EachAV9@mk-6^hposz2o;cTdjZa8!0ynRJw0yJidotY5IOv z=q=cI=^o?1lwN=NsR+d^pIhWm7n`jhck3o9Z=~MY*cT4`b$cDCHKE@v(zg?<_Z1Km z<5DSya}5XuO;+T21FxTst9eG#R#?LIMk-pe9c(e!VE(%=wy36$`cP|!o-o&r3 z$!11JF(lQ;X?0weyiN+TdO+zN!O2QYj+_yO?dlJLi=w6@Mkd;kK3Zy-0$=4_AvoWx zJS0BRQrK;+v$a{}iE@vxIM1|Rk^XQI;Z>A4Kev*tribhV{7950|v zdfWm>g8>Axn^-#;SroXo)~vEWz>OQv#af?Qwq&Phst=f)u)?-(9uEHxT8ckjW3V&m zuf;Jh9}9D@moNWqvtACiiT6=9miK_JJ{!@|T|%h|v$@eR@{`JL-K|;AC?)nP;h|A{ zypnO#l|5LSrnCSc$Jh7pNnama3Ssc{ROzUH@W)QVJr2iLnA#OTd#AUP*lBY0a6#@h zybg-CwDY$aJ_&ML<=w62>$J9oE2P>DcX+UP_Pmx26(*c0W3kjr(IUTz5gBMmC@wy( zQ0_R!1wbCE=DERho%g;ZH>-FIf{UQHhd{+;)iYJ9QYJTQx+nuAB5rM`ZV-$(fm%^( z!C1YXpcJCv!W0*`2X^e-5U(s}KMh0~QF`WQhVl|s7)#Fx%ra!af5hV| zf7@A@E9WS+EuVCw#2?%Xj-jug_6j<0jsjv^Yg}kNKVz7OnOa^NBTNxG5ste|<&Sj0 zmI8{^T--u#;|1f|CM&>})8kTZdA$|xuk|KXhS}L%L^+b3t8JgJj3HxdxK4YMiFan! zT92u^W1}_PR)yC1Wn4n80VzMl`WQeero!9k2yXl>mbSX1OKV}YyVn_=k#@3UnI|#1R0b| z=)*4p_l#n7enO8El?t(k;Q{}4PjB{@>Khl$pWd)ZQM6jMY>c2K3yr)~cHu9gy}4aeWiMZj%o zJe_%yjVfebislzP$pPE%>YL#h}drEsIN0L5Qj@X2->B91Y2&O?fF2b#&D?y+vWV~m> z4VxOWqSB6m;dBwSnV&uq{jh7x-c`wP@u#dd+Dv<4*AP-=$08yP9u$~5J2vo7oBqr0 zz-8Jvf82rb_GGKa%@Lbo-2zUz1T1vwHhbQ-MA1rUe^(H?(l+2|8N4S*w!DcL*eHa4s~4 zpul2Sa}u0C^KBR8j~e*<9edvg@O=foufX>e_`U+)SK#{!d|!e8aVx-BpBZY^O*zfI zwFB-@wIj}NT|9N}&}KESnbg<^e$ih|eV77b397|Trk4B=;snc4MyU$?_52Y`U={O%E z=Kk7_q-B=<3Mag|h4t&|e}i%Qe3Dq>==#}Ae*Ou3xKv?2UvT-oBHUDH+2}vMnV{`N zX}4~?ufd$F`{qN~O^um% z;rDn1sQ(pBjYmBPQr7h{ws@3vGVku!9+Ok94h-i zab^Dl=uCW#h|@xclPLqw2&3y-=-AlUR{s1!Okii%a=H6B^A{r#6f(T&K_en;^2=ux zshdAxPa2#TC)&szqNYAoR$k_e+8;sLMd*BsFnNCgc`G|c7u#Taj-;aL?KLmLcXBUr zf9~@*O3~wA8EscYQvdUs@*_Y@me@jNFlZHPLCi{N(^@1;9z8yuwJOees_K6RWBrZY zt%O~R9lVuOW0Blzf%&i>gEPr7fX5;%`{yBl_oHj)np_@|wEQC?#113-& zu$TYOqA=EFceKz1QriYaPJg(()+%5E18NZ*8`M?);Q|+#0x5Fx82{7nr-BL0q%}fk zbn~Ft_HrVf$wVIyEpLf_6B-wJ11vnXO&WCV{z*1u$U>2TFcm2I-R^mBgVjH zRp^F{`TWgTu78#I@gE$@uhA?BT0m4xTfV*Oi&UMZv}5Ga?T68^A_n>x}cZ)nUra&ZWft^RM$mh!Nkb^wW4qwF@^|-TdkUS z2DPG=jW!X(|C`~We=F|)0A4XfkQkHFT!#~X=S_Q3H1TSyH zRg;d+RgKP7jrONT8&Z@vq(-N#N2jbQUAgju->3Dt!OFFXTns?q>FVdQ&MBb@0MOqz AEdT%j diff --git a/playbooks/GSuite_DevSecOps.py b/playbooks/GSuite_DevSecOps.py deleted file mode 100644 index f8dd829d32..0000000000 --- a/playbooks/GSuite_DevSecOps.py +++ /dev/null @@ -1,212 +0,0 @@ -""" -""" - -import phantom.rules as phantom -import json -from datetime import datetime, timedelta -def on_start(container): - phantom.debug('on_start() called') - - # call 'Get_File_from_GDrive' block - Get_File_from_GDrive(container=container) - - # call 'ip_reputation_1' block - ip_reputation_1(container=container) - - return - -def Get_File_from_GDrive(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('Get_File_from_GDrive() called') - - # collect data for 'Get_File_from_GDrive' call - container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.doc_id', 'artifact:*.id']) - - parameters = [] - - # build parameters list for 'Get_File_from_GDrive' call - for container_item in container_data: - if container_item[0]: - parameters.append({ - 'id': container_item[0], - 'ph': "", - 'email': "", - 'file_name': "", - 'mime_type': "", - 'download_file': True, - # context (artifact id) is added to associate results with the artifact - 'context': {'artifact_id': container_item[1]}, - }) - - phantom.act(action="get file", parameters=parameters, assets=['google-gdrive'], callback=VT_Lookup, name="Get_File_from_GDrive") - - return - -def VT_Lookup(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('VT_Lookup() called') - - #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) - - # collect data for 'VT_Lookup' call - results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results) - - parameters = [] - - # build parameters list for 'VT_Lookup' call - for results_item_1 in results_data_1: - if results_item_1[0]: - parameters.append({ - 'hash': results_item_1[0], - # context (artifact id) is added to associate results with the artifact - 'context': {'artifact_id': results_item_1[1]}, - }) - - phantom.act(action="get file", parameters=parameters, assets=['virustotal'], callback=VT_Lookup_Error_Handling, name="VT_Lookup", parent_action=action) - - return - -def VT_Lookup_Error_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('VT_Lookup_Error_Handling() called') - - # check for 'if' condition 1 - matched = phantom.decision( - container=container, - action_results=results, - conditions=[ - ["VT_Lookup:action_result.status", "==", "failed"], - ]) - - # call connected blocks if condition 1 matched - if matched: - Prompt_for_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) - return - - # call connected blocks for 'else' condition 2 - - return - -def Prompt_for_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('Prompt_for_Upload() called') - - # set user and message variables for phantom.prompt call - user = "Administrator" - message = """Should this file be uploaded to VirusTotal?""" - - #responses: - response_types = [ - { - "prompt": "", - "options": { - "type": "list", - "choices": [ - "Yes", - "No", - ] - }, - }, - ] - - phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name="Prompt_for_Upload", separator=", ", response_types=response_types, callback=Prompt_Handling) - - return - -def Prompt_Handling(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('Prompt_Handling() called') - - # check for 'if' condition 1 - matched = phantom.decision( - container=container, - action_results=results, - conditions=[ - ["Prompt_for_Upload:action_result.summary.responses.0", "==", "Yes"], - ]) - - # call connected blocks if condition 1 matched - if matched: - VT_Upload(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) - return - - # call connected blocks for 'else' condition 2 - - return - -def VT_Upload(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('VT_Upload() called') - - #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) - - # collect data for 'VT_Upload' call - results_data_1 = phantom.collect2(container=container, datapath=['Get_File_from_GDrive:action_result.summary.vault_id', 'Get_File_from_GDrive:action_result.parameter.context.artifact_id'], action_results=results) - - parameters = [] - - # build parameters list for 'VT_Upload' call - for results_item_1 in results_data_1: - if results_item_1[0]: - parameters.append({ - 'vault_id': results_item_1[0], - # context (artifact id) is added to associate results with the artifact - 'context': {'artifact_id': results_item_1[1]}, - }) - - phantom.act(action="detonate file", parameters=parameters, assets=['virustotal'], name="VT_Upload") - - return - -def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('ip_reputation_1() called') - - # collect data for 'ip_reputation_1' call - container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.src_ip', 'artifact:*.id']) - - parameters = [] - - # build parameters list for 'ip_reputation_1' call - for container_item in container_data: - if container_item[0]: - parameters.append({ - 'ip': container_item[0], - # context (artifact id) is added to associate results with the artifact - 'context': {'artifact_id': container_item[1]}, - }) - - phantom.act(action="ip reputation", parameters=parameters, assets=['virustotal'], callback=geolocate_ip_1, name="ip_reputation_1") - - return - -def geolocate_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): - phantom.debug('geolocate_ip_1() called') - - #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) - - # collect data for 'geolocate_ip_1' call - inputs_data_1 = phantom.collect2(container=container, datapath=['ip_reputation_1:artifact:*.cef.src_ip', 'ip_reputation_1:artifact:*.id'], action_results=results) - - parameters = [] - - # build parameters list for 'geolocate_ip_1' call - for inputs_item_1 in inputs_data_1: - if inputs_item_1[0]: - parameters.append({ - 'ip': inputs_item_1[0], - # context (artifact id) is added to associate results with the artifact - 'context': {'artifact_id': inputs_item_1[1]}, - }) - - phantom.act(action="geolocate ip", parameters=parameters, assets=['maxmind'], name="geolocate_ip_1", parent_action=action) - - return - -def on_finish(container, summary): - phantom.debug('on_finish() called') - # This function is called after all actions are completed. - # summary of all the action and/or all details of actions - # can be collected here. - - # summary_json = phantom.get_summary() - # if 'result' in summary_json: - # for action_result in summary_json['result']: - # if 'action_run_id' in action_result: - # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) - # phantom.debug(action_results) - - return \ No newline at end of file diff --git a/playbooks/GSuite_DevSecOps.yml b/playbooks/GSuite_DevSecOps.yml deleted file mode 100644 index b280af69d6..0000000000 --- a/playbooks/GSuite_DevSecOps.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: GSuite_DevSecOps -id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 -version: 1 -date: '2021-09-15' -author: Lou Stella, Splunk -type: Info -description: This playbook investigates and enriches the "Gsuite Drive Share In External Email" detection. -playbook: gsuite_drive_share_in_external_email -how_to_implement: This playbook requires the Splunk SOAR apps for Google Drive and VirusTotal, in addition to the "Gsuite Drive Share in External Email" detection. -references: [] -tags: - analytic_story: - - DevSecOps - detections: - - Gsuite Drive Share In External Email - product: - - Splunk SOAR From d209fcdf9700b6fdd51006acf85a3ce1919c5be9 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 23 Sep 2021 12:22:29 -0500 Subject: [PATCH 6/8] testing investigation alternative --- bin/generate.py | 45 ++++++++++++++++++++++----------------------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 1ade503b32..7f8d4064b1 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -439,35 +439,34 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH): if data_model: detection['data_model'] = data_model - if detection['type'] != 'Investigation': - matched_deployment = get_deployments(detection, deployments) - detection['deployment'] = matched_deployment - nes_fields = get_nes_fields(detection['search'], detection['deployment']) - if len(nes_fields) > 0: - detection['nes_fields'] = nes_fields + matched_deployment = get_deployments(detection, deployments) + detection['deployment'] = matched_deployment + nes_fields = get_nes_fields(detection['search'], detection['deployment']) + if len(nes_fields) > 0: + detection['nes_fields'] = nes_fields - keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] - mappings = {} - for key in keys: - if key == 'mitre_attack': - if 'mitre_attack_id' in detection['tags']: - mappings[key] = detection['tags']['mitre_attack_id'] - else: - if key in detection['tags']: - mappings[key] = detection['tags'][key] - detection['mappings'] = mappings + keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] + mappings = {} + for key in keys: + if key == 'mitre_attack': + if 'mitre_attack_id' in detection['tags']: + mappings[key] = detection['tags']['mitre_attack_id'] + else: + if key in detection['tags']: + mappings[key] = detection['tags'][key] + detection['mappings'] = mappings - detection = add_annotations(detection) - detection = add_rba(detection) - detection = add_playbook(detection, playbooks) + detection = add_annotations(detection) + detection = add_rba(detection) + detection = add_playbook(detection, playbooks) # add additional metadata - if 'product' in detection['tags']: - detection['product'] = detection['tags']['product'] + if 'product' in detection['tags']: + detection['product'] = detection['tags']['product'] # turn all SAAWS detections - if (OUTPUT_PATH) == 'dist/saaws': - detection['disabled'] = 'false' + if (OUTPUT_PATH) == 'dist/saaws': + detection['disabled'] = 'false' return detections From c3ed16c6cd909da7e9973e6f2a3b84ebcd407a57 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 23 Sep 2021 13:17:50 -0500 Subject: [PATCH 7/8] Revert "testing investigation alternative" This reverts commit d209fcdf9700b6fdd51006acf85a3ce1919c5be9. --- bin/generate.py | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 7f8d4064b1..1ade503b32 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -439,34 +439,35 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH): if data_model: detection['data_model'] = data_model - matched_deployment = get_deployments(detection, deployments) - detection['deployment'] = matched_deployment - nes_fields = get_nes_fields(detection['search'], detection['deployment']) - if len(nes_fields) > 0: - detection['nes_fields'] = nes_fields + if detection['type'] != 'Investigation': + matched_deployment = get_deployments(detection, deployments) + detection['deployment'] = matched_deployment + nes_fields = get_nes_fields(detection['search'], detection['deployment']) + if len(nes_fields) > 0: + detection['nes_fields'] = nes_fields - keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] - mappings = {} - for key in keys: - if key == 'mitre_attack': - if 'mitre_attack_id' in detection['tags']: - mappings[key] = detection['tags']['mitre_attack_id'] - else: - if key in detection['tags']: - mappings[key] = detection['tags'][key] - detection['mappings'] = mappings + keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] + mappings = {} + for key in keys: + if key == 'mitre_attack': + if 'mitre_attack_id' in detection['tags']: + mappings[key] = detection['tags']['mitre_attack_id'] + else: + if key in detection['tags']: + mappings[key] = detection['tags'][key] + detection['mappings'] = mappings - detection = add_annotations(detection) - detection = add_rba(detection) - detection = add_playbook(detection, playbooks) + detection = add_annotations(detection) + detection = add_rba(detection) + detection = add_playbook(detection, playbooks) # add additional metadata - if 'product' in detection['tags']: - detection['product'] = detection['tags']['product'] + if 'product' in detection['tags']: + detection['product'] = detection['tags']['product'] # turn all SAAWS detections - if (OUTPUT_PATH) == 'dist/saaws': - detection['disabled'] = 'false' + if (OUTPUT_PATH) == 'dist/saaws': + detection['disabled'] = 'false' return detections From c857f761bd1f4ab477c81d57c6eaec551facc799 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 23 Sep 2021 13:33:56 -0500 Subject: [PATCH 8/8] fix of generate --- bin/generate.py | 4 +- dist/escu/default/analytic_stories.conf | 132 +++++++-------- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 215 ++++++++++++------------ dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 206 +++++++++++------------ 7 files changed, 283 insertions(+), 280 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 1ade503b32..14ec90d38f 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -485,10 +485,12 @@ def prepare_stories(stories, detections, playbooks): for detection in detections: if detection['type'] == 'Baseline': + rule_name = str('ESCU - ' + detection['name']) continue if 'analytic_story' in detection['tags']: for story in detection['tags']['analytic_story']: - rule_name = str('ESCU - ' + detection['name'] + ' - Rule') + if detection['type'] != "Investigation": + rule_name = str('ESCU - ' + detection['name'] + ' - Rule') if story in sto_to_det.keys(): sto_to_det[story].add(rule_name) diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 5048d3a327..71b42e814a 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-17T20:14:56 UTC +# On Date: 2021-09-23T18:33:39 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ modification_date = 2018-06-04 id = 2f2f610a-d64d-48c2-b57c-967a2b49ab5a version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] -detection_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Rule", "ESCU - Get Notable History - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078", "T1550"]} investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"] @@ -51,7 +51,7 @@ modification_date = 2018-05-21 id = 2e8948a5-5239-406b-b56b-6c50ff268af4 version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"] @@ -68,7 +68,7 @@ modification_date = 2020-08-04 id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] support_searches = [] @@ -85,7 +85,7 @@ modification_date = 2018-03-12 id = 2e8948a5-5239-406b-b56b-6c50f1269af3 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] -detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"] +detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"] mappings = {"cis20": ["CIS 1", "CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1526"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"] @@ -142,7 +142,7 @@ modification_date = 2018-12-06 id = 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e version = 1 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Rule", "ESCU - Investigate Web POSTs From src - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] support_searches = [] @@ -172,7 +172,7 @@ modification_date = 2017-09-13 id = 91c676cf-0b23-438d-abee-f6335e1fce77 version = 1 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] -detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Reconnaissance"], "nist": ["ID.AM", "PR.DS"]} investigative_searches = ["ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Count of assets by category"] @@ -240,7 +240,7 @@ modification_date = 2017-12-19 id = 91c676cf-0b23-438d-abee-f6335e1fce78 version = 1 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] -detection_searches = ["ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]} investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] @@ -276,7 +276,7 @@ modification_date = 2019-10-02 id = 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"] @@ -339,7 +339,7 @@ modification_date = 2019-01-09 id = bd91a2bc-d20b-4f44-a982-1bea98e86390 version = 1 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Network Traffic From src ip - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"] mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] support_searches = [] @@ -358,7 +358,7 @@ modification_date = 2020-02-03 id = 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a version = 1 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] -detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] +detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1036", "T1114.001", "T1114.002", "T1560.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -377,7 +377,7 @@ modification_date = 2018-06-01 id = 943773c6-c4de-4f38-89a8-0b92f98804d8 version = 1 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"] @@ -412,7 +412,7 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement", "Privilege Escalation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] support_searches = [] @@ -431,7 +431,7 @@ modification_date = 2020-01-22 id = 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef version = 2 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] -detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] +detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Execution", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -451,7 +451,7 @@ modification_date = 2016-09-13 id = e8afd39e-3294-11e6-b39d-a45e60c6700 version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["DE.AE", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -469,7 +469,7 @@ modification_date = 2020-02-04 id = 8169f17b-ef68-4b59-aa28-586907301221 version = 1 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] -detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Rule"] +detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task"] support_searches = ["ESCU - Discover DNS records"] @@ -511,7 +511,7 @@ modification_date = 2020-10-21 id = 66b0fe0c-1351-11eb-adc1-0242ac120002 version = 1 reference = ["https://attack.mitre.org/tactics/TA0010/"] -detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -528,7 +528,7 @@ modification_date = 2017-09-14 id = 91c676cf-0b23-438d-abee-f6335e1fce33 version = 1 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] -detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] +detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] @@ -562,7 +562,7 @@ modification_date = 2020-09-18 id = 5d14a962-569e-4578-939f-f386feb63ce4 version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] -detection_searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 11", "CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1003.001", "T1190", "T1210"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -596,7 +596,7 @@ modification_date = 2020-02-04 id = fcc27099-46a0-46b0-a271-5c7dab56b6f1 version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] -detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] +detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -630,7 +630,7 @@ modification_date = 2018-09-06 id = 8169f17b-ef68-4b59-aae8-586907301221 version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] -detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] @@ -647,7 +647,7 @@ modification_date = 2020-01-27 id = bb9f5ed2-916e-4364-bb6d-91c310efcf52 version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] -detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] +detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK"] @@ -666,7 +666,7 @@ modification_date = 2020-08-02 id = 7678c968-d46e-11ea-87d0-0242ac130003 version = 1 reference = ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"] -detection_searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 11", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -683,7 +683,7 @@ modification_date = 2020-09-01 id = 0432039c-ef41-4b03-b157-450c25dad1e6 version = 1 reference = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] -detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get Notable History - Rule", "ESCU - gcp detect oauth token abuse - Rule"] +detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - gcp detect oauth token abuse - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -721,7 +721,7 @@ modification_date = 2020-01-22 id = baf7580b-d4b4-4774-8173-7d198e9da335 version = 2 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] -detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] +detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -775,7 +775,7 @@ modification_date = 2017-09-14 id = 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd version = 1 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"] -detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 4"], "kill_chain_phases": ["Delivery", "Reconnaissance"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -806,7 +806,7 @@ modification_date = 2020-04-15 id = a9ef59cf-e981-4e66-9eef-bb049f695c09 version = 1 reference = ["https://github.com/splunk/cloud-datamodel-security-research"] -detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"] +detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP GCR container uploaded - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"] mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] @@ -823,7 +823,7 @@ modification_date = 2020-05-20 id = 2574e6d9-7254-4751-8925-0447deeec8ea version = 1 reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] -detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"] +detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -840,7 +840,7 @@ modification_date = 2020-02-04 id = 399d65dc-1f08-499b-a259-aad9051f38ad version = 2 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] -detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] +detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Execution", "Exploitation", "Lateral Movement"], "mitre_attack": ["T1021.001", "T1021.002", "T1053.005", "T1550.002", "T1558.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = [] @@ -861,7 +861,7 @@ modification_date = 2017-08-23 id = 2c8ff66e-0b57-42af-8ad7-912438a403fc version = 5 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] -detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"] +detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1003", "T1027", "T1027.005", "T1055", "T1059.001", "T1140", "T1546.015", "T1562", "T1592"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -946,7 +946,7 @@ modification_date = 2017-09-15 id = 9ef8d677-7b52-4213-a038-99cfc7acc2d8 version = 1 reference = ["https://learn.cisecurity.org/20-controls-download"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - No Windows Updates in a time frame - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - No Windows Updates in a time frame - Rule"] mappings = {"cis20": ["CIS 18"], "nist": ["PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -982,7 +982,7 @@ modification_date = 2017-01-05 id = 2b1800dd-92f9-47ec-a981-fdf1351e5f65 version = 1 reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -1017,7 +1017,7 @@ modification_date = 2020-01-22 id = bb9f5ed2-916e-4364-bb6d-97c370efcf52 version = 2 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] -detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] +detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously seen command line arguments"] @@ -1054,7 +1054,7 @@ modification_date = 2020-01-22 id = 988C59C5-0A1C-45B6-A555-0C62276E327E version = 1 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] -detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] +detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] @@ -1120,7 +1120,7 @@ modification_date = 2017-09-11 id = 6d13121c-90f3-446d-8ac3-27efbbc65218 version = 1 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] -detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] +detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation"], "mitre_attack": ["T1021", "T1021.001", "T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] @@ -1158,7 +1158,7 @@ modification_date = 2020-02-04 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756 version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] -detection_searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] +detection_searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1027.005", "T1036.003", "T1047", "T1048", "T1053.005", "T1059.