From cef72fadedd320a0d53220514e52ebddd997a615 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 22 Jun 2023 10:01:16 -0500 Subject: [PATCH] Created playbook --- playbooks/AD_LDAP_Account_Unlocking.json | 279 +++++++++++++++++++++++ playbooks/AD_LDAP_Account_Unlocking.png | Bin 0 -> 44873 bytes playbooks/AD_LDAP_Account_Unlocking.py | 172 ++++++++++++++ playbooks/AD_LDAP_Account_Unlocking.yml | 23 ++ 4 files changed, 474 insertions(+) create mode 100644 playbooks/AD_LDAP_Account_Unlocking.json create mode 100644 playbooks/AD_LDAP_Account_Unlocking.png create mode 100644 playbooks/AD_LDAP_Account_Unlocking.py create mode 100644 playbooks/AD_LDAP_Account_Unlocking.yml diff --git a/playbooks/AD_LDAP_Account_Unlocking.json b/playbooks/AD_LDAP_Account_Unlocking.json new file mode 100644 index 0000000000..b4d24741b4 --- /dev/null +++ b/playbooks/AD_LDAP_Account_Unlocking.json @@ -0,0 +1,279 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Account Unlocking", + "coa": { + "data": { + "description": "Accepts user name that needs to be unlocked in Microsoft LDAP Active Directory. Generates an observable output based on the status of account unlocking or enabling.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "id": "port_4_to_port_1", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_3_to_port_5", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_5_to_port_4", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "4", + "targetPort": "4_in" + } + ], + "hash": "fa54af4718791760fe2785872ae29512a7d81b01", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 20, + "y": 0 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 19.999999999999986, + "y": 864 + }, + "2": { + "data": { + "advanced": { + "customName": "username filter", + "customNameId": 0, + "delimiter": ",", + "delimiter_enabled": true, + "description": "Filter user name inputs to route inputs to appropriate actions.", + "join": [], + "note": "Filter user name inputs to route inputs to appropriate actions." + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:user", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "filter_username_check", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "username_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 60, + "y": 140 + }, + "3": { + "data": { + "action": "unlock account", + "actionType": "generic", + "advanced": { + "customName": "unlock user account", + "customNameId": 0, + "delayTime": 0, + "description": "Unlock user account from filtered playbook inputs.", + "join": [], + "note": "Unlock user account from filtered playbook inputs." + }, + "connector": "AD LDAP", + "connectorConfigs": [ + "microsoft ad ldap" + ], + "connectorId": "a5730e5d-a396-4695-92c2-35ff391aaf45", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "unlock_user_account", + "id": "3", + "parameters": { + "use_samaccountname": true, + "user": "filtered-data:username_filter:condition_1:playbook_input:user" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": false, + "field": "user" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 0, + "y": 328 + }, + "4": { + "data": { + "advanced": { + "customName": "username observables", + "customNameId": 0, + "description": "Format a normalized output for each user.", + "join": [], + "note": "Format a normalized output for each user." + }, + "functionId": 1, + "functionName": "username_observables", + "id": "4", + "inputParameters": [ + "filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.parameter.user", + "filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.parameter.use_samaccountname", + "filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.data.*.user_dn", + "filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.status", + "filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.message", + "filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.data.*.starting_status" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "4", + "type": "code", + "userCode": "\n # Write your custom code here...\n username_observables__observable_array = []\n \n for user, sam_account, user_dn, status, msg, prev_status in zip(filtered_result_0_parameter_user, filtered_result_0_parameter_use_samaccountname, filtered_result_0_data___user_dn, filtered_result_0_status, filtered_result_0_message, filtered_result_0_data___starting_status):\n user_acc_status = {\n \"type\": \"Microsoft AD LDAP user name\",\n \"value\": user,\n \"message\": msg,\n \"status\": status\n }\n \n username_observables__observable_array.append(user_acc_status)\n #phantom.debug(username_observables__observable_array)\n", + "warnings": {}, + "x": 0, + "y": 680 + }, + "5": { + "data": { + "advanced": { + "customName": "filter unlock account", + "customNameId": 0, + "delimiter": ",", + "delimiter_enabled": true, + "description": "filter check if the user is unlocked successfully.", + "join": [], + "note": "filter check if the user is unlocked successfully." + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "unlock_user_account:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "unlock_success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "filter_unlock_account", + "id": "5", + "type": "filter" + }, + "errors": {}, + "id": "5", + "type": "filter", + "warnings": {}, + "x": 60, + "y": 500 + } + }, + "notes": "Inputs: users\nInteractions: Microsoft AD LDAP\nActions: Unlock Account\nOutputs: observables" + }, + "input_spec": [ + { + "contains": [ + "user name" + ], + "description": "A user name provided to be enabled - AD LDAP", + "name": "user" + } + ], + "output_spec": [ + { + "contains": [], + "datapaths": [ + "username_observables:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries ", + "metadata": {}, + "name": "observable" + } + ], + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.10", + "version": "6.0.1.123902" + }, + "create_time": "2023-06-22T14:53:39.397912+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "user", + "microsoft_ad_ldap", + "D3-AL", + "enable_account" + ] +} \ No newline at end of file diff --git a/playbooks/AD_LDAP_Account_Unlocking.png b/playbooks/AD_LDAP_Account_Unlocking.png new file mode 100644 index 0000000000000000000000000000000000000000..92a894de2da90641acb9ebd63d615499b78e6a37 GIT binary patch literal 44873 zcmd43cT`hR7cU4g2!cuzP^1Y6(h&rt2kE_wbQBP&L3%GXlp@l5kzNE81*C*#p@RYe z=^%tiXi`EAFefN}-sRe5<99XI%Wdna20f@?9(uljf%KV)dLwAQ$( zlUv0=%UPw`mzeg+iE8;R(~Y_Hr4c8G`Gpa-+M69&EOx}=DqJXz+G{9<_}qBODzc3o zsb@XWtA*ODMyoPe+F7f_^b$8dUHcfCpJQ8M%@&$6QX7JfxnF1BqMTHa6!}0X){SY|&S#bADdD&`uhyuV5FF{kApR=11-J zs^m~Z597rZ=(a_VdXekJSb-vuid80wzG;Q)H}v-#%S)H|`JN| zn2rUBS1)(+-U~X30&eh`gn%&2o&X9y5rQ9j@Iydw zD)t!xG5AXbeiX7HCuboB*{4oEL&@<2<@DuMRl#3d; z?q(-&U0hsTKu}0PNQe)N;B)tN@wn^5=i<)x=O!ojQLuHlcC&Z&u!p;_;O~3)9^BJI znw1ql(Z7Fxp3~OH{y#Ihxc_}E@PY#PGXmH71qJ@y8(b=d|5ifB-pAI-Si#;IhzHCe zb6rqaT3XfmWJcT?L42w()N3UUTMgi8}=(iv=1cGm1-RXK!J z3;gf9$=&)G?W%IKHL5;m+K+`os`(U!)NL&y2jlAg(0?FP@YT#;VwUZ z9{ewsJOV;P6<8(P$wW{Cvr{LxfvFHeN?wK7D4$G3QuOikzqfe>>5HJ%&SM;>RrxP8|I zN2;l@rGOe991(f=Esr%%@#KLiev=AvO)R$1p2*aS7Y4J{P&$1g#%3NE4288KI}wN= zSP~%)wo@nLr)gNS*Ztl;J(1=`G76nbaWRA^<9~xS^OgQ_>tw=6B9fxWj`kC2lK6n* z1}3K~CtrMpKn=dy*qkf{v;iDjkXN4wmC%|H!fh=i^jAR$AQs@bg4pzAMMB;Y5GGu| zbm`yt3UEC9nD5`~+zAQkOpZMJZ@f|VNc}=EPlnpU=M<-*-~u5ou8OlSqvdyYVcc=h zCZU@$=V#ETiZ!TkozpuvpJb8e390_(c|1G&YLV_{wp#wc-i>Mqcjv};N88wGqtk6| zS8xF=3964QFEKEO{oV*Q;5ZXx>l(n&+DELH!d`AU9m1W~5zjS=qd=vkq0r3&mY)I` zW!>N775J z>lYnNIE@da13!%(+^Zy(r7mmz@OQN?B+}m_M?GzJulyO7^@3nH;-5uL+x?qKclX$v z-6$rp|K~@5@@lAU|L-)8&}MD5ZQ4(?kd6xvTwD_8=XJl|Xe{PRb>pHT9D_W5T#+v{7ocODfR+=oot*QHqb&|C`w+!5kVwAj{np(1dl+e<$Txm~jX-w{Y z^;JDR1lLGf7-<=}M|8eOZ{dSWOj$_ydaF6h4l>$OSvhP&<>_bund|1S@BIS<)aM_M zlPK^uua>$t?;s2R80-_r?{CNB#m;_qrIwX{d$+@R56PXZr&)rk4U4IK0aGPR3!WNO zy;i|qRdH%(_a1jjJJu1ilzQ`y5DhT}EV~G%-1a1AAKA;L@5SZ&hMxHLn>!X!1Fq+x zYNVT+Z@7FTPm$axfq8QJ-Y8*R{_8746@V+fTDNa6_18{+P_SfIzE-*PR|c;h0GTOx z%SN3i% zYZ_4Os;fR_@!VVbNtRsO6Wg4D&n^e=$&1e?=c3FDGq?m0o0SRgy}Z2I9|!M8NF8k6 z6JJ~+H|C1F1w2rw3D6?stqgZoom;Rd4OFyAaWl8()z%!r#r8ggsI)w*9<7EUP3k*cvArmDS=5t9OIVs~a3vw#Tol)?x=#8sQ(^TNQD5jR z`wf4%_esyy9J$w(tYz_Uns+C8o@fyOuBCaO9IS2ky-kmh&b@t`z9D;rQh&UcPaeJwWvZ|L)Gx%hg$x zTztIVE!>CEmz6o9w0CqIaL>r}!z?_)EWK-6S$|F5XxS^XADHu~G&fpYx6l~33DK1s z{2G-u$0=K@yK?X;u+qc6MrJF9OolhfGAN}17cMNcrM23Ar{&BK%FBcnFB#Ixb8={j zKBDX><8mkjX?Da$JBFIU@#=b zgbLeFe%B2?*vI*j!|m;PI0nmSTK%hUZT2f2gEcX*HVRH) z#5b|Dp3Zj&MM$w7iihyUk!L;|X;bV+hfn(!?kPt(B=+`dA%f5u-e|3=`#mPQQ(yI4 zhQ81R-eU51Di7E_I@gn+_ku$+lbti&HGm(HmGDK$LL%i2QjmoPm7FqSnAGUD0yZn{L)Ki+1@jAe%Kn4iP-?r0)nQBRxD2tc0sJN z%6W6!u7_S9laM@Q3+fyj;P%qr5Qsy$J9S=Dsd z?n0J`RJMGk7jJzxzBLr+*%m1?o(*mY?JQNQdc@EDwlg^L);G6yBWB3K0m7E&-rjbZ z)7@UV&Qf-R!<#{|@G|BHDQ2xj4 zq|i+H1O?vF$bV@YNYl6rT4nyFWiXJI5k%zu_2(h5>p*wzaWBcA^D)&Np4SKpcoQT!rh$? z{TtTljlpq@e^T||^dDvj-k_wlTa{kZYJbZ)YKVRGaR?3Jq061Sd9N-4B=P0#K#|)r zk&l$z@_q>YU?D-U80NiYk>MtYS>G?aKRbQl*Xk0ZWfe>}8?K0OOiS2GpieyRC+L1pn(`D;677 z`4MZ&$?0sTiMlVlBbctoQ$~%+Y8`@h`ba(%xAmtzNDM)}h@m1;>qu8&*q1izg z=2!QQo_|=~Ay?Msm|esrP+hHR2o2@y9~~|6m5`L2`;~j&FlU`17`H}LiyNzk$ME&a z?qN8WgnauI%oXOVhFfX#H#o~0vV*78?&@1`T?*b`+dvy|C*YAvr^#MeYZ(iwma0W& zjck5?zO^rbWb0DKRIl-w;G=!_uL=A6?~mG1#&G)^<}?@0{oRr0s%{OpGm}VZ*$WnOXO<|n)Z;6b8kPL#~LoRK8=`j&)O%?@N#vn z=e={&vKl_M!Xxkk4<7VGGmZ{~dsO}K`gM&2p4&U|GQ2MT7vGTCBSs#K=u(u} zWb7E?{<6cP;`Gxzz(qa<>BWVT_!k6_A?R&hOAgGJJ_p~mr%7{|(k5QV;c`CX!&DJR z&r~|g0OLa4T>X->cuIjqjnHLRu~>bCgvCnH>gSV=$~Go{RHuWZW5URL?YP;Ol1c^I zQ<|%mm2;lHJ27oGz3Gzq72as0ZOg!ATVsTuEx!PmJp^_E=$3Ag9tVWv4qdX4tU}*g{||q0Lk4WFDeIcugiGGO!w)8s^k5)Jm$ZuCC1A+}cv} z-lpoX@$W2{WdTNGr5-}bZ5kW@m;ho({c9;=0E!(|9_AE8W=|M=u{#IAfBAf zT``O0>O~Zg7ZS2L5KZ99(o*A3*o+r|Q&O|38F=tlu5SU2WUC)n`A5ny zmKdNKFP6OMPms1KNGF{f^iIeWc092ZGoh9H7ZElW05U>Tv-4kq4?Nn{$}#&JcsB~1 z_75;!WwEO9pCgu6cy>v_OET&N6s3XbL`AqxxELz%Gzsl4h2Q^AQ?t?k56m1Og4zS5x>C0l|47&^Mp#`A-B&2LuXNdvPLAK_Jj4o;Q0==&yYs&@D|a z%D)1l;s64Dd%m#tM4*;Hpp9HtS^t<3tQABjs-c-1bbrS$0f06lmalLk&}87KS|!rw z|Bep{1lqJ;5dZvdJU#>Bx!Rqu0kacr5&+sX6;Ji|WmxWlr#Z9enhJFE_yM-S`YomD zvHpD-c8zTD2mS-a@x7@X_aD>FbSV2Wou562i|mlP^n1hgB7E9TW4t$MpU% zCpqiK825o5Wk3FnvFw72?be>2^RkBzqzxnLfa`39CdX&~|5%_QMt$tZ>hh3QCBMIN zs!=#VWM-ExGr>u8k%tc-vO?cNB6Xh9u**V73^cPVDu&Uur}JxS`s_?%@n$vymZb zmhZXZ(`0}`AS3fDuIgv);5qqe8 z1Czp_geRTMZ50jL`MEoWRNTSi*x8m$RK`t^s(N1gHX<%3(a$L4GVXIpx=wM}bz`1z zKzn6Llhm99HoU2pq6K=G9l5@k`4I9Ox{26PHbh`7(cZq)YsaW~9Qso22y zm>Mwv3a8tl2VChB+KU6DsXW$SBTu<41{t02?uxTaoWkYdaR&~>l-&eYMqmKuEJvc| z{{HoAyJKT*==I2p#=E!g@?Xd2P$92Df+7rM69=pKO`^asRXNISo-4{>?*34NvuTY> zOk<;rZWfsK+eKh*B1*FTq|jSrMOF@x8&J1L#oyv-$aKEWw$(%k*?}nV74TpVkwJMh zBu@bE*j#EAo?i#)OwTTL%S_GVQPHesz^d9@SRIy!2C1gPfcm&u4o;K1n(xHSp za5g(Pj*bWm-I4U~jrUcJUU^%?vu-`Gw;AP#C&&D z%lGc)uV`1l4lEgij;(OY+xbjf{D0MvC`HurY188J3NJFxjT(@nP)jR`3`$waASo{CbhcW`2iFLp6sqM&I6*)>fpsSw|SgY!Vn}yy42gE1|pancD;LDVo(g7 z$?