From 81a49be5e80ea7cfba96bce982da35be771e9bf7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 14:46:14 -0700 Subject: [PATCH 01/27] Out of the Gates Microsoft Exchange Mailbox Replication service writing Active Server Pages --- ...on_service_writing_active_server_pages.yml | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml diff --git a/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml new file mode 100644 index 0000000000..c41f9440b6 --- /dev/null +++ b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml @@ -0,0 +1,100 @@ +name: Microsoft Exchange Mailbox Replication service writing Active Server Pages +id: 985f322c-57a5-11ec-b9ac-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following query identifies suspicious .aspx created in 3 paths identified + by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM + group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, + `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. + Upon triage, the suspicious + .aspx file will likely look obvious on the surface. inspect the contents for script + code inside. Identify additional log sources, IIS included, to review source and + other potential exploitation. It is often the case that a particular threat is only + applicable to a specific subset of systems in your environment. Typically analytics + to detect those threats are written without the benefit of being able to only target + those systems as well. Writing analytics against all systems when those behaviors + are limited to identifiable subsets of those systems is suboptimal. Consider the + case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, + a hunter can limit their analytics to systems that have been identified as Exchange + servers. A hunter may start with the theory that the exchange server is communicating + with new systems that it has not previously. If this theory is run against all publicly + facing systems, the amount of noise it will generate will likely render this theory + untenable. However, using the asset information to limit this analytic to just the + Exchange servers will reduce the noise allowing the hunter to focus only on the + systems where this behavioral change is relevant.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=MSExchangeMailboxReplication.exe by _time span=1h Processes.process_id Processes.process_name Processes.process_guid + Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process process_guid] | dedup file_create_time + | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: + - https://redcanary.com/blog/blackbyte-ransomware/ +tags: + analytic_story: + - ProxyShell + - Ransomware + confidence: 90 + context: + - Source:Endpoint + - Stage:Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: A file - $file_name$ was written to disk that is related to IIS exploitation + related to ProxyShell. Review further file modifications on endpoint + $dest$ by user $user$. + mitre_attack_id: + - T1505 + - T1505.003 + - T1190 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user + - Filesystem.process_guid + - Processes.process_name + - Processes.process_id + - Processes.process_name + - Processes.process_guid + risk_score: 81 + security_domain: endpoint + + \ No newline at end of file From 12c8dccc593f0625edb72e3d7a0b44d027a7cae0 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 14:46:35 -0700 Subject: [PATCH 02/27] added T --- detections/endpoint/detect_exchange_web_shell.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index ef48bc9c3b..6f2e31b762 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -67,6 +67,7 @@ tags: mitre_attack_id: - T1505 - T1505.003 + - T1190 observable: - name: user type: User From ec5f5713a17cd8346108f1e45eaaba7209e78c37 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 15:54:21 -0700 Subject: [PATCH 03/27] Update resize_shadowstorage_volume.yml --- detections/endpoint/resize_shadowstorage_volume.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 13d606a8f9..40e55b9dc5 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -28,8 +28,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: network admin can resize the shadowstorage for valid purposes. references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html + - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md + - https://redcanary.com/blog/blackbyte-ransomware/ + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage tags: analytic_story: - Clop Ransomware From e3a84f8f6e9e56d9deb3e0a280d26f855559b88a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 8 Dec 2021 13:07:50 -0700 Subject: [PATCH 04/27] Defense --- .../endpoint/windows_dism_remove_defender.yml | 74 +++++++++++++++++++ .../windows_dism_remove_defender.test.yml | 12 +++ 2 files changed, 86 insertions(+) create mode 100644 detections/endpoint/windows_dism_remove_defender.yml