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1070.004", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1218.007", "T1218.011", "T1222", "T1482", "T1485", "T1489", "T1490", "T1491", "T1531", "T1546.015", "T1547.001", "T1548", "T1560.001", "T1562.001", "T1562.007", "T1569.002", "T1574.002", "T1592"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] @@ -1175,7 +1175,7 @@ modification_date = 2020-10-27 id = f52f6c43-05f8-4b19-a9d3-5b8c56da91c2 version = 1 reference = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] -detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"mitre_attack": ["T1486"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1209,7 +1209,7 @@ modification_date = 2017-09-12 id = 91c676cf-0b23-438d-abee-f6335e177e77 version = 1 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] -detection_searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"], "mitre_attack": ["T1020.001", "T1200", "T1498", "T1542.005", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1227,7 +1227,7 @@ modification_date = 2020-11-06 id = 507edc74-13d5-4339-878e-b9744ded1f35 version = 1 reference = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] -detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get Notable History - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"] +detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Lateral Movement", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1053.005", "T1059.003", "T1482", "T1485", "T1486", "T1489", "T1490", "T1562.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1244,7 +1244,7 @@ modification_date = 2017-09-19 id = 4f6632f5-449c-4686-80df-57625f59bab3 version = 1 reference = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - SQL Injection with Long URLs - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - SQL Injection with Long URLs - Rule"] mappings = {"cis20": ["CIS 13", "CIS 18", "CIS 4"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM", "ID.RA", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1262,7 +1262,7 @@ modification_date = 2018-12-13 id = c4b89506-fbcf-4cb7-bfd6-527e54789604 version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] -detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Execution", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1003", "T1021.001", "T1021.002", "T1036.005", "T1082", "T1204.002", "T1485", "T1486", "T1490", "T1569.002", "T1595"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"] @@ -1325,7 +1325,7 @@ modification_date = 2019-05-01 id = 2e8948a5-5239-406b-b56b-6c59f1268af3 version = 1 reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"] @@ -1342,7 +1342,7 @@ modification_date = 2018-07-24 id = 2e8948a5-5239-406b-b56b-6c50w3168af3 version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"] @@ -1361,7 +1361,7 @@ modification_date = 2018-05-07 id = 2e8948a5-5239-406b-b56b-6c50f2168af3 version = 1 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"] @@ -1381,7 +1381,7 @@ modification_date = 2020-06-04 id = 6380ebbb-55c5-4fce-b754-01fd565fb73c version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] -detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"] +detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"] @@ -1399,7 +1399,7 @@ modification_date = 2020-08-25 id = 8168ca88-392e-42f4-85a2-767579c660ce version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"] +detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] @@ -1416,7 +1416,7 @@ modification_date = 2018-08-20 id = 51045ded-1575-4ba6-aef7-af6c73cffd86 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"] @@ -1434,7 +1434,7 @@ modification_date = 2020-09-04 id = 1ed5ce7d-5469-4232-92af-89d1a3595b39 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] -detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] +detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"] @@ -1452,7 +1452,7 @@ modification_date = 2020-02-03 id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7 version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] -detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] +detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] @@ -1489,7 +1489,7 @@ modification_date = 2017-09-18 id = 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56 version = 1 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] -detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] +detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"] @@ -1506,7 +1506,7 @@ modification_date = 2020-01-27 id = 2b1800dd-92f9-47ec-a981-fdf1351e5d55 version = 1 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] -detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] +detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]} investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] @@ -1527,7 +1527,7 @@ modification_date = 2020-08-05 id = 4d656b2e-d6be-11ea-87d0-0242ac130003 version = 1 reference = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] -detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1544,7 +1544,7 @@ modification_date = 2021-01-20 id = 2b1800dd-92f9-47dd-a981-fdf13w1q5d55 version = 2 reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] -detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] +detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] @@ -1573,7 +1573,7 @@ modification_date = 2020-04-02 id = 9cbd34af-8f39-4476-a423-bacd126c750b version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] -detection_searches = ["ESCU - Investigate Okta Activity by IP Address - Rule", "ESCU - Investigate Okta Activity by app - Rule", "ESCU - Investigate User Activities In Okta - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] +detection_searches = ["ESCU - Identify Systems Using Remote Desktop", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} investigative_searches = ["ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] support_searches = [] @@ -1643,7 +1643,7 @@ modification_date = 2018-10-23 id = c8ddc5be-69bc-4202-b3ab-4010b27d7ad5 version = 2 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] -detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] +detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] support_searches = [] @@ -1660,7 +1660,7 @@ modification_date = 2018-05-31 id = 2b1800dd-92f9-47dd-a981-fdf1351e5d55 version = 1 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] -detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] +detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1679,7 +1679,7 @@ modification_date = 2020-04-13 id = aa3749a6-49c7-491e-a03f-4eaee5fe0258 version = 1 reference = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] -detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Rule"] +detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1068"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Process File Activity - Response Task"] support_searches = ["ESCU - Previously Seen Zoom Child Processes - Initial", "ESCU - Previously Seen Zoom Child Processes - Update"] @@ -1762,7 +1762,7 @@ modification_date = 2020-02-04 id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6 version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] -detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"] +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"] mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1003", "T1016", "T1036.003", "T1036.005", "T1190", "T1204.002", "T1218.011", "T1595"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK"] @@ -1781,7 +1781,7 @@ modification_date = 2017-09-15 id = 826e6431-aeef-41b4-9fc0-6d0985d65a21 version = 1 reference = ["https://www.monkey.org/~dugsong/dsniff/"] -detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Protocols passing authentication in cleartext - Rule"] +detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Protocols passing authentication in cleartext - Rule"] mappings = {"cis20": ["CIS 14", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "nist": ["DE.AE", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] @@ -1798,7 +1798,7 @@ modification_date = 2020-07-28 id = 36dbb206-d073-11ea-87d0-0242ac130003 version = 1 reference = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] -detection_searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Rule"] +detection_searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1815,7 +1815,7 @@ modification_date = 2018-05-31 id = 56e24a28-5003-4047-b2db-e8f3c4618064 version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] -detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] +detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1832,7 +1832,7 @@ modification_date = 2018-01-26 id = 30552a76-ac78-48e4-b3c0-de4e34e9563d version = 1 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] -detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] +detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1853,7 +1853,7 @@ modification_date = 2017-09-12 id = b6db2c60-a281-48b4-95f1-2cd99ed56835 version = 2 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] -detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"] +detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1871,7 +1871,7 @@ modification_date = 2018-05-31 id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version = 2 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] -detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"] +detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1888,7 +1888,7 @@ modification_date = 2020-02-04 id = 644e22d3-598a-429c-a007-16fdb802cae5 version = 2 reference = ["https://attack.mitre.org/tactics/TA0004/"] -detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] +detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1905,7 +1905,7 @@ modification_date = 2017-11-02 id = 6dbd810e-f66d-414b-8dfc-e46de55cbfe2 version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] -detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] +detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 66fb5fbdf8..9c120d51cd 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-17T20:14:56 UTC +# On Date: 2021-09-23T18:33:39 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 7e45fe3a6f..64d13ed0cb 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-17T20:14:56 UTC +# On Date: 2021-09-23T18:33:39 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 9a8c2a782d..7de1d53b22 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-17T20:14:56 UTC +# On Date: 2021-09-23T18:33:39 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -732,7 +732,7 @@ action.escu.modification_date = 2021-04-13 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS Excessive Security Scanning - Rule action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 @@ -1650,12 +1650,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - AdsiSearcher Account Discovery - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = [] -action.escu.eli5 = This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = not commonly seen as a normal command from network admin but possible noise may exist. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -1676,7 +1676,7 @@ action.correlationsearch.label = ESCU - AdsiSearcher Account Discovery - Rule action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = AdsiSearcher Account Discovery action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -3015,7 +3015,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `circleci` | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id workflow_name user commit_message url branch | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 | rex field=url "(?[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter` +search = `circleci` | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id workflow_name user commit_message url branch | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 | eval phase="build" | rex field=url "(?[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter` [ESCU - Circle CI Disable Security Step - Rule] action.escu = 0 @@ -3060,7 +3060,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as * , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url "(?[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter` +search = `circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as * , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url "(?[^\/]*\/[^\/]*)$" | eval phase="build" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter` [ESCU - Clear Unallocated Sector Using Cipher App - Rule] action.escu = 0 @@ -9853,12 +9853,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Domain Account Discovery With Net App - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. +description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. +action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = network operator can execute this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -9880,7 +9880,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. +action.notable.param.rule_description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Account Discovery With Net App action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -9898,12 +9898,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Domain Account Discovery with Dsquery - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a suspicious process commandline of dsquery for enumerating users. This technique is commonly in attacker and red team to recon on users in targetted machine. This command can also be used by network administrator but not by a normal user. +description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a suspicious process commandline of dsquery for enumerating users. This technique is commonly in attacker and red team to recon on users in targetted machine. This command can also be used by network administrator but not by a normal user. +action.escu.eli5 = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = network administrator may use this command but not commonly seen used by a user. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -9925,7 +9925,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a suspicious process commandline of dsquery for enumerating users. This technique is commonly in attacker and red team to recon on users in targetted machine. This command can also be used by network administrator but not by a normal user. +action.notable.param.rule_description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Account Discovery with Dsquery action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -9943,12 +9943,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Domain Account Discovery with Wmic - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a wmic command for enumerating user in active directory. This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. This search may also catch this type of query made by network admin but not common in all the user in the network. +description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a wmic command for enumerating user in active directory. This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. This search may also catch this type of query made by network admin but not common in all the user in the network. +action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = network admin may execute this command for listing users. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -9970,7 +9970,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a wmic command for enumerating user in active directory. This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. This search may also catch this type of query made by network admin but not common in all the user in the network. +action.notable.param.rule_description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Domain Account Discovery with Wmic action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12682,12 +12682,12 @@ search = `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", [ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +description = This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -action.escu.known_false_positives = network operator may use this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -12709,7 +12709,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADDefaultDomainPasswordPolicy with Powershell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12727,12 +12727,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = [] -action.escu.eli5 = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = network operator may use this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -12753,7 +12753,7 @@ action.correlationsearch.label = ESCU - Get ADDefaultDomainPasswordPolicy with P action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADDefaultDomainPasswordPolicy with Powershell Script Block action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12771,12 +12771,12 @@ search = `powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolic [ESCU - Get ADUser with PowerShell - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. This technique can be a good indicator to hunt further TTPs to the machine to check further anomalies. Since this is a hunt query expect some noise from administrator or some IT within the network that may use this command. +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. This technique can be a good indicator to hunt further TTPs to the machine to check further anomalies. Since this is a hunt query expect some noise from administrator or some IT within the network that may use this command. +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = network admin may use this command. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -12798,7 +12798,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. This technique can be a good indicator to hunt further TTPs to the machine to check further anomalies. Since this is a hunt query expect some noise from administrator or some IT within the network that may use this command. +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADUser with PowerShell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12816,12 +12816,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Get ADUser with PowerShell Script Block - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = [] -action.escu.eli5 = This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = network admin may use this command and other IT operator to check AD users. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -12842,7 +12842,7 @@ action.correlationsearch.label = ESCU - Get ADUser with PowerShell Script Block action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADUser with PowerShell Script Block action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12860,12 +12860,12 @@ search = `powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filte [ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +description = This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -action.escu.known_false_positives = network operator or admin may use this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -12887,7 +12887,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADUserResultantPasswordPolicy with Powershell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12905,12 +12905,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = [] -action.escu.eli5 = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = network operator may use this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -12931,7 +12931,7 @@ action.correlationsearch.label = ESCU - Get ADUserResultantPasswordPolicy with P action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get ADUserResultantPasswordPolicy with Powershell Script Block action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12949,12 +12949,12 @@ search = `powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolic [ESCU - Get DomainPolicy with Powershell - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +description = This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -action.escu.known_false_positives = network operator or admin may use this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -12976,7 +12976,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainPolicy with Powershell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12994,12 +12994,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Get DomainPolicy with Powershell Script Block - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = [] -action.escu.eli5 = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = unknown +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -13020,7 +13020,7 @@ action.correlationsearch.label = ESCU - Get DomainPolicy with Powershell Script action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainPolicy with Powershell Script Block action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13038,12 +13038,12 @@ search = `powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count [ESCU - Get DomainUser with PowerShell - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a cmdlet Get-DomainUser that are common on powerview or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate all users in active directory. +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a cmdlet Get-DomainUser that are common on powerview or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate all users in active directory. +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = unknown +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -13065,7 +13065,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a cmdlet Get-DomainUser that are common on powerview or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate all users in active directory. +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainUser with PowerShell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13083,12 +13083,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Get DomainUser with PowerShell Script Block - Rule] action.escu = 0 action.escu.enabled = 1 -description = his search is to detect a powershell command Get-DomainUser to do user enumeration to the active directory. This command is function seen in powerspoit and powerview tool that are designed to pentest active directory or domain controller for possible attack. This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential dumping techniques in the system. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = [] -action.escu.eli5 = his search is to detect a powershell command Get-DomainUser to do user enumeration to the active directory. This command is function seen in powerspoit and powerview tool that are designed to pentest active directory or domain controller for possible attack. This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential dumping techniques in the system. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = unknown +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -13109,7 +13109,7 @@ action.correlationsearch.label = ESCU - Get DomainUser with PowerShell Script Bl action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = his search is to detect a powershell command Get-DomainUser to do user enumeration to the active directory. This command is function seen in powerspoit and powerview tool that are designed to pentest active directory or domain controller for possible attack. This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential dumping techniques in the system. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Get DomainUser with PowerShell Script Block action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -14124,12 +14124,12 @@ search = `powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stat [ESCU - GetWmiObject DS User with PowerShell - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a suspicious execution wmi process that enumerate user in active directory. This technique can be used by attacker and pentester to mapped all the users as part of its recon to the targetted host. Network Admin may seen executing this command but not often and also not common to see in user events. +description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a suspicious execution wmi process that enumerate user in active directory. This technique can be used by attacker and pentester to mapped all the users as part of its recon to the targetted host. Network Admin may seen executing this command but not often and also not common to see in user events. +action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = network admin may execute this command. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -14151,7 +14151,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a suspicious execution wmi process that enumerate user in active directory. This technique can be used by attacker and pentester to mapped all the users as part of its recon to the targetted host. Network Admin may seen executing this command but not often and also not common to see in user events. +action.notable.param.rule_description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject DS User with PowerShell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -14169,12 +14169,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - GetWmiObject DS User with PowerShell Script Block - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = [] -action.escu.eli5 = This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -action.escu.known_false_positives = not commonly seen as a normal command from network admin but possible noise may exist. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-24 action.escu.modification_date = 2021-08-24 action.escu.confidence = high @@ -14195,7 +14195,7 @@ action.correlationsearch.label = ESCU - GetWmiObject DS User with PowerShell Scr action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. action.notable.param.rule_title = GetWmiObject DS User with PowerShell Script Block action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -14520,7 +14520,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter` +search = `github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter` [ESCU - GitHub Pull Request from Unknown User - Rule] action.escu = 0 @@ -14565,7 +14565,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message | rename check_suite.head_commit.author.name as user repository.full_name as repository check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter` +search = `github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message | rename check_suite.head_commit.author.name as user repository.full_name as repository check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users` | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter` [ESCU - Github Commit Changes In Master - Rule] action.escu = 0 @@ -14609,7 +14609,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `github` branches{}.name = main OR branches{}.name = master | eval severity="low" | eval phase="code" | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter` +search = `github` branches{}.name = main OR branches{}.name = master | eval severity="low" | eval phase="code" | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter` [ESCU - Github Commit In Develop - Rule] action.escu = 0 @@ -14653,7 +14653,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `github` branches{}.name = main OR branches{}.name = develop | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_in_develop_filter` +search = `github` branches{}.name = main OR branches{}.name = develop | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_in_develop_filter` [ESCU - Gsuite Drive Share In External Email - Rule] action.escu = 0 @@ -14662,7 +14662,7 @@ description = This search is to detect suspicious google drive or google docs fi action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. The following Splunk SOAR playbook can be used to respond to this detection: GSuite_DevSecOps +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. action.escu.known_false_positives = network admin or normal user may share files to customer and external team. action.escu.creation_date = 2021-08-16 action.escu.modification_date = 2021-08-16 @@ -14674,16 +14674,17 @@ action.escu.providing_technologies = [] action.escu.analytic_story = ["DevSecOps"] action.risk = 1 action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ -action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 9}] +action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 72}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Drive Share In External Email - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 80, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 +action.notable.param.nes_fields = ['user'] action.notable.param.rule_description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. action.notable.param.rule_title = Gsuite Drive Share In External Email action.notable.param.security_domain = endpoint @@ -14697,7 +14698,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=email "[^@]+@(?[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter` +search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=email "[^@]+@(?[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, values(parameters.doc_id) as doc_id, count min(_time) as firstTime max(_time) as lastTime by parameters.owner ip_address phase severity | rename parameters.owner as user ip_address as src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter` [ESCU - Gsuite Email Suspicious Subject With Attachment - Rule] action.escu = 0 @@ -14850,14 +14851,14 @@ action.escu.providing_technologies = [] action.escu.analytic_story = ["DevSecOps"] action.risk = 1 action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ -action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 9}] +action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 21}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 21}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Suspicious Shared File Name - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14874,7 +14875,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter` +search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type phase severity | rename parameters.target_user AS user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter` [ESCU - Hide User Account From Sign-In Screen - Rule] action.escu = 0 @@ -19381,12 +19382,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Password Policy Discovery with Net - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a net application command to discover password policy. This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack. +description = This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a net application command to discover password policy. This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack. +action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -action.escu.known_false_positives = network operator or admin may use this command +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-08-26 action.escu.modification_date = 2021-08-26 action.escu.confidence = high @@ -19408,7 +19409,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is to detect a net application command to discover password policy. This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack. +action.notable.param.rule_description = This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. action.notable.param.rule_title = Password Policy Discovery with Net action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -27747,16 +27748,16 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Wmic Group Discovery - Rule] action.escu = 0 action.escu.enabled = 1 -description = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +description = The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +action.escu.eli5 = The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -action.escu.known_false_positives = False positives may be present. Tune as needed. +action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting. action.escu.creation_date = 2021-09-14 action.escu.modification_date = 2021-09-14 action.escu.confidence = high @@ -27778,7 +27779,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Active Directory Dis schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +action.notable.param.rule_description = The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. action.notable.param.rule_title = Wmic Group Discovery @@ -28246,7 +28247,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.creation_date = 2018-04-09 action.escu.modification_date = 2018-04-09 action.escu.analytic_story = ["AWS User Monitoring"] @@ -28257,7 +28258,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. disabled = true is_visible = false @@ -28312,7 +28313,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. action.escu.creation_date = 2019-11-14 action.escu.modification_date = 2019-11-14 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] @@ -28323,7 +28324,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. @@ -28336,7 +28337,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. action.escu.creation_date = 2019-11-14 action.escu.modification_date = 2019-11-14 action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] @@ -28347,7 +28348,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. @@ -28756,7 +28757,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity Sources -description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. action.escu.creation_date = 2018-03-16 action.escu.modification_date = 2018-03-16 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] @@ -28767,7 +28768,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. disabled = true is_visible = false @@ -29108,7 +29109,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs -description = This search builds a table of previously seen AMIs used to launch EC2 instances +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of previously seen AMIs used to launch EC2 instances action.escu.creation_date = 2018-03-12 action.escu.modification_date = 2018-03-12 action.escu.analytic_story = ["AWS Cryptomining"] @@ -29119,7 +29120,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen AMIs used to launch EC2 instances +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of previously seen AMIs used to launch EC2 instances action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. disabled = true is_visible = false @@ -29130,7 +29131,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types -description = This search builds a table of previously seen EC2 instance types +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of previously seen EC2 instance types action.escu.creation_date = 2018-03-08 action.escu.modification_date = 2018-03-08 action.escu.analytic_story = ["AWS Cryptomining"] @@ -29141,7 +29142,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen EC2 instance types +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of previously seen EC2 instance types action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. disabled = true is_visible = false @@ -29152,7 +29153,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Previously Seen EC2 Launches By User -description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of previously seen ARNs that have launched a EC2 instance. action.escu.creation_date = 2018-03-15 action.escu.modification_date = 2018-03-15 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] @@ -29163,7 +29164,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search builds a table of previously seen ARNs that have launched a EC2 instance. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. disabled = true is_visible = false @@ -29328,7 +29329,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Previously seen API call per user roles in CloudTrail -description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. action.escu.creation_date = 2018-04-16 action.escu.modification_date = 2018-04-16 action.escu.analytic_story = ["AWS User Monitoring"] @@ -29339,7 +29340,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. disabled = true is_visible = false @@ -29394,7 +29395,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Previously seen users in CloudTrail -description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel action.escu.creation_date = 2018-04-30 action.escu.modification_date = 2018-04-30 action.escu.analytic_story = ["Suspicious AWS Login Activities"] @@ -29405,7 +29406,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. disabled = true is_visible = false @@ -29438,7 +29439,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support action.escu.full_search_name = ESCU - Update previously seen users in CloudTrail -description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel action.escu.creation_date = 2018-04-30 action.escu.modification_date = 2018-04-30 action.escu.analytic_story = ["Suspicious AWS Login Activities"] @@ -29449,7 +29450,7 @@ dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m schedule_window = auto action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. disabled = true is_visible = false diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 08869c70d7..7128a1548b 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-17T20:14:56 UTC +# On Date: 2021-09-23T18:33:39 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index cd3d19f2de..71b6df9616 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-17T20:14:56 UTC +# On Date: 2021-09-23T18:33:39 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Rule", "ESCU - Get Notable History - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -39,7 +39,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -50,7 +50,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -61,7 +61,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -100,7 +100,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Rule", "ESCU - Investigate Web POSTs From src - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -124,7 +124,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. @@ -168,7 +168,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -192,7 +192,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -237,7 +237,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Network Traffic From src ip - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -250,7 +250,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -263,7 +263,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -286,7 +286,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -299,7 +299,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -313,7 +313,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History - Response Task"] description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims. narrative = The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\ The search in this story can help you to detect if attackers are abusing your company's DNS infrastructure to launch DNS amplification attacks causing Denial of Service to other victims. @@ -325,7 +325,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -355,7 +355,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -366,7 +366,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -388,7 +388,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -410,7 +410,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -432,7 +432,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -443,7 +443,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -456,7 +456,7 @@ version = 1 references = ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. narrative = A client is able to perform a remote code execution on an exposed and vulnerable system. The detection search in this Analytic Story uses syslog to detect the malicious behavior. Syslog is going to be the best detection method, as any systems using SSL to protect their management console will make detection via wire data difficult. The searches included used Splunk Connect For Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/) @@ -467,7 +467,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get Notable History - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -493,7 +493,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -529,7 +529,7 @@ version = 1 references = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others. narrative = This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\ It is helpful to understand how often a notable event generated by this story occurs, as well as the commonalities between some of these events, both of which may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. It may also help to understand whether the issue is restricted to a single user/system or whether it is broader in scope.\ @@ -554,7 +554,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP GCR container uploaded - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -565,7 +565,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -576,7 +576,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -591,7 +591,7 @@ version = 5 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \ The following factors may assist you in determining whether the event is malicious: \ @@ -652,7 +652,7 @@ version = 1 references = ["https://learn.cisecurity.org/20-controls-download"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. narrative = It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\ Searches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\ @@ -676,7 +676,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -699,7 +699,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -724,7 +724,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -778,7 +778,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -804,7 +804,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] +searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -815,7 +815,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -837,7 +837,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -849,7 +849,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get Notable History - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -860,7 +860,7 @@ version = 1 references = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\ This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment. @@ -872,7 +872,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -917,7 +917,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -928,7 +928,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -941,7 +941,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -955,7 +955,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -967,7 +967,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -978,7 +978,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -990,7 +990,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -1002,7 +1002,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. @@ -1027,7 +1027,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -1038,7 +1038,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -1053,7 +1053,7 @@ version = 1 references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -1064,7 +1064,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -1087,7 +1087,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Investigate Okta Activity by IP Address - Rule", "ESCU - Investigate Okta Activity by app - Rule", "ESCU - Investigate User Activities In Okta - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] +searches = ["ESCU - Identify Systems Using Remote Desktop", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ @@ -1133,7 +1133,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. @@ -1144,7 +1144,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1157,7 +1157,7 @@ version = 1 references = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process File Activity - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Process File Activity - Response Task"] description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. @@ -1216,7 +1216,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1229,7 +1229,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1240,7 +1240,7 @@ version = 1 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). @@ -1251,7 +1251,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1262,7 +1262,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1277,7 +1277,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1289,7 +1289,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1300,7 +1300,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1311,7 +1311,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1738,10 +1738,10 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = not commonly seen as a normal command from network admin but possible noise may exist. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Allow File And Printing Sharing In Firewall - Rule] @@ -3680,30 +3680,30 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. +explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = network operator can execute this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Domain Account Discovery with Dsquery - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a suspicious process commandline of dsquery for enumerating users. This technique is commonly in attacker and red team to recon on users in targetted machine. This command can also be used by network administrator but not by a normal user. +explanation = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = network administrator may use this command but not commonly seen used by a user. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Domain Account Discovery with Wmic - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a wmic command for enumerating user in active directory. This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. This search may also catch this type of query made by network admin but not common in all the user in the network. +explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = network admin may execute this command for listing users. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Domain Controller Discovery with Nltest - Rule] @@ -4335,100 +4335,100 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +explanation = This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = network operator may use this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule] type = detection asset_type = confidence = medium -explanation = This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = network operator may use this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get ADUser with PowerShell - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. This technique can be a good indicator to hunt further TTPs to the machine to check further anomalies. Since this is a hunt query expect some noise from administrator or some IT within the network that may use this command. +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = network admin may use this command. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get ADUser with PowerShell Script Block - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = network admin may use this command and other IT operator to check AD users. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule] type = detection asset_type = confidence = medium -explanation = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +explanation = This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = network operator or admin may use this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule] type = detection asset_type = confidence = medium -explanation = This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or credential dumping as post attack. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = network operator may use this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get DomainPolicy with Powershell - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +explanation = This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = network operator or admin may use this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get DomainPolicy with Powershell Script Block - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a possible execution of powerview pentesting tool for domain controller recon. This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. This TTP may be a good pivot to look for credential dumping technique or lateral movement. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = unknown +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get DomainUser with PowerShell - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a cmdlet Get-DomainUser that are common on powerview or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate all users in active directory. +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = unknown +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get DomainUser with PowerShell Script Block - Rule] type = detection asset_type = confidence = medium -explanation = his search is to detect a powershell command Get-DomainUser to do user enumeration to the active directory. This command is function seen in powerspoit and powerview tool that are designed to pentest active directory or domain controller for possible attack. This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential dumping techniques in the system. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = unknown +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Get WMIObject Group Discovery - Rule] @@ -4661,20 +4661,20 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to detect a suspicious execution wmi process that enumerate user in active directory. This technique can be used by attacker and pentester to mapped all the users as part of its recon to the targetted host. Network Admin may seen executing this command but not often and also not common to see in user events. +explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = network admin may execute this command. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - GetWmiObject DS User with PowerShell Script Block - Rule] type = detection asset_type = confidence = medium -explanation = This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or specific information that admin may look upon this is still a good TTP to alert some malicious activities. +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} -known_false_positives = not commonly seen as a normal command from network admin but possible noise may exist. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - GetWmiObject Ds Computer with PowerShell - Rule] @@ -4782,7 +4782,7 @@ type = detection asset_type = confidence = medium explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. The following Splunk SOAR playbook can be used to respond to this detection: GSuite_DevSecOps +how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]} known_false_positives = network admin or normal user may share files to customer and external team. providing_technologies = [] @@ -5897,10 +5897,10 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to detect a net application command to discover password policy. This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack. +explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} -known_false_positives = network operator or admin may use this command +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Permission Modification using Takeown App - Rule] @@ -7833,12 +7833,12 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ +explanation = The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} -known_false_positives = False positives may be present. Tune as needed. +known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] [savedsearch://ESCU - Write Executable in SMB Share - Rule]