$EYI$Vbwx&-7s@-XiLlwPSBan7*pbWfV3c2*}s`cB!#5JqaZX3xQpxEI8_Eh1ou zm6kLhiii49K6iMum!D)dXP=WQoABXj8#{Yhn>}0)ENX23zz1r=Q-t2}o%2vnPd^dy z3G+dAPwcs-yhx2=uhQ>aF4$Tlf-I67i69PJV>!#@no~naOWqJ0NV=>Vm)dlb-t*wT z@{DF`%3sF{@uqDuWXa8ckW(XyW@saat&?_l{gLKPpTO`-=Zpl6{@(R!$$e=oXa!Qjnl%8Fz!zg) z-60ecBw4@qROxIYw>gQ1LIwNhhfsQT5ae#$4(_LiveNvh^mNQaiRsN~D8Tb3^Y};% z04^wTQXqv={J4^>WIpK3o45{I? zyG{b7wK{KTB_YK6%8W3rub?E)Cw^lYhNZs0JGtG+%u%mv;ex&NFy>|x{Szj&#<6n zTi-aZtnzV*=uLhMMNLdRS`E5C7}QIWQ1*1aRh8pQ1%1t-%f}gFx6K|&`0g$u(0lC* z-8|%-dv8RL2X{Bn9W#NIDelolaNTEt({Sv1{jeto#oD% zKqeZ7o;0zhC2?eWsVTfs6@XTgpvP}3pC*c5+`Mg>!YU5p-F2Xb;l^RQ=1`1gwuyW3 z`s0#Q=cV#^A4{&5(6_{wJWmzNf5Z)tu1YyUw5E#7)PNiG4M|b00mjQ{FoNDzZ=-n7 zt&2}SSNluv0#oU2!F&kUqvCtgEi%y9t02#Pb68MCqQI(CW~W~a$JE9RBA+9Ff5{Nb z?^g&+>y!3=1;^I_br_u^dgC1829N61scld5wNOxeU!F@ zH(KA&fARwL_gObXJ#AlU&4jq$do|5;{^)2 zvwejRmhA!^EYcL=C>pM7xtl3&xLD^N1frP|fLruNYKkoHAjs5g3mz+)8=`)f9c{aO zDWAUwJ|W#dx{gh!5E3P&_NA;*0`aSe79xVTfQQ7ceo%VdY?HnMx8-o@TP@P}H-PRH zGvkQ_tB(YPNLNablQoCKs$3#avivQZsE&ejwjP}Zk((s!${}qW?1dHfTo6OL=j+!= zSFEYVl@t$bJUlPIH<8O34+36+t^Cz5hwg_^Pj}fAH-~?pwb;Z&o3}#NE zKx1H-`_RE7d>d;hpX$y+0SA=Fm-?e3X~;W@=j%h3g9K20T{3+cNYoVyP^>Q0%L#Jg zi>K2Pq77Q`_^33G8d}b8kfMB#G}-yGHe!&EF(Z?WV=DL$ERQq5w(ox`u~`?B zuh6%+*?MP3MC7TXjfKmEMQ0cFbe59DETcCT>Z8xN7EEU&JG0{f!MSFi>PlL|v<>j-$4_R&L#u7too z0URh|mekJz#aL!%qV*E$kw!f z??O#*w{u##poA^A5+Jr*L5Tvb_8VBeAsvbTB7AR5Yjewfja>)05&rqH2A{wX5RYUfd81g=wf@&EX@_I$HEu6Qgw?xj+DEk={o-l29tP zY>px$;pV%ne)stK=)?bUvjEFPhxqxrRnciW1tP2$d*DrnZWlf2RxBPSrQ82-e5=SCd)>PeIZX}Hc?yz%E`jh)9l$lR2%51hK|MKg z$mwh^<4=KTa4SIw=z0k(8My54T*oA*0}x};Q!ZxE97U#)E@&(vSs&S@>uX@~=WJ+m zTz_u)MHC+JsAcEdMlLn(XZC-XRX?>jRE8xQz-ZiGUHTRK(xcGn$E$=xLjSn_K*JC~ zH@>mr~cub0XplR`S@qhw* zjj!roq2|!&On8V&$cj}LsJ#Y2h+=;2`ao7E<89lb$~$;ST?GAzqD$aKfwg}Sy0uoE zk*mMI!Y6FUR1!SjlO_<|lVS7$XZ=z}jUTajFVKmZvoAuRA+Jlv*0xewapNrz6yTqm zgGX9PW5Ii~QXiue|6_DgGvO6c)NH?#vsG-p;$~%$iK`r+4ZyP#)zFKtE3c}G1Mc+? zP^sTWDssD;j85=v%=ac0>xa#&FiP{bJHVNb3!6U}_ZQnxknm-@?BdyTquwa7iJuK~K8`N+gW+oKvr&?qg%!s2ChKtK#LhMl z7GW$!V2O0Z@#bxaC(siw=j%noKJH-zx<;$=vl1IYQ88m4RF{Xa!0Vl`=b;6?lU41)6djE#_%13LPz0HZu!>j5RNny;s8uQ(?`g?xf zy$C;SRgx_hlTh1mEJR&^1r%SarQn4RL&)5(v9G_Ju)o(oZ1aUwsW9@J3aEL7LLsuE zSAca>->>xI@YA!%KJ2np%d^yvvk^*3mrJHuR`v}&Q#w-!VZ&-7iuDWCO-)Tl>b8!l z_1N*a@1?p;l{6);ul5WHN?b2Ck-})s&l(XHwcZ^T02GN@A(qRD$ROV6bsIN>RslX; zbZC!W=Qg{4mE5RH8zG@|;Nhk5>gCJxmn6L!K79D_%MTRN+Y2-==W!0O0c%+stTMrF zqz_s>-n(Q)qZ)2WdEv474*nzNm<>r(Iz3*eo5@4DBpege`#iQxabMTMs@Gw^Y|)qv zqs;gIrPS?U8SEzHz<4RzVYuQBW9M>i5Xys_`BO!uZtaDggn{CKZmjirLt7p_00J1v zJ`y5vZOmn}CVC=JiU%HqOljYKNo(w%kk4+w^xI#E69T0JdP;Jm4yUj8_{Q)dbiqK)uE*xRT*U9WTq)2ysl@sRPh2#m>B>I1R&g<^BJj8c zhomX?M&tQubVRWYD^9I{M`C)9i0L)x*gHvrVuFgdTp#$>Rxuy@|DSgAB2pqjpA@^R z*Mv9dGwGXVSnrPk{*rcrPHZeGHOKfWMO`g*KvwU(w$n{ksShB%t?>h9C+bERW?31C+L5 z2=71ic9RJgA2nC^sG(-s>P=M9|cLG>( zZp+7>|Bgez6BFF1{QCj~kX=a6?&UWikHJAly~h+K$bYDha(Ji>JTK@!_ki2|jYoN% zZ2!Bi8|H0~&nFvfdq(9vdOTLGzMAS;xl)^Cd$8D*dy~kPH6(=m*atn9>5l;gV~mCs zW-YAi(5}IdgW&@_0~v`KRI}<47HF4U`KVpTY@t)i?P>v~;`x*5((}djn6%(?gdOAG z?nDHCGgi6>h_PEfbb_*5l*c95+ zziKuhnpo61wip>_J2fzQFE>2?`!vK^pR;3nYq`>IZR52mJrZlS8a!2G`Bt5?cvyYf zG^i!H0~D*|h)n7w<_5>g$x<@{&d_|^e{7^OHJbUPI`cl8jx;_`E-_N<1)x&Rs!w0* zE##d&lHT`Vrps6CQw+aP2O*g|19Uja=yWM)CLs!y@0HXa?bFu!mN*net9&Ckytg-@Ms^{QP)} z$K;;iW%+v5gIz$ou1~>b1-zYH$3zk3 zhp(C2U0$h%F=W>u+XpwiCn|=u8}{@riP^?RIyfghtX~QUilZ;~Tds&!b=WQz+WmH^ zzv^hRGQY-hNNT?!(&-YPIq?!7n{rfaW|Bo*K@1y~A%n7q?WzdEXW};Roi|-Z=sWx4 z>O%K6uPyv=tkb`rC0v7M?#D<;mRk2sD0oS+sUwZ0)r;Myq-~b+&g5Vk?2#sy#C&s{ zOlrTLxh9GAa#S`k80~=HgegTi4>;@X4mO?<-ijIO-PA#3`Rk4rYQ}g9G?es7mXsL| zs^|W8O^U}7qQ0$M_Ps?k&U3k@@Pj4;X@Gh{nM+IAL0gwr zoz}v*U9{Q$gno&H%UFXVvHgn7wm#99Pe~nNOg96JKt|yir`}A8hd!W?)~a%aL_uKs z^!ZPHgL6=}!hl7Gz%l#pnoYfohi&QmbG!AcN#uvSNq$r7ZCOJtv7#(A2l4dnP1hD`)qo+xZxMCK%~wsC^08* z*Zvxf;52$xp94YcSKz|C8>R!@e(!6?)lM~bTxv;~bIQ8vow>oqsIggY!MUH|RmtGF z5Qe=r5+}PKbzaYaQELy=)NvZ^e(3Eoq^Nb%m3d@?k8`dXsYSzr*!Gr996l7)X4(s$ zO1Qq@r5oBK8@Qlfmo6)b_NGhl%A@{PJnN7WxbN-BqW>n)!JzQR`extiD^B>K=E}FU za)e%u{IbtZ=~UlxFj~8bBeyM@&!J|$7|q^fL7d@P!m#!Iy}PgF-ltRRzr=#r+XCmQ zYXet0FZW98SIBrS!Y9o4HqN2Dx17-M_&S&M0lc@JAxf5~nS4b>Q54>ssEN4RC){zV zShX}Jv%&VO|J0SEb%djv|CaB5n#b=PCB;ea?Wq3I>zll_W)M5n=Td$oVQWxfqayJQ z%up;T>?LB|T0&6I{prw6HcbcJmcfpx2DS4t`!^8F+vMKmLx+VKtZin8ly;zPobhe3 zl>_E_m^gaxqwuY&LaF^le>X*@wHM?P*j*=={kg?MbFH1$FLmb~vw{^32t4K#(d}uC z>+s&^gZ%63%twjprI5O~rrlME_*-AU@meZh_UomP!A4oXYv5oqg0$%@NDAz)0+F>D zw!aNLM6x)$)0vQwQC&uhLsIVhM;L8SGS^aSm10FAX-swYLgnHcc~8O0A7^+CbVS#t z4>tL38osRK`#7!K?WIm5oTB4rBN*l zH7X{xdIwEL*r_xTYq~xiP`fzJlm0!A`Mh@G7{6h)LlQlsKlX?zp~(WPSvz}>BoR6y zngMU}MkvZ_Z4zz|(>u2NOTv<;6zW~jlE85X4 zW2CO1NaamC%HyqDGg>J)G?3GJcl9X06El=um*9DnFx)BATXX1jRG5o`TjCO>T(M#q zx;gKJf-rOI0(W~QTdwquGtmh49If>DZK^Qp#l1z^xMQ8=X`C3hV%~2)=y_peo^z_! zUuMr(y4I9PC5RTuA=3XI_o6VP);MXkTQ8?fl3Jx>3sv}V*pOiN>(NJzy&>#_=)|?z z^g2oRtnhSYWO4jN3|(OR_4FKcK$-ucZQ!Dw=5M12i7-iTOoh=wl2g_1>ACRXs4*Cx z7K|q#-#Yt6`98FS$8~z7u(Ji7PPwa!tQi>mIq9Xp5jJ=&W}iGbh-i?3-LuqXN62d( zDqW$DW<)N1W}LLrA|mU_Ri=ZoW5!o}!;*|${P%~-dS^K7WRNh2 zJ6u2sNoDI!z2vDXg3s|CuC|&+_%|%vWYkIM92?h@V!0HwqK9T|Y#J2Xcvi?$onhIg zwye8*a9W?+IcUUT%v__>bt5@|-`9%2CH~AsdrA^6Kyc#sQt6O|vhhoY(XkIhWH`_P z3zJQq)Kj%0998+LBscKXmGvfDnM!u^;4FF4L7z|Qcd;X?_V^->3g3C6-8RN;)$LDY zR7e;42$(d!swXd?Lkzt|@?o_)!h`8;(g$&EMtI3@=Z_SH#ba;uy;BMnhY$hw6GPWM zzNClcC7KMLy5m3mCeE`D@un%on457QEQATjiXQ}Wf#x<=+GNkUcY9|yn1gTp6xPLe z-|LtFiZ{M`hU6rvo>m8)A;;|7aY{@O+7Ah3PJ5+w4nfQt*OSOUF-?N{4@!