create mode 100644 tests/endpoint/windows_dism_remove_defender.test.yml diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml new file mode 100644 index 0000000000..0d6c77031e --- /dev/null +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -0,0 +1,74 @@ +name: Windows DISM Remove Defender +id: 8567da9e-47f0-11ec-99a9-acde48001122 +version: 1 +date: '2021-11-17' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe + (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dism_remove_defender_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed. +references: + - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: access + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/tests/endpoint/windows_dism_remove_defender.test.yml b/tests/endpoint/windows_dism_remove_defender.test.yml new file mode 100644 index 0000000000..9f090a3664 --- /dev/null +++ b/tests/endpoint/windows_dism_remove_defender.test.yml @@ -0,0 +1,12 @@ +name: Windows DISM Remove Defender Unit Test +tests: +- name: Windows DISM Remove Defender + file: endpoint/windows_dism_remove_defender.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_dism.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From cd36c6dd6f1bc258054364476d178a9a6877843d Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 8 Dec 2021 13:25:21 -0700 Subject: [PATCH 05/27] Raccine Disable --- ...indows_raccine_scheduled_task_deletion.yml | 72 +++++++++++++++++++ ...s_raccine_scheduled_task_deletion.test.yml | 12 ++++ 2 files changed, 84 insertions(+) create mode 100644 detections/endpoint/windows_raccine_scheduled_task_deletion.yml create mode 100644 tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml new file mode 100644 index 0000000000..b1c2f4e114 --- /dev/null +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -0,0 +1,72 @@ +name: Windows Raccine Scheduled Task Deletion +id: c9f010da-57ab-11ec-82bd-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher Florian Roth, designed to intercept and prevent precursors and active ransomware behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe + Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited, however filter as needed. +references: + - https://redcanary.com/blog/blackbyte-ransomware/ + - https://github.com/Neo23x0/Raccine +tags: + analytic_story: + - Ransomware + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml new file mode 100644 index 0000000000..849361ab9d --- /dev/null +++ b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml @@ -0,0 +1,12 @@ +name: Windows Raccine Scheduled Task Deletion Unit Test +tests: +- name: Windows Raccine Scheduled Task Deletion + file: endpoint/windows_raccine_scheduled_task_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_raccine.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 7f5d11bcd9983bde0e73938303997d2b1f89c0ea Mon Sep 17 00:00:00 2001 From: root Date: Wed, 8 Dec 2021 20:29:14 +0000 Subject: [PATCH 06/27] Added detection testing service results inWindows DISM Remove Defender --- .../endpoint/windows_dism_remove_defender.yml | 43 +++++++++++-------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index 0d6c77031e..17df9c7817 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -6,23 +6,30 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. +description: The following analytic identifies the use of the Windows Disk Image Utility, + `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable + Defender before completing their objective. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe - (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_dism_remove_defender_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed. + (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" + AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Some legitimate administrative tools leverage `dism.exe` to + manipulate packages and features of the operating system. Filter as needed. references: - - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ +- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ tags: analytic_story: - Windows Defense Evasion Tactics - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -36,11 +43,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -48,12 +55,12 @@ tags: security_domain: access impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to disable Windows Defender. observable: - name: user type: User @@ -71,4 +78,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 219ba97d2d8dd8f1a8028a2f11f624d2670fb8a3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 8 Dec 2021 13:44:23 -0700 Subject: [PATCH 07/27] installerfiletakeover --- ...msi_module_loaded_by_non_system_binary.yml | 80 +++++++++++++++++++ ...odule_loaded_by_non_system_binary.test.yml | 12 +++ 2 files changed, 92 insertions(+) create mode 100644 detections/endpoint/msi_module_loaded_by_non_system_binary.yml