our> zJ$Fo=YaiMk{D8AH@!OFv0a|kB+Owl#qQIFF0UQ*K`LF4vOpmNzg$P|4=djh=t)lz^ZHWezq#0vmBHGHfx{9zE?S|zw$e+-vy`N=#N(Rp z@}7UhR^2P-ICy4RCliKPvnAq=KkqCuk@i3;&z(lmz!^R*8ta=Vt6J$8KN7KspK*h0 z@tTT9!cXk+cC6ZK4E{!)ZV5epE$GzQ#X*_VhtO$bl6%h)DB+`yD2Z4($}bMD0_&O~|ivEsaWi%i(s(S@P< zsBqsYwCiddAqkI216%EEE~Lm?G%*1l7%Tcmu(8EFl$g6D^B&f8iiN<#e^n-ESiqq_ z=cT|Z)~X|5MK?djjIQQfjUBcw9hGH57;Ws#dmC9O#NZ5!XXV++e{Ey8YE1>vm58Jhi@kQZN<-+V7} z%b3}jO-_n5&5?rNZt;3r_{D1;n@3&`Mt2O4ZFDLk3_>#-!ouret3Z!CfPmtbSUDZ` z=r^5S1h~8q8S0F1&-u@Wx+*tWIfPEQ$f3@RJOI;kUqh70$uKpal{UW&{VLb7c zVi7!np8fmUI@@_NdjlMS(j4htRpSkWNSJ?qnB?Ty8}kRU75V2KV9L^V(fTD#g|K;X z7_~JXJHlfbt2(xMZvHkQ{V6-o^%Ws-kBE`yWnG<0z;nB8Ed2CmrFNF?{@DQ4(zs*h z^y>NOJpiix%dLG!b_=}!-3$VSV}Xnf@6W=$KABEAd#x&7bvH93BL|GLPuvY!}6Q))N1>e+;w4%WFGjA4~hp$?Xp z4Gn{PxL-4Q7ruLU5se1yywAjez;)g2O)6VE3y;MK+-NnyyS7{?90)zkJ*l-O(!4+R zRoNf|wb~Qtn!cVK7#&D#;w`fzWKUbF2z{JPYa_M~0`aVKM%C*(Rj*y5$f zrlI$-iuwcNHq}Mpd4cEEuQje-9d5cY_5zTLoiyv*E+aGTl95;BVSN_W5wbTo|F&np zIP8(#l*708`tz|yCFbIV#--lX{Bq7B{zV3iaPMz!Ais^Zym9I$J9rP$+~aiu9;s?5 z8V<|*Dt?g^R+_6G%4#sCqgBfYFCk$!-M0^E)>0~@oED@Uj{_Opla?Y$u8<}_GhP~% ztxjUhr9OhZ`iX0K=gG^s+?#1Vb9GLoiDQt)kqHb%ucQgfZRRX)s#;7!3Xb{bac?eI zpr%{HX6sj)3T1opq;1<*qLk`}@t0ngG5-+0Z4~4#`%?!DvV@rTV!XcB)$SJ86ad9F zrz>s6{+fL76d)PlPbyEPRE=TfM)IF4bZM3`!W(!aA{Evj`MC@hE_-44l;5$rXQXjC z&YmgN>dhQ`C68_Sj!-fvA&sFYS_&0k$o`mSQC-m4TWnex>vmYQPWr;ay+Oe$w65nZ zkLXsp7w!DP#VxveDr+_7UUN3GwvPUoMy>uT7bTxzHm~;TA7@Pw3R5CJ*K(<2v~CW` zfs|rSrCAYP470jlm`h4y;72Iuv6@ijty$^UtOuV{bo-A-Gl#rqO5@QBxZLEwP;tuq za*@q>l6Wa%BcA-Amr~xjLF{%|-^eD|;0k9WYIfKrox{1n8(H?N+D)gerUnk{fk9(5 z=U_4>=K0)`v|ewLvUFMwuZ%T*Y$10jzyb zy?2##Ms&3!ZB2{Bkuh3{tTRgEfF$-_;Zi+cDD_}|fn~2nz-9unD51Lcc_S~}*>-+o zy^*l2G`FrTl^B_!*pUn{tl2$X9IdsEfLfI_IRWX8hw~WhBivGN*c3brIMWJrMkb+8%CxJUog@;P5)>Je*ZMy zAebjHckpbGB|kw$AD{xbku&K}>ryre(er59F#-}zAj-~0{K|Zq zK0vM0GDxv}>b|bpt{B8s(|Y8ubsc)15;6gvlXF6v`xu>uO~v6Lb{9hQ4BrMx^rS&f z8Ri9^3RsCz$xb$|y8(D@*mc`kfp0J+;(S_Zqju#^Af#W@)oQjZOe&tV+^7Vxvdu`0+mV-YoZF<(VtG~2uoXKE|n@X?64&m=b8UH;XFa|o+|wC_U#2( zSb>Y5gtIktI1zqDxy znH+QGgM2`!5FQ1;nc@)?RSlW#%Fe-5HGWRJ(=rBuQk|RC{Ky4%DQg{1?$=MVJU-xT zc@eKb{61ke+ol0GZqWX~W4~ocUNAaqC8`%*W7tGmsYA2TKGeOpT&A{+U^1m(%J?O| za>0~g%iw`7sfhT)kt&KF+tb=~>M`P#7Bn~`!EO4vaJ~8v6{y8U>z-2sgv8S7^{wbI zo?GSieU}%88lC1x8&bq+K=!W;z&KJU^PTKcjS^#9i{}WF9!ciV4h@s%jn>4SQ+x+Y zLcS}S&2r<$9_DU#T8h2j{?(t*wuLHQ@fK{*7NtBF)=T0(XWAJ`;7Vfe1 zox9B-o!^lM;)&cDPqpl<*V$BwOu0^J7bL8jfHWabhSxj56uBN8gJt@f%8fs|B0r_e zw9 z^`yw?Z&>BXij~6FHo7ap*y1F9KIkOV&Sr-|r@YAaq7&_erl3brz$9-TTtZKI3$BxT z`3#_|CX1L1Rd;SdYcXHbt?=LCdfS6Tlxo@}8@CyGp(`rOb#`X<_cnn*Na8R^&#PBT zb1F{0um#9Z=R!)C{n!YTgcUX$)a&}LrIGT7?UG9K4X)lNZoOoz?Vc96jop(v%D>wcRFNshkQ z?oddhiu$k>EC}PH3Q%~_&;nxeXz%CzHRUdZVjBR|knIm>sqk+W-hPN5EATsdczd?z zK|v4~E;L!2Mjh*#(F0>xtu+sA=d`r&og$OVd)vi98TX)#N{4Nagy>UzFmB&Zv^c@U+z?{vuSKoxI8Wdm&D;UOQ(AG`7*|K~>wP+^@2;+MlSM2eV+e zcsJYc{0w|WFGpS}93zv<7IoREdH#hnlf~YwNE?csVHC1?*b#I~43D-dLA*94 z5b+HQ!(-BI8R~T=ZRsu9%OB+1B6>$l7li#c+z83i0fv>*dla!XcoeZPLmiP42-rm_ z?Dnuly-g$qyG$yJbeKdQxIL6wnmEDhoaQxNFGQ2|#pJobe|vh5gr5urlLZ^1ccTNr9^Vbeajl<&BqE6I?1p+c#J}x z2Szf*8tHszh=WhATVP-VXhqokaRE|~xfI$^9yt;}(g3AZNgr(Tr^l%)gNi5@nwtf9 zrpV*soa*e?Pfh~zy>?21gyV|^HU1Y@dIh%{OY3?{Ph5IIKnb`-L#?M7Qj!DtG)_k1cX!)V{8jw9O1!ww^Fd&tVz z8tIuhvn_&XP<$mC{=7t~T(K5o;kQ{SizK!6RM)npPtEbQ$rJ-W6<|(Mv~9|)twken z-P^NoVYrA3z`IZd47zD?5C@Pl_Ob0K%9OQptvnoTG?VOCQcYP4A6X_8yiA-JD}^iJ z*6}*f!)_|56#WhryC@aHJ2#yu0uI%Cb7jOHHcS(w zZUzP!yJVZ9QrpH3iyFy0O)8(^va5QhGv-g}`C!t<37*dHCRpJy2wTB{6>r3(}l7M zIt?bTHad^ghB?=Ke^%0SMhYPYq!e!_#!36$maLm~zd&n_eQ-dyaHcy0+_RiD|C!2+CYLPMPSu z<-9PN{k+1y?_xO(0MBCpU<2ohrF~0Oh|`Zuuv*5SshzR%sV^6_PpPn+52V&Q559To zJW*LF18Is$Tl@_z)8t&boaN4P!w*(so=Y~i-7;*D){F=Q9%t&5%X*4t)*w!g#H=`D zJ@EGC1UgH>LzO2ZAuk{*b2dvGm+VZOkkZ`X!0g8`si8YQteFb~s%}uiV%M-4 zdNVpTL85`#Ffj36|5cd5Fg94NV5Qe9I9&TzmbQ>&AY$^E zJo(xDcpxx*anKI{OBMqU@A=KG`B#TI-wcR|i^6v#=b9BbnBA#64QI`3)T+=WNy^g) zp5O-Rqm-rw2KpI_e8#=CkyAM{Fj%ZPbneb_@W}D{r5~p|b{eQ((q@C1I6FHH_3i>@ zEPa~!OE|xhC^nGxj8m;~a|>q6`rW_HbLvO2Jo=P8l>(V8>9%{_3{r6@A1<~T-zH3i z)EMUJ#x(k%W#i;fosFM_qbI!4p9GbQL-X&h4j^Dpl(tcD zqaG^(;^TCmt(58R_~QXfwbg0510){1d6wFxSKybN2jr8a5Zjj}m1*fkSs<0Rs_uD0 z@)%!*R~PP6POo=R&y}*leY*9tZ}4+3+k^|jquYf|tM&Z;g<;`(+*GJ2G=u@t%tFp!x$3t0Zm$$~9Ab@ukbo8UolZA2X1R!WL1e z9Clk83fOe~!%+~tU8tU8OV}NiVFI%Gd@`!bJBU=*qD(z3V~@EAx`ln&Mx8-hVCyWg zl#@ao%xX@I=ki$h3eGX#ayU4i)pBLFvr8(WeuZooL9TNtkGLd#{|0s#%#z~gXRk)x z*Cup&6w*~~Z?*8`uwG)XYTCI_pULBB2Lm&7rA7Ug>%HWv7XMApyM1*UrE|GFnu;zn zGS#IsI08)Q(UiJ7&Z@+R6iTI-M#YIXNwo=VDwzN&Y1%=o*Hw{MBoD#YGZ%ktyc7{- zz!TGfW-W=wrSwiSD$s>}_~u_@gu45H2=U^(dI2Vk=V}4++Ieb*Pdef*xbf7ZG{~e8 zD;M!8nSeldCRa~-+R2E?&4?nyuhTceYLFB_fl&@7e1@xvJGr%1*z>n5FKXLGSe*6q+6pqZC7p z3cA#wdrxU)2@o)+EFcA454H?tXlvHjI+P$y28*Td+R1O6VSHjL*J01iDr5Ca8`6oC z+JO|oyjxRoY!i(ETqDrtJ$@KmHPhx9XP8psN-v=RVcnP>ykglH(4{F1O+H$aE_G9! z;Do*&8Y0ttE!1Ci=aIX3xs-%d2Ez?fP=TL-)yq6vZVTl*<=256;!WLw(4-go%JX!nQ%u#auPXIJGkiug z7Eurp2tuXm%hIjWXHN0vUK8mgc{m;vqtA<`Tk)J5&4H>wv*ev2&HIPcvKWDQ{$2Bp zx!8ZzPQOR@>+Gu^FCuQHMxK8p`7;TcB?)j(R290E!^^&;oYt@lFkSr=SRanPzIbWW z>O+X0SI+(#9RME?$x{Q4HJ#=D?+k*sa)OD0x>JTRkJ9NCYFAGIh|<;f4}WG|{{&Qu z)&WusqUDy46JLdRsJC9CPZJjd21VH^*_FfBM*!rlJDV_KWBS~nt&a+9V6OgU$D(?M)$->X(_&9yJ?b%75X)V}44{Ur-$TZ7z4VcGD5&8Qf9QW^TeMsg3or~(0E?^2f3wnJ1vf$&hBvA12 ztuX5p%e^Uctz#X#^xw7gbr=8_z1mpaS&i9-$v~4xL!?-Mg@lzv7?&TS9dm+=`6avcqW7CrF7% z0Bjce9kF!wO8RrXdb%0!ce`ws{zRV8)4%Eb1%LTe4J3e5j5kWxcV@_EV{Od--SqRHd=SY6 z-iD4tD{rgqR64^)QDB+T2Z1GfA65T*8^7z!-5dJ*HvXRq)pcO3YA7%sg!1KPj%A}i zKq7p@q|v{!$fEq(yTZax7I$76>Z>Z>V({Dd7yvlPT-LndFtQI5NqJv&etD$;=nFTv$J9 z)U%~Y%aXgWJBoeo(D{|#4X(%apjz4+<156+r~)tx6dEyw-DZ);=Qa119tsphOxaS8 zXl>09$E^&%5677!{59gG%p3g+R`I7k22JyfpF0$y*JD-@&zVsb4-A3o;6nE%wX*Yc zme~N~hC35lO2r-@iSOk+`aihbKfiegXP743-E~-_jdwf#8X|{GYE*a>8Pa3Yle#SG>)GkYnrM_pAqHVcif5`)s4?7Iz$B?&Yq6{hn{oXLb#jIAJ&F#v~wj#8phb+E|cVf0`ld4Jii!-Pp|4$aM7So^S=Fo zH`Z5572Yq#e6L=kjypeOsRAy3%8=nKC*Anl9Qk?iGynC)bMVP{LWBU=(X&*I)^9wt zA0q`V*8O5deiPWjpZH(zl>Y4g?f5kKD3M^?W!mZM>C(U{NQu*+5YBY#dmcvRyTg88 z+-zd902dN|)0i;FzL{5#F&P6xUpscaBc8v#qks1F{&w>IcDetK9R57a`ulDC-+vpa zC8AY(_VB4{T~)vRcWC-|g#FKP^*`R_-x2oz(+K--^yzO9?H`X1z$*X70{?#_vrCuQ zkh1n)Z<$u(M2h8HP68Bg314oe-WYl{XK<&|ya^80YohFE1ISf^{`9PiBhjp4{HmP& zu(F4s>2j_%cSjVEUGL8gGw?W9>&dpHe49_kS!^Ir*ByHrr7$;&spO>`D6dbn-rx)`y=n{RVPP`dFYU&<_5Bdp6|FHn%*KEQEpyKnQ5j8f*&zuP(=Uf%Dv5bg2 zvj1M+y#y|_a8modqvw3;BQqvw`z=BdZ)BpKkahzTQ<605sZyu&shrNkHq+bk4@$!_ zgIH@q-0%0uWa%>1^dG#%v&E-ntib3t0Y9S=4Si*C^UDzRhw!%{vs!}zuvn4|I#lgu zNX>GutoBEt-&cN#A+tBkWBM%cg)DQ%mwN*pzh;FLp=(|a78>gr6`L+JRG6G|LKVd< zE-tz&93cyJ8b{|1hi(tuxV_3u-oHNRe-L5%a(`y9m3pQr*R=5&{g%V4XW9+1>SV{$ z626R37C%Ro7gohrS@fDqMf8f<)(R8yr}k|hoh{fDfmZ%=}eh!g^5oswsX!^T}d6EBRpig;)*Z zEAhz#+Gr>~SIICoGr!!;{=B|`G{}!B4IQ|d(qJRUb%3u9Ua!qmEkj{Nl4KffAH#LT ztKvlOO~T=ROK5{i=h`B3VmAMtgeU8wL;_0S?&fMx^(s|aE&Bq1?u35y-QfBme8ly* zfJT<*Pq6pV*eQb5h9iK{DQ^A|=lll-ccKHT3@15BjQhu8jZ0swKP@ztIttCaTBApP zTz?wibn^>K?0-Fw*#G|iN#b`BvCQ}TWs@rBmqn(v7q^dUL_c01c|H9<2X+1#@llMx zt^6=V_SF5j#02mEkrWR@$g?36tnZbx_V|{sK9qf<%&(Plyx?n=EysbKWdypN4-?hr zaO);eDK!DUomYOi(sisa!=b&Qq2@6}=0|}KEn|F-XvSv#R~=o;uhHOb=e*+q^(byl zq6;Hj=I)Ksj44q0>9UO5e*&c*YW<0uEp|L#o~8H&8(CL@ci4z)KZJ|eb@O1+h=@nb zAqM-C33fYdEnacsu)hBWIRgc~94;FY1?C-|B(Ajy=QH%)PL{W%o(FChIN z;Hv)_*m?qh&;YnJTR22-f=uHPtI2%QoX34m-YxWL_hZNAxWrP&R(JfZ;VRBo%l%$v z@~dB9YIbG)S#R9WQL{i4U7C)rEw8D|=$DK&ErQddcvh{2H_{rFlMSKumdjHhV5-A8 znHD|Qp*67h!Sif#VA40HG6OUNNNiR7CqAwD4E=?K--DZUhB2$oeaVKY(L{W@?nyEB z?fZGA#sB@8>SrgQvhH6Y?B9?IS_qR{(YU?ZCE>Ea(~dq$?*E85{c z>d#}}%%rdVGY(l<{~A|_Zf;ptI<}JE6p$io{mOpI;6qr`r-hM#VCSzzenzncaiDer z9%F+GdvK-nQ`&+SUh2q3PMhri$KG28M7e$Y<3~kBQ9+RqRPY!`qku!nU@HiNAR#Ft zA|Ty0BLW7BsFVUS7%Xz4}JgB(ij3VFf3cS?^E@Qg{j)L&gauS8RFP1*Y6cS}C-wALL0Ac(2Wp%t$ zvsedtl`itGu6JurBQ-TdW+_k<%(#BO3~eJU*y38K$O8j?s**&fSRLcOV1-D6`?UoHuz)!06}Eb= z(pqY>A?JDc{vomWbPYI5jz791y4u5bki9jp@l}3Tg#VpE+pSD2p&9#!-wno_M;#NM zxrSY?)<8$!@Y)?}K2XEd3s*k*suHF5c2VRULP|Pto9yUmYcgkwUB$;Rech>|YJ<(_ z@1!dGBU}Y=B~~GVP|J~}BTS)COG&HHnMcA==sQn1t}OEpAt$kXr0vjB8CX%8_G^IC zcPCukn-4uWlIUZ(Rw{eQv-S}4-k3o-q4D^km}K7HRXn_p-60c@Z+5F&JAM?bp+ z?EVPSW4Fy#rmZ!{Ei^(9bWG=4`OxMPI$01A&b2@2J~iBuFiqz)I-$MmK}|(T z&0DBxq};9IIK_p;>ktN7X;u=E46U_9#6x1L*2M1PI?=BVg2c{Wl`Q~j4N(SN3ir4F z$LZM1gMDa$H@d8Mg()-^-a{$-H9MK7o*k7e1%57MG5SZ5u7PLx0!QAaucbPP;nR*j zrwJAO8qsl5_ERTFz#nTp7r4d@8f(JDwuH{rA(HEvpM3)B7EB*dObK0p<-?a_>~?;& zMk!(TN3Naq@9~*_#w|P`B;p_-t56CeaQzr}sE=b~+WZTF^V=}2{8_7RXXFk-c+{D) zeb4LNA>y?Ix2`|D4tD;8^gh&ea5UzeJ1u;|a=No!*8EYp*rd{hB?s(z;|~pOUwm#= z?j;YT9|9Z7f?D*icvt4!TQsdN6tFxpQ{mqu`V8uZ@*iQ!xW1rTTp6#xc4c{fYPK{e zjCw9v1^)gDt%rw!#zEPF-8O!W4Vttab0u`3H$-v;P$QYP#S5b#o1TI$j>nIM@&BjW z4aU+y2NVA%5>TRGvooGkoX*7EMwngP<>oh|6^o4OLSGsi!rp%_hv!O*lu}j34HrI!9iE9q%z5!vpR0Ip*6(n?EJGUfuo) z;V>58nwC9Rm0l}45B4PG+eXe#Yp3gp+LIu`&AXtQBd6{h^#9Qoe&U7m zaa?c81Z)f1ruyN)?u=@+i1Qu@sn|DCP73?a=@~piZv(}s*xUQfFL>vg*i!TR1}Op> zb^fe{sX_xGnGuqE04KM2>pt82betN-{zug#U{+gR#6ni(*n9~jaP7hr&)a%o?=7G? zj;eoJShE=>45&q|$L71hcR58syJ<+$%3V=^M|{L1Xe-!(K+fSpNzs||{gfGsb&6Gy z;tY@ZJ#l47}dmtLK^3*>98+&SL~H;d>wq| z*u@bp^4%hi%{S;Fh@sEr+xj9bpZ>$)`N~AY1g1@N4aY%~XU^F3hX1&2SQFp}4f{ln zRP-N|z-&6hao^vvzU_@&^JfV*VWw~Vo;43YiymncqMj=X(KzLCIRkg=`iwv9)pCbr zLBOag&mct}MGO|aHL;C3@KZwG+&j;1aYFRl$QV;+b*p!ch#b^Rx(V#_jyqxoehfy>Hk^uIV1=)d;VxqN{F!eBmYN zzL{hDG5@iN@#f*YW6@SGj0J}+)RM@K|b^THyZ@{e3& z@VC5eTl0uD*}o9;=PQZhXCO;S*0p+ueT(!tbYExEkGhHCDIyq5J;yHI@L7#JVcAwI z|0HZJ`g|1zPJnDLw*yi>ENBcx?rvV|;Qn3LHqr6vt%T6h!NU?5(RsUxPBowRAFdeh z4FPWJ{%z$CrEt;41wWoZF+v6B^>KF;(6^~Lgn_X{rMQ17P{4cD7YE!m_M`6sNx8n+ zb7mSi^yNVBdmW%{1C9@~saY71bh7UayoI-HeQ5fuDGadgKfOmiZoW}7%2K3mpY^8Gj@du42 z$H0AX{Z#3RuI+gT)$%1~{N*2|(VtgN;`Z?oyCE0C{WOC9k&n-vEe!HE&?o8TUq^AH z_U;Y%^L2OVPDIh1!1SoAPyYG)AFeSTJNB7^f6!Vz)!mgV?V9m@iZV6q-^n}tJ&YJ` z>sXU5ihXB&#Ot^>N|uhEiCgX=I4)!3huhcb50Z(@u`lO;^fShXz(mX7R3+Sz3*@qek#UjvgYe) z%dF8LwKgu-g%2|=aI&RlmeskYxqG5!GLDl;-TY^w<(CTG9iO1cgF!JyUE%K}tW`8o zpQ?)~_%1aEK1o^XNJ%dvmSR-$=U2nG1w->C`qY`w@8vkFPl5@p_Z#DjD;w2!)9f4V z2M_YcW!X424JGo|`kk4b@x-%L>B`SPvTtUX#c`pQW0}T(Jdq2hb6KQ>VGO74-da#? z5OZy!E-(f)`%}+pxi-PC&ilJ2K@Z4i^2sZ#a%SLGAwi}#{nGyKsQTyGAaXSH&%*#qdCsm(Dz#4R`+VZo(!i2WA-8}Ksh*B+VG3NZo4Wk3{joKEO z3QsrP$fV5I_J-%)3t}A}GtTD>Ro$r>!|Z|J^_g=}h+xCjcJa9$&WJ_7QD?}%k0NbX z82@4?6ccxf;wkSt)JWQ1?faSiu!o)-oY61n=#fGc zA4WK-PNu5sM2{)odDj;jIhE~tujG#}>}iX6=`A~Et1qUb3C*9`JDa8vgWCSc`KnNk z!wT4{(Xt_A%R>rYC87gYn=ccDoKS!tSIqC2M9{eDD4uC&wBBjcB2-Eik{Ilkmz`TF z2f0?Mt#jSfKi?hNaTI*L4CWyg^3r~zcCYKZh}~u(%{^BF9hS?o6=67wi%H7-Hj&&I z_WNl-D|wB11^q0aX&P3iS5@_2G|}b3E!@oZyj+Bc6!SYvQr1kfGMH6VRgDth3JR4< zXP?+V-?U8bPt4r!88sF^zL?Umd*oE>1Pn{Kk?4qLwc&2_2y_4&c)I` zCbP(5``N&y1D6^n^obwwifjzA&~mJg6U-MJTbA$`#I ziV*obU1H*931!i2ajAMGnc_F2;=_=HqUGo35Xs+V+qT}RyX7XWhJj<37i)bi$Ho>M z%>Cqi>u&Nu7-mi#lKfk0%RWD32r9WT*;Qbj(8U@0$%4NKK>-(0Ho3ViH*(bKN?+HX zC-&arPq?Wi(`PJTnD;^QuwUj*-=2!Jh`WbT4rB9#PmHm_N(SvpS0Exf>x+l13`x8u zfejEtnH~X$#2NoR9;F;@;L^H6<^=Mk->R=3$$vQOJY7Bc8hrh{2VnDi4fRr_#6jhErM(2696vV!vf^9%g7M|8(E(OvrC)I=9CRrhE^D!M>iBC4TK6 zG&%u=JezaGK8dtZq`Mmw2;I zF1zx=6C5>#kl{6<9pDKjOJo~a!rM}}HpqWLzZq(QIQ2>$Zo|wi;;_OZ2cvay)d>PW zU{TR71f&el%JSPMgT3WbEc z)vq2)bO5gyKEd|4nn}Ow3sB81TGryF4*fd2pWXtRF>tXEZ>x1_1oN3_f-*q@hRH=} zZ!SQu(F@4@Kl1;N`;a>Qr99okN6|a`%gd_{D!@f+WFo~zd7uXtZbZzL4V6B>AVKRW zK&Re(f|O^Ce{He|+`r~|VA?YDBU}R?SOYv(UDdZgL0)l5K@0rSP9InW-gk2Ce}1E2;y-zAhuoRpoRPfw; z!Y?e7D`WXF`yo=^_EWve2-k}!!$W{f($NT19hajkuq}v=24I_w3yFqGq>CDf_jk$);~Ic2eGl;)0$vnojs4*W@lLz{bI5-G$i(9x|to<Uz&x+k&V@z{lNEtEygMh~rjueY5zaiWAz8 zM{BiN7xv=`ja<51Q+bp6U0uXi=DP6X@#hyA8&>Devvq+{D%wPQ&0{5QeNpQwXn_J> z*>&Z58b@TC_x&!F6*d*V+5tS43`@@9xZ@6CrY+=joSywTJd(%vdTFfiQ64z1oi#+CN**lzG>4nGi$uD&+U>XdVYZ@YE7 z8@fW`W%baZ14rshoDzT;nX`^}IFptsKcZDj#&P6~q;}I-d`kPob4Y1I=w--t z*b-rs+l99S{HFAEUfJ(ebtP^Z34!J1+&yn)Wg605K#pBPX_w` zxyc*LHKV|MwJM%6`}5Czc;>A0vO{DT5~Z+jk}}W|uFcDaeRI(jK0gxtyb!~puETpB zHKk?H_w`zD{S~gAh??+2L$$6kgzcS6U!+47hz&BtzlPg5_<#TH?9)k0tmmFYsS)Hh z+1(%Y!>LGG9E6$>8<- z>Us6G4$b!mpLi9dy}a^Ax^}XbAQNw4I3?4PI2Vnx^GFjUP`*t;90*i@$J&f6dS3kb znt#brMmYOD_>$&Z(cx!64KS%(H`r`W>T~eHktUl>veW|j3OUEz=MQbUWLm06aIeL{%Z&IQ@*$os;);tPUYS*UQxBe41j?e9H2qn`)d8plGvYBOJcOB5NV6{Yyl)Cd28}YajLRYQrRu=BB8A4| z8$f1%=KxSC7h$0Lx8@EAKneNKOe=8|u-Be(fHj?~qz~kjy8Zf|#$e zP=DvCA9;Dn1ld;2XFC)70p<^n*}a>@xuKrIcoU<4hl5fg)qr|8y}H^=fbYpV`ycoiEOuAf|h$ zzxLMOdYRMTvj>B!yId;kf4r6wta)+J3~ND*Yy->@dX=#ihbkF2b_-X}Je7&_6T7e` zpJd7)xOTLYFl$ikwZnj%HG8SIRDqRENM2|sIQvS8d0N?GP{DJcTv(A?Fmvf&{=su+ zU=auBB4a$KjC&fnNrU)lyh3r``5D#jN?3u_?$2|i^1kA9KN($`azRX@=XKFpe6aqB zl$fvN7>U!hyFzepoG3739LhOgRu^#K01wwK32Zhpd@%TP4k{A$s#GZIP}+1bVfh29 z$we?0*Bn0KSpY*6RoJxoB$jYSVxc&{5kjJ@wBC=ec+f~#z)0I5}rBbqT)k~d9GE``E@5WsOqsx~$vp`YUgUt zr!7{54KsPg0O-@X>3JTI5g`ClpX&yXHcav-M*%k&f($N#7qH=UtnwDi|-^rUP=uKi^5u^o9Sn zn_h6~dGL=5iXcnHjZD7%>vg|AOF9CwRQQic|JDD#e@PA=$#UG}m$9Hk#t~#zx#MQz z;2q!iKtpou+l60W_m|R$)Ir6k-6F5d%1hWy0eK%1^tNxz3%7tIT9%t7@-2WR4nVL( zRLr51zf$$r>o0?-tWKiAG12|^ehoFG}pnFm$ zz--G;nm=8g?MM>Hv!9$Zf4Px2X-7Z`w=F~fOmXBRkcLoSyV&1TH-G@jM{atyZ>=&` z0NRp9w?P!#bts@K)E19@kglizVMIO#XDj|S!=IYW#O?xt8wEaxxL28{37F>*FST_o zvt0d&#}P=bX=J+DeZ(2fb2yK`Oy8;-@FgoK9s9-#~xo1q6Os^eSMSFfH zFv1XMvcrpp$7^ig!!UxeWB)O<`gQ$jIZiO(>I^-EcGA0ztxo)J<|{{q3|IgC$-S$; zO}Z%uzohVs9H8G&*Z}WPz!tzWe4wyXGkv?kQLMlA504LQ0C5_LZQZm|;dpqk0N%C6 zs9J5D?w>&Qj>KGla{ghVGCjc6d`#__HgNYR8|z|#Y~$sxtr_Zq7VrZteM=kdmhSRS zcC?>ZvKK_^e&9wC?#usyzHs11+iY#5*SxIO{yK!oUis4-$m6cN1n66{u68Cc-m204 z#*`H;$b$TeMHlZXddcnpRL>yMpnM~Jo&fZhrBDC-0{E5VkY8Dq^xw^xj!i&(^C~s} z=T?9g{GVG{2_Qf1;g=6`|37ytrox)x#HLThWa9jshVt>X;8+$WXAU0(3!aB;x9#~Y z_%CP!>=h?|n+7c73oBS(pEUR_1g;0A$2t*9j|RPs(Hw_Kc=rp)AA8mydv-dHcBD@s z=G+%?qYasqhXFH)PZ=EcG9W(XfcSJS@!a5s2= z-p3V!7TP~eQ3Dc%6sj1A>DSd@N3b~pg2DqWr`5W=$YUvKd9U=VZrU@?#a1=Uokt3) zHYtAl_YZHcpMF?-SliwWPU*GpWu)O_V~p}c4qSwzu$KAuUw+Bj$y%8)!Ef}>1~v!J znsvpTG5QI(q+eAWO2?j%Q&gWf+x+9M_`m)*45j(k2Gf(IY8N@5C%OsV>^pgl;QOet zm=7t)-E^$tQcvSf{)GKeaL4#!wr`(jMm{lm^BC9enI8sq*cJ;#=jGF}ZYC3CLgbFm zgU!@``RDN0rA*wpCmM$qrjeBSnfXwxetMjSsOQM=G(J9a&tk_~dAnYf%*A3FNT-qU z+D%b$`N?B%=9O$Id92YDc}p#HUn)$IiVs8LhW_oxF`4B9XjpU}tNL&@(r`8~(OdrD z@g3M3R$7{+iCaI190SFUmPw$A!6aMW$?G9vk}`8Mo(4;Xe%_L{;q(mQ$egGw$~(0J zF~|S+lG&9;eRA{ALOhD5N}#H-sSA!bedi_-m)*zXFHkZp)P#>?|E5e!=luzSdlN$yU95Lr|C9m_F>7d#xsM+p&HD z?2Fst6~v~8cf$sQ_r{%&#B#iPkxD-OsOi|S#+EnMLHd`ILI%jDa;IzNs_51I!}NDw zExUz0P-OaMK6X=ug!EHnx(5RB9Vwt=SJP4g7V7TFkQN3Y)T)pNX=1*HX0)$?8WyN@ zn7Xc1zg`oKalefA@y}NH$A_Z!Nz_d)NpIZGfiD)s5=);BcIk;c zMV^xTj+@ptJ1~|B!65|kHzwwi*yb>f$i9}VQR#zZE!&vjn5D9q1IFP8b>N9SO-}EY zT3Vw5#mQPXOv4`Q8-}Vk&zN0`w&pBKGst0gjdVha-0P+ff z90$)T0u~185HBZU@0k(BnK|6gV(Z<<;;VsI$eQgh@!G*$Ot9{MZlsfU*IF~}{te9( zC+qyvc(-?Rk*_yEdTW^HKltOy)PdvKLu`2J32xzZeQxQ_k^HfWVOxDIV1ecSu}u3| z7hYnMs)_pn>|eMBHLLw(Eq?+?#U7`t`HErlf3+EU6I`1R+d4hn9?*4u?7_P2C?IdchEgDHbi z_}`W%09#N1(a*>P4$q^e%z%~R1hMgzH6y5!8{V8w2~hQerwtn=trbM;S-(g#D3{A! z7_7)(r4lN?yG<`TZ>$^EUl4+qbfFr}gd6Wi3vFvyShEti8BSbZzkZjfaYz>W@HfoHhc!09wAZbrz_B7_N5k9{5`42(ond#LZj(CglgCc6fa^FdwV1Mn zuBQ@qx)B*@urF(Tz+s*AwLvb^gCd1H86v`+1r!w;Na^(-t*14slz6DyD_l79c#B1GyIy)ea)|sy|%Hny4?9aqy!Qq(vyRmVlRMXHDQG!OGIsIu$$le) zzeYHZIBH>u)evV z(rM-2ZaYaBotv-Sh3|I1g7vY)u5zi6i6N~Wap2D8CzpRtVC4fz2=EBcrwp2(>2HF5 zo0vY4|KLJOgkB9kitND{SnghH))`RX2CZxQ$2A}h|3bEi46y1F)!>(2e|Yo)`HCG} z969;x1Akd*#3he7z?u%yVsCoKl-Ql|U{vPJ5ayQSi?zj9Fl>abM;s-<0e^I@5ANr$ z>oh^_lI$xEUOw^!s4MbI$GT76I7xtfM!aVT3N=@wN4n_d_h3YK79kv$CN(G4sv&kE z4+j!&$?=~18_ATT0p>63Z;V->P)=C?<-wy!cjWjcKC6f;?DVX|xu zkp+ZNYMX%ie17573l@NRB&#&O^#8--++M(^lj4zKzx@9%ECuQjzz~$kn@2RM zlCnhZBma0Ele~9jFp;6HDkNUR!;BjTXBv40I;oy;n?qK12%u#@j$94>&HJvs%cF?t zYW{6vh+rn8wgtXy?{?R=7nYBgr?Sny+Ayp$B!1`TB~`61zcmE$=gZ^_!6eGgG(&>o z0#SnW!2;sos0Q^Q#P`olsiu++jaMY8{0+-q`IK3W$K^bt8ZzS9!f9(m95h>lG+ ztauB)hU1q25HFWW;!R&(ccnjx`d5q@+FGTU>7?6ATC{(JE>NXM<{)NNaeQ4bR}8W6 zA-x?qD4Cni=Qq~=8^=~R$q@7i{WyQCr0fbu>dtyt;8k-pY_xxaG)o}Ok+C1W3i!GQ zXimuuznA}EwMT3JNGU{lYXh z{A#~SL<=ye{|eKu>rkDBhn{ZI19r0Alu0jG6mHbmvYy_|@z%v6+^~UQzSgXhhIv3}nIkiwr&WyGXHKAxaxbL%!A?_8f%c*RSLj^aSH=e-b(w#fqECKb9EzTrAHwVv zS+y;XQv!A4$V&DohmnmQCE^3n{tF!ZU~YA6P}*pask)Jn^%yY{EC(0TJhKy-Ga!wl zXY7Q<>hE7#?|#1?!9@uO+xy#sBhyGO7#$ZYw+Rfdd>q)VPsw^}w$Ayr;dkZAVTCjc zOj7~j4hM-tJVl6-?!L8t?fbeB`jmiXg_FlO3YZ-U9AB*hGCwY~Gv{gO zmvRmsrO(-(NFrqR9?lw`vg(LO?e>#dxV_~2?FQ?JF+5V|>5-5+IQ!bNQNTlLk(`=F zIm0-)!&-$CcuF~i%{5rTQ|V#f2zf?)JAl0FnE$8drEqSsj%Rc0<>Wu9#(vhG|M+1F zH|fw!n_=vpv6ZbG(@WQZ*N+vF;_s9mS3+^sDsPHh$}EZseX^)mVDLC>C18NoPwHGb z&KpM?Vl$YtQT1s-u?gw)kSw=Nfc_qEDep<-0rDLcisy^l(8^Q9_RXa2qu(OuwY#Si zMP(6*X4()(F?3<5#$&#q&F;?Bxl!yuJ}S~}GX2tI;@M1<1Q`<4Sm4c~v9l4KtKQ3C zq2jbq|D@PI)%XcR^N9PHY9(i?eOH$AiUwZ?s3Q1 z7A)v%Y*<`AXSm|k>Mr(pEE{{@%EYlAc3tS5x!7A2Y&$GFO0r~5&B_7zO02MK)#5yB zC!asKT6JZCO|F1$fw4W2v44JPasXIEp(dLZ)jV-4J34b%{T=@_XtIcni~pStAje82xhwW(|0S>N}ugS zO?Ls7xSR_gcT8`JdIH0`PoJ)MFKW44AxL1yb5=nbmg2BNw6w)?#xocdeJ7N{Zj$HTN|>l5-(_GEpq~#9;baxkNs9aI9;Q+t_P=jj(zkT;@qUU7wMaH^ zz0(1^8OU2RaD>2HyO`V7EbSGHwfO{gt7KABWz1JtLgJbEXs@r;O`H^^u^?%o`j0Pp zj~C1jSKCrD1sa_`{zT?1C)9E;(<0QrLOl+1MVrv_`RbGCl4iYmJW6Z(iv8K2BktY-a>RHdLXktDsi_qma3>W=p#zmgX9Yo_CsNDl=ocpvDaN4+OGGg zzAL7K@>4!#XTzq6axMm3Zr`K6MO>-38CF4uX08PT`0IP?xz`D3n3{Hw9PRcyZ(b0s z2Cjj#O7hQu-s9coP}j4eVj&S0U$*KbK@(sAf)d5>*}Q1_iUSsOz8VQ<9Q@l52UO>* zM>|6hWtUrw%p+gDe4|ziOcx&;3r6_;Y_%2btfQ}{Y%^OPz6A8;oe*%3&`JY^QnR*K zKaU)@@a906I%qzV(6MT6nNvygIC({HnRkna#>vmrqSe$xq#4-r1sp8IkfEQ8$^*g3+r%Q0S>w#ShoB?ZzU4TwQg|GZh-8GAds zK2~4bX})pl=q_P?fEdVHBKdN&l4Dj|jI#Gx8LDa759FiYIM{X7#-r-idX1%lElz&f zt#o)8R}{^E{J7lh2RkHaQB9ynHw3-n*3&@dr}Vu2@W#w!9TgeSy3Hh{X_01fgfQy+ z2z}Y?szuz|KAZ(ap|6_Bk|)?QB3(Q+)C?aJaY{pn|Fphr1ya8~}Oy|J)AmX;+kD zFw^K*OOLP45pAjI5(?vt%@KUC3^^}oqLbNyHoH~ekvE5AC_mueRLxH^0FDLi7~v8~ zWiR6$#u>z^m0x^VC_)dh_v1fjZyjJSAx5xxNg8YKHELuiL#XgoI~w8zVOrn3A9BVv z#2D0p9aC32h@HT%!qP8696S&1hi3L6c0HcAM2=ss05wPlNYzXhE&p-rJ^NRv(7Aku z7pCsJ+PmS*1Syf=t~-FePo+ZvdsD+R07m4Y1ZHU`e;VCkO|3T0Kgj|n4&>PmQsaNB zL(0OM7Ro?-$H#%{&Oy2Tdwb)A>f9R=Fm?M2P0(`gE1{mU7_pLblbFwk?1yc}x$J5h zf}jNE8W66M>5!#%4VDkxf%k8(KDw=Ko=XQIp;C6OV>=|J?_~fZ#{M>Z-El@fd zew{PW1Mf6Q&@I3Gu#lS}E155TXgUyKrke6Qj#{bwz=>4 zrePe^(e7K@Ve1b;ja?9^B6zD~Z6n5S3A~5S&RwLfRlCpd0s{Vo_cuF7G+Z11Ma5VHj!W)~ZPty0j+ zF0>;ULaDp<)xk%C9>`{llSBPnly?FOf9#Z?HT&ERg~`?q9f#`E9B5BRM{&j)Cc194 z>r>9&#~uXGfX=(ANhLzAFO%}!UeLj_lT9x+X+wcfhaTcG$Kyz_r?L)dLGfHot>j>U z$vM#-G;?X%5_V4jR9r0rB^!@UEBH>xv*+i9Y7Yib-{mW3FaolEe=TGzzJ(&XNe8RI zFAn6BEvcgByS(Qk-7(yz|ZBDOp|16902UgP+)%0BrRE~p}8W#g9n>|^%K zHNVSzqQAeaACIHSIoZ^N^^xA*8yAEn%Hs$8ZHtT0#JnC1AB!kxU`Yj~kk%vz8bhpr zHp3_ZfNU)7%jDm0gp^Cz`k44=a9d)#OdfLh>}7)fDX$_#S3z=2{cg3RR{X3w$fk7f zKfa{$2fc-=j8gyPp*`nji$cYFh&j>eQDIyb)QiwnJ=Sr~zl;SucIuxcZ zzSD(Nnuydzp0>N5S{7CqXj;gn-PXxyk_e$b)I2-Eiw)g>jWW78JcJ9B|{ z^aU5ZAZy~ILL$Aj^Q1AP<)Qia8vFXBr*ourtY!z*mSYt4L(r;DDN7al()nWAoweQ5 zZmzBOJvF?VH1yAYcQ>`jnoqdZTN#@e+dl2VMYD2RN;4UB`=qGjRKa3U%A!G^o9{e) zC#7RLOVkZttZ?P-GsIH&z1Wt=_ARUv`Zy8tjK_&h?=j^~gqT2Ij z&8xws>^jcclh?nVB1$iH3O>jxBK11g>Wa$Defv~8J7uJy$K0ox)NNd8Q{|mGIU6)n zxu~!AeZCOOwadB_T#bxl^gBy+QVUwtOR;cj(Q{=Dt`3C>yAfmc6ScUEy9>%K3@93T zaarUmFq)Xm?12BfvRGr(FnR6_I(KMcrk624QHHi?iIkQhjTjCR8@`@H6Ry6^sN^ec zvo+RXp9;4}Xrs_iQGPQ=i1zzS?ioLDE@gIammEs zJzIX#Td{4^2d#h1_TH*>Q706M2M46$&dk4@`QUe0Gu)4PJJ(G8oFamTocS>GG9S)v zkvBCbVm}seC+9NERTnjQ3GC%j7laVXHN{pv1n)> z39~D%?;R9&H8F4QbKA9Nd1MoMj~`st^(#rUnF~p)6rsMmodWfx9dfvpgI4LI$Yvp0 zji>YFQ$JB(z~1N2=P#=@sealO=-}I+sdQTz3J&V3h9A&xPKdc!K>O2M&x7L#XlIjy zom|XU&~8n0>IfFXL8kLxQxv3+pFQ>iM+&j&BLR-29 zaUj!DnO;X~w)JS$V07p3o8m0O6*$#IV(P0Z9~*!WS_KX|e>Db26U0!yCJ(nTSSI8w zk+=dhCKofhN_b>503h2}m9Wz|eDVDpNy3_%ZR|Cin6GYqYnPi3D)rlGy)Jt{$KXsy z!Uyyo>B%H_XR1%}7KOf!G*dXN%gX-kO?r|K+VCZux0CEoGhLo$PVYE_cqli#737xJ z|9R$aIQVGrv3Czscvf?+&*3!ZFF)z-gIwPGWJO zzsebk=`5b;N``$rT07i)awX;z^!LpADn}yn3o)OtR`**iI^un<-MOta=&NMiYZ@ER zk&s8o>mw0xAFdo^rV@s+8T<26@7I64Q`q%fkMM}8O2>s$ty3xQHNWiM+&SAuKNM?$ zU2#P(9P4vTd!}*I{gG{R zwS=?@!cuf)ZGE|We> zNLo3Z&GYk}?y8-Jlm_k4e$G!y5~F63iWy|v_B1sg!y&L=Fkt=%=X4qDTsiEIa)g`h z42+5kt{UyXm@i|U=Ssm_3Pi>3cJt|&xf&8OXpD+>EO5l- zSh~cR4@?flb}8i()wiIBzQ5;ma39Y-zia6k+QkDgp1*Lsw*w>WI%hXIt5#5dzv$6c zgL2rUWZ!7DrE^EO!O{fJ7)yHAgqN^;@{HJc%YICMV*(@j$8a&4I+vL=mWn>~@+@h- zmql1RG0!5`xSL5WJDH26J4Xz3%k_N}MlFu_Zii97*x0wyj&j9t5^gRp#Wye~_jkm~ z>U~SC;&c?Sh$(*&Tf3TBP&~} z9Hx>JY!hpT*@~yec4nAt_T+YW3<*oy} zemui%@NULkQna8w16iN^PGZ}lPrr(GIH)JDPfWc*B3Svure_l>KMN|Nt=lUGPfb25 z-Xh!QgttV|j9c&a?=Bgp_D3Y$>)l;CtLh?hHLPIDhoPjBKXE_L1-CycsN0bzI?s-W z_puYdTe^wIQNx;i#`~5WP|L0*VUo7z&3ja@D?1BV7o3?HZDq!Cum!`b%VHzF(osAo z1rsT*=XAPFdsHC>K$8Do6u_a#M$;3WV{h0Lt$+5&gS=k;=jH@9EXiJi{LN6?w3a_^ zCT@ljE6j_blpQdBQk9sKA%i|$58l~X9@wJ8Re&UAKF^J1Bkb4cw3;+BAP!-p7j!phR?P7W^m=+o^HwUP<;kr_loDwJF=#!+lzCTZaJh{=k1v2 zn+{iN*CiA_f$#0(e9H%)+$O6gRSL78T(0-zgK_d@x;AGIKVc9mh|5Ec{ouV6ObCi$ zk5hBeR?E9(Uaq@za=U+^sEla+#O2c-i1a%{<&Rd3**Ojz;*xe5pegJJ2>SyU81*zC z2#~g4+D6+u^86w7oPMioMx(`hl)`ppVpJ4?HIi^9l2E|`)GcGk#p7(G`xz3^pG!{z z89TGvJM;2;&DrKJ)q1HW5~GAqmACLNwNHx2V&RxEa|B2bd#uLIs}5ge=K5i6encc@ zA*#>v{n?{BcB3rzThM)v8L56HKAV)Sb5uPLa18sD6+UR0VD!4`D32G#693boCu# z@;=1mSp__^Em&MknvxRci~1Jg7*PGV@?kidHis?Qd*u-PPxj~lc){f8)l;>UU-Ih*>)_C0KQ;gb-mfwfmr+ESxuo3Iz zb>C8?ytI<<+z8hXMz;pICdUkb8b)B{Hk-THKoM174ae8T&s&bZzDO2WsuS(6LMb5(4?hukMLieq72 zSrQg682Uo}`<-%@Y^O4n7=-nPy-Q0YwiFt(z`T+$nm_{Kl>MmqT6hJ&g$D((@$Bc!rS0P$FviN-Hg*R&1A> z7QS@c%eF=){q328uKU1k9{?)?><;Y)%T^${5E4SeP)Mi#1WRG1mV)$=4^Iy7nN_?R zh<;0TUqxLUehSP_K!*=M!EZuq!4 z)euI>iElIQf_ltLo$f7tQ8Y@=h2BH1!tSQFIy3pP!h84=lFnOqJ>zi~?3^hHEul$| zX3fO-!UTktn`q<{2ba8sSukc>&^`=i)aRRSc1)&eJDY%H%h`-L7+hfRA@8HeUbM3N zk7WHlSXw`tpDh^EvD=MQ!I;R;<-@nOlMyTAz%z9!+cO(M|oDixe((MH&~&SJGYaWZre==@@9br z0rTJ{E6>1y}N|p-O8KtVTi_D(_3xZf!wFv6YPn zvzARpB8-^SOxnOf866JeRts#h8rS!6O(pjWxxNU>%bI#Ce3(@)vpT4BwBug)UfG5E zEmsDj*$%1^%P{P(>-HlUfS)>19)^o>y52kmGy2igCN-(dwJgDNAtqjwR4{R>J_G z>v#Vg)hGj)rZ3d+43c85DyDNJV13Cf>>d^H=A zT17MAwM@MjPbZr{Xzuz%@Qf=6-nI(3)&)X;>IDE8X*;^ATF--h0Z$IiRV2+TN$+pz zQlZ~W8aVRg360#%VgTx1mf%B#(F@@0j)mYpJM*4KW`yj4AOSrU9SxFj!EE&DBt9W7 zIMQvFw`sc777rbF67(hrbr?UWTFhuky5?LURzF&Zsl<2&FP#DoyLdZ1W#Mt^dI9DW zJC#38oteVBXGyqsv9LW3)Xrvl;Kw?=Kg58Gax5>pywHsqYWVA3xgej{9CM3w#iPauy5hgVrK}JO>`~M zmiHH=On@tW-Q=ze;`ou2P~2nj7M-J#Gow*lIxHs?LvG4Y5iC?8Ca!%dqYDrk6^eJ# zXu|-5jspf=1{t(9WY8-A*r36_&Lg`n%&2Bs#QB_)+CG8R&)%I$q8q8?e068Y$xu1( z+!tmvi0t=jk$;AvrVb2pqWeMvqZG9xHNDykF;My{0`geama~+F#@_zzT>ENd`+xM2 z^PK04IdO9@ZR*WD9s3loTkGGFjg?()14T@pbe?lC3~Vbnu|Ks8b8}jGct;zQHg!L= z?|kMR5fd7`O-)y@I5aeI}|4cL0Z9YT{eX5-st<8>kt zCY>E)I39T-lu*w@6;;$fuBgDi@?iDa%Zc5mAAqirqhn(+&ufIh0!=dr&>2vGj!!C1 zEjD5cQ_ZvHIc%F3&9@C+nh6&t{pfz6Mx-0N?3^M{yN|GcOGu6M_=1RqP99y_geoUt ze~Zp4uoBdLY!M_Yybto~x0UXKFB21s+599wgh_(nDKP!j*g}NbcZ%mRK;%;M;wyRX zmU{=nlmqvra}w+ZONRq-0``-53wlggj#yG`T9=_8$*mROb*#n;9@kHCkH;t&2fPs@ zXM+=yk{S~%8Bbk}n>#uatx_W95eeym*$%L52F}D-+=2#&pB6Z)(6}e@3KpAr!I~(q z3$eBXO0&LU5|drB(nOSm-4n7%IackkTE2pJ_lIFqnp!$|`ekzXfmiyA69mTr; zFg3X`bZOUfhW@Hb#6kbEWD~LuKA*Eh193LrqDNJSmf$$CcZv4xN#ETj%zNON9>&J_ zHhuq^d5z0{BKWxiNWqLoQ9mXc1fcd^u=eFCCW}~Iv3U>nY5p*|@n72NR~JY;bijV= z>^PTgk}F`YnyjLfX=x8;+718Fs^8Bd!R5JX9&zj;1+J6lVfxOLep*1Lh)6B=50hT3 z0CL6uf4sd1RFhk~2B;vQAYh@0^e$aNKx$B=BS;64rUKHDUIU1zh*G3UM*&0VQl$n( zdWq6IC?)jXLz3B_=lpl(zxSM(|ID2=%e6EM6SBXzmuJ7PZ~yrWiZPV)a^A!cMZnPt zf||b}1j%n@HUE$duW~RpMKCc>72jBd6{BP|lSFgg5eRTBc7yc={5{~OYI;ZM-v$f3nUS!E} z|6D#x<&z&dM$cT*>Q{a;7Ed{+xX%8}5OU&R^80q}Cn^Ysq67)gR{@cv^MNQYFhpW$ ziJ^ZQ;XGw*;IC((Ce*;d2meK>w>ggl#s1ri2MM{Ct`3B2gBYbfmiGngeRs8Y*X?wD z_jidh()Y*3o1hR@>mu)bPaywFDc0Pe)1Ej3e%zM<;Aj}5oNzJi?i6}0TuaqgJ4EUw ziE&HZuOpxBeqd@C;D=Kvsy;&#?m9Tu>8rYcaA2o?!07Ipi@&ykt8Q1n^K_qkdfC0t zD_`B44s0jA#Eb8yI~1YVWp}NG5(^ozR06_B_ZD3h|wu01H+ zBfCAd*~)aj(r|(fp=y5eUw2_57R+^SCRdU4K$q(6t?)a{^0bJX)w09PL2l} zh&y$y`b;@AS*>W?au)PKB>BHxJE*pW%N6MOoKRc5$a>dp@{m5!W*Pt5MMA!4<0C@% zyPhUZ>vGPgzzNMP!PnG1FR8y@3H)^cYY_J>8*;on7}VU^G4lh+Dc8zj&pv%DGcF7r zcCa_oi%FOwTpQOt82hSWQR-|}S8XEIn0sC8%_4tju6^qwV*z1n<4tj3PI>h&bOE>y zaMB3CsmNv4N>v6@a(|8GH&`6h-r_r04AzEA950Flb%N)!CuA*Ib^&jF4f59N|HNB! z=G)E~xiFYl^_5ml#_8S<{4w&gNXA*Hdw$7Q#JRv808_|s^M+=C;G%h}-YKf;S*Scd z#!Y9LM7|l+KHxXm+3e=rYEpu>EPlS5(dI|Dh66vI7f&m8t_y?b8++}cHO8!D!;tDBjeii(z_Wg{!@=8=!B&RD_ePi z^5sFFm)A_@4sU!~%$J}-1RQEKTW=mr9uImOkl0%X&gc!a2-v85(MD)qxMU0gISkUE zL7@1XGmVHV`9USu50K^peZOajh4es(gC5Z+)1~G^Nfz&bgElGK^m|I@rYf0;Gas<& zEp~T;Q_oOZnD{96M{-VnXClsda1@7L49mkW8 zQ>OuClUo7#z4F*KR+fN`_YabP5M?}gs@LG=IP4Morem!0^1)8Go;E+JeKY0pwnbGK zbY7Voc_R>=1R9Dz7x z&Ba&G_ppIg=5v6%A-L|`px)^aWJtRHZ5k037<1vL0YD;PtE9wUsr{$2f2oqfesH zEa^HSy}joOWn)qDN5(e}f}@_xc~4cmlPvPzW?9c0)v}xa$XG-b%cCXO17BWY_zAjx zR|?5l{RsYFu~W6zr)HwiRJHXuxjD}#ADCBAaUB(m5qmcbovw#g1I}@ghQ%^8vKPgl) z&OtpayC;Vj1U25rr?1E5N|eaVtFSOK_v3kjGhgI3y`b@3Eo`Kmw}^Z{r*JNi-TRfj z>H^Olgk@02hBK^_JF%|giQ3`$9T`7b@_(0f~`Y`0I^b87Q>d1B%I+l`&$ z!>}sB?z7wEF#lcO_L}8qAR>JZ+UG7-o4=atM++e@tp@>r0t#=k0VwfB3hj1N z=Z^kgdi!*OJ~aniq0j(_1Da>D0dXRQbO-;hXGH!nnc+KvCFt=$fQaqZ!VtJ8=WmqG zy7qaMm0ctVwZ8ktps+IH(j^1NW17%xD$sT`op=Uaf4THH1R4e@z0YW+Q@3Y&THXU! zmdEsm7M<1#(;angjf(mpDy^5!Slz z@Z%Na7Ot^hv!di_(o^MRx-$0lH>p35P$Rdc;zYXR{$7l6R}-XJ)Gw7{UP zYEnY4L@)j&KvK4RfPfW+i~v~CJnp-Ox{`5phhBB;=~UDT{QqfAgY^Fga9Qj=EPE*v zjJAujMS&UkL-fv;QDERXe)eZe-jB2Vp&1QNT1I{X%nh?pH8gMk(q%{-oa^@9UPWv? z!})H{KM$jzoBefTI{;q@ko8LuXg8d!V*U?UTk!AMY<^cjg(xx&gV&fuqZW^TV}rjy zXtsRGzhk-HM`6~Fg*Ery$@>2PIuo;_cFLi0T;8#If>9v9?nYoYH|7}_mhbRw%Ul=$ zR75IPA>dmfML!UJ94-Ab#Ekef6N&uXAA=in#I(F|b-VNQJJh0G#lp%TuU37TB7SW(gU?q~;_CVW}!$bJ6EJ{VPB!QvbFRx4m|4quCl*om2B`i6_F??eEh@z_eh34&ZS#aa~g_s z|8P>}pQA1RePCtgfz$C);a9`4_4{*lwnq%dvn_e&2dto*$!_d-!3+i^Oe!6nh{**y z`XXEneyr{lxC9_QGs{T<2dMBw(_~=&z-k1LettIvp4nqvmVg62gL?RHWcb86AnJPJ zAbE|b2G6b|zncP$=|r)P;K1OGxcXtYzrgiD@L(_t9?Ub^13312&IRqF|GEa{HCa5( z3jnOS=91+=c)LPiZ3V{@hORS8H_xA^Q|LZ0(J>agPm~8beoku`|d90*~(yd&@mm`M!SnuhsyulBlO3jtEHj!e09kJWc8Y)P}uK5?4z)L`*uAz-M<(T{6zWsKAuaQTUK_)@o=w5$ejAfe zaI0nKTh+K8ZK6GakH%{nhXTX*#jltJ$zWC%H zRQ*I?WtS_(#<6FFk0}OQEh(b=`%Pd++-%j=Iq3DDYoq@C)g^AQBd-6tN@u0vhTi^0 zQbsTB@wdjj{&LP7=!=nbmX`79S8z0Pup=@*`0Q_jUdRlZPAp)U+d3A{V*X!I9qACM zNea7G!tc4Nss_%dz)y0?IKIvX*=s%5vAlkkCORcW0FB2MHA+)#k}R-(ljMMy9DU~G z5n0k*?Wt?N_>bshPIhoo^HV-}zaQjxOtV#W7<`taqu-!qkN5X?qnQh!2RWUs1aST3 zSKZJ3-3qgldZ$hYs5@yq;y(xvF+e)0s4D`l>vA_X=FM_1OFrg6?9|`5+la?uA1%!6 zlMI@?6am*f8qV`U`_VK{gI#LR{Ei~qw0k!x%P-N zM4O%I_i60t!F15oSthW7><<|Pvh;7S*kZxLwH$Ml^;l0Y63b^r5_I&%)uh7l$?%@O zqot(*KMfx-_=IZx3F7>>l1@`Oi1NknLU$W0g@QT&((50bPI{NI!wzH4QX12UI7ej& zJxn>YSkTLj>gC_a3|q7s*mQUNBZ}^LCyDmBy!QnptA~A&anMTk1@fyU{JuBE$6}Lr z+Ybv&sx{?(_i1h8GtK}Ssh$Yug7{1d6z9Fn4^xyKslveLe9i&QJ=qywZnAta z+X3CDSP5!HU%!w;{PqIh*Q?cY@^4j0lurRHH9RUD^-PGI_-YH^;)Ixpui)f{Bww27 zY=OG@`cwE&r;b4$8TmU&hr9sEwZ8vcs>YE1tac-ndTq)?8Mkg2-vsRH6$Y0!M%$&> z{#voXL-Ih1Zv->@qJ6ettBRSA8RD2>aEL*BNB9ovr!b#Mo@Qq78H)gpZHyL0LD@MA zU?&4Obs>38ItK!yGrK#?u^5-50;vn&OQw~AF~#(S-^&9F7?PGry4wo&0EO(oU4|&+ z3{gm^XY;Sc2^?3HA5e&Jym%V^z%rh&+IAk|^dn%?;$J7Lj=0gz_BuGnKP90cCHKJ$ z*v>{x!72aK6QTO(gbeQsFTsq}@9(C0-Wf;sI)SjaL^k0*iD|!*O$m zB?{x>S1@Av?7MsX$XC5 zNB5V%XQvR5K0nh;Ppok7&u_qPE1Q1N7P$U212A;bYxXguWFH`+=`XE&O!)7|w+M}% zl3x(KWsZV!1H&TsfBh9-Yh>y@EB zzf#9QLeCuU^VGJnVp+!09!SB16>LrkH`u$jg`n=;Q=(cMy@IVOhz>*%1pTW7DMrw* z+QcOZ88kwMvI?K9R{0M%x~)Py={`_=hrM)eg7$_sasiLPQ}G;b=7V2i)FpywNOdwD zH5rdJ_lWP$H4}LNG?$~a1Uk8D3OKo4*1W>so*e8zI*3a$d_2*RFTSl;ToM|E-=GA+ zL73Ip!1L5!v^n=wKfpUevG5w7r+~y&n!TK^_1ug zb%Cy!0&Pc(Vl5#K#v^xSECHS{eSS-;^rp8go0L?TqSityYeRzFU{JsZMyH&}z{Qv*1SFsc@;k z)&+2sU^U>=tsBJeWqdb~_E@Dgj1i%ai@xP4;_Ae^(N6M}A4rU4dGJt(0SP&6rHw2< zm#Gcv3S-dcsRefp>p9Z#9drqbtKNB+oZ)a!11YPSekI=x!>()IO~kMTmOuaDD=j~t zz!5hwUb(gFgI89tx(JD(HAHcT5;2j_y7mK7JY1iSvba{IcTbN1LwK4@03y>U@Kx$E zQe@C#;lDIGZP|b?N&N)ua4WDhyr)QDLc>!A5==!{@28Cyh*OAZ1R*XpGU7*InUwI%k zHU?_kB5~*2tIgv#ZC{lk)42=+yB3#HtqH7ZXJy*03&N(N7V@lz2^%cz&%$V-cg#R^ ztvi$Zx0F|q28(x-v{r{(rSZ=$7EU8#ts7`}b{xKC^2TR`bbq29i2$E{$DJuwk{8T; zyc1r)DD%A_R^7^J)MJ5XwRYz$-{!`9#jWw6wKLGccPB;E7oP`aK?f&lvVjh+3J$I; zq47=q|2((=$OKxPCB!>plUMl;%A7hgL<1Hc?(s}=p6V=l4M~_e2uZuDPKy8c=}LNu?yO^ENRu%1oi|QSgc#^%20NyU>q}_Wp+CF#72b`Q zkx|9OYEcN-%#Mk)*9-`Jt;Ap`<7>x7=1iNDaS`~N@CNxC-oSp#gCmdpu#pWa%Sy}T zhU5ftl?%E94udgeA`IseEDye`SdS%i?|DsfKHDrg2^sxd$mq{urvFwu7wN!$=9=a# z)?&xdvYaKprVqR&`&UcAisf1;ddoVcd#yx0?fY|)qWHoHmCK&a((&PRJJ;QpyhRVk zL_A+<`A^pDCbw-_!?0fWkH{K+=w5}6b`2c%Xh$|^my+-IIb489b5{A3XCkg~PQ}e> z(47+9WMNnM0$F}bFk4Go`8sj@-_tb_qANEu_D0yNxEMbp&G=i~{4H8n0A}pu1860! zWt>7DsUh=dg<1loi^z*TC$XjDw@A(MOx{1(IVL|evGMYFZ~1bP%>IiwG6hi4s>}~L zf{f-LUX{;~KOObSWBB*7@^fmz7?;oL;Iynk2lqaj5J-Z2qRth35rrPj7x;S7DboJ` z;`)C-HrpGbx)M!Juh)tOYe$)JF1~kO)AWE_@=Ryo(D#k7MdyVWaF9IOUZJ<1@!q#- zvQsI1Xinj$%bQ1PE|Z}TozC^qVK@-ESs{pytL@uHQ_&Zo0O*(p*yZx(`crbq)H;>Z zyI>*{;Bq;n>&_>^EHiLG@D=~#FA$)Z8-I+K`Spc7F^^}rIGyo{#R2fJU+)Y%=0Qy>4G$pq(3sZ8U_gXJ>Ub3h3aC52{}pIV0Skp6_?1?(ACurD6DA&1 z0PM=U{nJ*D9HBEok++`mq1284Nya}&3t}%|o}4!~W(L+_8sv#ch6c`GbpI8uT-9eA zAkL?9H09K=pv(|&|K69lRI${?XKN6~)$3qP^6fCGSPC&%WKb^f|nT2t1WAkacJ}FS}PoMsgf-6QD)h%u6 zVxNlKl5DxpxxvRnEdwcd(k7bbTPQT&(Jy0P>6HtH*v_ zDy7qiB&)HqCyE@z#cA8>*H65{hj6xNL)P4dd=`VhnRhP^trDlo@9v_-evc(YN$ z_GcqLa0~yEeijXbyGvN(v_-)2W8cu9P$D$O{Ne?_B3hDU>mh+{KnN5920p|=+CLi@ za(r;?G@PB2OR(=Rq91Hzlq`t(!P>xH>%Dq*jNXoT{X7S<Gx17lbQ0N9DST#XyrFkt_{BQb6AM_v8RqN8CN`9yksI%lc9#-v+gvAjs%{w zFl$*u>*v?