*L5$`ka zw0UM>bWbNCN7WOcl%lAtjGbLw?u^q-{h~oHr_svA9;tx4`fq?j)g-a0UKLhq0Jzeo z_$1DI)!|tw!@mc2&e2^T``Xv-=z}@F0<`vJ)sQLsmMgr~#yzU7tz})iyk+CMZ6+rJ zrV=2@=zR>zeYn=|Gf6D6jVQa<@3|m^_$p`(&cUuPg%V~}2m`64WQ5hZ6I7xCx)ls7 z_p^ph8l#9nNuBKZh2tFp0A_Rm)?Cf&XaL{HhnK)xfMRS3V^~ih!U(_=9V@{m(SJb& zEhu^MvgiS@a*Pt#O#y@$InZAG3qqP70WO3{A^Z=(APBVq5aeq8kv$+?kH_Bu5Tr6h zh4KXA;7M?sZP~ID5JU#1qou&V)$s$w;&(nQ9TsB$j<=Ens|8_I{EJXvl>kD;P8@w; z`a7PNxJjG0}(nFna@YKgYH{=(w`MG`|NaCR=8rOICq^4Tv4?tYg_aB7*75v z719173~I!lq4M?YN8nSJ6ffOp^nGJ@v>_nHGs4LB>!EW+q1@@qABG7^RrGM-*%y~U zD~G<_@MpPGoUwR*ON9EOwBHAYy=QCz>A^a*(zUQ^r;#N#K2;!*(BF_y`0i6#k*jzK z+=rxz!4nNjZ?}Ve4C?m{+HRMbs0teDJqOzw|Et$B<_xdpcRn_y_(P<~J%u=4(@DmW zT`oXfQ(WWF*{jieH+bB5?7*wz5+DA(nBMz*p)yMgSco$#0jV!xW`Da>hMDpwNj~Et z<6)o*8HGwZ?42&RQX!T1rEgYHj2h_wEw6jr$r2J`8EX4!9`v=Kj9z;Dj}JoTG_n>Y zyR8uLzAph!lR8|X*lEeED&j@s`@Z5~c4+8=ig)|RhqLZ1_ICB4=fO`%y3%DLbv)=c z{_Pz|ep~f9TyqEe+upLi((-H{v>(VXt15HyMIaFU69@&Nk<7}4oA@@ZAE3$d4@*c< z+#JtU-{~^oB_`3fsBRfY!;^Rkb>%wHND2i&@yQLg1B`D-lYH}TC1>*AuF|BFuF_%K zj@YZ~?QGE<>EhmMaCp{aA>=LSbm+i{@RXWZYCQucL~Zqi+c!`vg7SF+Oug%(_}p{~ zU}kN5!v3VVoIG zyjH4`M;&?bdgZUOtcTWZnAyu>&g(`xPYvE(>q{~H@No7kDc_p+of@%6>*<$t`iI3f zqY$2pLmlI_8#u!U%G?QUJ+git5$^S_@w$h4FLE8=h;3z&#lp#+kAeHudgjw36~Ra1 z!iqK zSX~ky@{&s<>b9=zUD`di$V`>0gVU$?(v__Y4z+u~tv1Oyf|B&pdaYQ@pQh`qkTK^! zmR`{?mVCX8=5g`*Ro4q(iw|G+;i){OlD+*fB`)<0%cDbgrJ_I8x#A$HFz#_r`ITgn zymX_)qOm}H+lc_7=a@hj&y$}>`!i*HasAYzYpRZ-Ee8F5>06@V1i{{y^Eod!F#?ir zs_g?Pbsf7xR(#{{#pIuV9c}g+5ky-J9zbuB%pUq!YeZeCisncSfhaDw_}+ssolB8z zT$<=O?q7xR0xx-Q#Mxl9pxIQ$H-1UfJ-mlCFsZ65lzQ$Eo+fSD;XT8C+<94)N&pxJ zrJffU!|dBF@#{sX+Qll_BES`}P$&aeeRGT6Q>j@8hT#1%lw%<@J}EPK`ysyfndHWk z5X4mFxfVG#iswnqPqTK4G}3SCR=Z4a4+o(ZGdr1sb~MBfKU%XdHy~j|a%0ubaaof- z?*nkwbUyvHm$xUpn>12y=nkqs-AF=~4!3Uy|F%Y76=b!`^sQs?_!heN)^Gafg!hpJ zt@Lg@gIjxx(0-)%f_sr4gU|F?-r#YTA&X!_M*pe>yal=I3uavW^1& zMB_9uF?PnbE3vDqq9JG4P9ik%vIZ8rz38Sbxt!6DX=wKO{QPzCKAZB(_*3V9^zoUb z^2#72jIJHGn=_IM-ZBi!xRpTho9!(+vwkr|5%Jb*{NqEn>Bv(yyX!O(iyfR*IRmVxo+nLY?us_QyD5wR+ ze(U=1?h4WQ^y~69i*Rz8H?rGf@GLXQu{QFahkkS4Ycs95lUSP79NHR+jVydM(H4zP z*L>2xArp8sCr*!BM^EI}rVQiebnXD;q5!hCt2t@*Hf*FzRoj_$#u0R~rGU=?%?q@q z5yF*uF2p6kgAQX0qhyt$naUy-78j9O2d579-uGO}cS}mL@KYR~$vzb}Z(O?%dK3tu z^yVOveD_b@63Gi8bpabgUB*W25X!_lV4G&H{3+j!+^rvhbyZuXwYMGY9T`cpP1+*A zgEbRd(8h+PmL_!Ew_Rmyu~;EEUW3PYD%^*7pyBI<8yA|9xb1tkME$f|s=mn5+w%?6gheA^+gS~hTmt7OY zT6<|N|1y&Fk7H>l_cn7L%zN4{rd~1JU{2%1?M|MGPT()GUJ@Bp*k2HlOXftzr%uV& zEPQ>*$iv8JpHVQ*jNi(}P2$e%Eok4*J`&jG{7JF5J&tsGP{?8M+Q9=NtaB62G|~a| z_J5rkt&&tKdzRU#vl7pMuRYM;$_6a>y=+V072G)y%hs>Ad}l7K@vIJizrNW}aIaV< zV52^KnZI6}NZ-MiZ$BKjo|2WQX}U1o*IQqz7pv2T6fOaMUEb#nidxgVOQbw6Kg`%D zdJ1cjYP}tTdjYm08S7W~>}_WWhY7}Y#A~9rSx~zP+?o8vL7`dl32vEy9#)rk4VlQ9A5rFtD|f2 z%Hl@~C%DroK>8n@`DhM1NvnxEJRiBIfrlnX9NKYa?>%o^-p+oH7kL%sx27X}Etm}T zG)|)gY-H#hYL7p0`=A#n%gjMRjYxMTM=3w(-A-Yp%>mC!`FLTfe%07ZO5Q4cBJ(c* z`o9IYdQG%*K=+aYH0Eijk)u^sprlfpdzNl;u_m&2YvMk%>P(A#$b`|R;`fNLo3Q*Q zG0Z_e2*`mBlIZ8ZK(Aa&j8etCXw82I5?|P3U}PdH%Ked}pesn<;fdM=l|c;z`P@)i z05meLx@Pi-xV4qq55a%11n+iP${W>o`DRVM;AG&O=t}Is?aKF+lA2#5!l#VaL0S~9 zYp09cyU>1AZHdssJ^0P`^31vYt(v2VfR*<~or~&8ou*TJ zz28u}A;F>Uy}Ka+^HVZ>vU}gPQIb=LmS814K=2z9&g&SX^4_wOHZ)qh`5~gUiW@Jv zT0Fp2RU9PYaOftLdqyHQY1>o5!3Qiu@2tHW^Xjf#R?DR*atC2WVwI)D=m_FqfGLd* zkSh_F@EkH;O(@I^FbjG(#z+6Fsc|jKZ+|0eUkp+9Qu_DsKI-UjUD@~k+O6H$!0qRL zM^pISoQbCJxcZgG!fS8*7S;uVA4W*kK4|PM>`Z<)dl16?=}a3lXYlR@^Jc9`;?Jg4lT-1pgCNkc}%K%}qIONQ6OSw1-3427top55gNH>~eoG3TaAa@tWY zv$!Qw;2fd(a2WGmX~VKJ92o{W$^6V;avP=KR$fm15*j>I>r&-Bc+YDlXp~gDvq0o_ zl(mAr7|`u25-m|EQ4nNcI+35=w=`1NB~N~+m>GCKro5|a*dq6Rap730UvJ=&93l`? zy!vgd=^$$iyT!bMFfD9au1@pJVDjIDyY1N*VywwBeRyjQTfk0Sw7#b`@WL42{f>%laVWyKaN7?myRCYG3fny?D60NZj~Sl7Qs~vxJYn_WdSY zI8PWe{|_eFpmhF`haW z1PjJ*b~ZNnw%yUi{~c|BDxKxy_$#(T_;SaRH%-X|Lyz5A~YiOmu9 ztApM>iSm=KPa0-);3;t#-bWd}^OtfSm5~Si`c!%M)7Nk`Z<1Aw{lMnT%8KoJ89dl% za;;Z*Zf`X}dsT9EoP41VofRzCco+r8Y!jDkU(CcMibXhVAL07a&AtcY1`f1-yS+B^ z`JP`Jn1B1w<0uQ2Y&~_&F5}?JF18{}Da*jBIFUSfhv8rsQ(DpSu zhVQEXRN1n@w0G+Zcr0h;o$M~~&19ME0dB2n8)s2p`T_KJe3MHmLFaI0^^XLj20e## z+q%-UB)(`r%mcj)T>t?l%5j|st-LyHbis!kM;+t7@&Z~eE=g8ygNjD`qQq0=>91ucWGj33m1K82w1J7pvI1ncvJ#sG&ncikqXhyU7O*G;RW!&3qFMdO??*Rd@yCn{7uqetm*e|U%MjRVJQ>B1Z>vSzEp78B}A+vC3tH^ z*v`LFcD?tNA6sTqF($AWH{q*($-LxhsKoDqizZJ~CSVepHdTmV=E7 z-E+>q$+lVCw>sI&=GnwYS|Pe-oL9GyeyBZy6Tl+qQel2nr}j z2q=OeAsvE-ie-Jx_31}LpKfHVR_3>`xZ46Jid|M$I~XRT*_ zSZmwfcfH&DO`N)}>#XD4kNx_p<~=d}1Z< z_+lJ^uIn0leO$6o(aqcwsb|)q>A&?dCdbGzgF&ngjo5w%-N>J}EjrU@hNzpj=@q?q zQs}A1IiY9ZuguW8*60*U3`IDI3ypYJwCu*cytEtfv;mpqGl>${xff1L?~CBJbvgR> z$~AF=%L3at?tfxYJ!ZHNiq|zgO`l_r^jT}!lWbTnKN)l#Fg7s(wJCgl3gyliX`Z^N zQ&c4~zQ|W#45l`N}3Efb|ggw^Br#Zm#Y7TR;mk zP4VsdzJ0%SyQtn!{dZ(nKH3UPU!X_c5_#WdDaw}gQ~Q_BwSTmIBVvMuy@@XorA^ADuFR&ZLILMycaY= zD*1k0Jn<+KUZ?jD?Ozo`eaCl@E8u4eI%!Ox(pPRL=^%?-F-fi#E2kRR1<3eT6;LNP zsXcsug`@~&CM=X2<%r;M5TAAyDk*GwYVzOz=_#*|sO$XBP|K=N{rx&!^%k!XD0?$!Ca$>NkmR}xrVsC`uYNgIV zzJp(sw^i*Vl;eCl*{~4D?cbL+)j0s>`!6EkWiXE!0KK=IE$@aFRiK@20cyJ^UD%>A z(d%qMPDBQ4l`V`HUr%p|SOd3RdIUmH=NpV<5AmqfilPgT7=)vAWa6)RwATkiah2|G zan{{TFiQn3*ouAN*5S-vk!uZ?h(s%&MtBKFzm;#_te1}iC;|g zxxhv$+)l2}Eyt3u9s~{L_%ITlZ;$Ze$Bb52XD0?@V7NBNk&!+F`JR)sMUMXL)YeN< zJTT!%zk?o1W}XARA%J3fP|)=JX}`d2dj1zcK78m6yv~0}YGhi@B!6-OXCOC#+;tCf zN;f!7Lx5^~+CTY-f5?O0;`o4OKph#PqY6s@2shk^KYdW32VwM}^MaO;HvnZ}cZqXY zKvSmxJ+1^OVt75cT-vFLJ`z0-b$_Fb-HYIA4Cs>Y&tuXCAQ9!~E0>1_nmH7jgN3okG+FzM~{< zWU69B4B!JPE{s&$y|fZo4%>>wDf}B;Z9GzN9pJeSEWQwS<^8q+^xq5nL?