create mode 100644 tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml new file mode 100644 index 0000000000..aa7241ee98 --- /dev/null +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -0,0 +1,80 @@ +name: MSI Module Loaded by Non-System Binary +id: ccb98a66-5851-11ec-b91c-acde48001122 +version: 1 +date: '2021-12-08' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'The following hunting analytic identifies `msi.dll` being loaded by a binary not located in `system32`, `syswow64`, `winsxs` or `windows` paths. This behavior is most recently related to InstallerFileTakeOver, or CVE-2021-41379, and DLL side-loading. + CVE-2021-41379 requires a binary to be dropped and `msi.dll` to be loaded by it. To Successful exploitation of this issue happens in four parts \ + + 1. Generation of an MSI that will trigger bad behavior. \ + + 1. Preparing a directory for MSI installation. \ + + 1. Inducing an error state. \ + + 1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \ + + In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.' +search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime + by Image ImageLoaded process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `msi_module_loaded_by_non_system_binary_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed. +references: + - https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis + - https://github.com/klinix5/InstallerFileTakeOver + - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc +cve: + - CVE-2021-41379 +tags: + analytic_story: + - Windows Privilege Escalation + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1574.002 + - T1574 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml new file mode 100644 index 0000000000..c06a3b15a4 --- /dev/null +++ b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml @@ -0,0 +1,12 @@ +name: MSI Module Loaded by Non-System Binary Unit Test +tests: +- name: MSI Module Loaded by Non-System Binary + file: endpoint/msi_module_loaded_by_non_system_binary.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 74cc7c54f2a9bace90d83afdcb80d1ada5519091 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 9 Dec 2021 21:06:53 +0000 Subject: [PATCH 08/27] Added detection testing service results inWindows Raccine Scheduled Task Deletion --- ...indows_raccine_scheduled_task_deletion.yml | 43 +++++++++++-------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index b1c2f4e114..623a9a5afb 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -6,23 +6,31 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher Florian Roth, designed to intercept and prevent precursors and active ransomware behavior. +description: The following analytic identifies the Raccine Rules Updater scheduled + task being deleted. Adversaries may attempt to remove this task in order to prevent + the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher + Florian Roth, designed to intercept and prevent precursors and active ransomware + behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe - Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: False positives should be limited, however filter as needed. references: - - https://redcanary.com/blog/blackbyte-ransomware/ - - https://github.com/Neo23x0/Raccine +- https://redcanary.com/blog/blackbyte-ransomware/ +- https://github.com/Neo23x0/Raccine tags: analytic_story: - Ransomware - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -35,11 +43,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -47,12 +55,12 @@ tags: security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. observable: - name: user type: User @@ -69,4 +77,5 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + automated_detection_testing: passed From 1e731ee7af915debab12d844e3e69cab5f086ac2 Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 3 Jan 2022 12:03:34 -0500 Subject: [PATCH 09/27] modify experimental detections to say not supported --- bin/jinja2_templates/doc_detections.j2 | 2 +- docs/_data/navigation.yml | 2 + docs/_pages/detections.md | 5 +- docs/_pages/privilege_escalation.md | 10 +- docs/_pages/stories.md | 3 +- docs/_playbooks/delete_detected_files.md | 3 + docs/_playbooks/log4j_investigate.md | 27 ++++ docs/_playbooks/log4j_respond.md | 27 ++++ .../ransomware_investigate_and_contain.md | 3 + ...12-detect_new_login_attempts_to_routers.md | 2 +- ...tect_unauthorized_assets_by_mac_address.md | 2 +- ...9-15-no_windows_updates_in_a_time_frame.md | 2 +- ...9-email_attachments_with_lots_of_spaces.md | 2 +- ...7-09-20-large_volume_of_dns_any_queries.md | 2 +- ...s_scanning_for_vulnerable_jboss_servers.md | 2 +- ...cious_requests_to_exploit_jboss_servers.md | 2 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 2 +- ...0-13-unusually_long_content-type_length.md | 2 +- ...018-01-05-monitor_email_for_brand_abuse.md | 2 +- ..._blocked_outbound_traffic_from_your_aws.md | 2 +- ...6-01-detect_large_outbound_icmp_packets.md | 2 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 2 +- ...