=%X`?C-K{kTw9rR5f^XzcDJr0E@rR(W&Cm)m9xZtf!TyU(8J_U=;5* zC!h{0LfOWfZ*}W#tMM6^SoTW`5v)UAA1-v~V#|DA^fWqP>LyO!-Jxb;_-zw?_1KDc zsYQRN%La+P@3{u4?FwC+1A2->DMBr&bS}qZ#O*^vej>k_q58e4A5nR_6XubF_xPvP zNaTHS8!TV)FD*j!41!Ylp~PP3^hSYZ!rW;-g0L45Y`tDviY$7l{BE8YCYYbX~FB6qxor z>xfu;{Yg%)X64_pl;lZHFqqcO?Y7b{x+`}TsF;RD$f#M$gBS|ne2!mV94%H5!4DSC zEX>UxHEC-rh)52x!u^Q+s;luEeHXuXcJIE(NDnr5E`lBJoZ4}7$Nfa`W+tXAQ^Vv= z){l?);LL(rL)m$8T}|H43lQ$yjJSTwwMXzEiz@Src7t`Xf<;o_I1GzYcF=OmPD{_iwXx zhYcnlRONKoN9Cn^Q#(Zx_iVIQ@@s4ck+x>2iC5P)waSFxVVsUuj#%5@~YpT+UA${o@ySijg^Q6ZKv($7_N@GjVRH#stuHxT=n zFHTm(Vz$HMzI=0kt*>3l9;`4=vemcky_#oDNcm}3#3bv=#(e;&zyBQ8df*jRdbo&t zp_2UU?M&i1z5d$=N;zteUxdSzPszs%n`+tjOWz}>m%k-JIDFwaRb$|_Its3>k7t}K zm&zIM6ewO05&Ud{ zbh*om9scc`_@?VSul1xhYJzu%`HYQc^W`vV?>Ta0Q=j-9k^M+_=Tv!*_K zxK=kKLA}dk2S0boXM(L7JBeM%-00yg@1{m{NpYMr0u{ddA3mSi>fGLc$r%}Koj*7d za;qYbnRci-t?`?`YhKV)^cQE{_y3v&u;{Ljg57wpsA4x-P>mzgo9|BHoN0Y?ao3+% z9yqK71#^G=+C-UY|7)$WO6P>aB?K;`qHb4vq~f7}$L2(cc19gmbY@JBAJe+e$`by7 zr&WYUdpzx+nfp~z<8K{#MJFIU$IryK6cKUcKdn2}+Wlp28pNxLZk*SrzI{}SANh3My$AilCSbI}A#vPwLgCQw_(tt7&*gzcyb)#e zK)z8&grdc1nWV?WUz;wJLK^Z0^4@zc<~$CQa@VY%D@D-7md*(roK?>T zirh@IzEjvjr{mswS!a9|KHpNv6s8d`%vdH5!*5h{CCT&IBtMp^?-#kp0Cz^&H=bMl z<-In{10%>P(RF3mBpPggb$PSGdfUIJejBgS`$^B%7gu34+u*-GxR)7R$NjySFt8=! z(1OT8395~(u=r}cENhP<@+}OC4wvW>L0b@I{IW1h^6SyhH#D0Jz{nwu2=89TAKQ-` zGhBBKmcxrZAd=vK67pj|yf7mRzBT5poK$QOY>g_wFX-F$YnT1u?>tq-(zHvMPdCll zH{C;g?l+@3-^Gu=Y(xMyDA`4%7DOf6+*O)qk-dbEu$H-*On49Xn?CqABmVCe z?f>5X+s^C`5uVrH(vpr9lef;wSX*CrNIy)7D{yyHW&CE&zQI=+)fOBwWKu?coY9pc zW7Kn_!l-W63M*h##L;JqF00BItwkJPcX2jOe$4oR@^n-}`YMQ*_DP_K#l884iP+NH zxSu({4o&L~&7?kB=^=ye>*<83$H-G)y5lx8f@tiFx}1=?7G1=T*Xq`utGpGqYTYXw z++HGEHW8D`KC6c%TMXziK`Pm8#7}wWntM@ar=z@BH7il#nYH1 zK`vrAJJXrMOXm;tGc9lO>E}k%=x-03W;9j5nEU=-@vZ-X>n+}&-oO{}{_lKIsB;k8 zzkE>*3RT>Xr;;kgt+G3v^9Q?5hvhk{CY~V9HZ0Pae0osrvATd0DN280W8u3NW>xBr z(Lxg!_DQkHrW1oOvhnOm7%51Kj@}*1@BWBOv*gb}ajVBy5@+h4)1R{!Z(92NXA#zF z?4gsYHSPg3??_<#*}6!&joJP${Q%IC;a=guDm0~?WP=MC4%J227`%9%K}s%YR&Dr- zhL0lFh7-G#)%?r&;)n%c`l#j)mcHSLv7 zri$cp+XZEFBbXPXW2DqIhRT7WqK{ypbOmax=_tQ7;E&!%O+o%B`y&A!dgSYP*U0Vo zJ{ybC=JshDZb^=fcK?cYs5<(W`E0O)8_^nlLekj)^|iC5GDhK-nR5oKGkk8G0qSbC z2(GBRuX?(nVK3T_JeRWrQxZ0*=u2T~#9tMux$5~Jq)9y*#rt^s>Ps0Dd#fDxo{W*#qX*WAf-Uk<;ebJ_zLAoSy1+QI4`xA9HyIl zyZMyB+v-MyVd1^b_IhmF(XPYXi|~u94DlQWHMhdZb*t44z-I1>m0^~^yS10U-~Vv? zj7f+nD2eCC3DQtp z1&m_6R<)yNE{i9~`Fok7w=!m1SrMRkDf3j@RKJE?g@v!8;AV4^Is6V4tGr;KUmA^S z+2fx?{-&0SL=;OS6V)0q8cjxf22BHk8;<`_#H2$v}T& zh%)+drMBqU9Hq`dQO^#pq=Sj74>nnmI}HB{hp={-i=)cw4_vnWsJ-a3(=8_accOuD zZciO4EAZdwFENQum35Ffb`}{dxYs^Hv(@M8ocjh$=S&DCqk6XDU3_DaQ_eQh>3idn z_ezX-zR}o79HzZqE9PT&a%+VP8Dqo|Q-K(v!&axN8!1h2VT*b#C;+bUUggpVGPy7ebNOOqZtqk;}`(o-1!mBsM}+h?c53XRKdf~@UnEJ*@2i|iFodqc_sm3s$v zKQH)48)gUEk0I;*JG8gwJL(CNw@J^|^{`x>z-BwMw`WnF_P#LThlR~PXLO+xza({# zMf$)@CKDAP_H%iYD zU0_z$GP(O5#Tu_6g8G^!Sb`s9IV+2c&wg6kG|nH?p8X{4rV4KdkXC*=@joQOQ@#nK5A z-;JMyHl@V-mp@TUxwm*QJl;i*hpcIt!#OfJLA6k2y|@lkQ5cyH^a%@>MQv7mu+{T$ ziMpe$2sc7BfgGYtt@g|G*|D*f$-@A@u; zu&+JHD#~Bq8KQ1bYY99I8%X>tVP6v@w-LRw98`g0vYYsz*6*nHjW3%=H;IL zfo}@YhmaulIvr5I`Y%grSMLGrRFX^j2inMZ=|pXHpdH|%@%-}UUZaILV^cXRqGOMF zEXQP+62GMY+t% z{BHN>+>r9{Nxh1~r0jl868? zf&B$?Jt`!hxI`~TEr|u-=Y05_yGfBmnTdktT-${sTmlBt9aLZ4p5_@`MSm7)m2Mt` ztsi2}>4fGE*kXFpyr#EXEP^U*UOcwhSLzR5G^_P$UkvmMJLQtUqct5197)IWDfvR< zPvcZAhGq1~xkDJ?5t${DfzyC3=}30>+rzz}J@xOf_C3jd$0Tjp-GYhMQK#-W(NpcX=nbI zrA-^gPZzhTiC91d!>94p+v^}`Pn%|L&U~tEpz!@U<+628fyrLkd*m+eSk>XqCb#G1;N%D^Vp{PghEwd5yrWXmUQ4yOK_Sze2RZ6{>u2DV>G`zZs#8p(D5k(f``^A9~v_v7?Dxr~I;HzHb@ zqClr~X^-4i=tVOLwD#9Fo{-WZDeX^aZ&+r7>lDb+f#9)NtrbUVE#2j%zB~hm!{KBD zb;^>!c_i;_cq@K;D3XB7C)K0|(ZBz+<51+P;vRSDuj7ix;<*KiwS!hBZ_fZ8-9`r3 zE3BJ&kMn>!l1=7)akl+>YUNQe>)ewjZy5WdZiL=uBc=cmw*e87$+*H3KUVrPKc#f( zcp~0u4EdtG4DTLPDs{l;GwsPwl>XF7bD7l#99)bDnH19Rs1>NSW`$0;6aeoLGj(!D zpFon5=bvl}?;5>y|6`e~^H=ZQlAlk!rge*Bwc>zRm#Mu?`3%1?gI)<4;J;h*5X{+ILL(2vlGnyqr$m1hP&G~YjHQR$kMvq( znDp+Xkl(-EV|y>4&#D)D(e8}%fNOOO)4 zz1U<(bj3^f_rISs!QV3-LCvh+#EtNAyd8R)(cieNPbMqn$tC z$Kkm=7{Q=WX!Gga#ssz3(M@795Vt6kyz(Z>c)QqoicCIG+}ZKl2!B+8v5r2gCdq87 zJ;@d1NKC&90`-KTNJtPk+NBro(+l;hSlt>Y+&F2)|FYJwBI}kHFXKV>(}+pz#>3hI zik?*g{_ldltw}h=Zk`WEIX%2Lz<7i&p|dkl@*Z9!aC6t6&07l>wMRk>JnaoA#)@pt z$yGWRHttP>J+-X-w&|XgauNLu2;~NNXkXduV0zFQHZSKubc>*;rl-@4(S681TaAjP zfmM?WXsPAmX?AXUp)0EUEXS++v8yKM9(LP!EUyxx8C@C-28&I3SI5fFUVoI`h^SpV zMBJBIAeDJ@Bwx@#&wCW^75T+02A>(BhwqXad>uVl@MB3TJ6#2N5OBPB$-m{cKWRY= zrLGPa=us+=gJ$Xy`xeVhbksP=)fMs}U`oZ6IjDW`m$~~Tp+*V~_hdvs8D6&<%lU*q zZn6^ow9az5{}!wpI7V^*A5U8Q&m?*Bxt?(N zBGs~5HO{q;+K;T)K%lN+5n*m1D{7%^FhA%d=QAmNG`w=Z9q1syG;GM5m-xA6nz&B& zgYka@J@yj$wE070$|^&-951MtOA|vwXZkho+ACk#M>y9XxvlwPIzNO_Bq5vLG}TlB zz>(9f_CLgCrhtJQ)JxBwFSa1$&sk8*(n#n%D9>a|^DjASVip*}+Yc#{NaP0>sIrQ0 zPmUi(G&NAv5@!fkuekXh#I&w(aCEcKB3GuJe)L=$F7n##IFDt|W3p}e29iHj*J#I$ zYjuJaz5^#1+z6q2uhF*YgEHAcGdWDXpd7aZI%G>p|5S9!k`YVoXtfb#`fs`Ve#9B} zhJ`d0!u$BCbN<2Kdo2=%i7nHfA;|;W(3#V5#qdh`hBvvWOeVf}ZRL#!-gH019ytP$ z35YRMgL+K9AkLQtfE(8x%-)kij1mQjUWKO5Rvwa^JXLDMMoXMuDeR*y@tQHU{iH!B>+Yq2Gve7=(|wW`dDZHV zTH7cHfrc!;H;#6*iA0o?J>ByL2!3Y4>NwH&$N-S@h)VRH&5e|6fI8v%aN`3jtMHE)To?%6SZ2-79U7;my zUmhr!OH&nFBgv?!DK5NM^ECS?}3r91i8^Me;|F-49GNbNCpyV*sW=-FE6!=o_)&lx5=3TCtD_f#8D{XM< ziVBH7itvMX@9=7hd+DoL#YPxZKdh`%`M%8wA%CLn0USqHNZt1@jSW;HPzD%+-nx0D z=iUq54~9cmXvM(8e>8QDHFd7#Tq)i`05HVWOVVF09!Uso*zM5IWSeY%BTgD8&ds`i z+EMvLh~W9}%*GWC-M3BTw(10>OxFiq(;Sz3Y@)ZCTV4D`1fwul-$V98O+4IBc*=FA zd+&s0MT66rVUko}O~3}eR&*}{J@D~mMq?R%`X*AZ%>LW;9};;cDIIZq0$`MAT7c|U z*5mfCl~YhLpe4m6zQSQp^@Ueq(;k^iu1S7^X0misy4iJO;Z~KPK-{ihFZ`Tm7ZI(Qddne_CrLE=&wTWm1$ms$%a7eBRm?`jxl5#ST1g0 zddIB3Iui=4J3t-Z>ql*g;*RfJ_fa_`Xi?wOfJpNkF#1gTwVTcPSfi@X`s= zJ_POxCe_oAV?;F+#Nsqi&oQ?{AU#PQO>lwk@9gK*}z|D&E&qrVZmO zZaDr>#rf zT;i~rCvk>8yM01bic7s&KO3A@5EIZ}@PV~%zev`HaBc+j%%hb&!GmQS4Cgj1 zz$J+EYwPECj@#aVh#>nOfSu?^=(7BEaKIKE`~v{Mu2=cy?fRK_Fk#Z?nvNS0Q7~rC z!YCI`)&@fQxZn14Zex!{)*5Jh3*xNR*wT7}tqfk;fvWu3vzxL+CjhWjA^n1?m*v1- zGi&G36UkY=2xDIN7GERPRX@sGZv$kUz=UOZ7=#zTiO9>`b zJ;dkssQJ}i5edb-#(HcG2`^TrO)9*R7a{Wgh<)iWWx;j>tir>+++7}2!%7G}w8;)E{%KfyJAL4mj;;J&hD06ojX?%LnJo`#Ro&S*s|sAlaIM$+q>z)Tc$F${!BVTBvl4r1*`;M1ovEj1Nl`FcVkHc!$zx13917)U!`8SGKmmeLcC)YsK z-DpM2Bxil(i1p3H-&L(0?6xN0abMbJgjHlzM7(;+1Y;OV#%VkF?hhxExYg(br{c9X zY_-dNZ*$z0^HXFnI{MX8#4o<>1>xGX|LjiW?pd+Ap7ls@{jPnb&m^2^*dAo+Mk6RA`7QTFg4YilPq zs&yw_Cg@X~h{YsTp7+xcUFHLt`ymoeW9|N|ugh)O!-o)*J*}cd;pE`{hJHtZN74a& zjoZg|_h>3xA%v*6)P!?nrjQ-b6YiWOWb(+aZqxEOoh(#| z?McmffA?~C&6XmQtcOb7s*7{mhlw*eYJE19t>I}hZOH@q^^bUkfTrmH&0~@Hrh=vgYNmhj1_S1T5=6VIv;xyZJ$>x6D8BW#dw@G#YRBUhaxOG5Wxx-8!+e zDN2@yjG8H0nR00)6v_Dky0@{F9h?|qAd~PWrdupMHgL>vPA$TR*YikhF)KqwgA^#@_y?(vEoWip1XdAfN-sG!=YcDjE3bz67Co1WvOMD z^O98B@^7et$l75o0BMYTTZfxJUA@d&Mb^_?e>HGVR%$7?!)=t0w-XfWNuk_rXV0Hi z9noXPHF?(5{%ZAQ{UZ4^?Z*Q7hPVM`=@9K9GnjF*go7{|w*NX;;`L57m>8&pL)fs{ zjqH4eYDo&cAYgj?vD2r;0|r&UJb&%l8%0So>Q=4EJvvBPf9Y?N`}pQf>HTTY8SBXN zWL&NMJU!kZYQ2^Ha`l7Ft{!?I5W5$4iUtJS`Zm0o#zJK1HN@adAaI=zF%nM_5l2Kz z)SsE;1B~sBidQC?-2;a^i`)4EwJNsL-3J#%-CK6vEsg+eX%e`*l#fCGLqGb)IX$|A zwy37I5 zQny&uC_#6Nq;~}Nawk=h*LX*LOaG0ph=&bvbV8;b zvud!mFiaZraE{HsPT6s;c6VMp(bz?k$NjmVavQmJbo`59nQV8UHgHtiZBS zE)7Ip$_71N&m_^n1m^O!bjl_>j6-p?I_No=G=4R4J+k4qR3j0VVjZB@54^Qooi}B@ zHSigwnTG4pwj~u24^?j6Yn4e+0ykHxZBUoQ?vYY0uwD`Ku>!uV&B=S5Z>-8CwuN$u zZ2bYlNheTR7=6Yd!e)lH;Pp{S+kpBx1%24tviqA;0V1sukJ&(LjAKcra(i!;>=9ZoU}(XsYYt)AY@qT&_4dEY3&E^J)rRknUz{8| z@gMzBX!uN8K%Y?kg|I2Jwc?|4H%}{Sydw=SQZ+cjIzL$Jrd+i9OMVtM;Z;t`F_%Yp z5dV-we#EZe<}LQcf{<_38VSXf`zE34?gM_VQiId?{4?BNAGIbMSD-4Ro) zBuljFCbB}9eDVu4zPv1AHik7UCI}5BoA5gZxk|+(6gKk85N26zmAf3k@5UCM9I(O` zhM@KuK+F2{i1!cf#F4Q9DcH`sisBwp+Bmex9marDDw57{o9hT$jRKfH>sCU3`Nh@Q z2H4OICm-iI=crl3$G&%*!!N(zCof7w6(zb0SMy}M^fqW{uSJ~M>%^@=fF~rT-mgV& zYhi}nX?GLxaAh^m!jiIuY6MZVPa#})!$_{!U=noMI2=)BX!1O&G5U2vqE1%p=-j=s z^KT14gEGj`3#mAVhQr=q+a5BGD&3%VX=j zFIMzC^?c)Ah?^=8%U4WYj&@!rz&pxIaO?1^y_2@xOmCN+Z3l#VDsnnpCO=rK!UZ-)v0dt4~>tE!L=UCGv5f+*U!_~qF$8>KU2>++<_vg`Hc#5>emgW@xo z?IH5XPwPfY@*nY7^o;g=p3|41aWO(5dvpu=ZK@H>keqQ~l=sr3?#xSWng)`)_4g;n z43gRRVV6p$+UWzRdPVnV6grtF zE88IvcWn_1qUxfnO)dv_2zf zf)&wZ>|~VX_z-gFr7=w)XFqvU7F?MzPy9SHDOrx^X+9+*QR!~dR&#e^+`KK>a^zkD zdi6$qiaKE|F5&Jlzs_NrYEWD?Jb4Nh4t$lf?NG16HKCvhg2PJ(PAwwnQ&j{-_d6^= zxvyrA`>=(CYoFYDuWCFV?{I5bVrKHxaAl$W$^ zBqT{=LLwyi#l>4=N-dU>v^7$$+FLZlKN(^YvbLLXX)m9zeSkV&oeOgIxKS@shPk*# z{fM@JZuJbBWV>|p`3vPshs}`P!1QWBwkpkIPzTS=-?FUWK{9}JTgvu{`D&|U)+|e; zj)~^v6jn(wWv*oOyN+03vSoN+Z9OWuoTf|J1-7Z+4c)?u#_4M;o-|h^k;FmLXIacj zF2Bob#%myEPH8HOtQdqt<}~7Nsh&;cC$Lz349;j-&UeDJpSqQFxL$f8RB9RF-Dwf! z?Ff<)X8w`0(WiksV%SycOKFxZdaU`QO=m*CedV=Qr4t?mFwr2v3b~wNJEi9l?Y&1a zOfG4rJ~4@9IQ}9>*i>?HuaJIr-CA1iTx-BGu>qczYAhTnPU5?ye`;UY@oNofD=Vnt z&^28H=DQ5=Zr^74HTzcSlVgt#P7O|VWUJ^LH|9Q@!is2i=}OX0ZtrCIi*(H$J83I? zmUPueb@@g->*3}Fw+?@a{C0>S7zMwj!omiDn^Rn7D zxww+86AWQ^&_Nn*6DF${%x1&H#q8B7`9QSRvY8{y%$aj*6T?e=(*m@Q6F|(Ljx4cI z7WpQ>;xO=`o79{8sGo&b3~r}+EPiGk9;k^&jBeZ^JVM2zQRni>a5q!B`}a_Gb?{O z?6V5$51B<3aS_S*sy1O6dTV;4_eOD#!n|J^8g=V6`?|E(j2hp0an+l;b2s;0=VI)1 z=iSOw@w3TSy!E^(^ri`|JN8nJCSB%_RiSXMCE<7^hKJaW3?Dbh=wdt5jP=(v8}T1M zLTFO%&8&anM_O>bzAZOIj_#xOc0Jvzz9<*#-f8O*(48{0-AAhzv9L|4OH-)6w%ARWR!Fa6~9Cq?lGNzEdK5#ofKY}^n&p? z@NlH%&bT7o*St>7AIl@ubxvLH>+`Z~kKj_4!A(9Zxo4ZLN}=Rr?OmwnPq^ZX?DZr_ zTX>)I3zG4v&UO8El+|%+o4_77rO$U$SiMa@N6wIwMMqsos_TU>WQ(53M;wxL{L+4C zC9yFu{T5p=2(h;8I)m5l$g*bUZ7iA{e;jqjn<~yiO7tiT8RT z6DYgnzc}Ub{IKi3LhqWFf_JCxtwA<(U+wZd=2%bgG|y7#H$*@%NaQ@2auK_F>Uq1* z`qt(R;#*G9;(G5?b=O{cd^K5*_+!;Gj7 zd0}L_Q!Fxr2ru2m=)BhQK5V<*IMNqK$b-NnNOlawBb4G9UF$hu|Yr$%`<9$t=FJpXxnHT=+7 zqt})@LA}{oy&bj=rV~w712GaujNr@Qh09d0JiW!Pfw4d#@ivucbIPj)majcm>jb!U z+rQ+$b|fZpgzTg{pghQ}I{dZ&{QLrJVX~cG``+c0!0OhIMC#=f+JmX>VeplH!sAl$ z^lEj&1iM2@mQ8Ej?i*LO3tBEGUXZDqvuc&m<0guH+g+&4iJ-O!p0azty+2itUAR)z zl5=6CF1wRoBPg73=%A>jH5R9}2b;z29lC^R%?tT#sC&xEY25v-v_}PJa%!``%J@oC zindCGsMQg(>X$DRXqdlvT0IH|PF2F-*F(n;yIwhZ*CAE=Fc!!-FYPZOktIEx4vZR7NzNJEncDMEdlrgHZP4m-a# zx+->v2eh5oy-#qK?;^7^u$$Rf`qolfOa5+{d~8H1_ikY>?A6l;P%=-CB3G8D-V5)h z`{mox0rFidW3?=1#Evj9%wd4$4zc|Ec%SL|_3=Iyy^Gf>B^i8RP$R9}8WXgK>HnEM z+(4a5u&8nNA*%?)sWY#g7Whzi&U1SjdgWp~)a!NfNC{Dbabo-|_f(_|=IW)RvwSai z6ZU*TkaZ!JI->u6*os>BISZCr^93~WM=^ODc62CDKWB#ju-fE4-s|`wJJX5JD4>8p zv-IJg*gVn5U-)S-2!7rFWExRHAAz4 z^g`!&UWq~m?HxDPOzc~jLBDWXVp`zNxA6!*x2igL6;T|E= z==^uD>R(LS#zpe?oM=@<*(U zC<3+usq5)_qpVMj^K3`D9tc8=294gSj+d!~=2iU`Es6zD2e{gF&2~5Y85)6y&;~jH zzC(D91LM)ap~lOHYW=@pUsqp5V`f}MhCE~3 zR_cP59MeqW5PWF#Xt|dpO6xf^OpQ~huUHnn(BVBCG8?+rgbonjiL){jtBScl@0Z>=XQpVqOi+cl)%R5^Seh_`)i>!@+2fC z3d%NjNea#3cm>Ps&pG|!x!UoeD+(GOn=5_6)O-$*y9<<*DwQ zBrE~3Z8J-;iE^4|J;$2Y_jQ+rH8>s(Fa5sCe zr>zUugwV^&K_PXfeVStU*YgAq>@$y@Iu8w6QlO)NmGMq50=>E@-Jb0bKG|KMznkq$ zP`Wz>d)v?`%Hw)7&rI=OgoVC}XPJ}5YhZlh_M7V^4%`4)uh)EBTtf)L)62s+Op(`m zYt+gSz%>i2OYi=Irf0s;hy)`^mlEJF^aST@R=8~U@o~XlXx*?ob#ylIcKU!u+NT$H zKkvQt12CI;gQ(D3iczIDAw(N2oeoA z)F(RQ1kg~kIyKU~+8ba?%?ErvqagK0Ywg*ue zP7rtq$$8NGL*tP3=e?=jid5H#J_X?7U3WXmtX|1~PP25;xEw4o5 zcpVkbgYYN%3d&E6Im6mI{i!^k8Y(P9HsbH?xgg2ySehE3ni8f{=8cu6S+KMz)!wb! z%z>YF3mDohRxEfvcesJ~_YtanYm?9j)rR6*Sv#^J8@&q{DBVYUT5#~`+GkCWebNie zdYs^8-0xor_Hq#fsT$soDCVC89#+J2f9Ojnu*{O{IC2bUPaNOq0Gw3;7K(Aktxy%h zk3q3_yq*94pjef-h-2f`vjZ{~k|!Z#6hoj5CLrF9RxTkooRJb?U{=DbBCZHcSzSD< zP6G*@Ah0S02W+BeMtcesp`wiykn0cW{S^Ag@j}-_fps2W`8-~r>=_|`{0lURbcG+d zJ%QoS4BS@4_xZcIvIJ=UZWfAlN=^`>bq=s9a~|h76(c+rj*3DjSPp1_gwtrs{DF4& z?p=W@M3N+e(`bdKL*5-b27L*5Xy(#J|L2L;^-Q2+YZkzN2>9EO$N${~{14IoL$v>> z%Kw~iznnh*Ip6+cl>9$zl>F0~##wB%Id)&}5g3?Ir2>=QbJZN0Cn(23grd{EQOEvh zJ)5fE+g{H48P@;C%^q>?^3!v`8rI+i#vXmhzhvww4qz_nBpn6m%$po#D2#3m<*`RQ zTdqMy^&UkuF#g8HM<4&uh-PKFE@!`UPSf?aQ5SMg$Xj4T`Y=IuZCU)kWY-3-xJTpZ zhO-=m=}oULE*!^MF8YCV#(L1XK^Wwj@wF01e-Zwlya*6?*{>cYzskfG!Gh)c9M20O z>>*^ri~MUQJZEuF$`W-$_UO0|ttJngtC7c>@qZ`cH)mc_ob<$vdt{iFc7gQ4I;zK^ z8xDvghoBJYIwk(`9}ZtKTHZPi_%8a|X9T7j8cYC3LFb^D^s9d@Ce2_x(}=y1*cz+E zQ3fbp4Jc3fzmMu|?%!^d55HaWP0$+8@S#OX5rV*Qmt!C5paHb^cg$d997Ik9*Z# zUk0~`hTspKm8CJAUyDL?H#$wfwg%HZ#x2c?2El{?D1cwJ3;LUNwCb1Ex2l)My9S%& zv|H9>JzU7db+y@dlgJqqIjA29-aGzOE7a?Xob$dbN%!x+MR|1dr>fYLTP_(}B)8}+ zHuFDxN<)?LW#GP!!0js!Wcvgn@7>?i?xOgGZJyI@R4uAXDpTqdR>EPl=j=jsJrm93!~E#b>#9{a zQJ;8&;c$i&J_$5;P-yb1#(hz)(N^-{yJ5!4AKneEM#yQT&8twighm-NDpqU5`AQ># z7obJ;E~2qsLz;t@xP*F7$1XgFZuOXMD57_Cu1|*gKnM0-S+bq$L<=lfT#jqIxWX_6W9+TC!nqzyXQx^-Rm+3AQO+0Y_gk+XtE!KDI1U>aPM{-)V-HmzYSGW=% z&M)=6oYI)LLN*Y@;6?h)8q9zoBPs1B7@M4A1G#q(aSQD9&scxdh*8^UxCAWSNq_57?VeA3%t1Q+(y_F&EJM~ z3fPUg#m|3?KkC`=vPknai&o5Fmky2&=|ai(5~Gxf_8tkBmW6$@h#(;5N1}s*F5W(@4qUY54_Cn9 zycT>3@|RPTdrCAtXzFv-noJUS?Gz(!YiKjhR*5q9c8+?_a=Q8@p##99lgf+9153V%PG@*EsGX z-V8ood%$7Vs!0+3mvGUwo4erw2gbv33F20Nm7=a3Bc4Pr-U^Ud5w(mr9trPBIYEiO z7_eBg+7Kx^!W(A{W=mC%@yuF;S9p^#3b7oSwFr^We^A6W{gpb+0Mc{oA?FWJ5qwAsgrD8 zSYRR+=aF8!cC*#5l&r*h)qe<+bKYe0mQ6OdBLKuZk!*TTS#t$N%PlOm6LT_`#Om9Q z6iztV(VPq7o6V{b|V;O`kvQe}maRuC1Y=627&V z@{p0&PR-6pDUUqNbNx@p!b%d1WUEd^8DhK8^Y0Sc2Q#|d8=d-}RI;(<2tEsoXUi6s z=Bh;Sj`6i4$StLB`bG2GIqU6DLoYuy)g*@K&T7hnUUlV^?5l(kB;|Cpu1$^m@bNvo zj{#5lrTs zy!*n@K;wwcR$@*zI8D2~^*tU6l4r2oE|w`EIg5EW7OZhwr#H6@GI)~Cnm;1U6xXaS z+w+g>{8^`%6)k z6i&LNfy#jPBzhmL^z361FT6i~nUiWdKUoNcGEWbZT2*0O3=K6Q`39z_DUK~xq)OdK z;PsKn#0V|G2keC0(iPn4QEU;lyDQ@=D8~t5 zhuUd|>_PXBPMtdAmpH(BL{ec3sR2$Px#^u4uQ?u6xs+#Z1L=MDio9_Zsk?^Y z3Z%rEMOHi+}p6iK|bhPwWJUJ$*a;<+dk-f_oF^4p$;No zx3|X>qISH?J5nKqK2wgZbu`1(Ru?y{REfq(3zkbSWO<_s4T)7Rr^KLpIpx*>5c76B zxWMP%xEwy)cfC@VlAEN3g;n|zI)+{uC1<;S`*a74sacFDM2#;?_dTxW9BN;>xy-=P zsM4o-w}eRVX0c>*KHC?2cT%szw)ccQOsU8B`I&t8r}_eRZ`|L`izOM!_)@`>mZB?4 zknx2F#k0O$Ff$YtV-7A!>A2LVsrt!fFNAuQZzdULC)Hl3bai;TEuuR_i(7*avM=&y z3q{YBN(m$s`W zTyQFsvvH~xO~m7^yiW+-dDmU#LFbvI%8+z8j^qQQZ1w$Ui=KKk`^6XAtR~uz9nrTv z?A&QZvW(bbb`yL@U0$axyK}n}V#4wytF%Rq(L&4fZ&L-gTF#^=eJjvkqgX(^f0_JJ z?N1m1=2G@@wufOVMF71eLp0jzRt05rz$7c1k5pQHS)A@_#LzcjE?E&2ri?T&T+?XL zCw0A|r?99~ zs1NoAg<3HScOpn;B~d4BgyYSV>Qj$_dRv_Wp6QxHPCNYVKr>d*xY*HP z+p7|!WWYnRT|-V@LLBAsPfepv@_lrFSBOW<$x~$$?xddZUk4sojGb+#JjvV)5q_|Y zSEALBTiWf-vmpG5=yK9>K2)0ng>kq7E{WNfZ59e$b6iAC0QxzqZVA%8Iwk6Hj8$qH}!Dn(<~6@Xyztl34Fca11r$!Ny<_fo>I<+G0Pi;P{TV& zeaFr-Ty|_dobv!O5d@4XXXGiQxhURWgAH}0$J#hkd0P73&@>^R&zE7@$&tYUyzF~! zOMs$#{OKF8hQQ0XbvINO+Ok`Dwf21BhH5%V(g3O{jvIE30{Y@Nm9Lt6^%Y)2aRW6F zrjry-gcQ?13v%ob88=gS;dYYNsuX*dIBe2}xoBKm*AF=&+f(Qki=jMh@2Gg+&l2Hm zmZZ9zn2_id7?4V<6sv`VITSlrPKS!uE}t%itp^;W`(`KlQRrnBlexD@ZmDJt-i+8Jzg-xURf`FZhT?VyMmI^ zPj%GV$ZpS|ucSgH#h~x=)6TSSpa+i(9XAM@w>HKaV|%km99`axPnC>s`ADJa749-F zYQ?vxGXsiUHj?XW9GV*9{0+4Cw)rps(KYyV(Mod&z}tFXt%E5!Kk-Cvf@VZYPAm6( zQ(Yq}=OkCDqLRAy;3%*^=z&PvbT#D+8~Gw)(#zEP+w0q<7w12w%2P^n?ayAmJ$W$l zulA#p*}d}8*92dYF683Gb(8)BSGqo#oltvX6)Z(Cp6cjI z+!=tqr)H7SV^qN2TzAt`J%p-s1(f1)kzJ!2a`UQtEAw2!h@&3Z*Gr^@xuSG}o{dz~ z8LFKE(`Cxsnx+o3Vf9p45UjPDz|T10-JJSH=|583hgyC;1Z)_!%Z z{28;3?~|S1bh76~)l!sqy}q0_F`Rh=*I-|2mR;pVhH(EDa_cJuFQsAY@jCM;24sXe z2oSX)dw}=m^pu*#pPqXt-Qf%Qe4z|ItJ#s{5OWZ%$S1ucUg}?q)VYj5Ndur4x*r*f zJeqa?By^T~1JLm1SRC|RlX`pGo1i&uSmN*r#7=zuTM=Djgl|t`zdE= z7N&C(M*EPQ`+0Cu8da^RddPVt(#zcK>c{Wp%$(VN2^dtjS_26sMGKz{!}4ztU-Pac z&IxMe^f(&20%q-G=0U|G<3*ymb+QF-(;uXeS-QumWDBVihvYj57_g!!BcLdlh|H_Y z^&lePA0cH11;Gq-P#IxoQR^;J^k3+G*xsu5Rhl|b2uxv?VNvUWj`~i(uZy}sKE0(6 z2mGFPyMzGkN)NuT9H7IOdd=U8Iqc%D)|OQ%zUZH7z&icf#ly9)*p0E}{ao$koL=Yi z#=Z#45I0MTtHst9OR2CBud*uzz42b%+Tnp7j8~=%u6c@6$~O1JgkE;;v_TP*kx^qd z`hJJqE{oQ3^e$>Syw6rh{i|vj7@5=rwmYtZRS$Xtb?@idCX+ig%a9=~8H%6rii}|# z_R`&`HjQG4WBC*d0wVHM6_g<}nc$zCkW5c9-(s0?*!wOnHpg}9R;)g=Ck1>9$+3q1 z!cu2*JE z*yQ5^*{Amn=E9_l#^_4VTD!jKd2pAgzg_p^$A%+_z_?$ryI&4=3q;8la+PcTS|c`nrN6 zM(iEiGi{iT$9dSvBNkO}A41x7f)M;r?}OT41?T=z5JBt?{&+&QW7yfwM6vpAXDxaf zr>dHrLn9hAN=-X}H;BhC7aRvi&|BXzpqi~Z-#ZIiTAzTNg=xrH2#DX$ z<|A)_@Vk`kDav{QP&;jkWg0z4lIijuq&xgZip&>SYf9(8YQE4re+?qIH$-r8rwe}| z_y>sKwoyz9HTY8Ex^0wPcD|w3eDtC} zQ|R7-Ny{(1X}HrcZDir~)#l?jyk1dc6wAIP<0SHmD9b4&26^0LN!mYmAizi z^j0fzBBQJN+tg=n9Vf;N?^omytRdP3`TLPsn&V#jE$d!TEVidjI$=)U3WP3tpOj|kMWX~5oUW)djS=#v);2CswobB?~S9R|m zSnEsKF z%_oBgfy=Nr!(H=gxMrtnY#hW%&w1E_4+Ht5d+h{{nEkx~j6vy!G*!fn8E})1)0JY-_)XwRvcIJOjJ5dzCfX~~G zcf_Z#cfp)*XloQ1-ABw*xhH+&k%u|tbjyGsqMwLE%VfvM%b9q8m=;+~Fy1v;od%Xf zC%TZe-JCJnv~-mxtLB2-@-R2Rp+wG8y0On-_g}9;5nOe;`(iSWG05z$3QAGx-Z%)& zZcMb#3@TGVd<#Ul5X4^aPsDR=M@YWhT7VG6;OkTY0X)gcWrhc*Q+{s*1cd;tAyJCO zWnGia4SanyOv~wQ9}*ZVk2-COg^nA4%&O-frw_lp((c;AZ31!DDR3Xa>Enr^-y$DO za57WvQ9J@|SK*5C>!veYY3&))K-pDL+DmKMlEn!?+jKO0c4c96oBO2=`KUr+Kq?%J zj^2-%4|XvEoIeC{zOlFYA2@$IQ0h|GXZ_W}mwX9OJ}7@kg;{#vbpGJW347;u8$|WN zmmg8&jDob{q>-eFPKLLzzHIiD zrY$guZ)9a^05?r$9e0lb+0S=N0Ha@>7V_I}Qzrb*{0FGr4n$IlW6U3>S+QY2xmvC< z-j6vseQ-DIo?J1RS)t6RfY{n(1s}wCVd>!g@iu1T)O&d2T2J{))k)1#}o~I zH%M-PsI-qaI-#Zn0&2c%;?K)=0Xufru|B-Pt9M`GIXc7{btt(&kRq!@#1KItt>8jQ z3E-0(rvMjo6;o^f{#E1+RIk*dE+*$%_>Gr(*@uPsgLjQn7$6!!3|>Ud0z~dpND1O0 zkVWmg=Z+WKgS+t2uf@3bv!}q@xf%Aq#AL=IpXjyA0DAjB2YUURg_S7S26+A-In(DU z;K{OYbdQEhiFdLd=>gSoJ^CJILGoGEaaQEzi#CRAL_5gdC#PakDp|@?O#Md6xZS%J zDR~quhCd=g+iETkBaTr&2SFsC{yji+4^6#i{>RsBy!dMzc$xIMeNycrQn|us(g*f} zw`q{2)rZ_jHb1GBsCn5^o)pOxc^Q2Di$Tefgu{RVEY{0m*yS#GzatYbVd>ge&B}M# z5ah@BIA$$4BMlRN>oJPt1A5V4>I^4BaNURCiq!`DZ|1CJ9t=ILmuj(u)?w6#0tV#U z!AY2P&e`m1aeKSuNwC!$ixcOu(?FQ8JhOloMLJgN0hSVNh;-BC&05ix%==^A`=E`@m>xlE*j96_wiyN zpjzLBLFD-tfm#AUjU`in6(wnMWn4avn+4h{3oA!Aj(JDhOdbIo76Y*AHev20KJ~7HT3$uu3ZOvS#Q<$!~?&UIP1~BMi^~w6@(7Bl0J%$ zowmr?VBO+;_yD9upP`A_`22^{WEFhf0o=+ao+2Bf{pC{03I{t@KBk%I64X(r0HE(7 zuXZNwTWr!VP=@|{g&82DIu$kjTV(8)U&qBadYJ(;6OgLYLH!j+-^~tRCC)T`-^+8E z{#X6f|p4jLdKVyTnxPN^wj_Z4g+}H~X*vo{p9P#&jePf-keeE*4clW>7Ep|3A zV}tjt-6^Bf^}95K_U>{PfM5tpEz#+;VOee;js386ss%)D%nJuHRLZ1Xh(|g@=-a;q zXbv1`TH&aJ*#crLYJ$`mBBEU8CBZJe^U^rbhJrpB-QE<^0XifteelF*U|Br<76P&M zZ&0Mn1B}D*h?JW?^lo$CK zyBP1k`6E1?R5Wu8aX@!m*lQ$iu!S;D<0ASfaTQ+S&)Q#(IwND9UasS7EjD@-vbu!G zU{Y(hb0ULAmFPa_oC-ubMm_&pRttpmtmijKnQb zH6OXQm$(b$-GPzwVd-P%LojXYN4djG;pDY#IljYk;sVBp#AV_3WcGPWfA>dC8>wf> zConMCF~$dGwkXh0KO-I^As}^=aJUR1ZCC%HTt`39N_T_V0!yU53r}^eVv;}kSBtt& z;5EzMmct&Jsl0rI)IE;cDL1T{G-ob2Ps{VI2}`d@z(LawVa} zG9>FU{2`TRMA3NE2jcVkU5)Q-_QZhr-G@7+_dl3cz5Oshj_efK4G)6!;ToYth)w{3~n@7l+lIOz1uAX7k-oIwnn zkk;#WFs-10@39(FghJ55kt~UK2RWo_Ye3KRh#o(DzxjDqJh??5Y69L z8vU=9FTDilT4y29GdPe_6;+$Wh(V~u2p`vHeko*l=$%fC_~q!6*&UI{%SvnyhZfqe z`_h&D)t*__l-T&Gy4sX9WW%H2e)Hvg`4Y{BJhLQ{0v>9cw7*ptPPj*x|L= zg2=zv5f{vlm#xTomT(?ehF!~=8JY@?T76WH+T#PO+JTODP)%K}Kn;bgzC#VyynK|N zeq*&lc=#D+Wp$;T`txuL>2LlJx=HdFCCG{a7A&5F>R<>s;-g0M6tChBw^Wz%&M~ZJ zSvI%jiq%<}5topUOy@~>&DNbJsRs@w@08^;wiEn>5=W{ft~dpc+nh!BL`fznuZl&* z7?9pQ9P(Mbx`fY3!FTi3bL6mWAg*N`35r@W95|<}JcAfgkK|#DcT{jP<5bB~kI>FBa4 zr|q)RK|N=j(X<_Y<~vj=ti~afv-UTCxUdp>jS-8&gZ$CveVVMqr-TK9sEHHTO5*Kd zebhW{{2Z=wqB=A1s5D8v*go7>OP~sE3{U)0!8IcO{MeFm`)Uhky*G_BQD9&;Fh*y*807HeBs27Pb6dD4ngoouwRYhRtuU6*B$&pOYrq7_5XpCv8Wk~kuk!>v}| zdPPQ{FiFc(%BM}p;EeNG-Pb_B_eZYG7r#H0sZ2RG6Zf=9qd^;|w%ij6e@*2s*QaW~ z_yU9E+(3hTWLOyjmLWKS-J!rAh%o%-s0X%%2oq$2D4a?nUpEH!D{mhRePgW?1|5c5 z=0V99YAW{wdEB}tK)svt1D8|Ni1H6E=UXV)lEr+5ZNs#P<-Q)J5i$$h>8-`U2eW;9 z7PVSlYC_fu6BLQI@4Q$A_VUv!w;t!%0j#xCa!!hy%LxN>(96Ve&&Gc@SN)Tyjz9+25M7GVqV*T!N+%C#tOiCUOY~68-I?4LCkmGasMw*f4Knm$DOiU8Nz@e2pKtT&xl+{ z&-Z<8eR!k-n6KXwmJJyc+sVo}uScD{oSG=~GcW8H+Aa^PKOG2p4ejVC zaD5fXs()1%-(Nlqin((QrV_H&e{(&Q++XuzVs`T{A>?6*^`1LxC<7GyPq5zmT~zK3 zdm;M7Qh}7)X6W;G)ZM`d%2%#8sa@D$w0I^FH6?0piC-Qy<>naUJEcbn)lc|@g7q}+ zEBy&rW&mv06mmljufGDC^iiHu^Dp_Z;k^LZn2#EeXYYR>$i@?CO%e30`7VbN(65;6** z-x3)`)W#7B$9{QQ&K+>dc zZwW$s=erB}Fa7ky_eZyr)dCeI4lWbe!0S^;<87u1w#1Oi|Ixiz_YU#c|xbHQ?ZXSO9l8jk_ecvo)n@&9%; zs?U(dvm1k4B7hG$F|b^FuH>%|`$OkNPuT%z1txuPUTk>rzr$Z_J%AR=+SI?vW5v|_ zk&6KhKHrH7eTel1``axdwjSy+0pRZYXu-6uPJel99i15<{B?##yKB@>wiLp-Ufo!bneCu2;k5Q0AQs9$|wGC0?9%ESAM&)3Gf;X0Jyhl z?=Metkjul|x38}T9k;LbVShN!I2=t9g12S?WCIaStTNpMbtj~pIc_62RP_eAN~j<^ z=uL%=HrOa_A`sytHdmW}wv>MGkk2yN4DKt5`qV9JgI+iMC~P;lkQIf}-@@b&7cirQ z-9~>7hM6Fv$g8^R47P&2M^Y{L<6YKe#t1eYjN{aV{%x zzFc(2-;HH#20uVZWBF{~huKeMfl0cnPZ4VzU5g|`Lu2-#bF4&A1B_*R>*bMS86IqW zHmoOS4%3}vs0^Rda__A`xg?K-*80GZ-u8pG`b(>c1k1MiHM?65AR;h-{#a_ z`!_xso<@V1pG)r&;ZB*8E}mo-zHHrNn6<23e9I@-=~t#`G`D6Nu`X6<13{8c;G)-0 z^9d?6`&QyT$It5g=v4UcJ30RK_K@c%@u`VgeN#L!TBr(e-Q1@IYSB8x{vJ?PmE;UUYC7y9pbT)*RO0JYHA`h} zpmCI(fi3ZG{+P~KM&DF()o)vSeYRDA1d7|Q;sV0aNho^DHz{z?2c}Q|t++_SNx2*q za@npEw=~kkw-2p$vdCt%HBz%c3+N5=Xt?t1YGJh2s14rOJkn@+7Nd~pZ~z`{3b~?j< z#g33RP#_ja&y%k39<`(eF(N8cRoG)?>1~q)9lB1eXtKZcna1epRmsl93_oKit2K+U zZmeO07x6l&mHl{Fb?>Sqg|wl=@bD38&yxTl1gB2T2g}j#{j0@asA0WU^ADMR?h8Wbcx=NeD>2!xkD<(2Q_wCkBH7nfHxj&X@T% z==W+cmysMhdWQWMdoA?B^|!G|D*+$adKt3Z^{e1GrBhK!qWtBt?`n87^I*sLNKrKgB?!wOod@SUNR=3+KuLnm$7{PHYA)dFjxnECZP%#^6b3(ij z*Ue6=`7T8lRTU^C!PA8!=ui9v4-;5I(Pll5v9(P(2?}!Qu*~kz2*`Bc76w_?dFQ)7 z`|CffXt^p1Bj>*`WezUANTX+FD&Y@Qgrx+e7E6kjY$9@o~|-xcG+Ikb@iKHSq^%++`cnq3zs{OfIaT1uKT%-!RIb8jQGt9 z_|`)*p8+zTiaU}6BWdePKYid$FWK(L#=1LY)nc{l)XekQq6PG~+$ty&3_Zo+0NjVy zjAz%)!>z9?^8sHawD#Rs=#j5H;E8{7^S@h0yr>d^=iUx&ZsFaP+I@H{6s_*s8$`oGA^7AMSZHt|&Yt($YS1;EfVu`^lvLkK5^yazs@ z1hH|TN@U>@pBo{BeiNAMdw>Dc&{@t7eABt$KPnu`WE;GtD1oyvnC_ccJ>ta;nd~gf3L=Y=!vb$3G^DY5c z!3bS;`=<2%*Y!OK34o#XHiAw6T^#OfK}n`dyI|q`N=}w(?pPEF^r#Wj%?ju?A@PCl z0+Al%yPN+YF;(@6^k?V8OqRJF^!V?TzD7RsV=qK)eGmBYKujGlNe8$1|7Qrvsp6T> z^nE>6<`X7c%U%krJ=(J2Hu%5+M@{6sAN=KIQe^d=H+zFt+rd$h!-NNQy>#J5E2$qG zs|H?rt#_+z^D%*l6W= znJ}Oq{?i!8&tK;aC;{cd+P=}j_mG04ww)il#0{{?v*4&|b4CQLKY5)A$XLKRf#hR< zf^&>%)v>=F=|?$JaCT{K%c-Gq1X`v^^$YxG(FxVO4t2eAN7^#qvXkWbtH)IBm8eIf zh{G~BD0c1C4nNz>PwlEqhVWcxg%Vy!mkqb*y8OJzmLyT_d8IBl+xS4rc~i%DL2P5L z?zhD@v~t%6UuW{m(^~nm2FE^974IyZH-9#PU_B+qCPy80AK;YnYUVAcTw+V)Cs0Vp z1n!5!mgz_@ZHQMQAaDYA$RBFXFDhLpoi{pUXJYwspy@9hG(8(lc zjofmT7kOt_S=jdOhJUN!xm+}xh%;GZ41CDL?tL2co5z`~4TcR@V>1#|xc@Te`H923 z0qUK^gYW+y^;At1Mt8nG`y_v3?RH*eNYpVNJ4dZoLzf6ZgsGO_~d%G#pr0C;)%K}oWo_VeS9RQ|8-^&$6K z-D%$N)^|Xs8gY_q0hBf9n9mCgc!uE}3|;2Y@bra~utW}#_z))$+-Sp))Y=mj{to;Xf! zNw=x+hbiZJT9gOILtiZm5Vn7w-H2(rU^Hz@Wp0W>D)^qY*I}sc?l+)5GU&qzr;y7Q zDb6+qiDyo%>t!Dws34XqGh_=P9lNY^KyS>7I2vizdoxgKzmVi;a{u_g8vW(=P4J*c zK_4v{B17DHQ|JEU>9_yx_EOmSo|2@Ec;Ze@V1CGbRog=DZH6(B?W`|6`w3e|x~OTH z{L^-6H9*%7M|L#SzV*|uxAyl)2S6cJ2$X)D{)EfgYh&s_DOc~Gv{5bCScF0f6qkcm z$Y6n9RT~!WXC>ghp=>u6{sQI5ir4D?VCUy>xq@|gT}i9Wme^W z(935JxeO@O+*lV1mrMT|F2@6_EfJIf|D3t|nW_iKL38PcJ7X#xg*c^IP2XUJ4U)%l zgYR+oZ)JRdj*tDd@LujE#C}aq*1uyBV3xW0fQEo9hSkNV%zg{S*W4Bw&-bi0k=o$6Sd%` zk#kHCFnWBX@$jY%L<^zhF=pKa-r&cR;OGuL@uBQHWw#i66NwkD_Ywu{;F1|jwXpk$ zMf%?&yHYq z%ZRB1Bepr`UrAW$T(v7&(qKQoF4Bs^AKaHFKA3)cJNsn^7POfZ3W7^tZ;sO+y<`YD zG5W1AO$Fs<&N!Y~L`G4S`}`wdsh<4obo=xc0B)GPya7!UX~-#rKuKm;JRO!(w3<(?T8QZVEYl6HGvYoy2Zu8f96M`JkzYR()|3Cj zXxnp)Go%03!`ag_fL>L3<_{=m(3SO-`c;y)iA!kd<+B`<^M%r9-(^DevgA8??qF(L z{SKlC+HJsoYaT`4yeS|}QZ4NTbuxGswUO{o!b+B)*yA!(ZA&W$YO>h!oV`z>g`&-n zu}DlB-Ys_|Jp47H?HF>c^_Z65|Hs>x$3waPf1i|yiWVe9WhrZ=>XNc|3yWbv@VU^HaYz9{ww`^_?}Y|Lk5U8fu{(->wk6*eyFAmD|qs%Jop z%a0y3*>~r7!Q_dStScZVabwpZ&MRfIPbeFN*I}7jUz&T}*X4R{^@e@YJ6U|=Yga)b zv8G)x#4*NHD)ZN{n%3w@(_Ez@SLAp}q!z)BS-GG=Bt|c!2&7~F|EDv5OuI4tiTZd3 zsjXuVA3@HQg-_q_Qy*IHz2To;DPXepNvc|wFtgjPEp1n-Zh8tLGlQHwoAcfHu+m*g zmbo2!#PmC)LJ_yKv=m8L`jWB;`qLN|40+iZYdSmJbBhT;>4)A@I^=~Pgev*m!S$%Lj zNy-CdgjDPypanwuAZcS%dHRWF8BjB*0d}r? zGIP%epIU|pbE1!QmCBi`I}V>xR)x_-in3NvvK z%6tW-$`5`R@r4V~!b--XCkS|G%8Q-M#&nk$R7i?hP;P82PDxk2j>u}L*bl7p6K-&H z4}VyZvf-&&eC#=-UFY;nj)atBhxR1?Aj2ykKK{ams|n3MoVb}w2NL`LAPQL)X!3) zY7!FjaOy(YATF7ZJrCN^PdtI%Nhej;&!vHQL*t3=6X&xuaz5jtoI;9){+ddI_g}w# z;0#>;^^&{u?>!jo)>&Sh7#r_W>HjPJ1Yx>isD)-`S#lRr$|}(jfSk9jb@BvK)w-{LV%76Wb0%4Mtw* z*NO&*hodn+y0n2~6wt3?T1;TrwCg?C-F{smwLk?toowvEUVh zCzwO|y@zuc z)_xcP^9aE9xb&bmAX0<;Dmak!J;#bp1BWwmLO6N{>AVj2=Igoqqz(Ej6m&;UXSDsb z?JW=LROo>BaJ-a|%$*Hco+Je~#k1LxKTmhueO!Oq>nKRG68^>%=}17Tt)ChX0m--B zrqjR0``$C&*FC=0n)Yhe%s%y)3w>NKWLyDZw}a=)Ka9MyVk90MwMHeUHTrmme9D6ZgP7+)f9vN<-t% zlMxm?*AYQsQ#U#EK**9;(Df?~eiP8DCCTi2m((Wd{VB!=wXX-(L}5&NM(W`#x_#uu z{`HlEZ(BN<0B5G`IiP<#O~or#HRk(I>y5F4^~T=jMQ&P;4@38 zAMxY-%+GiFCGB9n>tH>tT}UYdh&j}gFQCpPG;G(44)%5?D4YLxX`?{Wwp9~Lq1HS_ z<-@<@4;LhE)_Q&9JNRB|ej7K%)BhcD>w(^-XFApG7p0oOLMrh*LVpv0pVT|?sC;H^ ziqph-@wQN6;jN4JFjwpyZM>j7wmR*11EBB^3OXPQ6m-DB@Z8T#2FPu&0u2q-2>p?z z-%PF_Ch4I3_2>673(*~jvG+6&?=wi9vKMtv%~~<>*7mN5aj&OmkR{)IH~$9z5M#8Q zo8>VdLbb@K2*?kb|F75wh_d{H)Jp^csh8;1N&h8;|9)79c1SR*N{;3M3+H-dxTeva zWt1I;Hyr~!hEPOVUnd&u$y|D1y3L z`%>g^ML$;Isy$^9=5xd7l-B;a#o-N^<2@eDPKME;dkh{%}Eu5`z3#Ao#;ZB-q`j1Pq(!3%j~)x z^7qans|+V6H|8;>dkCWe=^gRWc5UXIiDqdi?SK8L7mQ2$tOS@X0q+03jfBozgTq@J z4~KYz!T@&F%^8LPTd+{@>hLc)1PH$zt8ha4H|1Z(LviIt){a~Q$(vNe29K|jrh6EA zq%$qOS;Z}6f2aesHAeV`nkMD%LIW6ENsp9Q~f~P_7w&U`NL&!Sfqu_ z%Em^&q2cM$x+1bZyP9zz047FW@@}X0idl(Ktr)jPY5WkH=q#P$IB&TZf*DMx9MHC{IeU&HPu2I^8p*kTO6G?|txJsX&I(q}2r>c$g& z2I~v7?V&1QPiQ;I{yFG04ch{8b5uusI(sc+Kwx7QcW!3y^g{H)N3F_4*sAh5W6%Hr?qRREor&sxCw}1^jU12D z?THZ$fe%`6q1{y_%UAPS=kRzOmwn0COG`^bdvr5B*NepETiq7-6Q3un58=p$@4kT^ z6w3od?T9S->sb(#@cg0kr{r$#eyZjbI*wSvy7Z*xgq3z1LkiYh~b;l-7_QFR%P z@V>WqzOBL7A&tx;Sw;Ca;}%F+t>K0(f$mdwc=m8X{r#YoC}hVoS9n|0c8uIoXCq(K zB*wjLy?!9w$;-#JRPsx5Y*J2EtqVmEvD7l}l%%qZqtwr)l_{p2cF07-Rl|k%WFnT> zDkf^!vO)sI<<9XN@Sc)@{Ce6CSbT^RgfRfGtVe}J$>RVxUgeQwuL6?+w%W>_(1G(G z=ZF8%x9k)=mG&O454U$jXlX4lCk{ENRAWyEC2MJk?WCVBZ9g&qyv&=}x5n4uKGuG| z8|&i?6<%5)m!*!9-z~HyHHwv-v)y2sVv$>U844(cQ}bw+uFy4fkeqRV&mv}NDr4N! z>F-3zdg~IAJf~9J>NZxp^apzAg>Bi0&)Et0Q7hTDe`x3QWR_!5l&V1AN(R{zk{0LG zlXb&6$#Z-I1XHQJqS9qOKojLvf1JAwF;ELsXYxnDNmb7z7D6-_G}0*yol*Yt_2b3>ynfPmzUDW5)!_8Na?fn}-0O(aqTv%P z5yX0kI+Tx=5pAV%w->OLVS2_|#&EEE3tO2s$cPPmib5K~+zNah3Oc2tSJFi%sworq z`FstX)_iZfvDo4t;bxAYG<1Zl&r*E^bcW__C;6wIT zf)vL+X4>7l5K)|d5G7{)DZ^7R@p`W}t%V4Pm`ZPdZ3H!=F`)#+FBJX+M19E})A4tH z{b&maigWs2s!RsE+3{?;@7Qf@3Iw?K z<`qUMW(?>waQHWeS$KJ#T9&EU=Xt+2UWGmX-6_CD@Je z%>v`QwMS+rs3F>%YH0Z7zWy>p-yi6XpW6N1_#%66S3O*bdAB@$S(&S062H(8guw1W z*zS%ia_Qr&l-^j_p1k@Vxi-U5Hs`dV*+>|zDw7k`FM3-RD_Hk3*9P+Csol(i9{h;0 z?R*cvBf<6H%SZO`m5^duhd<%Uh=p)JpXI*XqVaq@{)if4!|wut4HNRXUexLeLxhR5 z$qO-8+jG+uivAT-`nf5!p`L@y^b8&f#3?K#+vGVLzXH6P@8kx6$hvq+#sSzN%B|6o z2`^xl=~;y7tWkq+y{@;BN%SdV)e1Z0T5W`&Stvl)Zu~Mp=as19pE0y8?NZ&ba1bOv zv|uKb20Fc4~=yzhd8Ij^>bs5Eq;-z@jli-TwJU zCm+{C5r)yNhW5$UvawbPCq{{b0K=8%@a$koR};=(VeOJnMP+oWr1LD40FG z`<<kW5cd7IA;xpc@x+d+>0!4F5Dwj?Td zZBm^caYpXZnmdm;8cBPIbMZp9Q5870m9ea8@GBFc2->u?7nwDo5jwv>{V#MB6fFPp zJ|-u&BRU8*m4MqN0-NA*T|bLfm48scdgT0jg9E4op8;Ov z5+NZP1jaVi>;Vl<)d6q+A1B^6QRmLS6L#NYMLq>pyu>=JqNk=CWBV5zZq@BZ&O#`t zIZRx(^Fp^+k&~UVo#VYT$-87l zH$0ELh@458NihwR&^aHKi4TP5xKRC{kbY0 zdk{G^Moi4iHF1M*hOWmd(`xgrV;bn9_4PO17Bghu*zFj8-Lw;fPbV#`t!XB}jOn}g zc2J#Wxo(zw1Y9%Wg{)(E!I>m^cPWQP?lde*+v76VX{tJg{e!WOiuW%*r*)lq{OihF z`3ZUuv9J1Eq2DJD-L3UcUruPnsRougw`60V*APgb+b!!;EE5CP2IOU!#Zui;VxsyE zQH<0>#T{3*wEuWcXQ64cq^Y20EX83v#duCBV9eb^9m#YeabdE=o)3QmXx>G0EK|6jacqnD*tRHu**{gw{tDyzs1{Luj(bBEOl9_vN|tdzoy< zm>_4AMb%Y}uU9t>I}hiHQ)gK6Tq<2FVsFVplWy0vj608(GI;MrX!`m^BXfFgP3yE- z`j%t=px(9PhH!a>mFx|Wza_um+_82VCIJVREHTNOAsOSi(DFUhFE~HM$Q%{t9y@t- zs^{P@QlQ^5f<%i@(aTH6HeK@di-ORTdj4II1fsb#*Q~NZ4f|+kmaC~HEg`#FZmgMZ zke9QsGWyx2FQKlTE`G5`BaH6EYG-IyOL5yO5K>z0hGJ=sgyv1Q(F7PiM)i24N1q}d zs&1&s*{iIefUYCDhWD)Xn}=X9oD#@3R%{L4&)5vPw|8EdBTXZ|=qY8)xVo-8f5TNJTQc;l=^ZZi)mP6*&#LwYo3gcq(vGSOn4k)_~2reYinJ(lcwf4 zL!Xd?LEfF#spx3-LPFW)I^$PHOmjiX)a!R-5=yiEzgit1vq?`4;lG*eQ+(f&v=Fw? z-j<$G6SNC3_tC|>zV*RLVb71wC4V>;a*(ingeLeYTMgG;`6);g`XqwgL7z+TY7g5c zQCMW0Q|#9YpEukopp$Wom6i3A6LXy?s`X zY17m1H^r-nQs$Zud=aQ8{_8JQWntKUY&ND$AT?Zs8Ao38DPa*al=UHJZ%;(wO-P281F-8>lkFN2Qxtu5dQ~ZyN^Ar!4w3dBlWS4 zJ7j$tS78jjGgXv4J*`?xjO& zeFnN{o2UT}kP_NWpN6oT)0FtEEh{M?