^Ze5*=Q>^TY}O~?Xl8fFB?!Lee(J~=sjeCSnc2EP*b zhZJMlrLK`5c;PWFz7QeHpdHq+jXeR`WJ8Hv! zpgkQrDMXNQ!m7vP#gi4SS!8DfTRx*VCVFd=N}$Gb{90kRz4y$v1Uw&+D7L+!!+S zs5hl%tJld-k(%2uH}VpxV`6(KY%ZEezUC*WKd1#swb}oY;DkOP^b?OV$$1Q;ct=r=1Q6M6P<`GA@}APJW#!Osc3` zV|7hUJWqaIok3$$;@zniv|cJ+BcJJTk{vf8|GnQi!^}oVIz44>PL3>)p!jf`wYjr> zG**Zo-@FAR`mA<@2Fu87L0|lgOA8)ToH-Ndamv7$2*5Eg*57CW?#0`h(?z3k5c)T( zNA`{#BqedMsNchwF&WGRbk$7q@J%0DJ;xGFGGHZ&ETFBqin5 zLO`(vZfOg&0$CH*swum_*hE7dt>LY*_Mf>YN)48>>vi`k;rF^6UIftFr(c5NBtL=GfmB2mviXr9gbTdV&^U!L@(Gp50#n>_4uw z-;;Qh6=(sLJxPbZX<;t#bNW{}{?dkGKm~dH++@M(-xdHgqAp_Q*MF7(=@?vEc>J*X z6lw=9xD*IzMh|ky{@jdGC0L4MykWI}bK+DWC(adi85c$1zCxM$5$WhYsC2BdsT|3a z_t?_T`0r5+e~MKej@MdVedg_uxRCaCs-V4^Ydy3bt$3op_LYKTW&r-1Qkm+wOmhYq zUmxSM*3r)f4Yt~k57=xFyYBaL2vVH2JIdQ{E=?7AoY^9I;zh-h<9|UZ?71BBPs%By z%`_@4(*=2s-~J|AT?iT;+)M z%%A5(_zF~15pyZwN)vD&P-+Ixb%qb`%->#83jQ{f+4>t`&VXj2@FzNh8>6`2e*pge zUHWnQ0ScVod0!P!$bWyH5CChb^rMdcTx*mE=oFtVAZLDGdVsVc`1{?9xj%j6UvtXo zrQ_j$1f%>n@8R?VEasUah0=f=Wh6NAwgQ^D=YU~zn< zb@zOX-CbOF`3bV0l{_k*;46#Twx}iqEajFg%$OB!cUB@NqK5)Mf*u_B3zFy0MWWe> ztKQK%4?!vvT}dx~Nt#Ve$N~lTl0~ms1o z-rm$SDp12;p6el;&I_aK<)5>sVpNZVzdrs_y6TGZ}JoWS=CIbNG_d8N+2r6 zrli;?3q)7G9L2gtTE|IoM!>543!Nf;tR4@#S2P%Fv<>cd*B~S}|J^y!?d9#A*W?{+ zRViWp!x@)seg|rbtyN=OK>O$f0?cXrME zdIxMIBG5Y;8dt$oAqPpq$`@;}fi54*s7*B~WTalTfy?6$CQH^BldRjjm&eeW1y?H+Tgy7 z|1vOjy}8e#2wKtjOSQ^&p?05mo_6?nPfDG`@(|C!@Gu)H7QB;I77VwJMMdL4=|^A} z9PXSUt-()~QfZ0T<#DwCTzekeHUM(~W5M^xYDl0K1jXP%rS=|bAe~GJ)f-N$xt=U-+23`|Chp1C>6Mb!fRl%ZCoPed?CGxU*BsW=B;qG#Wd@CxCWOjNUL zKZj9`h^rr)YEzTyb*G)PU8X$k7-qFG4!*GKSaJ=%hTl{q%AxUC*uP=i*|HUi5SFen zJJm(HZpp3-y@_jilWj|dIgv2{GMAWpPS4(|OK1V}BT;!;YU6@hf#8homq@m}AXgS) z2np-70P^1x}dyN%X_;^CX*Bplz^jLnu@HD22aR- zX7Ww3LOLk3`_zD}Q#)@qc-NvOP4?>cYOB{02`Vsv9`p>ch`1Nhp9t&gvWf>YJzW=; zbQ|i1EdJ; zOOJDfK%JzPOguWk{>!Sw zaEWSRJMg0Nvh!$YKw!YCb}^7Tl)W<9D8G~NipDUJ>4I*Q^qg)`A=4OgN3m%B=1u}b z9j4f=#^pNjF#>ow4&)-ujsHYV3-()@pf$xw6V78_e zI6~4s;Vp)v>Nbi;8ZGw>)HXfx!84cmvG1#Pf&3j4VAKe0)E$qGeK9Eggh5~9%nvq! zxHTc@e}$S%6!Ad_lZe3HWnSJMlp9T-J128J@7voCI(ZiYgBRmp-HiYh);NF%O4InI zbS}iC)-k;LNP#mgcrhH2T1^nx1@1LITnQwS!~n)1v@yJ0$2`DRBYy7}JMf@@B0C%_ z8zh$6TF^AVI4sR>*I_Ite4*FD@d!Ox#A=EP_%U4fw@0Aymm^(T=?ncna!(yj?tQWn z?&>a+Wagz{{>Bdpgd-CH73!3W6k)iS;{L1`(RP_sY@_7f%8#3!q50`z{;g@= zYX|a?BjZI11uw*Jeo*kAt9!Zi56&qX5C8zM_1Wm=@BH{N^3iV!2M+mkR2JlWCmvq) zw($PqqLC~!bn5W<(vi)NC7@gDEVyl7vnGwYySR9H*y7AeGxt970lr~7-x*_b>eF~f zk6HIGUjsKB1Im{3{uhvqXC~NR=4b!SI0@7&r-O#4pu!iJIz>erna*o{_})(AcMqmW zpa^(eeBK&D3#g$~rvW=eVZsz+>60vL(sM0?2Kh>)pd1zl%C{VP0Hq1^qAVOTEk4Rb z1)ROa(LLSQRII?C$C*8^UX&RErk@zDwuh84V|&$f0778T8{arVh0az;M)+{njJtGy zThx8;+W4gyD2UP__lpfR-(3o{0wN`A3EYkc5={tQ9)Y4#z1CRVge--8oEOxKZfj4? zyY|!1ffdIb*uXQL@fB)o!?BjLw}TSE5>tkcFn|I`QpnLxcLGnWpoWxsgwE8FYwML+ zkeP0`&f$%89rY(;@1F#+k(1X~%i38|hhHyI= z1g7x_%0Lt$sQef0OCtad9OyE#bFC113t>Njx`62^vUIay05yyMI5olCEo847PK2s) ze3}Hf42^4PpxQbcs7fIn@jB#6rP4Kkzd>wB5FS3+VLakujz0tTS5ym=IctQ7B5CGG z9p{n?4L;H0*V5r2im)HYOS>MZaJg`(s>rm-GE(ble#&0xB%gjy)VcK7I7E7oAloPG#bFYDowl~rRkMkXQvImK+F(tv zdPbgMhHfr#*@sB4;AdZy9v}Y3ei{97j-3I=_W5b%1@z?N3&36F=A!Xdx)MK|Hc#i$ z9#jgI3`J(BTFa&;GK^{EUc{#b?&RY4hlxWsv}hpO1bTyy(rD9Xe0>L_=IH=%4XE^+ zYf|=+V7|$2M$-tL`2a7~am^h9mf&#~NvUhIz{D-Uo_gc3=85jpF z=T(Qpn4LFqdjwEJ7;nG#@D~>e5=V{y_mWj9Kl`|1Xn;=TH0^bEVe$!0Z}nmg&wqfK zzt8m;u4veZf=i63DdZM)T39j^v7a6@u^<0o)0yy;+P06@<bo1f+-3SCRq^&4BR zlZaa|DE1IN3TfJ(2!&Y`%`BNp-OQuedjKXjITo@YB9yo*XLetKA#g7-f>gx0J6U!h zg3kKG*xR6DH2EYZ>Cus1z08X ztbT%>tR5xd_LJgwu>*sPm)Dm|j163w@M*z5xcEU+!kZgpe1Q=W#2Q9uiEhMTsc6I?YcmaVwFU zL_U)fEDm}P=2<}bi=uRkc!Ti;%I_tty`E(MLVA#003#C`uFdI2>c)#J%WVU|t9Tye zE})ZeLA0e(Lri@28-s!Bav!XEgZyN7z~$^hv?FjMau=&gLiTTHryhdrl+1F4g8D(4 z?a-Gf93CgoA|madwZo1UmsvR7;ebxSH=pg`+0qqqY##0%ftBz>!MZ z{&@Q75@RGJfDF?*Rbp9ioLJzl*RDJ6sIE=ET_!h*V`}g@_xQM*9`%^$i=SWRS(|a^ z^YhCKDF_W^sL0@$^j`r{vnV;?c7{|P5z5TBC*4J8AK;7F@gV??n=OFj2Lr$&p_oj1 z@Zu-=5zvL%!StW4m8S+~9Zs_O5hx((fVrORtuctg?H_aj{>nE9C7T-Huk+5jK(EIq z{(hBlBX_5eOX1)I-Xazlo5M{hb=+eWqihqil)=0w^EHs@0!tJ=Au%CP7eneB8#zA{ z7+faMb{@ud-(c_JWGZYbr&S}9F(BdMB>eb-xPgzfA?7Lm&AFr;u`hHY`6uXBSvO3E z=;YcG3NyG6s|JotLVzQaH2P!fichskRxJ}T(}=q>O3Q-$ScVr%i;vv#1wS?>w-miM zqRmmSwAD2A^6H(4TPwu74AQk)MEtT;#lP~a2=O)VAJr3eTG`KsU5yZX3dsDZN>1`? zw(a+E3R?(=^gTT_GfQSb^bSO!?CtEX#)dhg2Ms!@V4x$WJITj4U_uR8FO^*3q{fw- zYjNZ89#E+!)PufilKB8Sx3PlgSrTwxqr=*wQ9_k2gQ&DkP01y>hMAE5#fO5WqN&0T z-)})n4VwjR>7V10SbhZie5n>PC@^b$$A1%fB|1#Pd$)8BW9H676@S;7*B&Nn!>3q) zP!6|dSisT7@2dn{<Md(l)Bk5XIYR&)f(IxE0vi+Gm4k2FRx(&84eTz`Dz-#eaEdcrF;pWj#_krQ$yP%e%td6U{nO^H{Nx z_tX-53ty=)BufR16@K2#R!N(!TxQdD-&M4M_2F}y0@EyQkT()1@&K6i+Z5!>o1Z8` z+r`uGR#9vU$d5bBF7$C#-S$gnTB}w4RY1XvR&EKVEKo8tGy8Dvxtp8v~b*zc;} zTVIgSPBX4vJM$>u(>}?W+ieey&Yhv1ez&?Hk`*GCGsHpBLBTmg!f$z&uEXg}CLZam z@R@ICf>eNhT{x2X5w7HAxAJh3d}s^{_}b@Asw zP>Lkp`1z`f-oy*+`%eW)Rtm-}PV(CYees zEi?sx|6l(F{X}}VDWV_UwpV-Oam>E?sXzQo1&y%ri1lXo9p|d^Qvdw3z|b#)viNPh znmiMUBSz~T_a^byMGrDKUNA9rTLoi(!1>Kw6bWsp4nBoPz`UyvwEKDX^#J+TVq{M;R)HHMOz1PqIB6#e zpSs7QFty2MHH1+pwH7qsYa)-mc*Uo_*}+ZP((k6mbo6e;+gU zL(Kwm!s0W+dFS2c9tlIP<3}8C90(wHV#N`;DjWoeD@E^tdm?ZeJSqa)(nlPSR(yrq z!dhsVUpD)1!@gu|wsuK?o1;fuJ zw_mVeFz4)zM>k(iNK|ewEm)sq_}U$Qs{iHI;~}-NXaC`nlrUs>xqbT~C6j2fiV`=q ztLtR5b#P*0$9KFVx?4z|%je+E+Yy~(C$cSv$Z$8!?k*EQ?uE%?y{kgbPbMohE;a9d zHa2oSq&WDtz8;lA{wZBQR$}b=S6Nt-Okd-{l-1GEEZs2I-V040Z1{@DRzq5^_@S6Z zXM;ufNY&mE@51|gVxKm=G*+ds>i=}sS{S&mate-@{RKD7Q5%0cZaDwGe7=U-s*8(6 zw9;3Jb@OK)hu?0rT%Q`{Y}u3$nEz?i`EYDlikbOKvty(QE$LS3j3F0w+zP01S!