-10-23-wmi_permanent_event_subscription.md | 2 +- ...-10-23-wmi_temporary_event_subscription.md | 2 +- ...1-27-detect_spike_in_s3_bucket_deletion.md | 2 +- .../2018-12-06-suspicious_java_classes.md | 2 +- ...01-25-processes_tapping_keyboard_events.md | 2 +- ..._servers_executing_suspicious_processes.md | 2 +- ...5-08-unusually_long_command_line_-_mltk.md | 2 +- ...-01-22-dns_query_length_outliers_-_mltk.md | 2 +- ...20-02-07-macos_-_re-opened_applications.md | 2 +- ...02-20-new_container_uploaded_to_aws_ecr.md | 2 +- ...20-03-16-child_processes_of_spoolsv_exe.md | 2 +- .../2020-03-16-detect_rare_executables.md | 2 +- .../_posts/2020-03-16-spike_in_file_writes.md | 2 +- ...n_eks_kubernetes_cluster_scan_detection.md | 2 +- ...mazon_eks_kubernetes_pod_scan_detection.md | 2 +- ...0-first_time_seen_child_process_of_zoom.md | 2 +- ...tes_aws_detect_suspicious_kubectl_calls.md | 2 +- ...20-07-07-remote_desktop_network_traffic.md | 2 +- ...p_kubernetes_cluster_pod_scan_detection.md | 2 +- .../2020-07-21-detect_outbound_smb_traffic.md | 2 +- ...1-detect_outlook_exe_writing_a_zip_file.md | 2 +- ...-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...ritten_outside_of_the_outlook_directory.md | 2 +- ...rs_sending_high_volume_traffic_to_hosts.md | 2 +- .../2020-07-21-excessive_dns_failures.md | 2 +- ...first_time_seen_running_windows_service.md | 2 +- ...me_of_network_traffic_from_email_server.md | 2 +- ...th_invalid_credentials_from_the_same_ip.md | 2 +- .../2020-07-21-okta_account_lockout_events.md | 2 +- .../2020-07-21-okta_failed_sso_attempts.md | 2 +- ...1-okta_user_logins_from_multiple_cities.md | 2 +- ...7-21-prohibited_network_traffic_allowed.md | 2 +- .../2020-07-21-protocol_or_port_mismatch.md | 2 +- ...07-21-remote_desktop_network_bruteforce.md | 2 +- ...emote_desktop_process_running_on_system.md | 2 +- ...2020-07-21-sql_injection_with_long_urls.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike.md | 2 +- .../2020-07-22-smb_traffic_spike_-_mltk.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- ...-07-27-aws_detect_attach_to_role_policy.md | 2 +- ...07-27-aws_detect_permanent_key_creation.md | 2 +- .../2020-07-27-aws_detect_role_creation.md | 2 +- ...-07-27-aws_detect_sts_assume_role_abuse.md | 2 +- ...-aws_detect_sts_get_session_token_abuse.md | 2 +- ...ct_windows_dns_sigred_via_splunk_stream.md | 2 +- ...7-28-detect_windows_dns_sigred_via_zeek.md | 2 +- ...-08-02-detect_f5_tmui_rce_cve-2020-5902.md | 2 +- ...-05-detect_new_open_gcp_storage_buckets.md | 2 +- ...detect_gcp_storage_access_from_a_new_ip.md | 2 +- .../_posts/2020-08-11-detect_arp_poisoning.md | 2 +- .../2020-08-11-detect_rogue_dhcp_server.md | 2 +- ...igh_number_of_cloud_instances_destroyed.md | 2 +- ...high_number_of_cloud_instances_launched.md | 2 +- ...ection_by_machine_learning_method_-_ssa.md | 2 +- .../2020-09-15-detect_zerologon_via_zeek.md | 2 +- ...computer_changed_with_anonymous_account.md | 2 +- ...2020-10-08-gcp_detect_gcploit_framework.md | 2 +- ...20-10-21-detect_snicat_sni_exfiltration.md | 2 +- ...ect_ipv6_network_infrastructure_threats.md | 2 +- ...20-10-28-detect_port_security_violation.md | 2 +- ...ect_software_download_to_network_device.md | 2 +- .../2020-10-28-detect_traffic_mirroring.md | 2 +- ...burst_correlation_dll_and_network_event.md | 2 +- ..._of_login_failures_from_a_single_source.md | 2 +- docs/_posts/2021-01-06-supernova_webshell.md | 2 +- ...ike_in_aws_security_hub_alerts_for_user.md | 2 +- ...1-27-detect_baron_samedit_cve-2021-3156.md | 2 +- ...baron_samedit_cve-2021-3156_via_osquery.md | 2 +- ...ct_baron_samedit_cve-2021-3156_segfault.md | 2 +- ...2-22-suspicious_curl_network_connection.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage.md | 2 +- ...suspicious_plistbuddy_usage_via_osquery.md | 2 +- ...uspicious_sqlite3_lsquarantine_behavior.md | 2 +- .../2021-03-01-any_powershell_downloadfile.md | 2 +- .../2021-05-21-winrm_spawning_a_process.md | 2 +- ...ols_passing_authentication_in_cleartext.md | 2 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 2 +- ...-08-27-exchange_powershell_module_usage.md | 2 +- ...9-28-print_processor_registry_autostart.md | 2 +- ..._connect_to_internet_with_hidden_window.md | 2 +- ...21-10-24-gdrive_suspicious_file_sharing.md | 2 +- ...10-24-gsuite_suspicious_calendar_invite.md | 2 +- ...-randomly_generated_scheduled_task_name.md | 2 +- ...randomly_generated_windows_service_name.md | 2 +- ...r_of_computer_service_tickets_requested.md | 2 +- ...f_remote_endpoint_authentication_events.md | 2 +- ...-12-10-curl_download_and_bash_execution.md | 2 +- ...-12-11-wget_download_and_bash_execution.md | 2 +- ...