%S2M9MoFqS`Vz_X0u7jXc0i+?6?V6>0lNR3>P{0{aIN zJ}N4zh2NG{TVH%P|F5?4Uw^5}fD@KoRmS1=2)A}z+zHFhD%5tr1tFX{U-_|$kzl71 zF2#=@H7&?f5txl|ydtm>nKG`JfvU#F+K6tl2IaZ3kCS-W7qk z7I=vAR%9YfFpPE&!fWO$idVJOM*}`WQ#Q7fA9AVB_g_b1*E-VLV?h5Z=``#MA^t4DJd6Us z!)J#)YjoY^^(0W#U19SJS#P7lL_0{_-?A_ycE7G{JxXQl&0#i0zH{TVM(|h8GM>~3 z5n)#uU7Bkh>;n23{@`!Nc4cMhHwKpT$-+ixypYc?fhBJ6l#{u1bFy*53h-?4k-fh@ z5Wui9a53yKTkv+k=6?dR(9i6tdY|@Vk5}w~`Izm1r9aV{J3t@hz;S**BpShg&_^vv z-T%i0OQ8jqh9@>J*l%*ToNq;U=(jh50%mUPx-;nj+MxwY30fuhFxNWj)S*8op9FZc z6nS(`xiOH0j^#`Q_}fj*>Fv*10O)JGPQf09*-vGFJ1wT{3(ssK9jynrh_$+ymFKr_ z2|PTbk_Gf?toI%^W&xtK^lYIcdV7GiD*548r{hUQf8(LEfdGo70z$2Q#-b}joeDU|IR(KXg zBfLPFY^)B4ZO|fkHS+%;+|TimfY{8f0(S6vs1zR&$2V*Bd^6|J9Uwe8=xsi;MRYc^ z;I6z1{hdjl1oqQ&4>TRf-{K1_TXPf>11=8&UdF%rd=AhEJw^`+(qczwW5`}VR|X@C zx~k(AADev9jodZNKw0t`tO5Da7XitYo|hD??OzrA(5W<1sD@73hJ$M@#=c1PKbE>Scgwu5ucCjbg9u00vKz z$B*&Zd2sPDBS7gUeEE|diaRl0YW>GVvG5S(17&po$c0|Odp>uyA?U*9pYMwPunPo< z65caUH!JXF^4yiL+4VsHvQ#I<@7!dhqD^@8U6mH%KGj=}eXOKn(a*n`fmrHX`$v)^ zNZ_TD5yzc3n+W-D(0#iIPWA17ZRFRM{(RC@;X3l&P$eI|U=Cfg{M}H!Y~7nAtk-i( zum4!Fn`1<^OWB@{8vy$L(>!u(0^vWlREY<7f6NK9Lt6Ng?AuUujKrZvGEqTLHoAZj(`~Nnz#dgJA~hQHt%$4$Chu~9{|>7 zw~>Gx1-CX>`#edtH#!ch$<4l5@wQ=r;tdh@zV`Z;wR7bINBOT#3^p$3YtN=8sIjYpdQ$0O_@XOy#~V35_wE~K$yvT zz}{%1V%wJpv4thTsx=@cr}jhtKE!w(*&m2JHdf8KE-&;KlfXxp7X!c3SAXL7@$4T| zN2t9PS+7r#&%V=6KFx_UpCZ4FYq{;pm1^sg?9<_^8Nbe|nXG1bQdoHZY05zs7M0l& z>-#lN4^i%Xv6lNThuoLA?o`EK^7k?(2k|hS5m3IQ%X6|LPr)sdY~m)ks!g{{345W! z``&o6#g2=`$TQx;LYuZ_IkmAb)Y5;1S`KS>kEBqvEHi!S53~iadO^g#<6|f1edPCS zeitrhVCaq&#B=|}f?v$|`Q*WPi;b*(v^b>&M&3wp44nLMZN7A4@5hfj zoj@-zi$!fyzr^@l`*ZlT3qD*32M`y@d%upcDSqXhRzvu*pWB|6+q1Fktb}=5lKFaM zdG;L@V1TiGZ_>dh*g`q0?)V+DJZ+fby3TG+fxX8dzppZr$>w3ah;B+E(EQXGp4IaO5>N!SyrQ zOe+JuhHq^|uzO3nldKFWJtt;yM@lBm)E^#P2coJd9d32>u6!3Q*sYNsxT5jzrtvG} zE4{*vpiIMGd-~gx5$)obwEXIxLq`0g?Sxcit4Wvh0SAZ&sVXi*BGpa>(zw}DGvMUX@`aNzjvhnnnwO`kSQl>~89%&- zhl67yrIkNwcN;8OF5rAIbx`lSger%5_-eQBMAbORacK;nKA(GIbg-6SH zJZWNvZs~GZnYpk^L_;nV!53EyD0RkS(kb)vC(I1NxO>0;tH`{`&pefm0y@5M{90g| zVeadec?;N=xg?rIwUr#VjT^|IDW5Cr`{cPwcYtJ6CJsPs%sKZhKA8x7@99_{=o(!ydKq8gASt?xr*VXy_e}++=(eZk29|P z5Od5IJ(>HMj8e+&&c&+3FJ-+oTeio&;C!$wh=F`;3$V$IYeN4Z?{lsi%mjv@0ZBJ zb7*F+z>L~nl=DTXTR>4N;wa;^Z@u9gm=H?MvyR1qV8{cqQC4ag?oeI?Q|`n=dPI)n zn*$JGG>5(uMiwH>c=Pd{u_t=HI5j4|fdL@L2DXRkVYX~hi5Z>p%uB`J z<&$TUFdF`6VvXB~tBXEL=f3VUDTQTwBF}&W!H)W{m@U7xsk3qN#B@*gRbC`aH(Vsv zbRxQ8n>ZTYw$!^5+Te#D8`J_DTwKkAv~VacG~rTxSEBIhK(|Qsr#*J69HU!^#}zaM z379v7CTg=1ZZ%IKN^vHcQA6bvch4kH7W%bMX8Nd&X!0Zbm-F@&-6NxP+Uah0qY-V2 zO<5Y_98B#Q2E6p64QDql#_s{e_q4SzmhU3}?K@|otp4hH*FcuzYsy)NuWwpDiaB08 zZZ3zsygW1|>>26ea?ICst9uLDldtu^Q|k|P4gT`Si4mIc-Lue#+0vbYohUYistV`q zT7wVg*{VK^%uDooX5cLUEV8LTj@Jsze*Q39^@Q&4>70ZjNU{4W-!g0w(=Eclx$6#b zO{F@?t~l$QV#~z; z1QF%(#zHq^e4yg5w5ifN`Lq$5`*uDdbNL^OsXl&G%<-VG>z7;)NHfSk(N{2v+$s*| zcObwGzF}cJ6XJRn78XiKWbDC%2bDnaQ)8HXX}IG^p6K9{M0$&l zA=Eh_@M>$9RPlucs}XQ>R9=_=Evq?QH9zWKj@_Qp9`x{8q>`>~zI}JTqT6iG$-=ee z$c_7NE+2_$YJoTI`=1n*{+=l9p}RBD)3_V4nm!}s=uZ|go!X8$BPwcH0T1O77uO45 zlPEV|zZh^tLTLsyw(q5!LrTwTV3bTmpdy;{>2i|kDe+t7`!ov4OX7Wk)-gT-B`XcI zq{g|3c<1_SrrfNP>~;q-0_A0P+{n!;>;Sc)Q?{+}Dw3+MTYmO-Z5C156dU@|-dtJ) z-H|7wF{oEYF1`5S)YGOlxFg=&x0;*?_r))l2sm^d5vGPx){cP+0cDhQX+u5?pge%n4sz{~} zw9WhnSi(OpDUgk{eCr>XUSn>jnRmI$Bz7EWrfxMp&{x@*T7FbKZC`cD zw^!Ey{hQr4JG5Qp5{mNjAQO{fwvG|qwhj6Z zAR}cqBdkx>Oiel`*E=fG`qcD_L8`8?IZcw(h_HIz)0jBhwk}MDQKD^O!`I!2nj|jG zqlQD>r5AW|HJ6-cjYEzu6Yht2hsAi2A7h6~=!HW}t*%5I#m2CIo+=={@9|Ylu&Ot3 zUSf)KBno*3uVz^ZY)lywRw#k9Rvz96pn8A6dec73o#o_aTOSz$%FjR7QPf;qY= z`}0zp-Ig3Fr<=MrLZXeO>#Y*k$chC{^UVi7{7d2NEoT)}ZE1nUwt*^C3j=ejlU7fG zbzmkHCJED5{(n((V}NB+IS9YxXPWfrv^lm+AGHg?k7GH&bWs~wAML`O(!hyWOkSMC zp|I(4vc=V_OOw$8)vP--)wzIwCFBc-S~{&fj$|gV$ky0pqKsy#E{z*Y7t}^~h7PSr zYSr11ZX^5igVoUR2oq$Y%=IbSLNL`SX}WwYUu|GvAMv1?uQ|xEi$MOism^q9_rJ>; zs2iJt@ynK${)dh9J3nPQpE02(kzON16%`c9Vm+R#Xu)Ka$p4)R^xuue;*LeAc1_^_ zGWB+4=&o*+=ZQ=Gp)_gox^9U5%3xr@JYV#Q%rc5@94F9d^&q9=-#vHfH#U9I)q6=N z&!E1>x9mdD?eWO5{Z>Un>l7^X#ZX~t1XyMXAg5^|5OU1Ly{G(MhlmJqSExJ(CA zJ(lB6KIW3EGGMKIaXG-$!cq4mS@7}azIp$;dVXIF&%VxL&UMJGXuP^-VP&O4oflX- z&(AL$Qc-dKq%i-JD^fLyNth!i{x9m!L{BD(tVRdT%*OO1PayXx5Cm>&A=1d{q-ZN6 zO|vehXeaL#YdA8y?U|b;7i*ax^9f0yJRd-UJ8mplr*0-vm|%H}-C790aGL=LUCU6*MjW~tC`0)i<&cd0LZ z#i2X@Y6|DAyPzORkA|aF3!dvUe7^cgRe{6xr53 zqm8hQ=ezJecHy@L8J%BGzn`|~k5kZ0)pdAzjv)S0%r#}IBU_fcof0@qEtlN;xa+NK zM_q}>{IQdt8yUPgCgYe|L>;FN6^^9T)>pRLwFHSij6O-j(V}E^1;eYw3lHh(F-mL0_cOI=_VF|cUduXH)L z0qrlv4SC5vqyLY9T35Y^;h@V zYM452k)0=4%@g!Ak<0i`OAH)>vOn*h?Nt{JF!5^#nUpd_;5cN}#hm&CwRo@Ymhc@B znsn(ca!q`78V81;<(bE5lbD4Jo}7t>p-ehz$BAAxsvn;)Db_cOIZ?DIJ#VYi{11yj zZanGs961+W+gIvc*%o}CHo+g{ckhhbbZu%j1ETTa5)hk?cg{M$4_p{;G2ZlOxuA(% zJGa;R0z;MfT(U#$n=@`?cPn+ZOAl91*HH9s-_9&3!-jvw1%=Nn6#7D6YG3t|STqG z_HOBwYP;h?kH3g&ZFqXx1+;tKA>!jI&U4SU(>OfNZIHWs#A8fDvb;n29_*+wZ>>1y%a*-KW4Pf)Lytmcm4F#gn-4ziKQKKk{-7umZ)EsW_eCJRay?h zR}$om_UC1#fh#enV$y{5$Z`xCTy;jxgoq)$Km-8`A-RWYz zpwjEToc7ZB;n#;>?%o9PX+e)yu@P#p{x#LZDUl@(SRHL7#jIjwxzh3tY-2%Sye}S$ zIJF>KxV}Ldc;QZ(aD`f5cJ7rpA1#_kkveKg!wJi&>V+}@L@ zOwFHuExV^<;AVbHCMvGbCAiB|p;T^lZoA7X`!BxF7~rym=-skwMuaQ_vdqegq*ah+ zM22yF40X$6SG#rG)S<~ATVNY9 zin{4WC-)o{JG;Fi?d}`t4bM~nu^+|dSYupbWk`#;BiYm41=T~357d9GOgAV9m-AVB zNuSob_uysD&c?+&y2-ZAA~nz1%u>no0c?npslGf_DUPl_drnXtPrfY|_FcX{KBDBz zX7=BGsJ*QEFyEIR(X`7Wrwaf%bc$Z(Lz-%a1K1bnf(dT~DJL-pL2^D$OiDd_GYd5u zU;jxsV50cc*}3F2()+pgzUK$jWUB3pBH75xwIZ6=v~Sk!k&43SPCTGfnfbbu701OL zGpi*qr=0i7H7Y;Hy791uk8W&)4Z`{Gkek60aR{`$!%E|cGp zC>W|p&#a_l&c~Y<|9pu9g_m`&Hgqbn8aX*D(hKy#N2m0djXxMxJrWFJ=I4jc+14>{RB{oX0)x{BPFVpCll=gY92^Fq2bl1OKYS-9K;XU5BR=%6; zNm$zWyuQ-s5VId!j@2{qF;$DB z*8W5{BXwz!4%6IGq5XL`4W_+bky~aM+Ek}^pPm?OtfOw8=t_^InN2biYKcAL84@jh z=aEhwBGa%SI_Y5UR~b*kah#f(+POjB z`t#HAW~x@5_q8zc+0NZwnl!zDg0mU=E-aDlp8aLsD${Nq1*RxcInhz$eT4{)SORVk zs6=~T8eG#hzA}9!;T}e(KWnL||F!?{*DB0eSc+#*B!hlt4izS&XvCm!t#7S9=EUr~ z=?#mawONCYb@Db#vYn|b10%wre)&#pXK83Hb}Ns8t`*{?E@pwbYTHj>1Pbq9*`1YA&c|>>x3LSvd9XktI$4L{#j4WQ2en4G`(juFm&f>+Kz8 z=chl%G4n}JAG}qYUQqi?91oIL>7jC^Mf!@BJLP(Bx67WHDw?d9VSsty$kxPKGHC>9Pf<|ha!&$=0OrIi!Xnr9%r|O9KH51e%M|E{|@LmVQoeh&M zlDC4-?0@<4=h(EaY9b`AYSJ2RKtW@Un?+=8KLgNX0a08Xw?-{q?< zhZD9lX-hi|XcCIYGo&3u-7l9o=!nksz10^b*({u`uBmb6Al_*x9IZXDf&8@l58L)4 z&whjD4+N3YW7rtE4?PMR(+No?Qh01i36oM4PI9BPo>%nbsJTa)Sgxu(Q;= zfZh34YPlrP6_qglYVyZgMV~<2(#WJUzSn(c&9z-iKFJH(=?1OQ-bs>5o+2@j&2a6y z!GKsDnVfeXwq%KDzX%M38!!+}8MQX2ws4$L2MEIJn(B|gPhHBFr_0AQM5tDx10zCZ zffV??wG%3KpQba!s*2z=f&1U*((b2Qf0%kf0sxdaJ|^R z;jp!P(UOby?ZD%%#KYzAxWU(}YC8DzS0YSAMELD`UwY=xEb%Ke8k0zj0XP#_vJ@U? z{Bml=v15+wG<y;b0;6&XRzUAeCAu=9*O<{I*v$Y_atlraZd>jhkya{>b=L>p`Mtue>JZMLDgjWWISku~%AsJ@eIVrdbT-gjK< ztYf}_DKag3SRnw%$7W)5y`h>22#%jpZDs}tnExBrxr?ga4_dg_X$Zt>N$Q_R=kM2fdLOA^aaCXPa9 zR2ln7H)gtB+a@p0Yq`W1ifu^?{*A-4l^J{M&-ZJc+_yI&^zKZ>Nc1^a^#t7S%>h;i zS4O2pGQf;-5di#EzYw`x>)LKKtgbqXhEJSd50ucnR3hHA8>xwLadENi>%k8T94{xP zi<{7QDXPaX_$V&;Oo+`@(@EsdGL9c4p0(-`Zz@zJp|9w!7dYX0WA@ru``kga??Py@ zJo^Cn0s<2^9zI4|(D6X49<-&l0NR4VKp8CUmlOB?#bljnX;`rF< zrZ>~?(cMXZyaDa;)N*>jAzbm>DW}h>COf^GG#cZsI>^f-eLcB6<76mbbxZ-CAEW}_ z=0wgGx$Z4`F?~O8`{w|T?!?+x92LT9)>V9LhpOKm_@duYVqI^czc%cvsja?XuOuyh znEg9Ta0jqTlVT3TVG$-lRYyEesAqn8(9VHLTL50vnIKdU`M%+tU0crHD11BTvsHO8 zDi8_$?Jjn`T>vE8?bYfFfFFmEKkQ~-r4&02<@k%7ot*^?njal+dabD1S?JbI|O@AUl-LUY%F}5wP zZd1h$aPWg}+bTCYbUuSD8-x!=2aJld-pl{ z(~+~8zc}_5wbEwT%xc%ozhfe{qSdgtyN(m6RxL5jMbLZoi3kU6yPry$lz9cZFI$ z#(VkYLhimDmZf(l?TxD_earoB3+pJpNNFvmq0!o94(TcE_Hl5E?4=D8dl<&_`kU4l zB%g*U`6K&j6H??8=%d_)SFg08Tzpb;z6kF@U#w?H>pgVYXRZwLkpV)F&dyaM-+L`h z*7~v-ALGL~+j1#+G{(v{6??O2;Cb3qN7q^$`kNz6eT0mQ+(H}WNY@;T2BZjWAcxx~ ztjvj$P;o3I?M#jAn#K5>*7aJP;u$t>?|SUgfA_e>c*w_q71zPkW@fv-<q9*M6MWbO#ar)-YVeJIGZ!|-`KbL+eabtF&TQwmD@gL(6KU6+!ayOa_J_x z>fK(D?XvGI=}e0UO7+|Zr_yXyKQxYw4YI}{Q?9(~BrrcV&`x9Cld4$8A;o?Se}(w9 zXX%wIA%r8KrsUCdg6y0!hc5k#%Ym%cJ9pJbN@}Ue+GGj2layn)UaJb18XZ9lo!-R~ zZGp?}F6Z-p`EUkRHE(MpCN?(=1T2xmcc7!hZkcsgOwY4I0PJP`cfwWSe4k`5YH1ormc)L7c7bkiU zyqj%N@6sH%W2P))5UyS4`$LUioTVB7eSHty2Tp9&guBuJ_5FF;;cr&%uW!F`gAo|2 z$?nATPcv|9R`;i-{h_udQOsA_-7iRa^>cZy^#)u00VjOgLv|K&(#E<#cwTKKwU`Nf)aQys0jMC? zmFIXwg5xkTK`n_RgtA^op{{Fd&_q)WbKkl5=pk3lBO?kvkI$F#m;BFSJsdhv60To$efWyC#^LIldr#>^oApq2juR^f|Z5JC8h7 zMnQ~MPKPKOU$q;~g~PJ(!a?~XOcUOnWyOg=Y^hm{1q0Mw%}xxFofn4u{L~L7|RH*_4ZUG&Wux!Sn^lbS8ckZ`sm&!GQ_tEHBl>F$%%#gc5Y*xUOB9g9UzZNvigGmg7 z@HMy@E_vF1eir%S#B^6dM4~FQzrl68(r9KecbUagtQ*riM7xK44BGLkgh>CzxL}{T)6A%IE1Q`KEdXe5sXrYCYkoN6(XGStJzVFPu_kQ2^ z+(-YBoSbvA_u8xc*4k^W?c_XEB!7EqT)&QiRsIl<6!~B|utG80xWL*g5GPS%K>j4K z{mwtTEOiU;G1rAhG;clRzTVAMKa}F;Tt%)`DaiS#6=r15gM&%~9I1^EZu+b$cu z^S;@0SiWSx<$e}YrYULtq*J3O_P8%BLDusENG=~2y&)zh^fV@7@N=*d@>7K<%Lx3; z+>2%U#VEd0Ha+dzUpIXG_*58DdZhyI?kOl2flmFTeMGJ_ai%gArX2DtuH5}|QLe>U zRHhijMa^aCK{WXw#kCiD9o@+5Xia!$xgQue7dqhuo3(6{*7DB@SN+20$|+}xM>6c{ zc?Eh4Y-~24N`DKa#r7u&??uOSo%B$dR1GJV)X2Id`hxy4bvdtxrzx$%S~@z11MXN0 zXEY{2Bx<#sM5#s2O4C5E(j(7$1T<|4r>67w+~@zD^FF}Xo})6xy7>uR%_a+<6P4U% z+mCPNX88U`+@0+@4iafa!@JfvrTCU^-;Vx_5R~L>WFocT4FYnT3%a(jZzJM6wP9SD z7OQp&Ya^e1u{Gx7@lF?R1-soGX=?Ke&RnAI5xO;Ym8W-I`M~3>ATFNQbtQ(U=w@Vg z|GmaS`682{KJS6Ma+5J7U~61AwoJ*8$ZYV~pkbv%~@Q<;J@J#+wk!IiTroNO|3Arp2; zF)e|E++}Yyc4cKq3(LvfQjd@Vjd#3bPIuIcTaicNon&2pvPX3`)da&VWA{qk+^r*! z(|HgI{rPguiJj}7H{F+dt9OJT%8G6lW(H)5t zcxER@0D>ZQT`dn@Ws@=7u|C0^kI5l>0a@wP%E9gYp6CnpiEIY)c_)ERT?EXE{ zIasfZY&%8;rfJ#X+Dp|n!IymPGO^R^8R{AGtO`q4nq|P8PiIf?u1aPsyKxz_7tQg9 z$ZJlQc z!wKH=x+y1bV)OLXjsVvh=WsG&D8r<>huZ_Bwtq;MzJQ zFPZGiTo)(rk?guA_ST|yRSQ4M?0m;ltMlbA5dybM1-(BzChp!RN^yI!U(BTo% zPdAV9l(tQ#W`58YqOfy>^LsKQrz6#(CF|-qgp+?h7;q6xgrOF4dj7^sTwBP5)k@^e zSO%`g2d;|DNyZYEXOGTw&JU`I-21G-=$p*`Z~`kMNSEe(mMKx5+#aKd!Cfh^?WlBZ z=HnqheP`cWN7s=VZEy0<`BA=&$D0{mq)q~e(;ou>#r!$s*s-S_HT%qKgJUOLjW|XL z8s$q%OV=uQd0p%8DWLvx<63&bXj}NFuw*!eB&QFKENURC+kYu@8}cy3yzQD_*ng%} zTm}Quc4o(ib3R>4jj=`OlUw*9zz!(1PnqhQ50<8WuY0uh>oBf>4O`lKNW7 zvqAYJM^Ur0z9i){)5H~i0~3Iwd{6BJaa9?PEy?t{?|}0qU$XBgA83Rs>pFd7bM}>R zTg@e5Ncm1l>8T~*oaco7cQ1lio*2XWTJB@Ua_CCElVc44Y9`v(HCTcJOk9eIr>{F| zAPCGBRswE|hx*iI}R~ykiVKg?f~m7x8NZSh4%o zqrwYi0t_KCdNrOhhS{YP8Mh4TEdrlso#YBYI*ts*`!}dXNk;6N4`#Peeh~k*jySV8 zI`+=!=JU?My$5UeyOtTKM--x-@SYeOAn={ylIjh~T<(#u8w>8GK#omb;_b}JE4h#i z5nf1F?)>?@=mE69qU_f5SbU87&3p-2`dn^rp*NPxUAHZ7WtTq};zq+mKZr#pnv=vBW@#sDzXT*NYQgQGK4HgAMaVl}thR0YBu*MWp%6 z>NW6u_G6V7I@h>YNbhMxNx(L-xOFVM3?(M7Ub1^WbGyz^cob`a?U#=Tp{EKKA73s_ zqT)`X>3sbzoQ&CkP}6z2hg~2kL-sRpNY1c z_0sW?Q2_=y7rnBUOnVb21Zx_@-`*bOYt1yWnmGwFb$!$ha5h=>j$hiCiVys)!-=?OKDKM$(Zu6O-u{1jGFes((FxYB1mk@sbW!8q}XzR@NTOMs;MsIk=y} z&N9eK$!i!o0qHydq56Oa_BWxs-uYw-lnwLP{_Bpz^CY!FQ zQ?##mm2Vf^39cN>8?aNZ?7p6>i6+Afjy-zW5d$+WY8G`2&ml^LW zC^v-)Z!906HYNbM=(4M__S6Da8XNN4#{-|3u1H6Y@m^d3N&nZun^SLe9##68+xt?B znhvNtW zO)Z=H+<6$F$FfNAZkmZd4F-O5ibYPF<#)&o=pSkf$ni_&xt1PyOWhrNty51HBiZ}U z9|6SQK_&jx)V6ChuQ>1+yjf{im@4hc(vr-R@rpDTpVb^S5OxO`m50GbntCPi(?t)C19P#GM`UHpH^%Zq*^H&V{&|rhk1Ax{g1z zFy%8Xk$g4jD9ET0?R{tetY6MmWv-&!a#OhL#AIYV!u=KQA9T6-Hqo7KQ_cQqY%fNC z?FHZ@awE7eG?Z#!PBEQDHo*}~!Ly&c`Q6-#EjQ_$n&+4*c!4@EREUZ}lFruhVHwIR zUVUxRAo|N}-y+Cl-K+$}0HNKK9$NZf?G$35VfM&Ep50y8D7wG?`xi^|!9v=$XNamr z7lwnar?)FP4R4(YcRqdUK7x01n={-sYTOQE<^E6d(U%zyL3m4U1%rl6Mq1Q93=dx^ zPGa#hkPDX@=RiK7LkRmAS{bXi3m%A9{orhQ26UeW`3lVLUTW0(u>*$m2~AcL%mdd+ zL{g^VIa1kL`rlkwR~wK$tDCK*YulM6z#*&`4w3@9e@!DUeLoh?0u|WfTD$0k{-64j zT}*$nN`_N1KzoFnYLmUe%3)u?2EtCSh@0^-DJ+sQrNoG{T(aaBe3L5@)NT>J)?4o@ zAYby`ja{DodF|F+r7zqz4me4B}MZPmmrm3`EDvk?doX0r1bkJc3pP}hwKtE#$((?3?v zizn~!8ySB33y-t%s_Ic!|G_V-pZlM!{&k(S17M3r>tND7gPFvUL!*4=L@cO1I#7kW|sZlQa=HfdT?zqFMG%+T1|ofoY@ z+c2PF)X^=9APcV&Mt>SfYUi2K=c<9PugHjka`Ca90LbklofoA6a-fbB^a$vTOE9H@ zL15S$u-wqG$|@PMoEj9rMJDg)%ffI8&%<+1#nOx9Ex#h#HkVvZUU3T=>RwilY3xG3k5G70#H2E znZ4s*RaNf>fH~sIQ)*O+c(@YV4J&_!aJfoMfg{_@0fznwP~%eztevU^zl8`EG66LZ zm_5_9MA|@PF#KS8kr=1sVMZ{mryAfjTgPF9XmN5YV#_A*tpXK|wgo3pos@6uqZmr9 z&pXVkBtg5b8-H9e9(2lcI>MPu9T0Tug6FEXLo(ci+k2`LozD&6^f>^b9hcb(Xs1mS zQXC3{dpvNbB@)fg`y_2*L4RvSfp$8JZzE4ULFMz&Zvw6g3{aksZ;?jzQN9iODLBSa z;m9RrO*NWP(z3@fs`v1SNf6xfgPphhVCQeL^n;ygr0Iut-k>;qe`x1#de-NMcHU@& ze}Ii|u;B;T*vJ_>kL|iRR#p7^^$nZmwDk6@K@B1OY@vuuod_?FwT~5E9%DHTJlESE z6liHYg=-lgU+IwSIew9}#9hH}!urym!s8^P)x(Eu!3cfir&0Xr|mpY=h9?xuS3VpF&j`5AnuH7L7nXG#)?Nyd5Q8J{|`)f+I zjpg-<#TOfN6l1pysXXv0x!8NLxP8~fcC3sGqs^mW#l#vAqlh&Pgd0pSFXm0CZ@Iti z@HBp(A*%vy7Sxu*seg{TtfGs#vWoH`a20}q#4a8)$_*H zWfu3)sWA271T~Z}bIuC~O^iFB#stt^R%9A>vP|ce{)`{11j(Cx+p{XOuh;_$8k=Pc zpeC|vM?TRb^_&+gv`f@A)>I7VzLsFEwzbXpm+L(;gxzC9@|c^u-dY zuCefX^FM&{9@TedJpl!MY^EN9=1uAQ#zQrKarz)9|GCrmYe!~$@2*1o-b1CXbK%CL z0n(s71uJAawUgz)Aw=c0c%`c^UQ-)%jL`3lFfB8Cp4J~qTv#%6O_gf%?sb{9-MkYsQ1EkllsV>2{!~c8g!(0+q@JL2Ol(KY(TDA>Vn58IoL@UlKH_JN zHQ%r0Yn0(BF^aayXkdi;t1Naq052a6fx0QLj?X?TD>D`c^H{k~PV8hstO7dLv)0Yo zO)!K1_8*KiwSh3=^8~zItX@mb6lT+M_)&;VnW06RF|+zeFcYVia}ZN z@qb;n`-eDykEzYZp4aD1Wu1qOscrP*_t!kxETXOtG*yZz$YfUeCwWPSE%&f%TZC=Py1{*yM8VO4X8Z4l+o@Ch_*91X#r!BtoyKyD}T$f;T~T7w~GdGx*!!;bx{NLJGCDYihzci7F?@laYkB(id{bZ4q#np!Kkk3$hBe6Qpa zN4eM@Dt-PNA27-xVlhS^swNWSU)g3xi(PhG8fz1zXd}i`PpJvH3&oM21|}_qh1TT| z`TMZmqs~2r4wQ*GA~aXdW1^s;3ETCtGfR6py!Y1hxc=s9Q~V=6JhDZfEil?j7Z*;@ z+8;QJ>d-E|K$sWzbz^xlfTS$L$kz>x;4nKL6ltAQ7*&DSl}Np96*PgwzwcL>V4h%h zwepu|oPZp6_m+gFIow2O48Gp?KIgTjcQo89&yf-J_5#TsvC>eti&(dJr4ZjCC9J$4 zY}Y(n$MGUi{X(8z|w$$H?Y2o z3yI=uZxY^x<+2_jpQe}=)6*R0C!(S_+?JSZ67ajh|90}viQBmN2ZHExh|8iZ(X~rm-ES1x*3b`1 zXO~2GTOXp-v(~e|Bjott-`^Sk;G!A-h~UH(n@@WTbq&ig&%N{J5Sp27IK`;h-1jJF zql?W|r{XjL)=@o}M;%&6&~xuvd#VAKt9{|5;99~JMdK6{p7^%ybRhEaorb#UPhqfB zVn|i$>Bpw_Y=Cxsk_;Fd_4r3bap=WQL^BT=2gDnBDb0R%>UU~_Sw|IpzR}S4HvKka zO?ub&P72(TZy5i`->G_}J>z(1j_D-_)QWpYo0axjPTBr1xBR|3t>R?G3ONQqcwV%n2SEcq1EOD#Z%}m#+ z)cG4!s}5@)94-%{SL;LePR6S>Y&rGJyIQ`&Hl%?yLxr?@8tXS`7+y%_ly|*i%^yg` zn4>+k1MXmASI{kVJo;V2?xqqp$Rq0g;o$M{Xdc+8OxSaWffvqo#%m!8UL&!E1KdI} zdt4VY0Nb*ZS()I%QK(~EWGTa?Q!{XH$?RfRjNH;f%W{2Q>Sn^AC&|j@`go%W`bqEN zq(yC88`SgWtz(c2(83cpbuDVW28+D>4T=}iXXV9SmCY}u1p3|KAh0WN>>lVnMje09 zPd)8V6xo21Tp(TH@}7D8ObUAJ@KF?(Ht>z2 zk0P2e%1~NrJwNHvEthR~j(RCyqgW4XyPdILEGMiEMy}5F!aXm$4X?7st&`rPZ=<;c zo+F=zuX#BR6Niu^cbDa%9arV5VM?VJ0`I>nu-c^r!>^BWN?K8rLwJ#2${H*_f0lZ% zt&&~AzO~CbK~Z}R&8cOr#Xzq%j>Ml)sU93Q?`mM(_UO|*n1TJiDJ1m{@}=or8)q=5 zM&}P(n<$!**m!lrF3sJfL74?vBTtup<%V4LnYL}n zCGCi}=N6-spLO1Oj8rcts?=4V=ks1htdF#@C}EF+V>>1VrQ+YjO~~dZSo{Pe&d*%m zjxnkPTDV#9++GfAAt0-*L+ODN%qy*f#Q3<#yi(ETc2aS#ts!iKXwcF7`&6Z#tpb${ ze@^x0J-$b|8iP2=PZG=5R->m%RR@FTOefKi>ZmBkMUBP1ov+Mu?Qg3uR=jl-7(bhS zDW|3A_Mp7ryGF8XH4JZ~+l0b}z3)U}zwk`;bbQu^6nsof?R#4F8feqN{J8aDII^d4 zWC$p#y+RXOIGvAo9g-Bo*3gpf)@|lYQT0%)Uu0Xt&&ra_eMGY`^N|Pm_viOAyB}*F zBNYe4l$_r%7hex`pg!fL#$+#VxVmv-C6H#|d?!v`3pFn;y51^-9e|4@i)M>wrk)%( zPd3)kMa0Tu4Gk;YlFIBXdvybm`=Pf_l7`X;VY+ee3MLa%pJ+Z&mXX?jny9hf!UEBK zTjDuoF1xn+vcV~EUrcA>QUgo(fj2vRkIpysT4z6v+j{DycXhejZX3KqWwO%*sG9ZA zF|H-XKLt8#sF3sBmilw?p9t8~>!Whtj?M!tZ#HPi`9I}*(a6RSwUJ$(T1Q-F1zF%3w0Z=ZlgjvDb!jZ46=Q_ zq}W28r|mIvDR)Frhicr!5ZI0`y;Hi&;XL9tSFv3W^t#d)(&9>y6Bw9NSP%3@TO#zIn6?1Y$ zp37-GF?%FsA^qvXzy)8WL1eErFd$n+WPyxporHEFDx&#r460vSW90Pmo{M|RNjs-g zKq0j`@8jQS5;sbPq2QY|e7O6vW2lxuD~RQgbSZ&UqJK-zxh>G#+6- zdP%#_eu($6F0F>Mp*#Z_I3*qE#%|>>a)K4$h-$3AY^M3uN<4kZ_d%ta9lguF!rpb|b&`EN(`Qh7-etV_}%1)9bB23qLov$$TYRTcBI^6{QFu$J2iY*U*Y zWoE^B>{-&(6rY0Bv7dyvPKg3LP$mXFy_xIaI;k(=+lhzS8$7A zQ@#uV56rOvtc|g1#YLG@AmtqkAzy2Ll4oTa-4*$&7l5%g{-O0i_7`g;w`X3rv*xze z%l#L3z34}AO)%%>EvsR`cu2)0dc%t}>U9^G#xD8X@2M(9etN8_^jcM5>bwwVMr+GR zx>|AbF)n$I9CL4k%7>)dV6IZ;`Rd%3)U!Kc*>T6yap|}^;)nQ-h=})LuU0Xo5KKSH zTVpnSw5Gh#8#fnkZQGZtG%w533 z%vwW7{^phj)|&LogI0*+{k1KKt@Q+QA4IhLpR5HRYN^eB4|^b@R=&fgkE^kCGQG%B z%-kKw@l^9Le|2`xd~p^Udbf}R=DydS2-H}?stv3-tGa3eCKkhIzy3}EecN+k;hZ4! zk_cC}+b-*{%Ch+;`{~Sg`LO>Q@!E@MzCL>`7Z4NB6-2L`F&kJzD{xOSY!uinmpL_X zr@Cu)eMieG#-~teUfA#70H>_yg$E*+>@r7El{n-h0**s(Q^7RM)9@U=Z)ufkciH8~ zB|SR0J}Oz^r*!fV<-kxQPnGr**T zPT+;#d0vrDqQ_Q13*m|^H0tBPq4)*CM1kiUg={0+TAw!?U_l>Zi5CBuKax75pOefw zAQufFwDpH<&z7>GRUk&KR4n2OfecCowTq&ocbNt^>z~eZ>ZlRvoT`ZDopFfE(iRWi9md zz;kb|CSZxW#=bP~%h(1ya-s3l-b8Tr-YS0zmN#wSs z1Gm*|ErNz<=Z5?k=&uy`-$YTI0A&`L8Y_ow+Bb+IV^Hf{)vsKs>}RbJU-rh$UNpsf zEvFyJvoF|Vu62TWt?%i~aXNb5UB{u59~EtA{Axp?_=WToh9rZH`e7r}RbKN&Q9>v- zvbPqRC$>^ZC}Qn09?c~Q?fr@qt65Gje)zO3MZwM6o8o#pgr}OwBvd!?hF@hFQ$6d1 z=qv%KCJi_^(5d3(78()ZrYiT@VYUriO*4pQI^Reb1+%PA?h%g`B{f7MQ<0=p${T$5 zX6hp%rb8VlLP#rrZCqE`0)^CpU#_vExM1^k&|^7|LthlWnFrch(Tfi2w{CfeR=TbL z|LIKtjOOPyXbweY#$fr|he$1al%ErxBUY->Q~j=kmqDNgn?O>a!u(24ru}XskCywK zASp>9ly{SY@WmA*#ch3T6!l`h+Dpzi6m+iN`ZJZ*d%P>f0M z+c{`R@{RDfAX|y=`6{9i3+?m$9pfExb~e{nR!s<)uT<}55yA9?-N6jFb#i$-4ntaJ zD43@C9tUO+ihRLWZ`8F0z?PXEn0i)F%o!RK)4^n@iObK=4+lX69nCP{>~R47r7azK8$nLih@TaEhr z;v7Xdj6>^7%3@xASy|a)?|f{2lsCb|2upBKx{l3!tih%(4t=r7Lh2WaJ=_5bQGXX1 zrwNlQij)N5J0Dl2GXJ#ivNE5?AyH9`dZd_Fbhb%x=uOeVee8ECJc`>_9|CxuP{W%9kJn6N*h<6^=r+|20 zm~ybfyG6qMobz~HjRQ(QCnZ`cCpALOm9sNVQ2(U&%X`|x8oi`?R-x^Q+TcBJHUU2D zK2%5oyC2mx(ZApB_%>3w7fO#^0n_UZm-QS=2;w`kmTXjbGi97d%1{@V?6ty{`8T8G ze>trF^~Uq7a?Uu{%`7tx=s~WV1DB<48mp@Eprk}FSN6t~SSXVPlV5g%n&CDEX4Y3J zDg9H8HRcpzewYzYHJz}qaKkCt{yA5LJ07wK>E( zN@~t{w3H+QXID#ER3%Ic=>2X><}dHv{G}To&K9~3lIOkQSKxfa?5BZ9J^fzIEBSVv zT6KXGS5Ytc{elwB1pwOfb51`FE5xh4OLx2v=Sca4UWmS-J$`Yuw-ho+xsyuta~8vu zd1cD`BgtgFJ=LGk&hG(2U&7hDd>}apCrs7i)z-SFkD;>ezv7z*RD8dDBIZs$i???c zC0g=cTgaZlDFq|m@xqAaJYWO=q@=4LUg1Pcl0z$DTM@81<#|OHF~>Fd-jup^-*p|IP>b81ESy z`y^btJqj}0hue`%B-HlQH~_zibdK;2=_f=Bog9MW(Tn)1bA;_sr|JyZ?BPZ!kd9)034pl7IZ}uUz@@`#%k6w{T<-(Tz`m-YH}azRH&enrK=Ha$$> z4u-#x2=q^qhyMLDg(oP$k6y0y^_!ZsfF)Difz}j{jO8%E16S`nBEhMdz9?p+e5$a zn*Cq;ruT(6H7Tr+QsIpIc+Lj&nVkBPWn_b|3DV Date: Thu, 16 Sep 2021 10:29:47 -0500 Subject: [PATCH 3/8] Added png for GSuite_DevSecops --- playbooks/GSuite_DevSecOps.png | Bin 0 -> 239611 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 playbooks/GSuite_DevSecOps.png diff --git a/playbooks/GSuite_DevSecOps.png b/playbooks/GSuite_DevSecOps.png new file mode 100644 index 0000000000000000000000000000000000000000..46a1bc362c89a507dd5aa3bd151949f1400873b0 GIT binary patch literal 239611 zcmeFZ2{hDi-#;$dN|DRhRT**F~k_cAlpzxc4ito zQ^eSJ#$fn=#(jV9<@ulc{CqpldG7l;=Wz~mnVHY^`Mj^|y}aJr_3W0uCeu;Qqf}H> zOj40OOdxLfTxR8+@YA?oV4wA9skZ+XBRA#M&-R5zc+o6?&Zwy>vL zym|Gio0|32iGY*Yrh?~DRMdB9xy~QC7oChuEI97pLgC$W0|3Sb0KAET2|2{i+Qo&$;%qDalP2 zy{WEr(->vazO_u({qp?93%Xl$+jVW*TvWH$Ou5-C_s;GWy>H<7=10Xle!lZZo1Z_6 z+~J2s1g&fm6$@Lyi#*Z^TCs35)1!wU`IS*S2`=l?cHSDxIh4}qC)=2K=vJ0TB}Rlw zdO;0T`Y@5!Us_pxPGs^$Bb9UX!>bSZf32K1X;i)-4lAKfRCi;Xzr@nu_t3Y=H`P3J zyzBHB!K3ua$16pLZZopBT&x_P-gAQNR{WZ1r4Kf1&|uT%8)G9iaE`VnorTvMJ*{p$ zBU$_$tUfF}COmtbN}IKn?@ips2UdfoC+mlgJxwDGzY=&F#e4iDq3Jqe?M%{piQ|p; z%QCUoNvYSLuAjHQ`0DZH4{owL{LP4ZcHt`I!XW3M8 zZVTw@hP|aOb_f%Yr?X{xnr1J5<<`opH{NjNmNa+JR{lI%E8nA7&RFdZr)4!yWF4z*IW7PDF!_kv( zJZ||%o0|092$p&pkNzw5_OF<(Bdyl0mh|OM(0x)pTJn(UYQA)Y)EzpF#-(Jcqn|Ta zjy!a8wqC0LKy^x$oOm9&GQ)6%UW1X&@z=v#7DAZ7E5^l%!=;Vtqi;T+{J=_XP~?z3 z_fn2S_UmR{AG1px#O&5dB<34E=!y)z=(Bf?EVeX~FP$T~#twbrImc9__OWto^i$W} zbNIO<21lTeG#|}A^7%5a_1+)D^ZqQ;;Q7$E`Rr%#ebg0CQqTEGEHDq8m+Gu%3gcTi zPX4&0IyG?EWg!0(oAJHfdUC}vbRegYVu{q5OU!)quc4u-dH0HbN;ba#uufdR-IOe8 z1l#ET7PC8mH_l+*{=g$ze53!++%ccCijgw+)*n9OZs7d*qMw!a9N5Z$&ZIB1Vl&Lo zgEwZ1XZMp(#&hk~RM%9+G!^0I6xoGz^QBqdyB>{7xvaXTPNp1G zr|_H;v$LXhKe)mrIzzD?k%7ZD!+1P?O^;*!$ioQ7``Z%GKfgiR=R2 zpT@2|gdNfQggy4~$VaMj2_DlQM|M5Lxg-4*UXvhk3dc}_ZP{D<@>DzS*!A7Yju?jM(?=oZy@!g((~deY5$xbal+wX-ay zja)}muf2A@cuwmE=C#Q6m)~9|eGAGyW&X^F*W#7SFVkNV9%tnvQRgdON8aRLp(8!A z6=1{Nh`R0Sb#W%Dq+39mHSM9}JHzg4UWckqiE1LcN1V9>&elG()*R|dbY`ZL@O~MV zbT9g?TvL;6v9!p^SliO#69vZ*UtEecHdBji=gl}aSoz1iQlBY)VLKbf|5GXGs4|yL zxakkYWrdxKA#9;feaCH%NQbk24*Q|=gQe+234`I0uaB;L@%eK8i{Ph31%}0E*Dpjk ztFMIzO2)s{OI5SHHmo|V<94~6mFHyO&5LgiwS@gLcz)@D7Ae~nqkwV8NMhLT(C3-z zS#=n77>nwP>gg588X$F{iG#Pxgk8G6Z+!#X3zvw?C$#e$@Qd@o_~hP*zgGMfd1)QDn=Lu*@Hj&k!CV2N01Su2b>M=(H-C8X{l)h-95FA$IP}Br>wNXH+>*TUJdc?> zGsj(|)@9d4qclo$XnQcuBorLwGI(V0Ft~`$szECv>vP}RtlN3Fb06FokH2h=)sBVB z-!8pXs=NAd@=}MGXh}jDyTuEHj0NJ(?8ja`KC{zPm9v*-^{|NV zitqb6>reL{JIz;tJ+MLYi6N65XZn>n&O*gu*j1Qc%M!U^@$@^54UJ_Dsh8!PR?;() zvXaN;5>6LMDc>7*_#$!SN{g&H)Z=?LHqM>%uFw@LXh8cKtzk@y?c|lVB>tokM-4|- zM~_lbN2Fu$r0k^DE*ntj~6-rEITgI<+=EGr{Rbc2+Kl^ePt+=>QR=WFIY=4AV=$~EUfbB{OTHxkd@ zqBo#_-9Q&v&iaT|nXi#AUt`!STcPAE<5}0UJPMMj@6#sbaf-E^5cw<6U(a7VX@q!h z-0$=roeb)`(R>Nxkgk)}#$_64n(hjpm61!fcsq2qg07-(;rIeIF>0YgY3f`Sh&=%1 z7qq;#5*N@L;1ggT01reGtEQ2&+=SZ3?E>b{{QXYR2C-e5HU{`0JQ*EIlHZ!xoL>o4 zZgq^i`@Q^j47r0`xofdAbolL|=|d@p2M>2pSB4pf#e|E5Z>kMNq!-Vb4HS$Nn11g3 zjQOGdnWrB;XFfN{B63kF`(n0?5x=w`>cX1ZTYobXGd(lkPnw%AmnIpmT{mic{xs#R z-SHU1j_K&N=c#P|SDtgmvlz3k3k)iQIY+K?a&yZE;HCm4O(e(OZke&PJ+op9RO!6z zu00I1dulhgMWU;@izc@*42e+diR(BWv!#pQ+vbCLHzH5#s zQFt8o<;uOpr=s~RwVl!5M&rom`DL9n^+VmY7ezfThv|+FAbb^LfMH|Zijk!8nY$vZypdxzYs@ig#EJR<(N$G)**4j7`Xy&=mGp-U)R0+1iZID9X3!u(T@K8cEi2?ToKX zgo1U8nc&smLr?DQB}@y-x_#MUPqAxtck1K0VHBbj!XOl9ey1taz~d0yDuj`tlE z<&R)_h>}8~A?;!C$Mxy*Ur?uzk0*}xt=YilVg~UZ_1miRYKVwg<{sww@8`X-vsJT? z*XNn?n4pn-%oWmGGUv8BrYpGh9QEQg*P=xfwdJdRIPVpIu>*CynJgSPZ|14cb*T)r zoqOiW-<;|OV)LGvoBoL9@BG+#R&h48d^&ZpvVlv$+;RG_3)|pe;Q~84t?%nX@d$Sjyl5LQ;_tfT)2vAJ6$L#2 zF^>{z7q@R=T)V4Rvxv=78F!RHvng9iYn3}MMiQHfZrd!b6V{13pYANw7g5o1B_|!J zPvNHOzH=zE!IR4&bw%VV@6(kXg@^T_Us_kk9{N$=VpRMJQ>s4mF!-Z6hnjo;sk)_S zYE<5yTrNVd9jYpYDnBe;ygoI*80vbADv$M{IA(Vj%|s^Klz+YpJKU{w!=KKWfi?Y% zY@|T;GC~r^V?ejA|2Q5pw?|7y_v)0!x8xz7IW$G4flnTP)v)3^bjQK=cKYiR+mhISqf4(^`LFfW~(reeSwNABM=_oSj?zeM>x zq;=;a@TiCSAx36iW_r2`b}*>eJ$sm~gP0%mK4l&%B|imV2zBtf$Lj}mbN5v616|nv zh5|6Aye)o#cmFG1uAmEMdbfDhVIB^=vSJcq5*L(@^78U3dDuHD+_|pt*UN$bKo^|7 zyzVQAi~IWeiup>3!91MACFSMi#U-wYU%4U*d_&aJ-`(q;pQyVh-(M#AW1i~{o^~FP z`(6;3J1=G4d$urdFVKYxlpFo+=P%Fc;0O8po!mYDN)|w%IOP*@NihlWzs(I?sziBL z;TFWt!Oi?S1PZJfa1UikNvSJJ`xpHGKKlDD|KU=zzh5dPEqV1HFa3v){_Ca2o(>-B zFeq?SFXg{)*k3RH#}EH{p^`X-_J3H5zby3ryTD2-A5{|n+pZ}e&2kx`Y~@+Vbps>d z6<{;U549}tN8m57z?fPiLMH@qnTkr4O6$6sk>8=Y5&Bea<68QqSU1@t7r#FeQ_haK zuo)zK>eb~5!5a$H7oJ|=KE!rIBqrw+(+39T>#B!X<0i9&t!`aUetJhV?iMX}2(4(k zC{a34Tj@&-m6NN+`)B-0_nd4G?F=GZ{u!*iy?RVX(Azkqqc5w})1I@o`x>P2X=kf# z6()7S6SFpLh+TtVCugeysw>wwE}xX@lxr%k5DE&6eRhVxHQsN*hOTXCe7PF+U=Dc{ zKWcB=L~6RaVe%LTyCOLrWOp_Y@ufm8>FoowWOS|Z&!H6E_N(~Q&7=8C^Lm#ZQ(-Ud zV8)yOj%h_q&X`QM6Ekt&Zf9ZNO4?z8*E^=Brpcf{pJWC9JIPlZJRTsS*z(a{^ig!s z3u-j;ji^moydT!~2Ks-&Xe0c`&}B8mZOBg%XPFfnHH5t9B+9?LHDG-2Q_XEj#$l3j z%}>^mF)mSXVROYC>&W>3mQj!Ei%es}x7Uz&kDIdRq!ddsai~^z6T@8nXMRmfoV{H7 zV4-gnjjW?T|M!hB5P&vKO-;_8fh2_|zD7Lx2!wD)s*F@evb@x<^I0#`xYTnyY&!kLB!N!Ni`D?-x0`_h%#>_8t@e8>z`!zvc$jHyGhwOu=a+B)mi3veEGSOt zB22_@Z2>Sxx9K4@1iG~{`cLoQUuX_fe^^v9w{ zXsC9(bk}GzU;E8fRJEa{L2d~V6n>YL>7pKH;xhf?&prCxRYV_U0IwT&djAG1t6DI6 zd3j~Wo0v<9mbH68etqbH*7l;s+?&=Q(_f!;!E-bGq&w0<)kO}RRnboBx=aRR0}{B0 zdZ$pF5-xHVeq-C{w0Rke3${DgvHdqVxIS2P_HFA1kjvKU7Z+U2`=2|_%}$(|J!7ob zEu?*i`!^Of6G~%ZPDVl=%hkc5y;3ZU{*y%paQ@w$$b{kNP9nlxW?dg#!cA_!nfV>I zhw?3rGRf-jX-2uHtRHK<=BS&Iuz)7#{P)cL@uwq?drH}{U)S8Lr;`(gqyHP8m-pL= zZ6Uvvmn_c4EE2X*b0#%}fR^_k{QoC-Caj#5<=FFJHYI-zKy}>^$XELvk#WAJD)He+ z0bS0D8&%#jL8X*>&iXtb6sM|N#cy$whU%+Jy-ECC42Kl|@0tEJN7MaBuG8Jj2oad| zgU4&H_eO=Hcq;67AI9<<=8|>j1ckomVJ5WZbeK{$v0$WpKL}4Q^v#Ji*mO}>3MCIo zLAruBV9xHaSn$Na5ILEf1Lb1U9`rkUY@U|x%4t+(A;LReF0)B($hxI`$r@!5Om5B@T`+V4|?HvoMRe+`iH~n+=i727Bu^d-3JN9&M=Ity$Bew!*rFs##1eadhZ@ z+Jo^XII?_D2wJn;1X;(K8ia0PGcX-;cuVB!45FyBv~zcRF++LtGjk4`iP?EFsVh|9 z)bhcNs;wCW!GABw&^P9|#@ zEOdJa(!eCAJKh{)@ItiQ4D9^w@f{~8r;zE!XD6{GZDJ|JS(#qzzrUE5jxVV1R)hmyp_tUcB!I8su&uq62$7k|*^E6IZWrex`AewEn-=JO6si zq8RLd=E4)LtNQYy=#a|0%Q3k;J3r_JhkEiyC7n7`QO)N9vtNj#{R$!6+}zX5p_}Sp zyC|7Sg}&e)KO=ecXA7&{TW8o}a?=BZkSL7y*LQceSK7o46c;|(K|~mnqBv!QK&$Oi z@MRMp8leeytMuO*cAAYWxN<`cu^XIdsrTni*^?U8>)k?(g0&li zuDFkPSiPEFp22ZDKUcJOAmr+$Bs4{Hr#N<{TcxJ!%TL64HL_~PHI;P62^wO)Fp4Yn zZ9d~qe~aGyDn2=$;#Q(nMVd@m-My4(`6gs7iw8a)qk`saZPm9|w2e9~`TkUQz^~Vu zm}J+&q)wH+9n>OvJE3#pYdF{8GsjA@jF;M6vpga|&Nz#2GkLjtZ`cdx&=u`hV2`fT zA_u2lKm`AUmH(^KysLKV>SE0*X3(`LO+5H9o5{_AqQRbT(I$BEf-m+E{n=a9*_=j$ z!Nd`)LC8w%j9GbvF}tnMf{)C-FOR(X??q1Zy*vj}s0Cyz?{sUx)VoMbHE^kmgfJs` zByh17f-LK8Eouq3d?8lloU9xi;63-~r2b7!o?x#sGDb%n4o?8*4|ZO&GM~TK@Wgm~ z(Z4GY0}EMAaS7Zb6Ahfw{T<8FaA%|(+bs`$oN4)i2ew%4k1c*1VX}VBB$As1mkwC_ z;I);O%>>*Up)r3Ne{H!UGX_5`YxTANQZy1l5y=as_bTf3Ez-pxt5x}<1@ znGZoCLpYartkwAprdc?*+3utqi{2wInhqg% zMTJhIc0Ag0L|&C_+P>JR`t?QWk-CFL3B!nxdcjRWSE`2*9i zQ_p;u>5!|vWtb)|=q*yTx9rwUy{^Dzcp_H3u)26U52FijkXbxXaEqKhxm-F3~=e)z|Cg%?6>20gn7}u)cbD5SQvq^C>jB-u1^FG!yT--BEnV51IRdc)C|xl8<33OPrtL zV25v#-+rm!@nf=VtvHk&qWg1*xrR<`Vu4g2E3vgjw^nzn%1b#&~}N z5tQYY@UEX^x1F769WoL1Ss4XpvwyZ^NfH%?uXZYDF&p4^E*XHxeJElGy=>^c3gLy# zi9KWASF^Iii|&t{Y&eQ>k+OOjDl6SV^i|-r-1J?YR-cmm#|19qI-)Yl^B+evF==&Z zehSbk`>7l}>fN>u-?`P7Di4k4aRFjgPK0mLRV#_ar>tq_?fEB4k`1+*^!2cN=u{li7|+kEH_xlxqaYuJC-XyiD$g9cf$?q1W<1ng2_o8&HF*>i4i z%=`Po=PcPj<#R6vF9u>k#9_nv-D!hRZA1||VBSb!4z=o;nLhj1ez2A8L@ zVsgrQ!HB^Tr;K1sB_Z7c>J(OFY-%L~BK?ZR)%OBBcc=OyvZmE#8VU<^t(s{SUa3SB zlxPDsId?@K>3*HYyksO1y*dvo56JT;!_s{Mw!W6hO_I^lgYwR0gayT1gAm&;w310i z;lTWOhIW_owq-^k(#nfCFPC#Bo_peb%+p0Dn?A252tT}{XtftJQTw<+JC<6Zu6jG6 z)lqN2-7$WrJGD^St_hW}x#67$WkqqyyLfR*Il6J04;+=)ej%%KPd`m5?@eLaa38^C z+Pin?&S)#Kp7<{QOOQogN>HdpTU#Pbs~+!kDSGKR{yyf88v5To`s}j=z3d#1B$h_< zr0Xj!KiZMs-6huLvYA>+E^=^nDXr>)Lr4>=?+zco%A4jtnS|Q~_A!~=CTMwQ*k=fu zSXi^tT4UpCUv2JC4aP;!RRMcdGH7M{>=K4iyyn(`v%~dyuhuVCFGNaij&^kx5i|DU zcbB>k3#MdnJEcC*Q26yqeMSCo&r^ny0^&vm{77#4RhBm7=s4;KUdPnh6I!>>*Qti6 zB@T-Q+ZK&%uLpHl))164v;ZZGPpPyotgNdXpKL9>Z%E)=TvTl&mKM35HYKep{rr9s z^Be|#2e!?;W-`#Rus5HU=lScK_N)z;j9!YuB|YShOJbH@xJee~i+Q)puexv(PobfZ zGG8FxZ$YB%r1nKKBTr5aDGU`{u|eNBgpYi$5tIU}ffQfB|3{3fxr0&|!BN_|sU9v0 zo0*3_UjitwrbG(o;$PSAH&@)8U#*L4LN7(oTcZm?XbA_y7PUa9HrHMVb4wRNLVo=NF>b!s>-&<;q26 zoM%zZiZ-X5yCq~))$0OKo?-&4$zw23Lzs2R<;&pnA0r(*Q9cl4-{dLW zB*PYO@(C-hdpqoz4)kbu=hHWeJS*?MX1AMmQzsr-H<=BIA1N3Vd~IS`zRoT)HWW0j z_kxY|A3REtqsR>@Jzxeh5^fS>9BzUj`i+M%fF0yUowK4a@`O~w5p!Wim|mKK3}|aA z3(_~@qm!j6o_g-n9$MPXtXxi4+X7l<*@>uHBMzAkFLF46IK^%8NRn=tn zbbOs6xY*9jrf-B@5$p{_ELqdi^6dOH*X66Kgv24e?b3)L#<^K_4I8K0p7#?0L2c)H zKd67V=x6}? z*I|G$bwrB&s^;FWVxF?{Re>O`RrF^AjJ6v1Vm1()P&q4X(QIJ#)i0hA#5!?qB2Ik6 z=SBCjR_x{6n1w3SOBZFbY`hn1CaR zArqln^F6g8rQ~W@og@>FY|V*A-S|vn?b4E+TZ};|R;JJp3mT-$i)F1p?>5m@t4gUM z+Q;Gy^|dt5KDgewLQvV0M;1460up}u12^(HQKVdDJ8n(XIWm(}OLm_?$)U5tc?pJo3f^E^2kmjYI@o6<0 z1oA?Z$efg`&*Hr_3L!+G=#>@c@ z9j7_g1yPvVDerl$$gnQtOUwCp8P>2{S9|h#+f)PC&pDyxIE=cG6~juw3#Ig?KGCi3 z)nR9y(mX?|ruY+UB_-;SCjJ_rCz-}^*$RK&G0Z#^<``kZpXPOEYloncVcO|~1P8C< zRzr%H8&4W!Q=$kw3P7|0E7^S3aNZz8xwhm*_qUzlCtU7t-RsC3fL(PfX}LT-nF1^H zHuSNo9Z7aMS*mKxp57V_cz@E+kDuwL2b?nW($dn(1mRtwJL5c%oy}#)#@qmW`9r5F zT?7sC{U~@F2QilTP>1hQKfYtc+0*m7a|gdFr1&-7_vx&t{rY!os20Tmq^Ro@ST}Oz zWdQGQ2EJ7fQ+LoIH-KmITBsyU#%F}?l2Ab02#BHZDFSYG+b?y%q4ibR+gU}BIc$Q8 zIoHsGXd*Ox18xug4?zB=&)^uqG*=;n&ZB6bQrX5U!Ozr`HoGceQ{XJum zz=y}IYq(q zuKp_3?tm}bu?>>31~{D}%rkk5K?KF=9}&#@;&nS7V2_qd2)o>jkN}0XZgs@G4SB|N zI)Z2CZW+1$Fmv`C3H)G<{~Km503e*r;{IgCUkDF?g<2%vpLr&4E9zFZtihEHL|%UY zMu?pwVBBvdFBkh$lUvHhwLMJAs@%@k$M9{JP3D%Fz|22fB?zyR@PZC}4O zi_tgfAzRa!{uKPqgN-#NivvkC`oAOUA~W{ z|3o|lP+SOa!d9xpy=xSlm_JT|9$=R|cs?;z-qVp&()PM{&{sB7-O#;lJYs$<+B|A5 zL8gz1>+F=lEBI%NUsxKX$8)tlXMp`x@LdaPh-2iU(7?;c&76rL1^akpsd2jb{8ROA zp=-C9{(P9RJCm~S1#awj!2sS}QM7-T2dx;9U37|S6RQ@P|JZPx)K5XnivsaX=lp(z z2@XN?eZ0KA;S&iKVtT1pi)G`QVt8!knR%3zcocs;Jd83ubh!R;^2NcAwpV4}< z0~Z|>O&l~Ooy*oRI=K{)Q9xt$72!JKwWvXMRQ{DmyS@3mI-%ie@0hRFe;w>8&CN76 z5Sd5C8bgDTD+Rd4Mc|E4S}TJ;Z-0_mrgXYpfEZGS@Z8#J#-0*4AfC99tdcG(p8+`P zIVIFPJy+T#7FD~m(gt6`Q6hFB+w+O;pME}}2xyLHr#ycYx1wy_Wk$a!E;+G9Uzif$ z08%1a`Ny4P$^k1Cq|Lqt4qE<-AR8KhWVro*y~g>JtM>w70Yj(?5KDrjdH1#yJ#zzc z4M0fkHLS4KrEH(6o%qxcKF7=*VCBZ?xAC06ud#vwY~ir4sQ?8feLpfTU`WuV3q;iA zu)MFPE>ofvIA3N;QA&Yn8INnrhuo_vmez&W6_c$+8dhAakwVt(ZsB$Tmc)pMlG=bk z+SD50M5*8p0b<{&ZT_@?O*1rHq@z%?JKwyR)+q!Lu0|$>bP7Am1a8csn)x>jx|E4Q zLuwVRQZs6_$oCg5Nl$ z#BqfWxrXp!AnYZ@eZT$?yf|H9(XUxC|2!hay(-Tu03L6mZJ@M#ol`l;4^q?H;)8AV zX-k%cf}sLyr7CI(jvOU79XLL=iOZ`1QR9+k9pcDd_uA%3gAG5ifRDy%31Mq5Wv2~l zeb!P_&_lrQoRH(5R5 zk^UQWzN=3eUCTjzWw*!