~05T#F(o za=5~wE|{NxU9{P;Mrzl-WM!;XRe@of`s$rZ4beMrrh&w${G5n5i88TLTZx+PpCXFO zqQxZ13(I02N_A%FI^<$9#;5qHyLUk~d?N-Cd5tGrziH4rgR=xPX)6+5dtF4^>|smz z{G*qWMjaMn89sL&MzV~>yS0r*JN3B4t549p85YF$ZuZneFVieHo15N8vfCeeY7|;- zdPKaNbSLj`N-qYf|Fc9F%PP8!a=TP0`Wn#2zR3==^e3_0+aD{>BipAWxEXxs99uM5 z%`aK_#`d(#F(8xty(&sEYxDy4AFqhaGt+!!9y&%K*Zo~wQTgK7D(kJe7z?&Np8cM7 z%vD3plNIyFClxV={ri|f9pOf0rxMlIC9PG4=H5QxX|7{#odU^RB~FJ$js?ZTH6^mV z`v(q{zZCZtEp4%160NtfCv1F^d+&~B*Qrfbze>VV2)tLgreYi(XAHQ#848cu_B&D^ zIqcBz+z+)FUe$KigGDy&W4D6*4=N=iImNR%I2Wci87k+!RjWq%2UI@l(C8WPXiglY zA|_nMdoFAs}5@j`4wKexVaq z-Cb9Q+uH4(?~k=x$e6E}b*1)|ju1a|*n%@O=olL~#ijhJXI6M@&)X(r9gTeK7Wn>4?+~n53|nHb)a|i+ za=4Hk^A3G7AvHF5l&~aVwWyW6y?NqYcUde!FJ5h@`?jr-NCT^|HnAS6>=`8GWDS zpiZrADc9(W@7KO#w%zJNRK9KTpjugkTzAS(nzd<0-fxOvTVB~GEDcIk!~mA2%6bLE zkF;%{=pyVC!Tt)Lf5joXd(V_J^<+Qkw#lAF(KhT+uc^9(YnEKT+BcZtcwI~H=$^C4 zQn703NRi{nHs<-V&GyQjxyKcw6*hUqy=o(F6A{T~kuVSgd4ZT`0B6EICqIo0y3Xe_ z8Fnf8iOF{E6Vs#aYSAyodxtAt^YY6XS*)TQ1Lp-%MZTN|m5IeDdy(E0^ips;aK!^Ir;zWq4jxmGL3Bs|Nl~ek#Z6OZQQcqrSo3 zBZ-Zr$2%lDg8fpe78=mbZx&AVy^SAy;>u&zeTt7a6aADB1r&)>M-~DjjVr>~^n&hY zO$)0DsX^{brhegtnu|q7tm$;diG&PI^VCLe%a*8dc_OANut|VGl zB0|POvdS?@D#;~Tn_gGArbKh5sQX#6YWa3i>e{8%I$ph@-Kj(C;qTUugIFmgYT)bB zGQNiXANzTea!7V>@JYcMw#_vo)izvsQ6P!rkGGb!<)nm<4`I&CutPlkjBjBfm1E=A z%)9HWmyF(Ct?Q<*q)4(|J1A>OJ{sY7_VK@G-TT(MLrYLcwp6Mip{Ek8;(Fa``G{js zze~ZPr^F*N`pv%$J7rR)8gHHvLjqjoIbyR5c>8Ek>2ZzEECdgWo@79GBRNVgO(C$G1eOdqsO(%=Jk6rcD|O_ zY2i22;Nlw8br=9y7_dVqV0T?vIEC=3doJi8$O+Uuk@c?{rgnDg0M6`_VsULE_gHnuApTW^y6>_q0@NT1w0j`)q~TM z!f-b}Z3;Hb4OFaupGsgFcq$@BIKSHOCwrHMG0VkKUioi8%?JW&Jq_wpx#092eFRE{ zX(rkf|HUP=dUc%s#Qi7&rszUCA=la*{pR{5qu?*I5nVdCLq&nZ@nZaM;h_`1v8jnJ zgX@Nw*#v2~4uH*&ZSaA%o{Azo?FiVzz3#sBvAl{3zV)kv@6*NHzXqN?+)ns~yW;!C z;C8CnH^IVM2yuGi6pun3IhhR(>Q%0W4`tVaxD{+G@}-a6^Lk=V4;Qp%)OwTbIz|hDr4k?wf`2(dY=ZfAU2ipZ<$NUNV1&%M`=aQ__i)7Q9dC1-|3j|82c)U~EsTAkpNkdQb_^IYqN z2Wb@XFcUby0Mib9> z{Bk^^yNBd>V{!dTP*V*o{=(*c&7k|2ft7EI{E@wVbjPEdFgg*HHzXy4Bx7*6!S31w zbNYJ?plETyItD1fAbkxQpZ!g;29wrR$ake2wY1yvC=@5C%g+lPa`7+dfG>s zf^I^5<;>dW^>p4nrbWd%b$%gf{7&UQzqSojTwQhh9INZxzw*?L-vl;h#23ooSK`|} z3QJ2u+juEyY`By2UYWOnt;RjR^PnHa$=z>uE9%$Cx9Lmc74|`oHh0F^N2yeUIzigx z2l0BL#U;GI*$wTNfq;Sc{gp$6pyL+9Z zGdN1O)VO9;Z&{DNsntz5-mT$jVF~8)b#XlOM3}E{(76gcaIi)q#HXvD^-B9oF3^a4 zH8nxD;xEQ1jU%M*;(K{Fl_}m|xu9sfWIat#KS#5FBloNZ{+mk-G6G2a5COut=m5;6 zC`?`V3u!WNu`l>ls=wC-cqNbnJrZ9tz`yCkwW@cuNv}9dnHehmO1ujIaG22pax_LV zne@7*odx=U-V^iJ|Jeb)AxxX%?-|1%IYEx^qv+O-n0jWdUk3V2=V-O>uEL4%*AbI> zzg4IDxK4U*+^Qss3$^hg*IL(_rurw#f+b~ z6@y{!@DD2a(9rYSIKjXSn2*PFUwppbvEo1{F^~zYvT98xrubXT~u5Koj7Yz5GmR}dgT?- zto7%OU!u{CNU^%^QX|Dqf^`WCn|`m*@zjB@PCnaXF7wF+-JNXd>=&qeVx=Va3+BF` zXYeu{DjSO$KXutiXTAed)B}bHCanaBeMhJHb?=pmPAiqw$99fGL5-!!tZu{5~} z5*(fJqasg!@~5j6xg8#J)f|7kkUAG{V6Im(Fw{r#f%XL)H*Z3~dQI^3?knjA;+3D@ z{kI$Jr$*NA>iVl_N?e!Waadi&6sY7X7z*kL+Nk{)!<=(#89Eu}=OPzdSgDHfMzG78RdDew`ewcd+mfTS?nKCWjo$C=mr&}u;<7A*ntIfRS81F?V&eHuyhjL=UOVa z`m_>v^he^)DoZ<=Qyc>rg5q}qX&?|u0$#J*27XVM8?s}Hb$IuVW(ZPeLU;$!(QTv(!S80SP>U=9pz6NZzess3{NZM zH_GLZFCQ0U?S%6SuG`WFGU5nEjA0ZGbMSPa zCO&1n&!G@s9th_@;NJp|!gqsgNY%h^;u4BN%(CZh*0UOoi^OK*Z%)WGLqAKBAD z1Q=HudAumYdCUI$MY){An>|~nAqgSA1&CDlA1Yl6;m)LB7Fv!=R?Ew{<9d@*sE8BY zqF1zPd1{HyybYQ@&v~AkiZjZyfzLo#kdJ(x^V2CWI`IAlAkcXqJ@O^OM?8s5vDSgj zshSa+^;Jos4Ib%p2~pz&)-#X~)QnlgyZhfU6ofw$4_#RGP&>(qhdQwwHU%pD(jpqS zd@;ANufGY}_I-7(Zhl^*X<5uyVP3zHTl%KR_HDZVu_vaU({(=Csh{%`;5o5h!jnWA zT%VQZ>N0K9C|=QAFPfik9Jig~v!0UGo1ZBDIq!R1%rzG#ILUiSa-XdMwQZ2-CIvVw z(1xY_Yu3Z%cSNwO>q?K8H-3FW&O7-@G*o=?y1z`ct)bzFI|&=fJPlG03QU#~x3nzZ zCq++^^)oR09UrA3^p)c!X06yXlF>TdR@Wb1!>fa|v`DyY_f91cQFe5Hk=!M(8G zho2a=gtzyK-+bk9Y%cl$y$vF0if|Q{foV;NygQpZ{NklE3wXVXAm3GV-qXf>ZJT^R zZ}5`u;>#^W>|^ADJ6cL@XKV_SKY6^z=db)lWcTO8x$h_5N*R9k=|`){BwKSGLUxI9 zj__5nO1}ve-<7QMCybPA8c`h`g%MdZy#6z{8jgM>F2VZ6Tg(+AN)u1&4{rJ%Wq>+# zDZQS@ty@T|Cjaea3zq%@%c+gQ$LRN=e3(Ms3QNcFcgB7j*mabP)cyyD&c=q(SaHMq zNX&9Ybj{<0?kfMWLjTqi?7Avf%l!}HzK(-I?NSF1wvy~%`T2!U4B;xU<((gzg9``4 z{@CovVlR@R1aIY>U+ps3GfzSs7x**`UskZ8)z_t^WHnuPknxS-5TXz><5*%aZ*!bcv`AuW9Tk(x~Pz51* zYp}}1o6990(A2>er3*9}+!jY4^)OL(u(Rh$QL4{TrZmla5*Rw$bk8@Ed!ug4=;x9Q zO=VrBle7lb5}pGr4YLspBSBlo+*akCsvqH7r26i>8BePUo`dtQ2`;Bf+eIu1?y%sC$ z)vf!6Jn)wFy)AUA<52Loq+2=Y;h~=7CdLESPVc?7SQDofvp$hMajwnLRF=`&RT2@; zUv{F(y6~ex8jcd=S%xDvk?m6Vu6P5#4;bXcNvH`cbazV%jtMspH(96WYu?Y+aKWKw z4n}iq+KGAAo2FYZ?@+Tv1?kq<^A#s9{cOD01*@9c+B?bc>B~m&tdqw9P^O{;%YED# z>dQa3=jokT!v?*EG*=BP=QLXU85!cAraRAzxQwk%4I^#)lCu1%F(pwGJ4-*@^x~(F z7ZpR1%nW8M3@7_+#IG-`+yZ@R(FJyoF$11>@3b==*B61Hu>G=@@WT=$LU-zBozJ0- zFNfV|v?9vao>~rfkrJ3UwnE-H)NWV7IW>S`5)VL2q@Gyx5Mn~~)>w;oU3E>}GWhdi zT%+m!m-BuFd`;Lz#gigF^5U1WlVN2;7Jf_C5@+*c$|g1?>=T7v3d;3&6`})2bGmYQ zIfiwo7n|4m?QS@TZyEM67YYLs;+cK^mTOD)XPH>;XUJ!Y<7?r`(+|{Uj;=acdyFTIf z*oLqc>>Q#37E%XD(qa5yKQ1$!i4N5PV&AozFc`naN%aY)OK7+o1WB9>#~bIZkB>Yt zi70Cr=9SNq>PfkOXR)f|-toHc*8Z&KPrbRN0+@1nN&MluKchp_w~lOinodA6LbHBe zKba2N>hy1rLm=<4g<|s7b0w0&+1lQ2@cBLojpLmSW=pm(dwmtN2xzE%tZ`hRv8dRg zl$`EG26RiX{jSD@^fA)E$r!f&AqYch!X`;VlJhK`QqwfkzxXQGVbhhdQB16X+kr;! z_=sS@>y@~Ey8;+%qVE=^%Z&1cIUYs&Jcg!B-lqA(HAP>`V^GAU30AL+pM|g5risO$ zu##CcVz#qwWD)8kyS{SIOUj#ePdcmZev}$TaC#>~4bc5^4kKGJbZ!VW?30|>Qj1Ac z%(r5_5@g`{0eAtw(f1D_je9CQoVP^Lh&oY?d?$N}t%m3AA_m;}#Cq2^TD z578CtgTcARFbVI3QggJNONSa-m#2NJ;UrM1D=*PUeB=anTzw*YR>KEcS?#zQVkKo< z2VmcN{;NOVGba;DZSFrD7;RMNHGifo)AaCo?NI|bxMT53aO?4=_O;!xT*)>IAVa7H zsQPuV6TOmN!be!&J)}rf$rlwB-RZn!R7GnqvRo=C=ljuNvYB#+?