-cmd_carry_out_string_command_parameter.md | 2 +- ...2021-12-13-detect_outbound_ldap_traffic.md | 2 +- ..._class_file_download_by_java_user_agent.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 4 +- ...og4shell_jndi_payload_injection_attempt.md | 2 +- ...load_injection_with_outbound_connection.md | 2 +- ...onnection_from_java_using_default_ports.md | 31 +++-- ...2021-12-13-windows_java_spawning_shells.md | 4 +- .../2021-12-14-hunting_for_log4shell.md | 2 +- ...suspicious_computer_account_name_change.md | 117 +++++++++++++++++ ...picious_kerberos_service_ticket_request.md | 120 ++++++++++++++++++ ...spicious_ticket_granting_ticket_request.md | 111 ++++++++++++++++ docs/_stories/credential_dumping.md | 2 +- ...ing_and_domain_controller_impersonation.md | 45 +++++++ docs/index.markdown | 6 +- 126 files changed, 605 insertions(+), 133 deletions(-) create mode 100644 docs/_posts/2021-12-20-suspicious_computer_account_name_change.md create mode 100644 docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md create mode 100644 docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md create mode 100644 docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2 index 6f81151276..99bfc103b0 100644 --- a/bin/jinja2_templates/doc_detections.j2 +++ b/bin/jinja2_templates/doc_detections.j2 @@ -31,7 +31,7 @@ tags: {% if detection.experimental is sameas true -%} ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! {% endif %} [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 0fe74c1bec..7808f8c6c0 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -85,6 +85,8 @@ stories: url: /stories/cloud_security/ - title: Malware url: /stories/malware/ + - title: Privilege Escalation + url: /stories/privilege_escalation/ - title: Vulnerability url: /stories/vulnerability/ playbooks: diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 49496d4d0a..f4eb63a047 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -60,8 +60,8 @@ sidebar: | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | @@ -589,6 +589,7 @@ sidebar: | [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP | | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | @@ -599,6 +600,7 @@ sidebar: | [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious Java Classes]() | None | Anomaly | +| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | @@ -615,6 +617,7 @@ sidebar: | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | +| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting | | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | diff --git a/docs/_pages/privilege_escalation.md b/docs/_pages/privilege_escalation.md index 60bde4562d..234c9e8c36 100644 --- a/docs/_pages/privilege_escalation.md +++ b/docs/_pages/privilege_escalation.md @@ -3,7 +3,11 @@ title: Privilege Escalation layout: tag author_profile: false taxonomy: Privilege Escalation -permalink: /detections/privilege_escalation/ +permalink: /stories/privilege_escalation/ sidebar: - nav: "detections" ---- \ No newline at end of file + nav: "stories" +--- + +| Name | Technique | Tactic | +| ----------- | ----------- |--------------| +| [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 118f12121b..b3dfe3c717 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -116,4 +116,5 @@ sidebar: | [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | -| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | \ No newline at end of file +| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | +| [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md index 8cfcdde7fa..cdfc5924d6 100644 --- a/docs/_playbooks/delete_detected_files.md +++ b/docs/_playbooks/delete_detected_files.md @@ -719,6 +719,9 @@ This playbook acts upon events where a file has been determined to be malicious + + + diff --git a/docs/_playbooks/log4j_investigate.md b/docs/_playbooks/log4j_investigate.md index dfffa5f799..a6b8404eb9 100644 --- a/docs/_playbooks/log4j_investigate.md +++ b/docs/_playbooks/log4j_investigate.md @@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + + + + @@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + + + + @@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + diff --git a/docs/_playbooks/log4j_respond.md b/docs/_playbooks/log4j_respond.md index d54e6d630a..e481f99c95 100644 --- a/docs/_playbooks/log4j_respond.md +++ b/docs/_playbooks/log4j_respond.md @@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + + + + @@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + + + + @@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md index 0299c811e8..bdea3a0823 100644 --- a/docs/_playbooks/ransomware_investigate_and_contain.md +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -723,6 +723,9 @@ This playbook investigates and contains ransomware detected on endpoints. + + + diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index fdf9fa20c5..455b9a95ef 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 