{3GxQ40=#Z_y-2UlDPGZ=gJ|HIhaXv9*#DQ1`@XQ8ri}%hRP1VKPt^65IvDazv8?Y!dq4 zxY8iOU-AWhBLk?K=^M67V;)d6xa$N2(SDxUUf3S5q^N=yA$}&DvLZvFdArM7vwONj z3!BB#xd_B=;~|Bi{6(klEA!55m-3GP#!b6rsmVu5P#x-P_s#>Ey`{N^whx|Kp&`!juLm_ml!M@ml%ne_jtVprTYmBSfI9yn15U z#%k>8dg!PAx&(RVOp+J4+eP_vwdn5c6JcvZ zYmm+g)cCMIclpzHo5G;UEG)-ds1ad#N?fWgwnw`zf26yg&yA#G8AAT+)YQL3#bIHr zEcVa5CtIYh)kpu|GyUH>{fF?A-y&TK{B@Rw+=H*-D&CaZt%V_&OH0JkONaeps*dR2 zuXp;`Is?-at|5s+OVh*5zDb1!3xSpiDyUy3N_OV{O#vFlCsEJe7)AbhbHL)v6&4*G zjapFbGqB^ZDuDKWZ+-knEtqzxQmUz{L8(m^V+1`IQg5!u`GhT&TM&k?Eeo+|D`@= z%mykNsY!z($p_|%cAl`FEDr4#B2|7fr+Ws*sh_~-G*5C?cMroZBWJf z%*z-;(!SX$zi94^k+&#rhT$sJ}H|1k;KEtz>4< z!+y$r30*|}Q#P)aceDIPcm5x3AJ-kYeroS0@nV4*kmMYL6!tw6Y9TO;$~Nsp(CiPI z)G@AyX1O$Yg{y~hH|cnL1wU6D*RK~uAA0Joy@ZT7dH?zU;8)qD@$dxm^U#v7vXHee zjI>I%C-%3_jP~5-2xxj)lShcGwE6N3c1Ovto6)9wcl%zL<>FLNUe+roXX4`Ght_}> zB*s~$tp*dp*x*o7lfO^VT2UR35FQ_`9pY@3z%%1gy>kl)cxps*rU5`S1$Z?c=@1%f zahdt01!;|I8POYh4+A)X=|6-MhUV6mQH`G-d_51{S3=!c^|f_q(b}aQDO?79h7|v{ z|56KN=DQ%MGYucHyZx>VcK7odcdUXY`nA(rla?ze&-8mgA2-LXaP)E!(+WdEh0$q` zgBbC5@ggeH9`+6?Ic`pk8*R*GTHP*2;7>=_i|XD2z6o|xO?WnH+wO`lT;x7sTcSee zI|E*zC4F{je&CWz94yYh%X@QU?u1OMoOTI8At=!28RrDor2$WFG^qM|)JoKwxys}C zbgTCoBn_<%%Sc$4*zK&Ktc!t#4HZs_A8w;>zXA3A94giMF7SKPa$LlF<4I`LX!WRR z@Y)~1MUpv}CoE1a1q-+|R&dbZ%Ylp%Wb%&` zj;NQhZK#w}hi<83=gUyxLu^Pns$%^kXz%;f`pZnJ1%}};?$n2dL5Epp<9=As^Zz)7 zr)pHVwAuUl$kng^gI{HQzF5*$^tQa;F?Z(~Ez;xYesoQML8N^11f*qIXM)dMfVeQ^ z{$YVyN*ItZ^U@X1`R``8c0q+n<}khYG8sV@<6uN<#pRx41N3qskZgY*D#CW~cw`v* zXhCJCA|`OO?m%G+E2>pcn)1|{yu8lF_1zZ%+a9KN z9_SDeu+EA+=<^?y6*uVEtfL7XLdizT26flk$lL=rrFz{sI2Y{Ya-U$jxrS-#V zh?eOR#xBnGm^sRVsos4>S-usHxn;_K2U##6X8=4z$MYm0FdOy`fRQrN`0Cut0G)T) z0Xo}ZeWeFZl!Yk+T?XriIxbNZayT%p`Vu_Q9-!@*2e2z@yWyaN7kE3H0L@zFlB+_bt41Dx5=c=l^{N!6%`Ol8 z6DzBFH#6LXp68>@;Dc?b_66TzZv%z#K&M;+Kl&D@4Q#|4!@n^YTzIROS-j?In(yZu z@JiM+=7PQSwRO9gP95%m#-8bSDm%r4b-ObeIh~!IE`ei=;yEK5gW?&cu0byNm|QF0 zLG<8!{-bBIBQD!spDXb?Fz`LnO#jO>QrLu{IinQot>Mr*gX}clep#OFvEpX6aLLqb}==S{!S2~7~&TsBy# zG~HR#g!J5Knk4(nh!tAy)v0{q9r2p)S{+QZNw1o|_QzQO5A?Pch+TqK3OOeh6m}6d zx~|AF4Nj1YQHVPwO5R5tPSIB)Spe`JLh>Uvy?-J0CS*635%V#$Xb&j2*H>IDhCv25 zm&Y-16@?0E*`iLT`R*yl|V_UT6r2KTQN_EM?V6^hgN7O{5YzM)<+Iqf(fF>=NlAeXg$`09QtxaUb zv?I=v9@}AIp~P*MJySW$_{iraVWpk&DpqT;Z7Y@L<4@I@b%%od+JfA&I#k{$hc=#v z%!b*XC`T{B(th z?4n%X+Es3lUR(2JlWWjwlP|WwF$h|HHlF5!4Dkjt@COqzeL2|6LE<9;<2cgG{fZH< z)<-pa3%<2dX-j3|6F*Tq*WXEc_7Eoe@0zB(q3u&HpN%eaU-yhLn9JBT8DK;B ztgWTxr_Ii(TCZK>Ax*i%xsw8pf{`D0Jf`2T zc6BD+pPl!G+tr2Gj&^YlxEu5t`?TlJ53ha83e_Gc)EQ9+o7Wdqj3-tMr|YLJji9ia z6?*i+ld*6}QSC-Rvh~0XfQOqBn?nCcw^S|BJLOzTG`pZ82Nc^&+crL}0nUO_soKQE z&AZ?%fGWgqucv1+tc;Gr^wO_fBClq|Vy?tFG2V!{W%|_L5Jpf9W}&4msw4wqs3Y5 zWr;Wnwp$q@&QYvGD#fU;)&>Y2T(>!e0ab2nzR+YK4>sr@)8q@EL3{R$8z?1h0I5J_ z6_^1BWkn0?W*6|;S#>)q{(0%)CIc%4$ zZQy*CE5wa_ScdXHMwr2f^PxC0w230x6C8UVr4zgZR%Vq2hh#*z(e};4MK#Igc!#0|!!3J7Q`W;Y zPd)&m%@VwPE(H+n2r~e3u+&+`{0Yc$p?fCNn3(yU+jk@uy%s;744$cUN=rAfB8ie@ zYH1&?9MO|aW&%4*lzud2-)fB>4L8XEtvy7|M^@x_wuH3#+;8>q$ma&A&;|!0W%5S` zN}X~$gns7A$EUrmT6D&JTeW^L{TTA>5_?f^tItTQ3tNnv=+F)^fz<7zIG?n;JP1^m zxUR`L$Im;KOqe_K13EaOGpA* zo_`TuOp@-tJHPK}bW;Nwk3CapznpCqXzX`EuT;w)7*05=gqhGIdo6s^q<_YpT%q6l z`IsYjRqT_%q8#Sx=0h?jdI%P4Faj^(>s>u*^KF|9UAqK4a%0^5w>a)vT4YsZyVzEX z!*qdXXIEk%woJt!jZed9o0;6n?LvgvV5GI$>zxrVS|r*6!WR46S-FbCy)(gx(8_1e!vWO_L3ey&Ul-!mtW3 z3t`bKK5pKf;;>3k@cbq$VUj~J+~fumlzJHupXD4Oiax5}VPioh*X=Io9~g)Z>fcpk z08`4Ev7>r*^ZNZu$JTqx`q~?==jv@*Q*zFM0E^6SkqpFc z>WEcd_kI?-y)6X+l&B4~&aSp17nTteRF+0gpnY1xd)vp08BFOxz%4J-k;ewPFlBPX zmfRuuz|nYpg@t}hoOyg2vP1%VBhflN#1~J7dxE^T0Ko+^{@3o5jfeB>T}<0<;K5Zf z1&h@UmrRc_?#g8Ze($l-qV$9f`eiX2HRtFiC6^ES5O#uy8aCl3QT;x3G0I`@fDNCsdXSxOv~vw99(wspVVUIk=(Dw~~C&+L6NPSBI73%SlTKq&v@N z6@S$mz`4t}`vR(gIxf0&qWx*lA#7yIm_ZC^(#|;7((4K?7 zi=Y)=vjPo1`J)Q8S36F5`vgjeO~9*ah+Q9Y;&cfG zs&C)|?^B>U7?3lyZ5Pn#1IyM_iYfxg?&rJLF3$u#=rRa8KVQ;}_OE;0v}g4|3usi( z^`2>LU00OzC)X_W=yuN_nuGbs?@Q8qvNVj_M*UVrDL|-}4p~M23V=mJ(^aivMy56) zx4~XLH}YjdLiZx3KW3rh#7m2Ss;ByrHj%Vw`K@m=ofZv|4k`*@ruV6C*tte20Ei4SJ$ z{w1n%V*vV2xHRCpwt4&nC~~c1XP&E~hIpVOmK3rPySkdJQnNG`L@dw%%ID3eRWQtZ zL`Bm2-gX2dw#dDOC$Mn=rAq5x%l!J_Mk zc42b9Q<^k``=Wwj2*FHDTbu6MiCdiQCa)R#YRgQYkpY8h^tSpm)Yh=SBk^6n!{ zoCt3m?c)nEKoRReZRk!zDJI3l4BhMiD3;(!!|iMe;#ZJkJW5_$5yqxhFIvubrOHb| z%hxq^ysPMuRei#GgZ*#YPxtHQr3{5s9 ziJSuj%fZ{d@@KyE9KPC_ypk}4?Tg-XEZe!G6J?+iwQbt%_9c%$`!%1YN%IRuaByV_ zqv^&uPWj_SbGzO)mp=BADaC5mqB}+0*5R!Sw`w2f_-sv;`t0c+*#vZxGBb>9^MY6WG z`{LWFtx~;`T$3S#UV(SP^^`xUDVOhk*34E>-XZ|+ZgHWiCJ7w5H=3f6y+P}^(Cm4i z(NZIoS4Zqw0Xc<+0To-XN{dXea-3d^DAhNxYpP*QZ9QA^u>;V$R^;}r0WqNbw%ELN z(pROVav<8o{HE{T+0<1_JWE8>nlq&c6llWe^Y*zl9%8A`k$a$?;Cxu6H1iEH5xlBwOc zT5NZ<1`kxuR^wIp7bzu_R)IJ;WbMOkTrp6TGcVJ3(<%Ldw({a*4jXOYpsS8;bGvDH zf;OY5bd^FcR_yM;5jBKR44wg{3k19zP)8|#e|^viz=#_xxgR_(J7`RCtp`?}&gWwd zK=%qi8cWF{87$Uioa1Sq6jqMC`7UpJeVP^UE9NV@tRXQYK0+NSK&Q>%PMxnnltUVz zN}MtRLki`~!YtgY`O>^QNsups{MqZhR=Kj4Oy;2NIZr`GQOdajBz?nyM}meqImq%6 z`3wsRnv-$-`4}6YNEYz+@#)phNwf}-2a(on?vzUnw8G2jqaVJm^FOw)~nLi`h)!nND^lG5q^Sa=U&gHX?numRiJ^8kg-~e!h{x>aVG->+k1@oPO+%GL@Q-diq;rsn|-Q_qj+5R6_;$Z%j#Eo*9%nLYbG4h}fG_7MJUzl`dlH#bS^3VXX1R(d+!cUv@ z@fi#T`-yHReV+XC-4lD{Zm``yo!tmzAiaH}b+b6Y0#T=XlD-xQ?S1If!sZ(2VRQ9f zgpNIY-uoX^;_&wxi#*z|zG_Fo4n^?5eivH@`hqlKzub=~!Tm(w`u-Z|r@h%-ByhkB z<*gu-FQ*|uP;gx=14dwv3ypDA?X`$??%>Dwe(KF%L298UV_`L}|Ejb>P)EArKd8dR z{41>}(A6u?Xu%y+9}=ITc{WyG0YLPFT<)Du_DhAjuZ2}cm>6QCO!uT66wUQAWM%Xa zJ1)%)p(>~im4p7p)9a&ZzVbaUBXB?De%l>IK*sp=F>Z=?W zWf=n-;Hzr>H;pPXH^rU;3ZNS364OnV&I9d5j=H+80bz=;&lkE4yJwyt#E|ajo>4Vn zm7?L+#UJ4-ctx4RvwzuGS4&r8Qt!nvwpTpY zJ2Y7FB@uQTXz2dHil5|yfeXG>{5wX;#+I)lOpvU%<0%L(;KY=mv-e1Rq7i`7E2pu! z>s|vvJgazSWH9YN)z|p3!bqZplB){%{q|8(rDVNcbIeOp+_*;orBAxsHa;BOjiZpH5!b%o zOrs`@-`}j$Zj_Msd{n@>19L>T0WePpbyX@LZ|c_pik{Xu$51rOc}jNTk#)J|!Oshe z0!Wg1Z@=I9zyKy4-%se>1ximi-C*BW56S{mVIh=*EKhb%0E=<@0wr$r>qek1WgE{^ zwsEZlBy?cbbOuPuXT9V}*=E)5R^NRlq)P!f;BH`6`oW8p*9?JqG9HRilHn|r^HMK} z586>!oPola?-J*4ADG2e`2dol1d{gICfo#ln6l>*{ghPi5ZAiW!8srUn1@W`MF~(p zc}n4F|DJP{x)k-Bz&0|}y2SwDlLIakCqR&YB6HI|5uho55|!iK@w7@P z{8#GZ^MuUo^9{$OBqWZ-HuU~~%zbxUQ`@%g7C})&U{j^qQL3mE>4=JghzbcEgh-Jp z(jgF0u~34FfYKEKA%qfow*aA6Lno2miPQig@aDpOZhQ9}Iq$yr?)^vO4_qsA%rQs# z#u(qk=0qD0zzBqa)DlbyvDc=E67M^QYVp>YU&_!yZGV;j&1fv$0^1PwP!Mc`Y7Ee} z{JM)V(3$Q9OHL2v>eJi#E-29{%$DfP6it6eXD*t>a_gwf+v4-tx0m^HpO|@p*h%L? z^}RJ(i{?Q9`9>*Z#%*hG030Z^T|VbIv;QEGzc1{Ux9`-p@)QmVO8LwRAinb&b8kAZ zh1aO?@f|G14vR0EM+>FKt>>ccg||2VF#B6vpD2QA>M{MIYp32B zoL^jdyEWo2MSdl^U&SVJR7CEVy=XcCOr6QJ#rd7<^Lx6auHKU;9o*dpTVgC%MW(rS z!$prW8SXQZ<}h;s(mrr8z~>R%u-k4T`xaZ^uvVBEo2!tVtQm6Rk=iE6;70og*vj*X}G;i6fRzlS2ufUiPW7`;FY`T(%2O zN~{ywt#-AogKU8+Oz{;b#`;$p-co-QD|sblZVNLJYCZ{FhV2|NKJe*t_i}1Ybg7?Q zjq_&j{$bX<^oJi_K-OW31A-Q7U%t0C}Nq8v}E~j?dNS zhx|7Bl7 zK{3THBWr5M3Uf!5z9u8zF(bca9I;`&x6`XK5ys442pxh%z5ot24A0r)a4|1sYctme zjm6aOPQ(eBZLP3{I$#ifFknS?Xdr14XB@siG4R|9M|>^7yDd7YVVoZJgA&jm0lai+ zz(ZMH6^mcI*;q96@hxS7Q<^yOYii=3f79iFIM2RZud>;cXPbg zTTT(Oc90x)(f!l=mw4*texnFEUd|$;Eoo91p#Y^dDLuds3Zc6mK(%OkJI3=zZS%dF z)#pbTgq|~;bHdJBZ*T8IRRlQZyu;}`4+KuJPw?l73|v1{#9LXnE2oXEGVI8=E0Oh{ zu7D0;PwjSt{HG(WpkrmFWZY@_3rAl1?rYrJn|QSKQzBvL0t=qqru+n#vL`A+*8VR!LcTZzlfJX&4rKYS`*vQ$Hlp0A#wr0lKDX-rUwR!e5jOcg zeorR6Z|tqXR=$dalG*sJ*7O^v2DT61Bh_P%;jUx_(RexX04Fhh+t4tczX80IOM%GF zJ6sP2#P7jsvUKtl8IcJjG{F<;JDDRN_6Y8NadO){ankc1$}>9aY^}IK-EBF!VaQ3$ z`0HhW&pll#GaUkjc61a1&IS;{%PyBNnK*j%2TEC&n`#bBEABTU>`UJ6DAZ%My$j}_ z2N0>17six)E(glm{~FB-{Xf_*fDGTx(G0*0B059#%f?rD&N}F&8OLd;VdUStL5-sU z`{_at8Z{Nobj#)MvJzU|4Qh}7JJ$#P1vnJC1$Pk{M4%3hAE!53J--aTsG?qSO zC&DCK6}RJ=tv_wuTBp{0H#u}nmn?|C7EYp%K58rNHqpu>7BZ^ zC*x=8A(fiGZrEUhtmF^s%dV@aX4&$46-P;BSJquCCbbti*T$sV6Bf0dqqAydvtDh+ zI{S1WFIRYnE{!8QV#Y)ln(RNSjK>hqo4;~4J4U-eT1r_9LN4-7wydSdHtCPV{8Nt% zT@e7pdDnfa;W=yI);F0xvdIDcZ*QDOX(xz^SnvyHYbDg|J-x$p#n} zS#d^!!Cd0cFEeqc01i^#nwZ$UjKid}=n-yYcz7h|h;hxUjYrN8+HsGN4RWu|e`?<_ zg1>Y=q_MzMQFpCj|AP4NRsS!t7w#FVRao)YNv@t078k883^}&OKpOdI#jqCXa=h}# zf8n8$t~2>$41!EM7y{Ebrj6E|RPrrh%`3Uxntn|mpACgv2q z|C1Gb;6%oN?SJrnf=AW~8Nx4}UIdVih4<(8sG?W&s5{(&D=kuE zt%i9e`WW62CF#777%_ixtMG*W8R)W~5!F8v7PJrarty<*9DX6Wc5=_G9@<&>WmOcC z{jrA#zL5RukXFSDHHC=bzJ15%Pmrn-0htDcD8K2F}mtOcMVx5D`lJd0I3jg zykaDVCr|f6MV#uN=Ku6#^K;2pVy*|3ulTx4*%DqP&pi0Du_iU%V>sXMn#+Xmk@D?q zd`r7Ns52;6`BUgn){6IE5sT5RM_8Yb_rzw=#s}Bo!LKfjMt#-R!e(v5ylgb~yk3vK zSxbCeYSq_3rlF9^_|9RM8$>%yw^dh~)bM2L5NJ$#p)ar+E!b77@^h%a*rmD0W-KN> zo?J@W%o)7Ghv$qk<<;RPnv=(0c9ko`6N;{wsLb}hRi?f75yF&`{8*HDLI2$gGIE-4 z{+kdoYi>L`XL#0g>l~oz;z7wRzgeA0Rp|*)KYtPmoS+;9e_xY0gn^C06 zawD3~0+y66tF*Rq1-ogp+UZP)iO2rv+dk?VT$?x*2^?aj4h$26I8fZ+Or`7`Gpfdm zPpdJ?+3Yjr$p3S5_8SYSyEa!aUg6Sx3*W{6;~NW+yKunGuisUq^X=#G@OhO{Tm$VfiH_2o!f}X7X#u6IiT$0l~kDc)VUANUAuf^cY zycdTsTg%m}HHDRZN#mmKL@!#tsI=$3(v|fXL{g|Mxaw6;p@%ij>SMtAXpgJW(f_$02!DC$#1@~6KFevdWCIT|Tu`lnWuSRHe|_l?lP z9Q!Z-LpESl(5rSZhZOKkPoTftlL$YcPg{&vz^tT=Uon3SkD!CEQJfaWaxMFx`i{m- z$&rEVYrmqN(>5o=s$1Wy57&!IgcZi$cMw1r_nhdPJk>XUin=k{vc+u^yV)hTHcc|| z&i$$)+jF;r2N36!0j?%+(Le{M&m}RF?865yOb|H9?oMJ1Sc%G|*Ira(oe5;=RDL21 z7A+w=V@n9Uv^yY@4f5!19q8v#f|WAG8bOsR$A$DlAJrJ|7XBh$v5(arO!WQrQ6a(> zOx~wT74N*?hj#R5$}mw7;5i!Ao&yiQE303FZg^z&$U3RUxZ z|EOPbgM1jU4)uFnYYfM0GE22XPiS%B$6_1|##fIjZzY%qQOd}>t2ce;WKP5*7hXiS z5FbznayonM@$XOyO3DjgC|xtgE!t`rpEv8BfcMDRKmO#Imvo^AjKsY++um+c^{a8! zu6rK@5x4o|9RZF;ux4^9*=aaKK}KFcB?r2CX-S56k%_Tvknd6Vq*A*2-8KvV(~KC*Rm&VLUQ1)bgSWEWHF1^wiD!JD&6ujkqTg(*qaVVDTJJH4iS{jk##-!&$n?HOx zsUd)1tm0?&R?z9v87@9&+%13lT6 zxvDIkhTvjnxA&BpsSk8cUB=8ySmNBgv-dKCbon$LJlP_|6lLe&)lIfs?UvTm9^j{f zuI@m;%;LF}p|=℘^^osMW{O!=kef-5Z)@tNB=b{hBJ0W10l>>L0;m`ycp9DHd!g z`_`P$HxWp>5-P%6IkWm*SEt6_EZ@9L&eO@z*Q3p})o%Q>?ob#?SqYa7%Wu(^C9>j$ zT=fW_`(!JY!|JEc)k1l3SS}aL3C`9;L$gG;BVqF*kjtOE9-X9DEWZFD86LQ-yHp-v`mGhH(Un# zf_hXlE7uAPP&DSD7kHttat~7SRQF2X)LG7zBB6phYo6CYce`iK z0<~VLQnfZ7&kpG5%UyohA4Id0)(g5lN@o?O$R!;frjKr~J=BwVO74dX#OIljqLXw8Sq3dTs4hF>y#xpaiZ0-y_>B8iE*k&Ng53 zwb`2N)m4h9dj3kFWuKAzO}QhjXX!#2jl|!2`zrc<*^3x-r4)ud4uGt{=O0jQM$!J> z$(`ETo0osQW#1An=u5NzG`?PG&Nd!be6~?{wC!$FGGKHCDj9$_wC^(@{}8I4$k*R< zPjfaRj3$(~{<9J#ro1-U!u9N&dp&yFBR*S6?Pz{pzCsipYe^6SZG-o!l_PkKPuoU> zZuOBid^RR3D@j%&DzqNSq1JB)B@0jsD$2a5%?_c4_3!(Q27K^JIb%ll)vr$k4|gY# zIC`34aVo+nnz74JAJNQV6IjDj75)qQ@+II*iwVBnG&mqh{{iA$_FCS|nkkA>xv&_^ zWLYmEx>X*XSGOm}t?o6t&oI;>#PFp=(9 zEnmN;*k&V5%QuO)fasKJP;|#%apUH&=Y)aZvqHSjUjI^b+7hbO?)#@()qmXJ%3Pz7 zZ@g#$lSZaBh6mOaH@psj_Qz&9TGo6U3o217!HyZrkyo;o!Z!?}MyyOk(XVDesxoVjlU~nwlF-_n*!ixGpz(-JmoF!x@POcuTPsQ;RG_d=#4J{! zuv^@|Va_VSkJ76o=shwx$Pt^W~Bv8m6u+H)ubvf77s03WT71U z{rj*2lm%hKZc!#bDRUw$n|g&xvJ%0!C$y#GI!-|Nrl(iuSwfh}~q z6@I=~RPqH=%Z2h`pEL0prCa)lp*IwdbNQPrMpnD!r~8=@kR@9iAFn#tcO9IhVbVe; z2$(B$9Y{7U14B6)LbL6uM(UyrSX|r(oIp~#A6Q5WelJ+m(5z!&?}uZI5z=~0MyB3P z?o#*K$D{yh<6GP}8G>e3M)AOk%a`gX&X&s6!0;j2%Js|h$i}x)+oye0G!pMU9&4Ig zv!szAHiwLueI79z0$Vqkr`*d~8#At&G0e5BNB2cWiwcs*vABXSUQ(7DdvaEkg{z-9qBEt+1NIpSZ1k!RaaSrQ%Vl;|u1LFd#d*F7ogZq* z3Pdp>(bL9=qBdHym8>y?Sc=*#2c}ki)P1RyN#~}*mj9Q$YPukk_*XWA> zUQU}s)qpFSKwWJqmep1uKu-;G!Zig-36;i_&#a=93!A5SPlI#U3l*G|x&|_KSa~_~ ziQ!5JzagWcpPbCQr68O)(WArNr6vKs2U+iQpgp+F{yJKkvZ0qzGHL;{mOG<{aX6El z*m{E7oQLc~HCCvR^^brJ#iNvY)Sn*s*Nk@9OiB1LFknrTHenks@rwKHHbZYn8zqku zN4k1Gecy6TSi39bK$usJ2*3SlcBRiL^qbjMZ%{c}d93?w2~{ws4W!ZF@*sh4Pg%$l zg@8Ae6W?{g7S=mCWlUN%+E{(2GBII3d8sx1b&w2ni~!(25~zV#aVMe2w=NWUMmvOZ zN^3%p`QPf&kSqON#1Wt-e1G+pa8;&n10lnglJ&~6-aLfT2Rye>HNfP zd5GICx9k;qk%Pe3IQ!EYR)@w_y3}r-w#|o(H`cRXcgA(~eO73nQ+a+8DnFbQyFm3? zwm%pooPa#K((kBgSh(%*s0t(j03V#T&vJXkV#F*Ue_qhr@=8u0b#pe(Wz%~c?(;E8 zyEXms*L?wz>=X8_c7qwE!^Ot_ypsK%@P?*=hmdOAxepCYH@i!V?m#S%=<=|i&8QXf z2QO?);MOF~^3L2i{Uk%scjP^8#iN)<+1m1Y|C&bfh;@ zPn1-{c(a)DvXq#QImCUuB3ia7%`DsU1q4g^6lItrOl^e=V z6@$?dv$LINEEhO`vFbs`NOGXw%NcY&RyXmjL)&m#l)A^RGmZM<5=&y zB!4jNG2AB3*J4J|O7nWc=FOQ(5Q32>=SINst9f}ueduG0zsL=x(L#X%U*0?s!dhdh zG6?-?WcevQ&<`prqp>$-3Y1q^mWuMa(kaa=M->*Kc zdQptg<7dEL4o^Xh-ccqGt6f>mYM6Gpimd@>jg?d=t&K$c(nlL7$^sK5seH(lOf@dM zPd2x#D@%>>eRO5Jec2H(hY&opoWB14NNyino-(>D?*X(E!u-%>r za^LzJK7)WC&jJgHJ9ErmFc1z z?hEre{_>kNgizRMLlizTTn3%xx7as7hCl~1FmY9lG|5g9>~HVIR+#a0>=UjK|65dM zis<#3b{zW9kSVs(^wrStDrRZ&TC0eVqQcV4$3x8u@VO@ugmkVvk-#peipd(eg`etL zSy-<|j}PnPkHe~d4t^W1tlSz{ohz&~oT1=Vwxn0QM=PrD6X03hVmJY8x?eg2)~S4v zXyDo;J-p%C@`6%6Zb}f8EMPJsjJSlW>M|`Ix6OBG>winBO_rj(UqpP-6;;pIR=V(b zyZBQ8*kJ4$tYq)~1N9@?MDYBL3*g`W+5u%ip@--2%#F@ouR_-~A*Wuf&U;q&y3CGP z1q>p(&@dT=Gc}H7&LKT_!g!SZ0zqidl7TWwM_lTu}tOVhu9tzRATdU*U&Re^KcHy*TO$swm%C_!9 z^Y|*5zS%7g71VsL`G&k1Wj(?o4Kl0_`e}A*81v1sH*ym{)b|GzbLLP4OKaG}RN^HK zJvK+fD+QfV_HsKgzt!XG=d)DZH}#-uP*k6>n~?7l**ds+!>pd z+De;73^ppn_+I==mnDHNubA)pW2d^zPp3=il_Ub}ss5yETd_@*w7!W+=hz3#=h}TS zH52&-!ME(41di$ViJ9ee;=1qle-jYk%TI!>JX(}2IbYD{{|s>QdARKTm@)g%kAi+C zh&-$?J1^`G?hm80QjoC1i=97jg?AjTE_TJBry=JAd8uGZs;RFwKY$Ia{1(BiA~9Y! z6^gd%*Y9%MXXeBEy&43n2U46$=AU|XusNTa))lvvb{VRw^$6#cceCwxZ5fzff6OAb zr=ng^!sL2%p0|llH9-nl^}J|!rEiEiOQ9&KAxr0i^g(3P7b$WzHzKAk#xrkRN2dGE zx1x~+OwgC23>uY0^O)C3(8kI=EvAI;MXjHea=ZP&KxaSWkU;I6a`{$ zP7Iu@as8);GB3auD)HcYm#yVXRsRxZxWvU>FCC2RzMm8Ux`P(bK8wxI95Lz(&NDz!e-bUR`SfP)b*yJW&y_`kIn|0tOHbn1-v^z5)W zdGk(B`8|D8F78-ABg2^Bb^7&lAg!JFq7nc6)iM329{#J3$<>|}`DaITNwy8X(no=G z2hSx?k!4$th0sUTapvVA2Ebb@f}0KJEswMo!YwFi0CdV9CPF|zR+yg;f}V1mH-**` z2?L%3hW$+#1Lw*1w-*psu7mV}N5vnBKc=$QhQiBM`ai(CPkw~Aiu5&2rK(Ubm(8_C zd47pDX5_EmnHJ@ITTsU``oi|aAhj>vT{uT zcQ3dUW{4#&CvR;akxMGdY|uq+Chnu0F2I1fDJI0-4alhkSEhsrC=?_$e`R2@{629@ z;0RXCpzz}v^o%J`a3rMQpglxOEL;tOAXHgEYl_dqWYL|(snGA7PyO5`Tz1am?b&>X z`&)~&tZH4IvNA259&K)EhIIwog3kuS&#mEsg~WJ7SC{r8*!v=jOowkXZc@;a2<5+!)Q+&i9}AP0uUOA_j$|mr9elU=jYTJH z811jCNL$jiYI!38Rk&2B)mexzC5ni&JHL(6;&tQ#yHIe0WchIkP`!k(pksX(MEee5 z7KNEC;(*PD5=;TLybK+#g%WUW>kz;=cu*H;jgKaqAHn11P1tRB0fdap;JEsB5GDv( zYnPvE+3ZwTZDj&-hHLOPl^bz5ivjn(ruit+7A~XdGL4QVke80S+thK6$#ho6o$~eI zt!a+k>V*RjT<;Eknp2K@3};bVRh@q&_R{T#+FpG2`)@<9gC#=%6MsSJZFiE8w4Gkr z0}>68bAEMGsZaK@Hj8M0mEFAwPnkLi3-X^Iaw6~i;fpdZSpUXn$Kr9HV&XD>i zjUC$YuJHz_A5;)o=_P+g&o{XSrR`R#SK z!>tgR9yVLEW*eqe0)XPwi^z%{1_g&(-ROi=CPxe$hj;~sOK2(6!%Hf(g5ln4EnwGu zoZw`3p!sI~Uef~AbAQW+mX*^Xj-_a*L25Fx>LHZgCWe7;;YYtDw^K86Aog?Zt)w9) zb1E6P3joCzTt-ifN8}ezyaT(_Qs&c3g(3({Mv2|V>{5s2mq!drekLf${)B>G=nxAG zfc${!Q6P;=FYEu2PXNF6FD+H7TTBi`Z7K7_F#nX9>Qvfbm&-U-Hu7Iyy99dLR7*jM znm=71BMa8DCkx<-KTM6!?T{Ytb0T;5gX!6!Do@lWhxp3Xwn6}Er2sYjYhC|WUT`mJ zU|1VpndA^pQdnD*8ZYj#a+L6a%68`@%YlZqW`fO_Em;@?^}K*D5MhH?S7+mIQHWn# zcV>cNrI$i*sU6htY;>J`eZpmdd-E7BNrwz+g!4F*W9Ef}Jy5_F6ax>Es08%97ZKOA zjlb^TC690a_^f^~jCN4*Bf<&l;Y3nK!sRpLmLPrdbczSat!gQ-rTKk9F_O?0KumT& z%n|2yQeou*lOXE*E2DK+&pCAeG^lX6=Ryy1yyK7;d^ z20Dn)X`pZ=RFK_py4B*F<@{F$a5?yl0nYYTWAvKdfkX1=;f!X>4fS4iKe*&p9LX;n zJ>RxV)uH*Yvi#XzIpjhW4FtE zaTc<0W{#6PjxWj_=>&qkc)&QZ+~3F!cF?5u~0yDK=?pMOAPp8eDI9y>9P%p5%O zZU+4KYhUFwuk%%}!r-&>F_GfNytxVQ*g7(c4x1q@Zitzjsl-bwswT!Uc=TFPygKH| zr;e>oQf{DA6Od)VmH)D$WBZ^plLVca%#sVxG}V2G6k~2#T44unCt%OM0|GK)2jypq zy6=ZK?N=~ho?eKIGK=MFh?EQlBplTrE;9xB!40i0W}I4T^vJ76S#x_7mTaa64;A;c zFdC0q#IjFZ`O#fiE?h8Rp{bE&!?bmf_G5ah2e>T?*tzn;#pB?h^#UG~^f-8*31mV9 z>9hguMuDc#cK@Q&yNaW@*|sQ2W3Gn%sOWh_S*R&z1#*$Dg602FSK{Aq<7pa;3CuXy zd=Vbwbc<2DT(KQA6JA;wPZJgj9^XHhW_T_kWbm5?7wAAjEK7I2knS>*?KJeH@l;OP zNqO{(NU9jfi3VcF6ct3d8c}I8W=WFKO@*avyw08%{Ypt96^I&ia0_zM_!W(6u--2> zn_l!Ywu825xbGtiXn0lr;r#{}0mtJ2KwTbfK^CnFao73_flB(Qc3PVVigbGLkn^<< zQW_PZF5<9J2|J{_Dim>r!~YW?EE)v`@|F*QOdTz9YL|z# z9~vallX&I!InDpKeVkRY%zsJPh%yVAqznkOG{pnhHkTu+Wd+JYc-0{6<`TyHhim!87)(G+KTz&Z=66`Ymhd)ic2* zs*ROMdFj738WE4+q>U_{>Y!0k%etY*;WERc6NL{OJ)RoMd?-V7J`XhbE;bdLpbi|aYN=3OVhH|=M zS#vp4h(s(VP&r6G$v$0S&gA|nzaZ!G+vU^vLQkh<QgC^4$gHFWZukZ>ME3KE?t*@3}lF%rdnWBd8=po5QZwY@&gU~aQ%JkvM4uAwF ztSUmZy#;KaIP%tsbqSJlcOzz(O0uD*;!Xd~|JYR=4*35$3oc56zcLRPSs7oF0hcO! zb)Y!SGv6}IA%)CVuKLx;=G%HJRg4OzWv!-giD%&p`;RSilD>Z!U0#j!{a7&+W0Y4W zNO}yxdc~QUTy?geW0NegGTyR!x!I!2AB(IU#f4zdcVtb zs0$&Pn*){8M^1=nTbjDqny&942n7&*`vAV|N5Ke#4iVeA#0ZkU(?}G7gyKu%t7dlE zsPG#O@k8<1#K4>wNZV)g!dbvLz}+K7y{m=^3>?Vd5_@Z2=2U>OTeo6YT$HQ~(@0VIL20Si^FbZ4CHN}nKoMIUy$A!gf)>%j^%x$^ zEfI1#m`mn_M(&nh>bdB753XyzO|n>VMnE&ak(J0&ZSM?&e?XeF?iqpZ^u! zqI~XHX65>ar(}mw>P@528veBuccmF^Cy zu#k*yC{HE@Cc>)Pt+Wt5?aA7cgWy6*Q?7sK_+&1(iqP`(b`qQ(ZuJb9;f~}zgcAwP z<|&9ibL5~GO)6)~j$Ny%8i5ML)|*W|QVrifBWGpD@BUSx;R>ZOBy~t%g=W@>x@Trs z8e9Qk3{5Q^P-w#)0Ls3S$PK^Qvwn-)2!z@x5P30j6W;6~3a4L}Xf;2AX}=nX)%+7p zFT#{juwLbbr>bzVcNt(ZzM0>kS@pY9n?Po<4k*G2p6Z-Xpmz`o^s?*6K(ZOI0-fxcc z>?Bi0!`a@zp`|Sk)kokTO6diQ=Vhd$wsdVIU1m|7`nfDC{?HVhI4<%6PSBLfm{#IPU{>{xM_b2~lI^ zJfI!cw9#uJ$IH5gJ$cMuWxw&VLNT{Yz~>m!LgvL#JPz9iUD$6VU452^9&A{&83cbs)&2pcIf>7}8er9%CXm-VA%#|(I$j!1;3O4FGmlT6JVyN{Mdev?4s?$-`iI9>cvVd3l zeO}zjEs?7B`}2&ztHicn6#~7g8A#DCDs8}}fqA}5Wiv&q^l1&iJES}H-Jx^91Gv?XVrsv5)hYtVc_~E+*B<8d&0cme}39?mJz>};^I1x}+ zRzL-S`IaxYc z#{kflh*1OPA&~^}XvFn1ZEwpLAS>oQ@SR-xnRtPIj~0;C>Fon%6##-T4PZBXqfYn# zYE8K@*`E1+3uyUzOK%LM{`KJD*fO7*ZS{`;KM+Z?-3d&@qeu5x{4UIh-vUS%A-W&v zpSI|e4F9emU0yu|S01lk!@aYR)ZPNC_sy0QI#L0`>Lu9HY-}u z391hKeYoS-kMeMz@30s~bY9uE8T;u77vY8d_Z?%`qI8Wd_B%>lQNt7%Sce1eq?!Qj z%k@v&PdpESeBt8H2X}(oePpwZdI`IRvF^6(3@O^23LY*tJcszQ5v3U>_veIX0MHNn z{YNk)3e~GDy97MgozD|GC_k*gI-|@O;~`{ zLFVSJ1qNKfEp6sLk@HtLFr4dAAhLMB4Mhi2hj-DGn%Ad=)}0R%^$NiX2lSvO@Ye>n;;#gS(fA)XiyC}>F~$mm0A{|v~|HzU_@ z2dcgY`|u@fHkq>^eRkLhK@V~}r=pd5IZB9%^jLEGNk9gmS)T?G1cP4$9jK;8?2w1= zgP`Qu_Lv>O;)%-)Pco*A)h#gVu}hj@8L|mHx*nubt(@ts;-k&fzJ$^|d)pg8E@LL# zNl=cH3&IEKz91eJXrq<@|95)UqxhYW1b}%8fRI$FJrm&LbJ+I3OxynV-+IB}7q?ye zgaWa>o1(3fe`s)AgqP~=H>8!b;^cK})6Kb#v}w^}|5OtJweY|0km2rLf_CmHu!@dF z6Dix%xBvJI*t!Sw9>Gk5!;25h5D^2-?F<~+b&zZ`snk)I&3CA4D}sURpl?4N6L)vefjfDl!^ zW)s($Y^uHpLQd%|-a|)#K%>>b!wBh^PA9BB4nl zq6`NmpJaGoS#h9wC>b;lp{l=s0P+zpx&IWx=KTR8Ic0M{3-THPPocNRb~EkdC1CEw zF!?63_-Qtwfved^^8RX@FxaB3ncF{l0nf?BBNzz@>~|n5O^j6r5D$+W(3^l*M0Pa%ix7nN>TjYXe}VB;?8fj;G4H* zfaNunoUPerB`pWXVhS5OzLO=bUskP6&uRP$s6qrX2rR%MdSF;_C1XLs!yjB*crrSi zFy8x&@(B-O#DJ82fRX(xReK0BCLp=VuRJ@s`cw7EOV}2Y=?Qin@10#Xnw^9OJG3%; zRse|XxcC5gYI}ptPavfUSs*h1q?MzP$R>oLe>_^@-HEQn?_)GvZp37j2V&Pnx&>Q= zR#JdT$^wSI5-@n1Ac>^j-S4%nL3nhM$uSywIs^?1?NZtfB($L(H8(9wRq%t~dfj);mRLKGpuOmBj=XaYDp(@f_Pt#)6h>^Us- zjs2S5Qihmv+$LXpSv2R0hsDwQ`3mdPUkTu|&K`-BF#L0ItemwWQbN2rcT~9h9v%Ds zX<7e`^!b^YLpk@qY~1iP{qu0E9TZ*_Sk`P$?hgQ4=Po<~-8uCSzbh2KR6_FSb8q6_ zXG|EmR~q9ihhxR{mfF`&rE5t(*OFw#@n)Dmw+1BFD%>*NUbh{x+dlFDXyfwSAsr>b z4svBFPg#2R`+a=5-q>8?6$t<5{07T^Do1^HNNRBsKh$G*&d%Nbov*?S&NBnf*ra66 zSU2F^kgqL0H&a?rV>G?ua~(`xh6)QMm@)p*Jm=2L@~5pd5IEdeY8VRO0_K3@D`9_- z@LSmf_ht^<+j?N}TvQ0Jw8+WpZ&?9r{dLe{GAeO4`B|>{3b+R7UqhlM^y8aQ(o(P0 z90qQ=^JQ)Bexpg(1d>31iJ9yMvw=OYpfQ?b13uqi+Cl~C!g6q<$IW;LGz%x46_&rK zeyp-<^BG6#$_Sz(cyUs(C7`4^44Z{0A`|;8t&jXMp`IuJzI(4lL=#lko;}eDprQBb z&uX$Qz9Fs-^5h(a2F)6x#DlE@Rhm|%h&7q}%`3cjk)Hj3B{v{l&oy^ap2$WZ9&5{l z9qDn-+n8Q#FDrKGYU--)2sDSsO9Ka&i%{8j-oCrO(m9ky_XcV1SrvomQd*f@z=6*E zEa2%%QM`Byhfp^STiiacbRU^u`PAO3) zmZ+BD*TRFtfWl%@%`r?6cDZ&=NMhrP7YFKBZQ;UY6v}o6_j5Fc`=?*+FaC$T(~scC zu7rqfs2oHbr3y9fm%@ByA&lnOwmmY)yKk|6NcfX&*}t1s{WpWF|NlN>trs|Pn%RlW zVr?N780+=TPIXeyu+ma30#W}xBH-}`e^$|I8JLM5+h=Hnu)j=#ulf~RGaAk2la4@* zejEDPeTx`L$L6@sPD4}@u%+Wpcys4x-jWrpo?Ks5n^+6#{n5_3!%l&w)m$9A@8pl2 z@$QR5#4XE+pnZEIxZT_aaCgFKzAj_|S?2E81<*j@AGV_OGkeGcH@;vm?m)!{o+J;PK`A;A}yOB?AfTCoT$FSQ;v2XiU-7i{;mj2;XS z0}H_|v+c^Q%-FF$kzvQDiLldU?crpD0`@j0S8K}1tEZHvz0UHLVoaJ%Vl%yRzMUao zQL+C1M>5V=cAsFPff1)N*4`euPO%v}*ks263(U;;>cK$M#G0(L@8znV%~dMIBOQE_ z2f6xE=KSusXkRH==r#PC0h4mclwwR zz~kFgsK9hsyT`9mq8j&*kkmoO9MTj~I`7li{Z^0hC~Ut8a4->83dYP;sjjtlfCq;O zQCu*E*7FWVuG(6~l`~mjVZj|dpR!@~i7**9;HOvNKI5v4|9c69k__9d&^>#G`1%q8 zjpQ3PO0O?G{%Wop7;&~^8Z~dFhL0*(Cy3eRXJ^L{9-(MahuXDewNDId4;x_jlkCpk z>s?E6$$$qsOTRlmi|mktW4;zfUyt^vxW|uy4H|2o)K(y!M-$S2Vo!#r#5wcg?O?0$ z@M|5-vZ0845hSMWdLU+D zb|7xt)4!fF>%^UgB1a>31>J`6N}TyY8zluV(9|j#HZ=P=037va)j} zYbBs55)YbRgf*Mc+9IvMtes50S7%Y438Kf`i?t$s)lJQ zuK@3TlzOf;VP<^bdpV2PrpAO8qVCa6Phz{YBCI4qV9_E$VZWdG+j9!2Qm=}&$UaUK zddzvLtIU@VS0CSJzoj0e?!S;T`D*qnY%&+ONeoo&Ot0=+G(*0(?G!qKE29yj;!W>) z!TPpcR{6MShQ0?PpU@>n%qmE!j@eX8yvzU<^nT7$@+TY)Y;(~uUIL7^T>mJl|66Xc z6s)?^(6JY`-;mRzplC62+Oj4bASc(4VEhe3=q1?-G#_@;pD^=;>T1paq<)eSeaB^w z7vpZwqngL3r*yof#k=6=xzS#q5}7=md)!GIT2uSfN53iOU%a48@zw^D|0zjG)J){} zzLzkW+AFE^1W8On6DBDdoB;Y>A8-9{!(9}A6*kDVi7_xme-*`zm*$A z%@q^gk-ytiu+l^ckfxNpHOdUnhBb&A_B=HATx|m@!8G*Zn4s*=u?IZ4&?<|g?48Fb zL)$>}^|fpr?9Cg>MS8rGN}l~ZEzQxlO0N6NXw{1F)s8rNqTM_DKFMu0zAtT2eS%$B zQ35xlEY`(mt<-rOY4Dg#&rc!56K*8-02nUXFEC{LQdl2w;TAzxinbGs%m>2Bk7Y(q zi#ZS;Xu>?an>_s~drcNr<$oX4Gs^i{i!mO2PUj3dej>!$_cw~1f{FE@Y zC%XLDR+d zOnoIcoX~KzS!CY?7atfQMi^oQOQ$Ghut}_58Ast z^-mk;TyQ2`u+1k2JcA)qj1c4b?0M-Yll{&B;F;KEf?$hII|R_(*|PGuSCvzX~K)j1Vz z9tNfjjamqz_C|r>lFS9 zZ_3}u^7|G8f|xG1L*M__!x-hkOn(-XdyPT`&&l8fUf~iX3Cg)lyD+}M8(Oc8>{dvY zg6;3to6?_35D*1JW|d87T?F9InYFbWLBo@ymd^hXK}G@jb9&_ayw^*glG?i7Ia%TB z9Q;m4$t)k0&bPJ<_(kh4Ix4N*RWJgfWrXsh?aCe0LBOL=h=pt~5dbi=<(t+!Sku*$ z045B1aFgTD0z0%72hI-dZd-lpJh*r&S2R#B{ld!K)Q@)3w+qR>KP;?HU_xCWBViE1 z+5_^9D8d9%$~~d0YN8DxADw%@MV&$#a2fa%9#8*X(;{2U?fh&#Q;EQB9Xn6sjAsIN zU>H5i#xq&r*@z}-uz7ZX;F6#!3Kd|!iX7UmRW3m!>cU3rJ3#dr^*C5@>9y@Ep-{6( zQ~aSWb9Wa-o(=%7ly8 z3F{OMDlkowA>IVEzLmlSD+T%F^$~ToNbp~b_%S|=`TYq{Zgx^4s_2-* z@;bs2z;SPy^t;nTj!g!>gxzi~5bG3E!-(C9V8Gh>S*x5oHdje0sP)jEs+Vp*LX=)BA6ryVjH7G&|y2{bEzH z0UYYPTJ#de^2IId)R|T_OdF!6rY1%k?cPQDG_)!&D`9d*MX+RRZb-sAjtnc2VDQDo zrOcIC87(}#Ewh>CD`c=TrAMx(v+SFb%gOUp)rf}2AdB$W%bO83wa==T8LIhw;e zJ;sUeeA!cqo8X2!fWIloMwvQi-?Au7tCJ+lM2P$WTY3Gp`d3^c$`WK%>OA0UL*9L> z=b*X5hKjEz-C>yb7I4`*zlGZdyvVK75ue-iP+=^4U zHb#tj@s66H5PkiD^bLOLlXlnj{$#FU3<{c2I3Ii-=aK8CPNw>k3Zq4uCyh$dr}eth z(#h9)<;lLy-Yve$&b!1rvl4okPDq`ub1S_M*L?64>n1HOVAK)s(-Bd-gtWI$w`y5w z;rEN*9P~=Td_R|#&!S(e+0vljYFEcx=p9|sRgpQZc3Ct_kN-K{u1D}&+0PZ}=ok+_ ze0c3)V#JHbd!WyM{Qi%JDs)dWHf{~YX3{;umIN8}oxE#>waEzMLMKLK@_tmmX{vr{ zGxM@%fS}S1;u~bx5ed_PPxhQgQRL}aMN@+2v(Tl4cQvzLi;tdGEbHnX?W#Cg?<36d~zc^?>jY+ z8N6i48VDEHZvMrA>goKdBw9qHR#RW2Jpi-Yx1fklnRpR?V*G#6_TBMR|NYy|SHS@2!&T?btJWML5Q>?l<3WUBBzTzIWGk|L*(u zkH^P(93JoYYmeva^$DEY@AaX>V^vIu<7|{Nsu4~~n#FQBRYlFSzfEV8TrM1Z#KwMfp7H~INhKSabl!dKHi0F(zN2K7DDFxRS z>HZVx1J~mK*V~)=BSiQh@_lEgUCoax-NN*X-Pfy7(yG`7Y!=YKP#90}`)?dQ@c>ym zly8q1m=mGj5YAGjgq4^mRf-7t5wpJ78FLB3r+0cFwf17Ud_juN!lr;D7j8z=rd-6)`oViHWp8JV;ypJ!n;mxG0%?K;lHL7Q@TM z6@Nyr?-&)m_APS$dAB_1ElJ05iHmW&LJ%HT0L#vl`ylCkNLn<<)6m94r?>gfcxK_g zsS=+~EN5{3;BS;Z>FAElysq?f7r+p|fRTe3WOECO)jm{K=b}*Hn`Du0`85TGzoA*R z9Pm8HY&n&!00Pk|wl)1KPP>M2G4FHzMTK*9`uGf7^12T<<$rcZeLnBfnG%K<`;@X& z0*c|6f+OZU(-=8ebOlD^GU{^V;@FgA><(1S?(ow(m{iDHc;qY-x%=fhz6iSlkNesb zUXp2H`h-43H1c?7FF9;r;C{sgQTL4(BgH>RDo$ipX)Tc@q%{Wf>$dB7Y!e(OJ85NL zuv4qTQ-BahomTZVRKPM_LRz3_)_Rzgl8!B_0e^dG1)Aik=ae+N3h6!uvP?v(zl9QV z6uhpm)SYZHQgUoJhCO%Wg5UM<<8AOhnCwp?XEznQ4^%L~4>Cvo?=8x?%5q@HdX%JF zcLjxWeZRDP@4M@}K;<=CzoHSkz7O>SgX%UqE6Sd?kj#U!y1iuLEp1EJl8%9{wt9pJ zeRtgc>gVe66jBDi!)YgY-Hhr@9)>oTIMmz4#hzr0&$J?&N5Y}9j9>7 zwc4vRNh~&KHKyo_>Ns4MtHy%rK~mr;cZw?v_*w+m`F6STb;9CsKjVcaiY z!v}aZRWB(=GC*?J=^RqNFlNfQ$@`QJ>V_`B)%tXxw^55u^4f-y48@h52Y#@M962ao z4N9%GE$B@!E!Hg-(+nC2b|^m0@G_1rBNJ2Wdqlp?6|NCRBV(PLR99CEUJH91?naA{ zAM5(tSHhLB>{!{_(&6925y@15TOX}}gs+v~>cBp87_?7-gnz=d75)z;oa6$P0C~)5 z%+)wlO!B=g%HowJ(}+iA5iFNiGrYz%xr}lL{Od1k9=xO2G@~yrW@O~)oOLiWGlRpC zB-9}u`;%kE#O!Qz`=8Bftx523E{Dmfg&4n;32`JHi zxqjQ3myiGBAsZjDz_|e5(g6bShLg7c+-LqJ9TzcDb9rxjPrJuTtK+m#?+7sN<0gwau3a zrk-3qWQeCyRFsd7w?2)V>(6g1Rp70O>58xhY za4XqZcI2;~^BbcSuI84tn!Mla$>5vEq#V!alCM~WG4uw1!qK&dv>S2x2NH#fBgCig~^9`gX=YsRd?~jLwmM6^5-~DHnvGVfO z82jk=mCL7cI_{}sTzmN4bZlXcvZ1`OlnqZWeMy9fmT4q9xgZcZQJ6L5ExvY=wncNf zC4x&Dh}TfpTVcfIxW)jDQ}jut6JA_@BZT!O>EixD z|B9K80iu0|jg#Ps$Br<|#J*@oRpxLzdEHckAW^J z=HhEDa|Ib7Bo3WqMw+fv3$Bg5&9!vd%Gq#9Y#!v~ZMg*b(4zgZ&1EJ{S%h)cb~{0F zXf$ZBMnL6Hy?yXPZZb!YHn$Z8Gxqg`Wd}TILKMPI`W*5& zuyZM4dG7vsquLbnN77Sa@HDTx?eCr#=h68 z3tm7U57NHypC@%;3}QX3;n2XUbK(B?c|~dJR;*j58H>?80@AkInf&7Ng1laq^O0`% zq2^lE?%KY&_B`;))=(((xre(8%qh29kNAI-7hbgF3Zt09(Bz^oaC_S(fkM>x99Kf4@GX{mphN48dy`S@6r#(cRH*e*5f9`2Y_4Mc zR@>$H-YHZqBNfTK(V>o+l`<4;PuD23eUrZ!G>UfR;w2?bc6uvx6-{>rNRH*8XnRzh zH?F1wm`79xJYnUwPem>XEtvCzo(0HqwvDsrB zO&6mNCD9k3chze>@2vUiP=T&?bvfkYtR7waQ!!GozI*M+#@=`EyF81n>~^XId9@6LB;oNqL$riHSeVxH=@~LcPWJfyXQ4>}~Mxi2B-e?KZvlea+ zOTo`6gpCemebM!FNN_)h>+;wZ6&zJJu9%v<6O@77fqlnnnH73qx6r;Xt0o+*(9%YK zC9&>yD4#>-ohR;f%fS|t&a&p_<_aG7&*}9{d%Bl7Im)JrL;>ewo&x2cpWae9i$&RQ z^h^FuF%vKvrJuLoMezujr0!7MeTV1Af&x9{2y%Tyf{K;yqZ zDRj$P8#(aJ2{|v+iLK!p89i^~YdEOjHhsCcXQ*`fHB{;H)AQ)?mI@##L;g)WssA%c zy<^B)8eHGKZ@EdI_H_aN`P%vlHfl9_VBrg-*Y} zBB5QfyO(kkN^~`<7232e3B*5rD(C~HO2ve_Ht5!6dyp2dm|DYTWK9^DJ^dM)cm(o? zkazh!ilIu>g78uFp?}YdNsyQ)MDiI!#rQ-D-2#`7UaFV&Z4Zhzd2N+y2LBOcCLT>u zjf-UC6w1QbluW{RTkl5}*$z-%a=c zp+5f4U8$tKlJg~?hmO{JuK3vC^@`qt-#s4rl6QJdT25?|vD^_FkMEy;dhSYjueG$a zgfg~UN7ufKxU4nu(j$iW%!G<{gD?v<9?bT;_}se?N5^Sfm)myW#&Um!-p9QmNWM9o z)p$FLM(&`A7%~Cpo#v`MV;T;WmW5GLRke?ipGPyCB!ZEPPL?>FSlt+`@;=ymU}imZ zfq)dx%p!WQoYxHUsR!hIW~Szme${dM*4-$aNAF+J>u(1&Q<3IYE1?_1DKd(YLwgvB zbZo~KvZu=axs(stNP7n95ML^J$**}SZ4vV!Zi;mV&p1db91DMr#;U2A?Aj`?NP(4z zhEiA^?R)eu10Q7nQPJyQ)c%!Jftpi%zERmi-Vg@9CV4XwR?MnyTCWOWGhV%RBY|K1 zx=xLF-Y3%`0_xjlG@MzZTNy>{lBi`k6vVJup0~ZxwzVs-V8D+FnnE;cCBHeH4!z2W zP;Y|MN%*&hb{MQ+HcL?HVPX^fut*RV=GHge6tYiOhk$B;dfy-Pf|Lj@#eI6c}*RJdRd=iNWQ62LW zS~CaZD$B7-CAn@gLAbU9Rp5Cb`d&;`H2~M|YWRCkOop@u&vmwCk3)IaSY=)9}F`hZ-+ll;MWL3s!J*^5LQIfGvH$1+9yg%qfjL?aQV*ka{rX~h|@nyjk#m`5Ar z_N)nDLLjUUO1<`;_bcvjc~uM!UeC$P;ZC#ybJSj4?p52XQ+I>LBBV0V!e))qUc|b- z0iCWFbX(0^gDP^&RbuluoVqLKTbIjY`v#)!*j!#w`)HF0%d_v1OHAj6q9NT)N5?ip zBV~gL5!lSAuIfa7mvN#(^j6PFet$~PEB1@|4f9ImFyX=Lb_T@f4B7>`tZ@U6fz znSK?56ubl{s3xF{%<gHgZiF#4HfxAuA_L%PXy&-fwhh z<=s6!gk?;Cu?q3em0q;5C%ha^4yF5V3omwA?(*pq0#6 z=NpG?(CU#$N>0&3T*nu%W4H3R`BtQDodEDSe5gfKTD@8?Z8Qkcz~+G|59LAV5M>X8 zJ~h>2`Mqz6GUl70!@Pv=m@xc7TzyfCxlKc{KV1S+5)i1Yst0PraB~nx1Y2k0O{u$8 zDry_TghCIC{OJcBmfIj*tkA(A^G=x$N5>s; zfQYiNXsY)2QHtuSL?f)NEu4-bo0#IGNT1gWdo>=|G1i~lMjcVQyIC!E!}if>1KW0+ z>s5)O8sAn!RJ*%BRV+H5=)5Zsl@k`lo=O_~Z~lRcXfv3>s;`GCQ3~IlXBB(AZ|q%K zQCdk58cN%U#D08_8{O7XB~K~3KII&aul-`Ga*}8OUa($QNVFJJBEpe|u6VZrw>` zW?Rgt$5C!9YvGUoBqs$n>o3Zj{SuaMH1E{|FRRy~PT0(uCuw+DE)z_1sH&7K#KByT zR^4}x{TqrdKhWUrX$3y;?HFarc;h@)Aey3ZchU?*anKEBG@O7g9s$Hc{S& zpXh%5^J@M%E~AVS?Y2*KV{@<3cXxch^-sK~UGbkp!QR)C+pf0>st=pTEFZnx^Z1h7U<@UB4(nV{2Q~eVAN7b=F&{05v-9$!>_D74 zlB#CA@TDl_`HjF0|CEmywKw!O^j-Mem5EJ`68A{#+u8tnEUgX+>4hsl3!GzGkMh2} z2%(}S{j91DoDSu9g#?IC7Yx^?30x4S^J@fi_!Od^Q})%Q4-w;+BjzYV4!3wF`Ya^; zbIUEqX|)@M#irX3s@?ckJKLgSHP|CTEDrHzB~4Y02g{qSo-)8X$!}e*j)R@ZU9(ZI z=v&MNJ>BQ?tVFBF-6abF5nG$3!ofC}2hug@akWJBg-gMlDB&8r26(Y}fKsyU(WaU1 zgmuk?_a_1|PrR$26HV^gjOhFp-rhu0M0gXKE>u#~-ug z;jec_)S8WlH;HT~0w7FplaIDVG#@>c8vt zh^kO-=pkaRD+N-+N@BK=Lb{Fea=;Xg*prxk?yci(O{?Xd9BBPN^NhwVpkqVLEZVW^ zLtN`yHoPMuA~L*APi)r}oe%`gzI>KVho3f#S9{;>@4oHa2z=I5q1SN24N@7Skj}7< z8T#YhW!KdF0Tng1JQ35U$OD6IKLNAcyod#~6e=Pw9*LbFhh)UdZ#TEM5k|%8&Ne&t z_w_wG#x_Qs+RG{{!s5HTz^Km#_?iYesV+uKgF*JNi z+k%x%H>BS3fORhg8RA8|zEaCXT3l@10~}b*b*_to?q1h1)Eh(hZ{8Iz47A31j3*)W zx`6#PRCa~)OMl;va_!Qc**qU;5Ihd1d#Z0-@8{%#sgL^q+X=_d`9162=FWd{G@1hdU`cKd@5SZO9ZeB z5`HbyboAK`*IP-Vs`Y ziY3kxhkm-0*XGo4n@r@?+ipKa@8I~3sdzHx^lAk2lFuj~56=Wq_G7Q=Y+T0mV1h0_ z_(tMd}dq!5mel%%ZamLjWKJ3_| zI(_=V2kLmd{Tg_z!;>a5y|h0zu+#idhx=OA=3wCcHCmqFxD)z%o4F&qq0mA_)FvAO zgO$#Hb(g4N{bvUkME}j=FJJfn_9!}D{{csnA9e&*Pb6_VswdezHAGoddSH4`FHmGZ z(O;aUh|x$fIh+-g@r|&Bd^A7$!U8u}H-WtV{=Gk+6;tPd_8Ja@?rrv{zHdE{`eiGQ z$zT&Bqm~|`k#PPy@_s=r;TL?|H4?aj?TXSL1=9#JNE3X&2Ua&9&aOJD+z^bhHvQo? z=G0Q#5YZtywY~K?