~%}B*H7WXOAld~ z9b0Q;mmbEPLnu|iVKf>u@9g`n-J%GdJ17BCH^n?o-pd>qfmGtbJ)7+KtF?UJr!<5v z%+^R)9CW#X8p_mXkKAPIRE*ae781AiDZ66}bOm*GTMSXHWy|GoZ3eD{NMCrIXmI1j zgN|!s=!3NVLL;`pOKuh^jSNq|XRErI9adZ`+Z6NI$jtCf6-5(b0|W0p2VvuI1s+;7 zNobiz^oDNYQ$0v8ScvBdic?Y)8ICJL5BBBcGP&_-ubFJs<~W<4Ad{O3LVPk^59`EX zGG<%4F#c||st&7gP0gpB0%yIMn1;e+VmH^_R$sFYUOXXT;pJ{Wb6yTlhsefPd20n- z&BNVm6_~jk6*&akgifN%jy8+}3i}D|G;EchFvyd9pF9fld2SDHjQjcHN9wjv%sL&i z7G70VHl8BqP4*Qe^t+fID6$em?eFOYKa_`&eFdBCuFDUa=y0)DM9#fb70#!b?yAcD ziC&c-#NF-1ejnbj!Pcg}bbM53h6e#VL}dr8_;UX0X!g#{DIv66wt?4P8CRDG5jY_g zs8Gf@Mcm7^R)C7}J;#s0EF+w(B#jSt$WejW$)}MOcvmav;YhJN)i?abR2=ZTl)y$dFU#?|uq)=-_TRYD93vNbqb4p}7GI zs(#;<vi<30G6uYZ>Bu{o2>=D)dqh^)nRJ@nJE zaqkD;|MT`e;0_Na*g1rKaHZ&Hurb7XJb3{hCaF2gq*WBDPDm)#E7z6?&RyJSS42_} zJ=OIJ&J-c}d-dhuZjcc?5~}2j%VKer?VMm}$OCao<|@aiGB9;8UdC+|vKHCW6JlxV1wh1hj!A(j#Jyavx|($R4Q`?}X&L%GJ&6YM46eJUvbG1;o>l~nW$ zDg5X)C6S27MgV$YI#Vc+l6hJm^ntP~$g@0|lbN2eq@^d41HulNSciMNHCbPTQD15Um-{X2zJI;2M!0ilTpSpm?x#6K!!K=2L^s4l} zh0?wo_cv$qI=vi**p77g7;av|f%pjj^&9LFe++kbOsb&6=H5Bgb#)68MkXdryZ~vV z+8CCSu5;`3U^7c%Fecg&tY9jYS^G1tH7YAE6E;c$YGqH$e zOQ?vm?)KxFFbi65@j?zJS`C-ecQ&3Lm(@-NuJ#S*EpWBp;w)XSsP?kW0heBZF(IfHQ*7b7VxI>Licq(SPTZ z!^{DvTz1Br$*arNt&aI+)g&`dfZy8-@6@*SeJY4Lv^|WGnl)pv(r~;-G0*Mr?Sg0N z=C)b^*G%G+(}$zinCX-nt}W`1e0Z~z?PXX>*EUITr%r_zJ^^WrIX+64xF(x&^p5H^5T{B z^comBOhJl;7&b7dJt1izL`-wj`~fU5Vn#Sh>(}f))$Y|rc3}IUl8mtU*MGNffsJ;> zQ&$n(0ve~#*2xMVsD4!imdzvrk9W37im=wdb=>42WyKr@W|Y%qGmsxlxvxEUmi|_m zUm*v*?W5A)GH}8wFuMQm{kU}aaGxSGxtS1kq&G>lex!#TUAgdvt9pVy9{e`x@U{Jh zo2n%N7PLXjBuA#Pd3tSp;h)gIla6vZnB08ezihbvshW5{&$)iGtzXEN-O;2i;;phdUy<^Cig1EYvQi~isHafHXJ(`}0HdJi}2hso^FZxcIyd7YISwz8wz zP@R3+5(s--`Jdb4C(cNzbh}v7o->OnWBHcae`?foe&wA5oYVjMwkNnaOq^Qv!lL_2 zk7NA*+NP*;PU%6-MCxdTo~CL~%38j&J0roC)2zEk>n)>+Y-1DDs^r@H^9tAY^?3TCVz z6BA~n{qa%d<&Htt95@5_KFx2#hPMCj#2bU3BmN7F*9hDnzB1lm2I88n=LYm+4X#0S zci%}F-7LhaKW{@4W8H`nwCUg%$r4i^pi7*W;<&E|E1St2nM=;q!@%D}Gv$Icy{YbO6E?41n z&`m>b%|}j6!3({;<*#8pzgF4&CdXHd^LDCii;Rssl-%4fEKMot_K(Ms?}+7%8g}gh zhlt;R%F#VuY(p&0ur=vsY(aOFvi@>znxWyw=r5q5l`mhtRWiEHyNrlivM@Q#5SI}WGpK@KWD zXoP?@N?Msfp)O2aH6J9=zP_e0XDmo_sZ>iAFsic#=YUrF9HIQ=1qIb`1OYNm;~GNk1OqLw*9c zw)dj1fMDR^VsT*o<0vaJj3)WE?m8=3wC`; zjh}%V$pV5B(M56DtRQ1ld21y*g+EXB9P0XxuE+Sd-t`n822`O-zr$z{W(ou-5rSwt z;@?dHi~k#@09nQ$X*YCKb%j)?_A9ei{NmiECKJWQ#l88P2VeNPvV{3=O&S*KMgX%bMy!= z8v(IP{@hI;YvPLxk}s@^1%eXH56HAmK4_iXF(f0*0nxw}#dOI-YOQ_+oO%2S-m!yK z>N_?%NX9xy=9Fso81}p4#EaawAZHIBz!d#93YfHY!bv78DksKQK&pK(%TRnR-^8;U zb$pHymvdLT%^9sEYksEg{M!Y6?iO*srR$D$YKILHQb=;b*nlN}r_bAaD2@JQX6M9eryT`l&5B?VM?K^jjBcWH)H1SBU-BA-26Wgv0|8Lb@ zc{r5&9!IiNuBBs_rgI5{l#YX}*AivVWJYSH$P(d}QPvqsM+cLV$(k9%WakKVjE<2; zLR~6kvYxS}BaE_-nfrTfo##By{o^j@k2`8P0XYE2qH9_v8-pjHLjygNlH;kP|2oPyn zw8gxKjQ5fwaUaVHv{GN^d5lz=@vJ>7!~7T4@@sGq*cN-n-@CQ_Z)aOlNK`%7SB}vO z-N7w=hO44!M}B6v6sT04KBc-%5i0Fd?PPqdBfh+D9+_>AIuL-*-80CY*H@ML@de0y zCviq~l4aqofZ$_J_5`RAxR3gTt*S_2Mp37`CJ{y5k8Jwr725S{uSOk>mQuj1^zvP& zo$o>HiN-m4Vf?2~VHNn){GWa0sC`o-)l?$3h6^TgTRcwuqn zR3jYiJ0=GN-P*O~QdAq|a0GyesimEn7Y*3&f7AYcL|jhBiRP*L@if}xRDa!^!$eC$ zDeU&XhLw{-H``vFUHp;3@-ZFl9UPoZhB#y;R;`)K`cM^71vff6{z%X69@kzC;r|F8 z;zF9$?4n2&PvaIMZ#g{<>{XGTO7U&a_pN_Pm>L(%U&#OF$ZFqpL4Jix*E5`wgi& ztb?h1LqmRS9l0{r%3WQV)2g9ycv%>pMd$qOeU`e3l?3z5HDzKq9J=A$0}e=J;TuXN zuywIAAMC!U_F_CdH0Md|;pO1tPRa;P`32iE^F{3m%UE(IRpAJ>aFSW2R%W0GnNm4H zD03bnd_nGLrm2Fo-$i@6yOG`^m@dgxKcu`QGOsh*b>0MFxHG)3Hae2$ZIIk$f>boR zQaagF`79(F?sm)E*Vkhd`$GW->q;f(*i} z?STxx;3kpO*|(9>*N@sjZyCs0=fXE~)<8GGB$Plhdnid-8}b?ZO43fHo(()0!5yq8cYwDQc%W}ULAZjgd^7N6GsdO*{+8kUn=tR)n2JtmTWE-|m5z^1sw1Y>v= zf5IQ;{6HW&I+`_d8I$on$!Fh?2e2FZ`}iBR$hg=UJC&Cee9I8q?aR&?OaNMRLpCun zP9Q=j#UM62^#Pq4_O%tODG+&-z=_R1e85d%>8(fh;7E%Qlu^_+bW`pzaS89B*J^Ep zA>anJs=>Op%$5`!7?<^R|I3p$gjh%utW*>T3cFQu%#K5Z(T3le2yR#0IS(EBCZD#0 zMdt5ypBh3^Gb6!D!9H9RdaCgxMSiqSQ1!z$R$3s-M;r$&3N^M5#U)M!^Rc?lixaC% z*eLt_;#T)_!ql7Nd`0GxoE<|3263cq`2yB6nlZye61cCBTx)j7-_Zru*p+OVE6(L8 zHZ&V>gEbbGtLpf zg0Pm3@f*@?*y2#H$@~9pcMz1vfRX}|&@_y;%

3E-qG)Nu+*Sph>pQyQ7lgA0zEu z&^qAv=}-RB-p2NHxn!Psljc9%kEZo2ii7zUKexh)C-tOL|_nl%3mzwAG! zrv4Ys;2%!f8CJHJV1?}h8dA^dlnLu!=NzjsCy5NtL+?UEPQuU-t)X!_Vji$7C@y6I zPy+0;Y`_MyLELQIt@b$UD-9y!%i&b#xn?^#yN*VACzXp!u>eOO^x;MTZy1)d6;LlS zr3P@Utti{qg;Of80xCwRRc>+i+CKp>WL6gd literal 0 HcmV?d00001 diff --git a/playbooks/AD_LDAP_Account_Unlocking.py b/playbooks/AD_LDAP_Account_Unlocking.py new file mode 100644 index 0000000000..aed8f5958c --- /dev/null +++ b/playbooks/AD_LDAP_Account_Unlocking.py @@ -0,0 +1,172 @@ +""" +Accepts user name that needs to be unlocked in Microsoft LDAP Active Directory. Generates an observable output based on the status of account unlocking or enabling. +""" + + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta + + +@phantom.playbook_block() +def on_start(container): + phantom.debug('on_start() called') + + # call 'username_filter' block + username_filter(container=container) + + return + +@phantom.playbook_block() +def username_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug("username_filter() called") + + ################################################################################ + # Filter user name inputs to route inputs to appropriate actions. + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:user", "!