@gbYXV-1?HU|vY?tgR%%5z-6lal{ZLJS|UCYL6wXNYC{;b}03vCO8VbWKUM$%H-E&~9~8LvVckc-$x zmb9bbY}&%7}&4 z9e$le`XBFD;4fkLT8ve!TJPYdq*-iQIdF|&xL`i3AUaJgsltxNQya7xC$~RQ@9gew z5D3SlE)y?Ud@HOa%BlYmtS6o5t)r__2sx&Y~<&Ki9@YJKaa-B0GextJ4ApqZe`C}Bm zRa4&r*v2x*D;^NHl@8AcfwyO3Jb|Y|bdErFgRi+vbCQdBYlTheSUDq)ql90tGa!#= zaeiO}Dr<)#-@c%Ao;9BTu);_JujX+^+f-~X{n^E)RRw(y$u>DI&)!KxhmBdIR0HJA0&iP%MnpLIbDfW0EkzOi`T z0UQQMI@pB9+k@XAvBWw6POPQvo!oF6%O^IBBDxezsM_ppg`*|CWG?-|c+CCg1E zP}FoNYn1lsg6zggy$7xfDN)s<60pqp45==L<%8JdGxUeeI;$n}PMWF`q7Z4;|KtOX z_5rR|tktBCA6T{Tx>Ah`%a@ur)7~DmD0W(eD*G#V)WZ$2h=;lHZW`bf&>;ptsP=`k z8+T%66akCW2gz0EK{%rr&Go)H@F3Vo^S;?b*y{LMwU$E^T_yug_FoMo?6+(`bp1zB zPXRPiewMCN#Xz0)+MQb=zw4idaS{fH!qkEaVQQ~6E~aYe4-Eg{7WR5tL7K~vz#e5N zP0;r4b7OB{Z)b$Dkx|>591`QBFJ|FUQ48B^oCF)ujc!h|iqYl*BAnl7G3W?eZaAe~ zt=aVt7c#9iu$SnOW6oFSVFOmC0UiL&FGS9_K?Pot(oE5LP#GZZao;+4Z*WKV20{XV zeTohnsR2Ci@)PBoMZ~3Y0Km|!4nfS&OS>3t@mZF=Y(*7s?G{u8^$tJg1Z$$-FRl3W zRs*DTRTRsFt}L; zcVi2xI6n%ezVkMA1tP+A6?;3gBlMk`Nn6UNNw!yIrDd%%!h*(A-`V}xMkG`Au!Bq zgaYdHZM-4U9NEgo)y~MgIkeE`HrMjWV{375@;mRH3`}i9yX|}(XP1q+AL1_azKi4N zv=5DLE#_|{?;}DX+kcpuet!um?nCCuV0o8ZdwRI z;A)d1+Mt8}d7uJjyo(%?dzOm(<&D0DrDZ5p{Gh-7ToS>u@-RFrjgNPreY;z@{{%?!qj?-PP|aa8%4meZ0n45&7sBX`GA6+*^&kmwa|cE}V|*>x z`cZ78`w!*1n^40cK}@gsTDA8^uX$cjcluZBLf9XsjLT8M&ZA>QHY3dh0E`y7b*E zmwxAJP`c-sHM6jI0TUK1Z<)cY5u(Z@xX^x)+do8|4w1!Br>xf>(*$cR z_Owo92&t0%7J=e|^tOT2^Aj6ssj436c#xKY#(f?z^ba62a9!-YQ7t4FRkeATGfY-C zUzAnzhc7pWTgoyuRK2{<0P#t}Uz@tz+%h-1xbI3T!g%Dx72{#^jjp_6(Ck>-ZMo2G zvio|~s2uldGjn!IqyfT|>K0=ss}V9=0{TJ&l;!j@d?4Sl%`+sRiF&Lq8M_XJ@a=XD z9>kU|XG_zIZaHncvYFtue-Lq>9`uxH7`x83{VfBaaagHV$Iqta-)ViS_(!`IxRh^h zxxcW{{6!`JvY00IZXvuOY6I_p&?qP?DegX)xgsfb1Whrs=JnBw@FEjg=;Qo&`nF|pW)xPzBn-|`oi98J3umynzv6`NsXh^^}frs zw$vzc+d{KHLTE_gst?(0pk;jp)u}*Qt03j(u*^XJ^xd7sK6lT+bY{Nxfml1EZv*bL zd6ctMqYV=Hpsm3@xyVFG6J%56Vmp1k7GVpV|@^);)@$YbSpAae(r({)7WQ?|3HN_n922T5e< z3ZP}JO<~FKN&P3ayj#u?=KK~-3g?dd2=p7~lSxc|6W9EK5ry*z0C5je{&YS1dfs2Y z7*)CUs*;PE#WlflrKt!bi({k(AEr$JV<*NW67%8TyZEGS(#y?%Z_Gazo)0_-yQj-zEO}(y9}`c zWi`zpX6l>Nq3@h;PA{@=xSue^hGKNfD9iuCrSMF(`05Rz$U+zqPm70cr^QUTF@T7m zqOkIB)uqBJLXji)nCB4mShn9kGs@oZ3^ID(AQ^rbqQcLr+X}z;68T||WWaNLKJ<)T z0MQu758kB%=5|v%RUwYfKmp@`P`pB7Qf5};%P)=`VgfO6iZ*8mxV5N-E7->@TGAFN_xJ@_p zLojIsb!fGD^Y@(JD_z7O>OqE51Eo%9uw&%W{d6{qK$_?N!sc>oc&Y?z>oJ1}3j~s3 z9=)5%YKGv9j;g-$l#|hN9>$c7De#g9V2gWK1+0!96*OcyIYoT^ddX#1dMZMSv@qyP zUQH;ZH>V)IK7YHrWT1l_t~F-6e9x+iA(H??nw#LwX2QruS{xAKq+V*PUKZY^54&fC zv|oO!?olNL$8TU~FEgPJ3*`R=lPd@KMq|XhKKD7*uAjvN*J0`YY+Le!C?QXR0;+^XTaoq!YD^ffR5@f+)f#_Bx0|P@0_2SXUtpjAkX*_&a&0>WB;!_C8Hmaf7 zYt5=>7O+G*2-?1Es6ANWtag-sRFg%A$R~&%FsWo9pyqtH!ovkQo}@^orD9j?8&s$3 zL;{G%w{&1g?Caj2b#4EQ172aB#jRpSIOidm_GQ3dr0reup8?v>8j_;xWLT7n+^8XM_CV%WE2=DI0~^M^4~p{w25g7;5#?UOC+=AkYrx0ia|kslRX;% zFIs0aBzQ-=NG@Ny9&S-_pO?3#L=>HLpLd{!s>ID7K!<8XnYVvsdZ}k)Ql$lVyZr&H zz9a#}AN1l!BjF_mZ zsjWD^58k{orx;6jC2D-y=2mksWh8rY!SoAzPZ6nF%L5Q7%KT;hM3d@W3Z~bL+E&vALz732xx8-0DV+!Qr z9b&adf5V2K;cyGd+pnQ8J5o?A0SSJJ6R^kRobpz+n#9B;6IRYUJt8B!O_#u&$Qom4 zEWh0KJ2ek4UA-~KTXZi=sbvArD{5ikd4-`p?OhAdAGbp_5|d?#PTCj?y3{`Q-0tg^ z)F`>K2sW@f?a+8^v5-f{FFKacWAC-c7o2>~oBB@mCU>n~yyI6Gg>!~*(tnx|bgnX9 zKxKCI=%2s+jmi))5q1KVQTt-=&nMMA%QBe7~; zDs1?8)YJ}w22CpxcFr0G3egiWI4e$C<;)lTW@KPg8@xeleRobe=Bp#rogf#Q~$}8n_GfpLcn}cGu-Agxh+i%*qF<0c~5r zv&bkd9az6X6-Iy8aM!&xxuWOAX9$cmxDax{I5>pI>?d%Yy-o!>?ixKtLc=l4+;E8E z%&4oISdXC+z|r=#B9$^SZU^H(XI*&Paidi-in(sDBabDk8?VDIYx@2Hqx)5Z_~%5r z9b}7|QmtaYJA6Av(T!r;e7?U9Pd^RnZ(6nwc|DGpb8>Qu7Np)2L%nNR?iqawrx;&& zoblP70x1x!SG@!@dx`9c>nuB%7ObciHvKfIyVVt6FwAQ-pKuraw@0Q=n{(h$QuvCl zv5OI;p5BNwZVxlA>cI(qg%AoBv`s|I*lBW{CDV)-!&ic^&&d ztqzWoe&2w5mFo`&E1xrhB?`dLz%I#WadQ z(p_zJ==dT63~(}0QBmm>8X}E4xNDUB{iP zteRd}Wf2$K(!XoNw>CgrS?q3;-ZcXznH9whAN+IF@xd6by`c( z9JZkn7rnA+fz}4surJN=jg2PV384kS*JS>TMl(%(>_~r}{S^qLakNHkHDj)weI!N* z%)c`p))iX#sb9irs&*ZdXL5SKs{bv! z_lR9V*s_N1`fg9MM=4Y(`Hnr%Guw;A#Kd!}AwnD^%*syjJ6ez?tHaE0P>ag|Az^85 z`r;z3(fo+-)1MTi1-r<#nm)5`zdxg|B``(-d8h@mUv~B9_x_>x;4K4ha$RwY{Z{ci*X1m=#NCPQ_{cw^CNMGuErZ)!lmeq8%}HsxO-^gbIX2*b#_e#^Mi6Dy9WX+!g>r2Wjvpz-V+fPR(*V{VrX;# zuNi+{g*h%ElO3yR`_ku&B%H1Hp$1T)c)cVA16hR`)iz`k&z4pC#b2G%5kB7 zBZn6APVIu$dfhRF~5QA)`D?IF$1}!6_By`fHVP`}1;|`(!mED%E&g59MDeYN`&6l$$ z@2XXOd3LjYqS$V1F;nE`E~yN(;XBRApp((guueb2*x1;7BA;H^>$)0+od zdA6nTRtixfMqpH4F;pZO0K4;#(b2Y*`pG$>Q8(Y@-Eu3ttSPyR=5qTff*<7oA))5n z*Uz-*6%~-%5d+c~%-`tLuo768z7z%a@+?`Bk4$2aFm;Cd%3I%6EY2xX5pmw*1A)5X zN|yI475%Sk2jQaDAByD75eVZv*9`z@jYXRcOVcVsZn@39+h_yB1O4eB%9^VvsJ{)O zt{Al8nXGbaB!)ta@+nGwdC>psFiKzhf;jYp-c7Jnfo}nSmw0KYpkds0Pa-@a!6R*ly5n#_fAS(XH}_mr z4RvJXfO0jrfP8_ADEH-|WRF&CxD7J^uNp^lM4u?;eC^4ZThccKYR3DNGV|PC z_0WUggrCjc`kgp10dbhoQ~V5mU_K|j>FpAjAAPoE03~y-UIuepa^LYfDJf)uIEFTMkMjzgq2j;5^bEW(CNC>vx_q8QLMtfdgi%DIoka*~d`_QCZ5fgphyr zyT1&c3L}WhMA~JC+e9orDdZB}5D=2Ls-Jz@uU}Tiv-N$I^GsFdrm@j1H`+Ctaf1nPqlD0 zRUr|30II1)jdIQ-()@*~37nYe5HAb<*!z`<-I4&uHOeI^InU=e^*&yI$adWC23$L% zQeA+(3`p!sE6QZ!(Z&CRIGUvq5jsRtmG2g7jbGkA>UtZ5>>YH9!n#Uc>Ujv)j7QN7 zr)_Fa5=}OrVx-?XmQYhUm%%$Gwyr@%g5x@sI{i2OOVC9(EydI>FX_Vh^dm^2vO(;%Kg*NTDT| zrC`wKi=G|BdmQTj1CO{czWvAgrQ0oy`Ge=>7S>x8l++ZX!hLH@keT=A3#3^^{o$Q8N~a z8ChYQ|M-|i)m<1XFUe!U?dUKxOA;@YQ+1M{OWLSj>0M9lH;S7Yi`n}EjN;ojFV~mj zXn{FQIT}=dqJ56NF2I2ln`a|nXmoW?u0m)U_rFl-e}D<&O7$SK(Y!-JS*|_YrnI5w z73F_$j*mb3q3f`R$?YtYxy(e9@1iRwFAqXLLL4dmlW)e{HY<1f3Ee;s^R@7pqQ_T1 z(G9)XgPF;SRriwO<~I6})5P@j%(%C3*7o`JA-ynAXFrqgWfywYM(C8=0&{p=+=A;S zS(2MnS2DY8DYIfC-JU2qef7yfM&MS2*NHcRsw)w3og?DNWhmP`;&P^0g0P)o6^>4)BpHbE`8q>SL^ub z^eD93$4z^fdRMyb@Y8{F#}ErqoQAu^>C(ePe!RMgEqcPIQIlUT zb+UK5Uy$!u=~(NRtAq$eMq}A73~)6sx_sto$lnVp-=L`$(W@NW_jAPBY#O@#@$gf& z!LdmFVEj$#FGJwb^G{B!>79_B)|>s%zICP?&CmZ{IhJjg%*;G=jC)afbG&eKXtiZE z72g8IDCE;WV=5_$^nSuC|6d-x4#C1QyW)P$Gc4>Xd+A1i>2}@mq;<iWp|I|i(Xf!rtv(2 zUKMaAPKV4;)P5)++C*iL9C5k(@a^1x4V;1U>E7w|6rZpGR&VnmAC8bHN7E2NI<3;D zU(bIi7lA<HPPxs+)B*WMrId z-}kGHLK10h&<(*llPjy{bJO3~ZNIOXfkbs~Z2|clpjXa0V;x|+g;MW?>rW|-l&lB# z+~RgsxH7)INy0iFvA}JbT@XEWik8$Et0Ykb*v@Vw#bK38#JqQNJ^QVtLqOG6s9`bzIMpV;`}tieKOE%VERat1 zR0>Ep{ga(}Q&s@rh^I$BS-xPZX|>~UNUJ+PZD#Bj)Dv$i|JJ7pfcC^a;kt3*HwiuA z<{c2AmB^=~MnMV3?0E;D5Jtu1ap={X++Q5F%gY^IHu9o#p3f5-Fkiz^d)^JJ+P)s| zH(6p>a&2wI3Iu6(-e*DB5Dl2bi{uJUZR9FA`NrJW^VoXrx#$~=>SE-phZ4qZ9sJy8 zTAtB@Blj$M%vP>eo%S-E!cyt|ZU#hCu!+f8K`zY#1q?NxjSXn;^PS3e$#pEZO( z#$~-vQ~^nmIfBi2?5l$+Shlk=fG(yZ#P{Z^A~9YLs)(^tBaa8O=^MG9Ik?&W3kuP&H2=ML zwCP2ryTV?<;~rCKR&%4dSh`b5xZtri2sb(d4Sld4#qD3kgT8I`v!`i4 zc)6q@25q{3y%Hc*G*KE0xDM!mG-=%P$_-f9QI9=sT5x3_U;7>9XoDK=u66W^e6*{v zm27M4mJiKoJX^MgE`;TD(cjCudQbFZyZce{;`j+l`ji$VC0);Do`TlX8`#62B~q|7 z0I*`)`obS)9h2;{l~fM$ZJ570wg1YO`2R)OTSrCpcJ1Q^N-5HaK@1ErLnsmo(mnLR z3^0_Gpp=x-AQD68NQ0D81JVuBB_K$rbc1xm@1URjJ+7074re)Q&AIP=UwiLs zUwfa6eX$(}_GP|ebS;xvp*t!&ue^&Jt2BVcO#k9~60cp9zJ}uQxh!20168N8`iksA zm=lGy7%v3Qth@HJKionVzOmZOu)hK3emvyxfB&9RbGum%n4__{Y}iuyB_*A&-Ct|N zMquhyozUTUo;&N>+S)~3(O1L(9uCYI`h%yA|<%_Mjo+)(DuwisO-+gZ?TXK*+ z>aJBy15Zmy3G#4i(w#YNgHsI2Vfp%Rf`Sd0lw|ynrQz3udRJv36F6lr!L71xrw(9hV6WH9Rgp11k_E6-LdPHLP&j~G{ zCF-tPv;`nGn^5xaVR+)GYP4ApC$Cg1?kx~ZzWQ*t=M|O4$BB?ZcD=dRAD(S+I4*Rm zi{0_Gu4KJ0NcvfIXt~bn%;bVX-?_)HoDRHYDWn#DStaS!vkk@Fh31ZrwpeqZstb?E z|NGG@0K8s?i2Z6lpz8(TPx6R>%l&@=32ne`18XmH2n*>$Cvc}oZ*xCZwLBfU`f-$M zb(Gb)#8rPeRiCmosZ!(u2+9j_*>$FtJJt0fn|+RGwC`6(<(xG~gonp2JAJWjk}Pmr z8_nevSika12heXnT51+|G0e9r0#!%g^5QjWaz2@^=r}&Fq2oC@pu@}G* z1iivHX&u6*QMC$_4s`}5jkZB+5AgM&?`B-)1b}==Jfzhb!ltIF`5ZtK*3Zj%$PS=r zU17aCQX)IyzHn0vY00&>@mXOA@oj&Hx9qsH0UWG>qMU%J}a3 zO>2d`qFGOu17AMC=)PY0bI{J%3(*xoauM8)q`W~vA#N0W2MkpoH*|UrOk9wwOI-U{ zqhZz9)YNA2W|Gr(p3^3EsAlPr=CN<-7*HX)cexT!${A3f9(4d=w1oRDEt{zvZXRC# zTi&ynP=t&I^+nn8H{5-B2M|=ZSnPfsABiI1Nzl4NO#d@MC1OrMT;ShnzrUY}uXPA* za;zh`afe^tvUfx#?pOgoysGWn|GdDLu9T1gMVLx({;n6E*07Ufih&JuLxVl0LAoMwuD1z(_+xzV zm#zF^`CrFg=x66A>n0wasZs{t9u_zL(^$|Jdgh_2zI!o82H0eA+}`4^ z1KmXFdL^H<1Q;?O^EI|qX6JaUEJ4s!tmX)qmle;?bkn}LS$y>`T^-;#FO1^@KJ~8^ z{sO!p18ZJFC;vY$`emG_gv13~t73Upm+O%=u8&7--}dd;Q4BbYaf{TguN9aqJpXlq z|CknB*-PRn2+Wgv3oTK6>rCSY2SNj#dlv(y7FG;PQL18Mo-U_hEymNcOB`eiT_eI( z;88x;dGoD1-dB2PN|t$z?BU)y%RseeN-IwKuTf(4901e3D);60e*DW@{C6keu?zTz z9KK!N=|2WF!GMWEGm*e}uvv`W31iAT;C-1@Sl-h*yjl5Zwtzgn7k8!`cxr)2#^BfE zRFf1r0euIvX#`~X_5^IYC2*T9rpm|5%geI~lP8tg_vHkDjA-kN;pBVmcfM|C!NEk1 z=Lvj9gCz?2jUYn_s73`=spYrm7d)@Jbb@4X%P&B zXVo~J7Joaw|G1)i_4eQZN7L>2WgCrv==6?ze_2)k;DAhBqJ>S(L13gVi_Popmv22v z=_I(-{5Cnw5p4Fw{gg6X5^02tX**Fusg$tgpDw_pV+0&m>AhDV$#On_-}$Jq)OH?Y zaq8G^^d}{nh;E^yi0sbbN{`Y>y|M09M(>BHtH zCxf(_Ljqb?%)I|hufvku3zl)tAn>umg0vIE6R;%BpEc0bqSDe10jnC&HRm?~3*YD? zQsjlj(`;%!#(erqCbtUMX!|;}@#NQo|EuxqzuTxt9-f^~&Ka%q!sXkNnDb35CozI# zZ?B0syKC1jli=W}kT*5FCP*aEQ0hBpbxNdhaH5H)c&f5`lU(!(Nu-V1H3_E;@LLfX zF{k0x^XlP*wyt%iVXnAw^BScn$BoW7z75ysjslF^!;=;V2{f286EHSzxF zO|r1)=!^u`hQ521+m-&U<|=sjLB#b4a$=^EWOx-sRDYRi_MTo)RjP0@BcFmmF4Oar zl+=g%y@sYERT#?yI6xE3yva9N;MEZ%EDjJ+h{CdH_UGQ>4_~U>5K)}QiHq^`9OAIMr>?DnS@LgR{xLWv3X{lICh3O}Ah{|iB3;T@ z0@O7g6LgukG`UXFId5Ev_O~sXF@rHlxg;t?pO~a^Tjbs?Xfvv(qOE#&>ilMTSu-O6 z=Vg|;WLwtj8oeiGq;!}6_~5Al>vd(f{gw9b6-^}lU^>V8ghu-B75;0f|8?W{y4+44gQOE43CT7H8+yE{+$7X}$7Gg9GdKX`BxNdt=M$1i7fu1r_V>7h znyj$Em5<*l`!2N5ndqJBd+YJIdIW@3t3NG!ZZzLVsySJAzfvV{R7dQFh1nY}=N_0; z5m%~Y8$V;zX;v{iD{IrjMr|@C##+%M1!K!mle_jUUEt_ucv1(@o7g5ZOYW^{43#s2 zN*2LETHaUTB?R~sv~$U=f;$WauigFQQ=#nwct5ohh90->Yr$>E#%1K>y({r=E4mVPNitic3UZGOKlBoQs0SagS&rf%E#bf)|LcbZ zXW5=Q#4C4(WONlqg^rX%qP%WXLqC3H1evgj^g5CCW7UzRh-g7GA8}WOoSzaU{+2`3JvS@qvh<}T7>mR-5}d@;(3j;US=wa9 zH=AZyglhF9Jcs?K?@8$p?(9q2rE+9UI&+b7QtQ{gH_NE|EGr>}jy9+M#GLdfKZ}eZ|DO?*Z7_divcA75 zSU6O!P>IfPMO%A_SA9^4juKFsdKvLh+>E%h;-e0Sdn(P>P?HyYwlrY7E%pI6{Iccw z>ewEXBT?9@_3-JMS2*U=ti!#3ESm=>KJW{`I(rJg?C!@cz$#Bf6BZc%w9~%~_Foro z>F9|uLzKHtr}(=~9mQ(-MidaEYz}?lWZhO)62cA$A6k)Bvs`K*0?Dcn#{faeh$+J5 z|x*WT@UXn$`n7gd7;jbgXX$n&GfZADURdgHxt0Z*fJgZLGW8MIpw?-||tKjObd zNev^yohc7n)EV{#-f=sTC_iD3UjY+qe;EoQ`8 z2o#!kzrDxWa#Ec+;WfLYoJhooju($(EqAogZWw zgCCMDwVNa*4;IJyUQG|_18~XsOim;MTcPKpIPNsM4&SOgWdlswri?M?p9_dbd~y0` z#a`Y1eYSl_LTfi!&lS@3#|s$#28n-uDQ;wP4MS=_tF_{- zsc4i66Lj`~J_is}q}kDx!oo>CVWJ%w6z#nGtu{s*F(Ip01MGL%4njoC3(rjL=Dv%? zSEl%jKK4hd%xmwkoQ15H6+_({!>&5p*|RO;%UBnxC%GNLXd?*-w;s+6x43?@?Oflg zh})28kdhr?{%N<)6%kn2Lz=URtr9Y!!HG;-arC>lhnhYq}PMGE~o0)d=d}(OS z6h*WoW333xZ+Ce{mtM0CYXO0e;l1Ea36Ahqj`_h~N z_#fsi;z9hul!A`Rv*GvhJqYwTk!6vDHoW>jm-#2{+finDWMfp2nYx&e>3Row#MoWg z(?l`zm1K^@=Gt&Xp4{<|&NuVrj|bZ0PCpwx)ODH~ZohkNNS7M(vM<`&2Sy})i}p*^ zaN!m6kBPTFaSdm+-t#q_?+CL{+|wut7ZaN=xz%V!<6jWsB&1BU#Pc>0h&IT4)rK){y3c$WR|P5$@71$0{7bgSFw9dub4q#c0K~ zTY?Yjnyj^Av7=S0ZBI{UQ=|7zZUC8jGE*Bep>nTrXw%&*5*w)4t&m`37v;9rJy?K= zj}Nr8cl*B5sx&@3SUxZi;Va2Rceos-ydN%H<{^@!!xhsx9S5D`M}C}*=qO2+Y$NCp zT1ldduz2}q#ye5yhAB0E@DQO%I99Hn-q1gCPjh_zFPYS z`8k}5o%MG@uDCBLjOUeeDjkAeWq=}Oko5X0FeB(F8W|dfC2xaCZAHW)%1sf-_<%xa zlIVOQXOYk;=0$Yh?R~`<|FQ#|abiH&wOQl9nU*Bm-(M(lC6^eFeAqu6162>O_-EjB zq5yc=+Pq8MO23f#88;B#Ns$@5|GlpNxzfO$AIw+wZsi}t%3w4*e0{a6qEseJ?rkul zKD?fnB1xA1i$CYxg@9?y{X?5??%ru?-%HsTFTS7T{-C7X4btb!2_%r~i9`^_U_SElSK^G?9kphdM1%1YwC)pMV zu%k%|f*SQcSIY1^a;P<__b)^li}>*L)|xV06v){I*`MwwxkQr1GnaG zv!I^zS`2)==|fbjQfg?@_P~e&7@Uy?(x&I`1!>E+!5qC=SK_Np!2*z{l~-Rtlf*qX^HsJxAM$QHhL192DKF6on?`VP(FzT&qh&|c=Bk*#gQ|=L8l_F5bUz1L4E4E_buE#9Obb+DN6igCT6<()- zPV~&)Q3e=loWhH6;$)2~EkTF_q#Vx`n4*$`xfdD;Q6)2i>cNoS-q#$Q=k0*=`(X9X zHMlgQ4JrNg6o3U$d=T3ePvYEr#?a0(8~)-d!|YeDJM~l?CWLzfzKb4a7TAvxMYBlY zGYmpZR5QP)g%r3+GL^h88I?^4G6knS#$#>w)L^6F%iu9tF?qh1wApPUSq?B z`^Fj-M){-)-Ti0M_)p{rP-f?)1gr|NA9Rj`fiTyXSz#x@9MNMEnZ0fO>AoaX8nr1a zds|>naXk1P_%sZuL6t0)OMoAd$3piNqWdBRQKqrb=){x`mt;Z=@^Grb!qDzfX>M!?y-8CD#6lbT-R2c@jl%k2eNk2Qa&wG_pm9T}DpI`+_k9MC4qyOw!r03{%xL`p z&jcyNeuj!v8_S?vRgr|+XHDcHUJCDxMkeQ_=!Q72W%TwKCsrmkVodCq;ps?@V~-xY6~x{Mc__sjl&uNt}l7JV1%=c=MAvqTeL4gUmLW zUJ|+xx}LaGX4zt`YIUz$4$hdZ%!<1$uA|K3n>UqYYupnVqH^%oW1LD z1syosnKs@(Bg1q&GfkVvs*BCYSohln^h^+ESYAL6pL)Q*g6V^Imn5O?$_r0qekO$Yxk8QWnT^V&GeM?KRIo;1~M;q(4 zDrVOzDJQV`i4zQUBu$ls4u8U$&*fgC57|eA-%3()bU}HKTWMF40`Xy{@@M$1ND`m4 zONL3o_k}$6O}Y#6h}vz83lQ(i@rfdDO6hAB1)=F?sx_`bsV_?bbpz(LPnoS_ht^YDOzznE|VIDm= zS#l*6tL@2)!wWEy7m6ndg|eSQXzP+)1+1qRMagFuMppIT|D6H>j^RWJ*oE`F%hJD3 z!ZS9&A2e?nS^Z!BfbYsWuqnBX-;5gLWU7p+2)83_Jk3ACkOk&`IAnKY-@T`=P1bMK z$0nUrX|JBRGW06aNIQ+NVkcSyIVGS^go-D};_qn-q}7Ir?`7mIM)Nx;%OJV#UyCezVe`_mk*HL?({FHlHAIy|5o^w~MagX%nWIqn?Ow?D`P|25 z>u9)b^v_#4VOTqmr@19XUJ=7?jAs!$j5|6dC-vxlafVu$X*%fD8!SAeaGXhR7qqO$ zKU~u8U8P;Qv!W4=u7C5QXQjfBFZYldcW?DuKegrqSW&p)7I0E}DhwE*!|E2{qT|MI zPRlA)YDEth8lI>^S3B1}NE8vMq-C+l48zE<5)x1^|5l{pVChydHYe>8Gu8OpstB|3 z`{AQ&D@+3oS3}Ndr^!g|TN0Iop^QIbT02>z%It4y&|SWYcYrF%k}2S~KY2j3F$x5o z9%ii^|8(8Jbh{LcRat@h??ZA<0yrGuy{C`<5t#mkeE+z(4f~?g0~0KVl8Q@clND9C zQiG=3CCPRjPLclj1j-3i~~0wCa2M9@+YB-*>os<$VL{K~m!m(4(98ri+dpK?MCOBtcnOj9_+FGuam% zLhL$Km+lVae9j{}vQe|U5gu1uPjNL*blhn!yx!5)>>gw#WV)brD+4(_j+McO;oSE7 zs4bO&*Ef8AN3_V+yM7q&GwAnv#;?{fCcCK06=hMdm=>wYdKCw7D^h^t5k8d0hP?w}=K% z^WED5f&T)He}tyz)*PjOOX5^;GdMZgkwAF&6VS8=O%cJ!#{uk%7;~^IQ0ER!AY|ueqGn z-Gd=9-|jzN*)A)IOi~EGbHOKOP2Esd!!LJeG_>4R+ z-wL@(6TB#*s84A$5jXN{kbk`~lSjq9dpCXujF$oWiTYBQ&i~Fmg^JJ-|3ntS7k1rDb>bh-WH`+j`szO0P>c3y-Gg=v)PK;H`5d|HPNVmVY)disyZS(Q zcx4L4ziAkiz7Bxxt)sikdV3!%FocdkATeGrv#7CEynf)FN(GcFjI0hVKp0 ze6_&nTrTs3@HMiHxEs{P%ks-Fd}qSrxFumQG6&M7?&L>&5EqL6_WQ|wK~vWe-=PwX z4Z%@6ee;o4urKrRHU4T8kh!c^K-glQEQ5rXgok4yu|QBZ@PJ+m!H8;83~}Md@m|W6 zeA{3C0#%`pP-&SVJ^p7&h96#nRQ~3~enKxFM#!vK;h*pmCC2~DMgQw-zd7(P za#y-=sI4m4*xBpaW~8lQRYYFF5(#^Jh@J%UY$Gyy6l*=^PG>u#3zTfx$0WsY2-Qd@ zw=90)n??urCRdLrL?h*>IKTMtK(*IE zrlUNt7k=43L1L#qvIfEQ(+M>Gg~n^vU;DHqN=a?R&_U*4uS=3LpKq(fj@!Qg?~Nes zIz8HGkHuLN0`Q1J22qa)(5jKr4#@7C=di@qicy%woG8Ikw-9+d4@TlBSB^9ehPCNY zha9oNpHeW98I&&SyGN+;6vVlx_(PkokME0H5yG!0JaLWHGD|33$nk6G$Z#2V+UxPr zRYT&|YOivhu+pmmky5h0SP`jK>mm}S1{`)x-CQ*Cg|JZIS3$j(r_OP*mc2Jh$4@;p zZ0|m?1D{XGwJo2N7ZM$7h+e4yeaoDgTO8cDPA?l1sg5W>%zJOQQi%OXzFMh_ghZOt zzohUp&7GnrG3}{IMRP=Z7}0lhxY@}{6u`mR;nN0l+IRWfd{bKjDX8rijNblh_p0as zI45*?8u{xk9UVZ760~;Ii~gOZ{KHrOefT|`aX=u3hjW`ROouY^opCFMjw&0*L#f7- z{RiMuq33e+bs(l_Y){VDX|3akdet7@RVoP|jkKhcdY2r%d>r7#VPv;L{S95BA!JxL z?P3yZYio`KLG@PhL87HRvuqe~KXnfTATZO=xZecctoiA>9xXMeQl>dPu-aoIQJ6|Y z&GjM)wBREVx5_$ZEhX5Z6yf4`B_$>G528mydvh?n?*a?n52^ECN`FqWBuPSQG)r~( zrHBPe@~jV!Z5b(`7S;CTr=TK7Oh$G#`!y>`C??|36hs2eu(mPk^OOH(|8ow@raMd# z38wwuif&oJ+&`}to*niG6xtc55-#7Fu>_(-B37-oRzw&4m?+_A>x>e@Spr(#EbsdI zdP=Hc{LPNk3V=nM_LbZg6 z&`2&Zy*Uyrmz(QNlfmwv1TW0Bt3vBI#0P1jQULIOZ{L^O0x*D6*-8`Q&zl`91=+$q zHt-rHTBc(4-6dwE*q;^nBjIHPBwK0{YE5C-S+swnV9W`rXZW-jJ-1K5B0?XXNe10( z?Y>iad{wf5fGjMhUEH3C=lh5 zkPqYjb_=sC6VRQY&D<;D`KtyBfhb)AS>e`sv(-I6cSDoI{73%-R%iqQGy z2P=UdSgx^ws~p#wSa$DR#n~0jqTZW*xyr*8rh|Pyr!($aN!Gp4X49}Dh=}-L2)SWMXBHWcFm{~P2 z9Z2Kp4OzT;1`sg~yO01#?%o({6s{VGK~odJ6Pq@O{K;4B37*J)9;!c6kyd3fK=Zi$7T z=lDHYB1_UjX%&v+5cA0bMb_i3kan*t)cs%%p^5bGNwR`L+?!U!qefo9&{A8zvE5I& z7L~g!Nf^h=&?whDiR7(}t2An?ZyT@6-hMhQ#r-ng9FyT;r+SwjwJVm~24VKXBN2Ui zgZ)g|$jgRRl#_8NDI?6SncmdkwVn= zO8!UzFVo$^bv$=JB=Gi}I_%6wUr>5M{m41C{)AJgCswV5<7JRbGiKzyn`5i-3^b*%|p-hm2`2@bUI%c?B=?bkI!MX){$v_P{7)itS;wx-q?c zGhMpOMQ1@@TRF9krc=)yz{Gc-(Ci_O@ovz*zBN+3mhOj~E5Pi!sf!v&$$K75zk5Z$ z;N#aFL_A2-@-WKJ`8vHujK8=F5>61|;O#G?3C}HXU7IMpyfWafdi=w-`JdUtWgwqN ze9;3Dh5oXGFA7&K)1%sGiM{=3yV^sSmpPx!m1@K`LW#**Rz|bMYG%#kJT`E(?ldo$ zfhHX`FZEDd^`X;riR1WP6}^N%ME3agfyb7`fwA%Pv*UW2V9~i)hjZocXVt8!_PP&$ z+~I~P@-AlO-~E-JynP0G^=i^`&h67j*Ba}p=32sIT}KKjZ9dAHz-Q^f6`w^UkR4yY z6c{Fu4BM2U){ItIz$`YNcuvCyeSFufZdOQ0zTDZ8fiPP;CDm`(0&i?b$S? znJgDp^4s(%9rtaE#nE#}9upgbOREg6d=10557uPb>=M~WHzOh=(C)6&Ihpr~DECPp zj;1{Wr`8UkkzxkQjjWQeZ-n?=QjT)%APKMQ^BXPkL8VN6#^i%7Tej-X57ZXSP_SX5 zA{L$GU1s;|n{Acn1MM}f8D?LBlGlTc@!=6xrr(ii4ko)@re}GHnWiW9&_<_E5ia}j z{6q5XC(pIP>{%1w)ctBfTc`e;!(#N`lI5&+?s99SsywGmLA-~cG(jkDFDVeWHX39j zNEU`oGY3Q1Y+g`Yd7;@%G}beIz(ZE#nkW>zbbz&fs*%rvU|^9}b2b)NQvgQGIX z)fsdE7Ald=m0+HZ@eYN~K?{fUm}`i>>ObEcY=vlfw_`gUzovYsYLvo5vJi^uzD{(o zl#+-bgIi^UmQd6|hYX>(Po7FNM2UJUgJ1 zs}b^e`5k;X^5v)Kdl%PB{U7DFir-GXGgp{ekuN$reiQ=HYi(Mn3vxE>i`;+5Zy2l& zo{D2XJo3pNfgWZtx)fsZUFJe;w2ukyPdHb?29*>U+kG`|X;EFAh3 zfcz`8Ov?72N^LRt(U0*nN9;4^_1AL>iw$@OX5B6Hmd4>&6UG^L+NB6LEV6O&dvd2m zu5!lw1z}|LToeHcRBK9t9V5o3g+9(*BK1eo=*0Nn;?geSvXCbH4qNj&Bgewwv2^9K zsupYr<5h+&LQ^yHw-no220wa;%Z7hQs4}1}_Ql4d@gnfo9LvD@F7c zS`m##fnWQLniM(+eJuMdb8<>1h6%j$$=v%H7!2jflK`Zj>Hw+2+?6P38PfE*K={Dv zkwfs{T_*&sTn*yU*2imyPU3mXhHa%Ur6!8#^sE*Uu55?M&ek}}*_E5s{vq~Es5bY) zZO5PfF^&bk8+u9^kVp_k8sgRKo2`IhK3%`#qrH?av3vb zdsb=BE-aMuhrG0C**v1;I}Fcbzg$CW{^E90-V2vJYWqjAC8jT);_dx*y~K7n@#|F? zf6f93rWHbu3-AW$xdfOznXBb&tYs%4*t%+y$g{Q`J+r$uYC0ReDMNaz{ox;Rz6b(` zXl?WzK&WlHeS#>{0B@f;PI%6aGOV9%A*NUQPo@E`I39%@vmgb5p7x!>+}e$7tk4;->=pp3xc|LAO?PPnpw!sd}71k+bD8qc1;FP5y)2{>0*U_s;`g z)F^}Php#rl!4fK0C7`M!PGgRmE=i;3@zOxXR`zWCdAw4~CWEh?G|tv( zjOB-cD=jO5{?_(qKb&9WP2GOHNICaNR0<0>f@W(N`xzKxzt2LgY1uZs=LGW)R-^VC z;q^ozfy8jk9HDQ+EEP#Wl1@i!6g-ze1*9%J+z!!TCE;SXK{%>qE3=(1iLZ|DXIqP` zIc?$URnnIsW*x@s=Uy9b+24)P!VS&SDjTzuud!sXUAeSnPZ%{C)HY~gWO-kt#&XK0 zJpWP8h0K3;`v(V^9hQEwHrINqh~m%*)>S;yI>@7#SOU^hYD2had!Ugj84Qxp%?^D) zX+{gXR$|(;i9C6~<)&mre(0o>KTXqGYQQVCO0UPj!oQJfU#WQ8u9L-LA#rlV-T$%yK4U^P;2qP0hF2yJ~Z^-fo+GZ>;6~%5uZB$A7=J#${$8 z?YNLgry_OogBkZd=3tr<7sA{vy1lbQPQWEr*|>-kV*a;e4YNkyqI`W~NlLzG;(Qd~z5xnbhZx4kWL=9q2vQ&gf1| z(RxeFrmEd|YnXO+a?vx?yw4p0~%N%}Jf7Xj0O ziM4u`(Zs5+EyjWPfFe|MRHSP1Mc-rUeZd_@gGRwTi}sGry55c2=AL)BMM-&+Hpe)n zlG#}}&{5lx+uN+uBf+1s1#JL>J%B3@n5|Y%mZikySm|}icb~c0voNc(KPK)UxOSk7 z5(G@Xf3nupBe*8zhg|PMo>k@84$_DX(fTi%26z}xwk*(A&0x$i8nu`C^?I+~9n3A- zs6b+z@g7d~La)d8Kd55)s_2 ztkjC}TMm+yI=OkKf@XaBWT2Je*X6Ww;sEz5{@tyJ=k&vh*_4TG7z3lc9@su8Kg5)0 z^NcmxVbUl{snTMF^6AbO9Beh`pyV1O!iWWhxZL_!Bw79s;=tU0^JuJztzk9k=C#!Gf zcS&Rq>bfNY#u@lE6);XGug1jn0E|tcYn1TmOsk~j<2H#(ryj8*-*gZ&ILjvj@Un8UG zyZqSZRTA!`NY;wywcpth9Rr>FL-yLsS_+3C|Nii6v>lWBP!(c8u-dP4xfsiu)B@oK z;%NOJk#3^B3j*$xaiUp1Y$+AuxEoIx#1?}W?h@mN-W*LbqfWu z71U{gp{d>xHn+M~B0DmY>9*r(P({8PQlru-odcw2ykcN{db@l>mwpIAk(^hsEy!mN zH?A!24i-s*UQdEhU?&6=Bv8%L|NG;r{3CZR^q6(mVsUsZg>30uB1w=_vk zGulAaA6Dv8jSg|>=>U5!!aU5u*brHOqImhz<7zdxulxMcP zK1#yPi;k;wJ~*?FigsRW8x+)CFJaPq<5xbI=rTSt2V3zV#%fcujQ*y1`gE@Zg~K1b zT(#i8biBVRVU%_tCCT(h+Vq(;R3)3=ekF5evvXmCet%k0=RP4LF&Zb9+ssct)oS48 z+K-y?3agI6wLeJj4@goLQWAavzgC`-rPMbQlue*f$o#uN5wUTJvC}W9GB4v(I@yFd zZ`n?sFn1*hWcO!MtJ7%Y!DN(=ZAyaBR{qZi-O#%Y$A0EhsB0q0Y^TTqfAO1jRK>l|y zYUZRs!n|wUSf^C22Lf~x4DfUYp^+aw4D48_~OJGWR6}1 z(WPz-4NwDfLwE`>hdBKo_WA-^-o{FQi7{>Bl+JV<3}ayW1vV@|H99N)n(c3n=`xJ2 zT+=r2wxA+k1u&C?9#Rnu2uOcp+lT_4FdtRakPAazTE0Uab8Gu!^~$Z9lUD~ z9Lml{`}a4-y<71%pOO8^E@|M;F3h8k6Xfil)*S5!lF!5021W71>pvt98Vs?tuz-Po z4jWkYFsEg&?=eUwR5^t4@!HVG0=I5qddF5_^Ot=&wydH+y;B9t2C)3tv{wkPvQ{qc zAb!8+VYvN7MOaRwY=Cbp?@rh`wu-awMBvx!kzo7kfToII)(|DtfQq$WogSdU6xzW1 z?tD(WOP>UEDFLCEarQ_!Bs_;pA?Ve|GB8KvfV7IA!+|CRX--d$m;_FJsInY4G>qhy zOb2rodx%w|Tv1B9#{=x2b!s76R66T@4L)13A@?2;*^F;7 zwPm;h9QtkNri~lg3htWNx??tBF=S3?O!`NOB^b%(NW){4q%eqk9<9hWBK@<+{IJ5*`sC+Vz~_ zx1s!PCv!NnR%AJ~V3s_i;6M22D}EyW#8@9ypw=N*|Ety^B66Y53yt!AX9KiiK&eFY zsV{0CeKuFRB(wLuO))whZ8(EFhBMRFD+&843df3y%zI~}kE~bGsnKb?uK{C#GG@3U zif-Nv5slE#qfg$}U{;9yB!j&b?(Zw#ArA`2piR?Tk)SM0XwFw-%3+vPiGK)(ctnP( zSPB2?x2T>145#-Mgy&BHIOvI}AKp>FMZ5Mz70Gt8#c)#NnEKtd1OtnVF)^Xz=Wi}S zwdMWUUT~|#-=8s?O;tRe-7+{Z{D_5xGDLu|4OSDm$SJ1g5%@g4iY*1R^`pou6^*2j z6Z#Z&f6zz1W7JB@Ytl-2KvZ}ejFa7^<2JQSx3@s($utyd!s`gj|lh@K672v@~ zl4V=+Mf`-7uUpUMMBYXi7*b%_C^0tYD|C99$C22Z zB-y6MP?b!Q2kcjnj^t2BwL_sFao*?6J%;O&hQ&`F75;Qm0PLF1>wkF#@z<46aDEqmlgg z*nT@NybGf{x1gKLvVJ2kq3zdEiPp(I7`?D;g*;1$d`I6 znn9k+7LEaFv4*kEiuZ!VyyY=ypY@!EjIdDcT1b^mnw;898^Bz)M}fGBt&i%)~S4f`{s->1b9YfMlv#}x1AfQbaX5t z-}3@KX`O1c>crgT?9k3g@2S<3ME8GnSpBzN3TuT!tIIc5-rxU&JoB)=5XZEH3ts#! z@__6W1mz0Q{oBCyA6DRYjIp4ubzo+nUJw&sN^#=-klVs>zMk=HlZnyQ$MGVjrWt54 zJHhKWtC3IjUbrsy&gZm*(A2Ao6||RY*za($4z)7Ua!2(Dy2Ox<1WEONF(J{+!*;%C z%)1wPo*qf}2vFueFAOv{W=7$+wdY8bg%?mr7y;6-`}s>9;XIH6gas)!P3`B8K9dBg zv~aaKXG09(Mi|iNK^dm!^jMpWRa15ta$7Y$9AT{*crmh(0C88{tBvLGCgX|%xz z@TbAAHO>{GN^$`OGm{(Ps}VA%OAlugG{^!U>m;g50%qcg;YVjQmYBY7@I}8|d}{Dv zB-h34lp>2XzY&CLyVhk6k?iihMeKbKyVPY7m%kfT45;Jffp3;BY|d3=1S=3Af&McR z&wk=o7kkFhR_E%Y9aWI2qpc-1zOqyYfsfrnbqF0BNIR}QvzOy>e1thL(YLN$x2Pc3 zLW~hH@Swb=tysQNFF(hOI!?D`*#3L5TMYf%XN<2#4@|!0yl^%K8WO>TFLm3I?F(L8 zoBCl`wqtA(bHN9}M8m_%)bV4paE!TOWj91$bA^a@*x!n(n)U9V^yqI5gop^BX{1n& zdiUH&pOBH`tMAEv;@;%u1sq0?`;N0f`QJND zzwJM~Yb|=xF6vsQ_BrN!I`(YkMcJC~#Y10kQCpZ)RU ztt-*O&yQkK7{7oJX+Q`XZks8iouBZD{NvvGNN~>A8%F$&lZ}my=nQ0p#jT#L63{!O zX2T2h+2PweY%g~(up&w-MNrUI=UTDdi3_cABWG}SH zerY^$cKR~ynK5CJ{-ks$_m3x|S+K2k1Ezt8)b0|qfR2LdF)PZRRma02?L`aClPX#> z_oF-{FTbj)B$V|@8!mR%MAaUw#R^N*lPcf>4eyyrxSuUD=(;EdRnG{GXNJ7rY4)pf znoGfGbl+n@`DGvhxRPAhpWX?%mGZ##Q?3=I4BZgk&c+*t+*S9~==XEmq7*rOj#>LF z%gDp8pWPxeS~4s;N}a-BWOj$Zs(aNujVff=U*Q>kqgm7C}Exc zZzR7h1#Fl;%P`4r(L>%v^8|(F-Y=O$-9@qcl}`5v?_Gan@tVJF&4pw6K@A9%6Rinn zQ{l0^Enc!A^dA*-8Xj!h*#1mM8-R`9i6~jK=SjWmU}8X;V|-;WxG=1Nrwd3e=p`70 z()5A?-itvq#<&Qol6#lID0`8cWOzBFp{N>zO~c#WebYfgMYZs)l!T(Zyu560*-gsM zSc6sycD?I5pb3!Ggx-cXg(I%UW5RO$mqE2d5KUGt4AuzDh$C4-s*+<=L`Fik0Ih>H-KB~1`Z!o)tdrL_;$L#Hoe%5<3nhvH z_1jeK%f!d3qPpMOQ&aQm43^Zf--32o{|+NaLqtB`&sLjYeCr`DFUzPrp!QMfpVmp5E)-WqD8vkSCby z!E{(t0)ju}JKo|ivRr(iV`Y57706ij_9g2vK)TWrrBJ9W5*_LhUw{;$zPYk}YyLLB zuDczw*a+j{0uIL@GT@C@&B&n&Vt7(``>(!!{ zLRfLfo)|Z#I_=*1Van5*ej(7^3RNej8OsoO?eb#)A0*GpUE0cONB>7!_4diq zgP|V0g!GQ0Marn}GH!Kp%o^U>7e1B+I`eb8LUB~riQ-KnK<;siQlOW?o%yb>;I%Ml zqamFr#CN!6>9t9WpkJ%^Ep&TCCp+i9{j=+MpA-@A_k=oJnr(X2#|-(i#W>S$`ON+0o_CQeZj0k(!5QTCs+)JCr z?G8nHJ=)IOHgs?ZvzjCdBf%_)@Sv+%+Y`(SBwC-V@v_6P!FlZ(jwxzzM&ciEFemay zhbc2u-T({|tBD(SJxJUHIn~?!Cqmq?rEZV|c7OXp2}_~aUB|)+kCO1aYoho#0O7!u z*CU@o1%*RBqxj;Zj@iE+dKCk^tssxdY?k;raC#{vr+ld`a?n}D*|pNgg-oQ+-6;E2 z$bnL(^+kA{OjKiLVRTelm;=jLcXF4AjEoGvi(~28(D+s(RS5s$Xah5G$)|SR z-}b2tq!2smVFG%)Q>u1jWBC2vx3u(*60@C;>DLAC8g|Dn1?0L+8NvCK(#F5Xm@d=P z2h^YDTy~s3V)(^yK;s4G=lj0B18U&sV$EBG1H0FK9$b{2EaIB=VKHgvW|2e(cf*r~q^>ZVGtL3YA&5f-Ob$<*zxC2s%FCq>UU;^@z^+;ob{40Y(A?CJkVEy*GMPFhKIX@Ozj|*Og3~~S9@POc_cbo(7`yRh&ufdrt z=cdF}^*1UK^3EVnQ;U*l=%A)N(N8&UqP)9*Siavy|NbV}hLCyD&<$=`1jC zyU*$2J59)YSZC= zrh-y&Kzl&;@*!1g;NFk>dBGRwpY8JPhB?|wEY^xwJBAW47f)%mz-EELH}9g>lO~k< z`(|*4(+$=S$MQc)9Tc!vRfUQ+d9!4Jnd-Nn7@zjSa&&(dPD%7;IlC}+bNPH+*AhHL z5*_Y!XH_so+h2QuB9vE=eO{!=`SD_&({c9gu$+<=t2*?&`1W0ABwSUG5JnP&OYjh1SX@gc+h9|kYn~AqYvd5e@ zUw=e=l$9@FwVm-Di}5Ac*i5Z&(nC@oNMk^ed>i1vfYek@H5uh*MjMD*tj_9 z&KGJbIvi3WDo>f(GK-Bmpiy%>_D0LOyuFngsKplJ4R6S;O8P-DohCjiaO)kO0wjE} zecm@LCITkKl%?s^TtebgKGcM*QWo{7y@OIi;zXbW`c5FfdV?lA?W0p@jT=Sb(K7)F z3lr&P{75~_koWFB7fHewNk>pt{+;@2&~Z>5DI$%=88g$@S7y^{K9x@hRzQQ*n$ez- z2|uLEgd=uazb-ny)Ei5VQt0$kWi5>6Y==@teXO$Un6E6chUab`pMQQm^|g_ub?T)n zB{*iSUU{}^u1?bq-gz=R-`Zdx8AF(&brVNxG9Xq zP&}m+r+h7oKLu_;l^t6enLFU*8fOJ)Orp6Wks(0tl zuNk=;C;WgS<#M1UwEKT7^RXvjhL)T`GU9F6&WKk}v%{p>(u^Sqxg5)H5nN5e11x@B zCGh%P2PEWtdKytyn+zR-U7~l^UWqET3cg0_fG$4E;*RMne*J@ouWR-F;K~abySw(^ zxx=G271P#Agrp)mar%p~*1qk(5q8D{P?J2&D~xdH;#Ch@kyoTQ>VpatgE%zb^QKGhX30)|RtwlG z0MTQ{N4+MrD-A$J@{TcHI{@jnI`e9;tbHe&SnsCkMqprI09KoT{W5BZ{W217!Kg!_ zEIWIAz*pal@F?ET`I#ufLvVM$kruR&+zdZ7Lxlp|pRk2F^oK?yzCT~JUOtb$9Vu`@ ziYH$;>@pW$T11qJ2l|9cJh5S8QOrWOiT{jgwYAkB-RJA;D4}Pw8GArIWI0nt&vG-( zCD(lgl3knLjDa`p9IQdaY%(zG5w3_FeJZ2A)eRN4P}|dQLS!DQVFNh?qQSKg&gzR_ z7awR@RQ(`0(c;il95jd*V~sIBF0DQzP88kpjN1pDaVIcs|83p(4sIq4WockEqnaA^ia z1c8e~^k2;Am?N_tFlTTfyR`tp9f1Roc0ycoTx@S)=d#oLUM->$P><)2gB$FT z0qRR$&}l!gNhwThs?Unk*zp2vqELGSJXbQyfC?w3SG@x-S^SMKFn>dSl?#^=lX0XY83%Q{xk+x<))=x2 zF<>Vaf%rnYTQh6A)5g@Z%&yw?9pa>{p zpud1#qSC8;i5XS&cYGCu`F&dXQ0+>+Kp#gYkt;3x{-L13x`<8JB-F9+G0ZGo5`N5T@#tudIjw$Q~q5QK)~A zS3(mmx5f5L1E_bF__efOGGgW87%*a`R5+oE6&*+agBb&eq&nj;fupnep@T zx2-0X`(;R*!1-iWyT>{Ui~8$_1#;u)UgWi1&zno1_aM7D2QqI8C>tD z?v}xZiucO8Mk*a(syX=MLxR*v#&oz!N6qHn>705^Kr6d)h1r*;P{q*>y!N-YhE6iR z-M8~~&v_NF@xk`Fjhvq}hZ<(-!a3pAVCG7&G3}ND`n|rgbn;Ekh2$ys#=Wy*y;y+j zWX20*Lp6F!ZLo?>CNU1yX_Q>tjX!Li(-U)-;`w4(wzeyrb1&n*8S ztuXy42I_2~cZFQGXbu&RZ@ZEbr(A(kJDczIW-+D_eR`u`GlUjm>ghM)^W4`f-RRsh zlSq?!^?Sy5-PJjk3r=PJudn|IXaDS}^=fuJu%UkBdV=!}_}zt(5K=yEEewM1reHLW zit9&k6JJRh?H4H6nEmASp^VK+$Dy{Z0x>t4532%Bhd--)yb~tPYdU%A=B&8@x=-d{ zMFp-^vVfEnalGGCr658Mp@3)-xeOT%VK1?cTVI|sF$rqAK9V8kb_c5ef$Ml2)A4cVq299W}q)&RC5IkK5Zw~2H z(oPs*y}@pelR-dnrFA>F{v$HzbjqrnR;hBOs?|IuS*XGKyLsyhu`KF}eftwikV5=i zDqT`P$>lHKtA?b+y7e_>tB_j;j7Rnr{bMS^***OBs7`j~A2W#R%D(F_9!X;F-(HzC zx>cz$ro`C;nhO~_URPFXGoyGK8&vU4^69X0*=^3cS5uC5)TT0qNAWCG{EXPZ!WgkW znsWJ*4HuX^u031R(>F{S9xOn>N<_%rL+$a@rl&sloM`?{Y&d|hcy9Vz^WBi(A?%p+ zuV~sMUt+^(&v$Gmtot!2Jt1aM&e8Wq*I=(dh9x8@8K`mGyl$HWn8;ea&LkJvda^Wp zxSg|`hQnQi!FV1IXq5g1s^xb3E>@G@y5*3J@gpsRtG52s>wy;x-{gW_x9Mv-4!_Ah{!Omjqe50@ED1*Gq#r%9-jrx`BRv1Z^c$b~fKo0ItOW@lOr;VlFh7%_F@b=iP5)$zDK)pO zrE36RZlfXo#=QQ&qz=m@s&^- zFJ$!fsl$l^oN^U1WUJ(?^L`#B2eW2EedQp(&gjv!v4J7*_oKky zH}u`6$=0q2XE!4K>^toa3UlvoceAv$dWKB(b~Ge?pv6Ac>ju5&Lebbl287&~7W-@c zd5typCOMk0Nyt_0P!8eS3C!)zZ0wP&^N#e?KQ-*dt-k1Xdh5EiG5n`g8kD(N_#@dFahmcJhc~VdYk2Y%WMy~)?96>j2kk<{X!H1AQpA8 zb=Y<1m7{v4kR*2uaq>3A`04I_;)VWf=H8Cc3rUe9Zr0tw@&Y~ky7@+@o`f?J*{#P* z-Dl+;XCx=zZ?Rn-KH#$3LZf&3DKYiY{M;tMPv+2aGf8sNsA};dmG>#LxAH|=DF^Me2dho)oyN;p^pQgxfpZuib z$i3*(RgK+z@J`u^ZTnuw-uMp#$=V^_5wofu71y2c@5j?)7^DR@LuBg+_y7=QJlEc; ztBgyS(V=c{kPa?nF}OcVr#16AgkLE@ri`_6aQ(_rqAcWyn~V6Z7mF<1j;BH^_TY5m zE!^((u;L+0&2tPK9Gp{+vB(A9;lv}Jnf?2B^x3B1BlWt`D9C=mKisN(V)1~65A3#c zyu_cxN&f9}AN6pvZ?Hi70YC{_ta858$Q5RNQDS=4LX7vAuGVYSbyELuW6Gz?RB3I^ zvt&k!e7jZsz6f+tc4JR)s@-Xq4Rd^BzT+C$-JF|OGv$2xo4z8#>$x- z(R#j^Gj9B9UN2$chyXqr_r_AwTif2CQa5Fa8AJ+xek(EKZ+1hE$ZmdhcHda)Kyo>f zv?!OC*}#s@_WqQudg)BCI-A#`Z$`FJ zL*AT?h}buuu1YTrQ(t$Pe$HblQ$F(#qLym;y6(c)(88? zM8w2a)9fYCyEt4oGs`qXS*TI%v#7P%x2@M_HY!1Qt=Td26O&Iqgp_`%CRNn<}n zyxxbN6J#=f5lnY+$y7v&K@xt8D>H{_C67X*Nj^p7Bx*3 zC_QH+c2gB*lE{N%ppmEEN6tr^zHwyfJDQmES^y-&zh;+rf z2JY_EbPLg=KR&K`L^((f#YIhdTmVKUtd2tB@S!5>dwNIDb-}TEjMo{njeofZ?mecpu=@Jv}`IMfT%Qmwlf*E?Ak@ z6+I=xAmXU!)N;-&k!O2dQSrp3-yGPqLl#-SyYvS?SF?16vsKJZSqdr|q1>?qxS1dq zR~_8t6u?M!wef@I^_-(R+QPHKPMZ>spijEQP4y!R>ZU&&zBcTiNPh;myQQ@Cn0ms0 z%kIb3Cc%U1!t*zci;Pg6md7kC_!2By> z0p<=i#TotEtG3Mo9=u%aDf$~cfPvYl9jQ^OYp>znfba;XI=wNWSVMU>7kbZ&oUvWtD>^pf64Ntnod+N1z)@c;m^=!o+^z3F57G3S}Ex8pbo3gM? z`9rV6f{NmpzKl^bALn{?QENE`VPTZ$t0N+&%ILs*wCSHme~6J*lW|TP<9w5%#WPFS zp5$JYC+1S$X~N6pc_rQ35zVnjJwpm^bZbXk;^KFAr}78G`BK>Q&m03r)6tiJ2BT@9&(#wvNoNOfU#O} z@)U%_&+MGt)pp$93Q*giM5{gCr+SLhn;PdV>0TIRd2&|}9+`tY%V6~&TtHvyfyLQ8 zwI6mNVJMaFk=~~4)nLbOu=f>!nlBDZt8hq2<`2m^ay7nyiTM;-&=V68`1p#M*s0Z} z@`Utt`D0V1XM;D%*}v6<|Kw)d{0Mf|-6cl4Vc@^*A&5GX01)R=EKO7p^DmPT~?48&<(!bJT=YXJT7tXSQ5%I4aYb ztH<%3kHyy27ed2i)n~M0#TMT;BIJ{EYjnPb9|_+jj_nYv|Ki5+fk{Giq3^Dlbrchk;u?5M^BW8y>r`DWU$?sfSKx@$?f@Qaipsacl(6| zD2(N(*F0kReVmb7W8M&jn!&4M>V&x@k-`Cj7f3>$Yge+9O#pPApESH!x+Qz z2JCvcdN9&iWcwGoTsJr}-AdFYT?o>Ak^xq7y zkn_fzlVN9mNgGuAIMw9oeQGQoqx@PQnTM zaZ2A5ffMhe?vx&mg^#t8t6ZuauvP5X<+ziw)!D)4M6mM7gpgUi?NjU=IL3LWWy3D& zw9*D|yX!F-$S2=L1Txqhue^A6x`ldvV9ofpjo!C@MOW%Gx zH(#N85h2STB0r4TG^m6jx3;@?|GD*V*qG~CAS0HHQ{&Jj&$9>tbAat^M#M((? z!&-t!KKs(D>61!Kg63q;3)j}Dvpen6P@i`q*^UReQH~W_KSKD=?!n!Te}12tORk>& zfb%dR%sm-s;x3*&i!2z)cC^Uyb8J*JM}VqCYbM+{G}$IXU3e95Qbg8m%N>Os9%?(R zEJ>Rd7_A#}I_mVVk&{!Ye}8Fym!5y*NAZ9HaILriTFLu>lVi3_vBw#d?B~@i4C7*4 zM}FjXk_t8S0WBD(;0v?(hIszdzkQ9cT_Ju2nN!kD##WD5q<-SV_!mBT4)W3fs4pg2 zLrny!jprCd8_qP>AEF3>Zi-d=B8&O(n!{+L9h~AaQ=eOKW1mfHy%pWhEeYVu9oNVF#ZZ+p= zGNtdZ!f@z^EGN8Tnn&&h_z##&4vF`g^weG;60EmZyB@j_jw0UKUjdJ8!rGG@&vDc_ ztz-MX2?rj5fwt6fn#7$U(?$85A3Uejw(wD-@t|lsP}G+lHKEh-K`}vq;3da%s0{WHXzO`A4=eu}ewjUK^-4^q;dVfIZyJqXXQ{0r1w^~W~ zql6+*e2HY27*XwgScF`O3B;7$UoGcptQD2V=?kXk+JDd>A>7_GmI>IGJ3t|=_>u0x zCVIZ|{@cx2p6q^cG}HH)Q}e6;{!7tQ+bgqtu^V;eMUylBjw(|6H|%-}7U{w?olahZ z1bC7wIDt;8ar7hlkn{U5d3;V}UApng*%gj82aUM6-J->WysngdXWJUZCMv~Y927e| znl2aS59x}-HCnn8yz}$rzT43khU;c?YB`}#=53{o^s%u%Hyh}Bt9q$G`a;gw7%j