=", ""] + ], + name="username_filter:condition_1", + delimiter=",") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + unlock_user_account(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def unlock_user_account(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug("unlock_user_account() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Unlock user account from filtered playbook inputs. + ################################################################################ + + filtered_input_0_user = phantom.collect2(container=container, datapath=["filtered-data:username_filter:condition_1:playbook_input:user"]) + + parameters = [] + + # build parameters list for 'unlock_user_account' call + for filtered_input_0_user_item in filtered_input_0_user: + if filtered_input_0_user_item[0] is not None: + parameters.append({ + "use_samaccountname": True, + "user": filtered_input_0_user_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("unlock account", parameters=parameters, name="unlock_user_account", assets=["microsoft ad ldap"], callback=filter_unlock_account) + + return + + +@phantom.playbook_block() +def username_observables(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug("username_observables() called") + + ################################################################################ + # Format a normalized output for each user. + ################################################################################ + + filtered_result_0_data_filter_unlock_account = phantom.collect2(container=container, datapath=["filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.parameter.user","filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.parameter.use_samaccountname","filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.data.*.user_dn","filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.status","filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.message","filtered-data:filter_unlock_account:condition_1:unlock_user_account:action_result.data.*.starting_status"]) + + filtered_result_0_parameter_user = [item[0] for item in filtered_result_0_data_filter_unlock_account] + filtered_result_0_parameter_use_samaccountname = [item[1] for item in filtered_result_0_data_filter_unlock_account] + filtered_result_0_data___user_dn = [item[2] for item in filtered_result_0_data_filter_unlock_account] + filtered_result_0_status = [item[3] for item in filtered_result_0_data_filter_unlock_account] + filtered_result_0_message = [item[4] for item in filtered_result_0_data_filter_unlock_account] + filtered_result_0_data___starting_status = [item[5] for item in filtered_result_0_data_filter_unlock_account] + + username_observables__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + username_observables__observable_array = [] + + for user, sam_account, user_dn, status, msg, prev_status in zip(filtered_result_0_parameter_user, filtered_result_0_parameter_use_samaccountname, filtered_result_0_data___user_dn, filtered_result_0_status, filtered_result_0_message, filtered_result_0_data___starting_status): + user_acc_status = { + "type": "Microsoft AD LDAP user name", + "value": user, + "message": msg, + "status": status + } + + username_observables__observable_array.append(user_acc_status) + #phantom.debug(username_observables__observable_array) + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="username_observables:observable_array", value=json.dumps(username_observables__observable_array)) + + return + + +@phantom.playbook_block() +def filter_unlock_account(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug("filter_unlock_account() called") + + ################################################################################ + # filter check if the user is unlocked successfully. + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["unlock_user_account:action_result.status", "==", "success"] + ], + name="filter_unlock_account:condition_1", + delimiter=",") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + username_observables(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def on_finish(container, summary): + phantom.debug("on_finish() called") + + username_observables__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="username_observables:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + + output = { + "observable": username_observables__observable_array, + } + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_playbook_output_data(output=output) + + return \ No newline at end of file diff --git a/playbooks/AD_LDAP_Account_Unlocking.yml b/playbooks/AD_LDAP_Account_Unlocking.yml new file mode 100644 index 0000000000..a8f286268d --- /dev/null +++ b/playbooks/AD_LDAP_Account_Unlocking.yml @@ -0,0 +1,23 @@ +name: AD LDAP Account Unlocking +id: e6f96caf-61ac-4ced-aabc-ba9b19bd9e1f +version: 1 +date: '2023-06-21' +author: Lou Stella, Splunk +type: Investigation +description: "Accepts user, to be unlocked using Microsoft AD LDAP connector. This playbook produces a normalized observable output for each user." +playbook: AD_LDAP_Account_Locking +how_to_implement: This input playbook requires the Microsoft AD LDAP connector to be configured. It is designed to work in conjunction with the Active Directory Restore Accounts playbook or other playbooks in the same style. +references: [] +app_list: + - AD LDAP +tags: + platform_tags: + - user + - microsoft_ad_ldap + - D3-AL + - enable_account + playbook_type: Input + vpe_type: Modern + playbook_fields: [] + product: + - Splunk SOAR