546b572f60..c3a9b214df 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index e12d68de5b..b2e53eb9a5 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index ab0ecc5637..b86e580526 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index bcf8aaaa8c..5375c0dc11 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 8fad54eb25..7eef32f339 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 4ad2e5b52c..1db007281a 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 84e6a6e56c..afd439206b 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 656f58f772..7b784a60aa 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 27c4ea999a..f8d7a0dcb4 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 16f6591cd9..2a75de252b 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 74be8d82f7..3a35522a01 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 3c89f71481..7d27c75c68 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index abe9c62ba4..89f26464ad 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index c04d5022e3..01de59e01b 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 305b0d96c0..13e25a88c2 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 57e387f1b3..7ab8e16864 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index 8eb6dcb7b4..371ae39b20 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index a3a7ff4fe0..ff364d2b70 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 93b66ac79b..80bf394297 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index e45ef8fd13..e3e0e07c56 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 2324a3c081..a4693c8e2f 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index c3a899224e..7bbcda1b38 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 5497d10313..67c87e61c3 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 52e81731e8..4acc79024a 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index b2b1612b06..097d2b4319 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 648c5ac70a..e7c964633d 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 342fdf976a..dcc2ade5d0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index e9f3b6a2de..1273a9a86e 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 21755982a6..494f9069b4 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index c47e24c064..461b3e2071 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index aea0b66924..b3bc479faf 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 34dfdef967..f4161d48d6 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index fad1b4da69..04e419a0d6 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 6cec018769..567d895104 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index efe6426756..811b95d6f6 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 587c321922..8a54943096 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index a3971be906..fee7273c83 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index f59439128a..8d4503f02b 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 0df2e3e9a4..56ceda832f 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 125925f8ea..820c32e491 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 76df51567f..16907b98e2 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index f86000429d..54bd047e59 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index b398487cf2..0430827d4e 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 59b32e13bd..37da58a903 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 011f47bf11..7812840cfe 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index adc98ba3e1..055e3d35b6 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 6d7527892e..7bdf6aca45 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 05f075aa32..87d7018f47 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 46c91e5864..d1d6b9e306 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index abb6589d8a..11ebfa0686 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 657c0693e1..c3eb8c9414 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 4bde5a0a93..aba20ca45b 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index ac098cfc58..a8dee9f816 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index de3b6f6ff7..e632104e28 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index ec5164abee..53f807dd2c 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 251c22c45c..84b3076718 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index e725754cc4..917c891929 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 6b5f9a566d..219d929334 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 88ae2f4a2f..991c26fa6b 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 66e0cb61d7..f472e72c33 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index f0740c07c0..4795e1ad08 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 09b0d44813..2c935da8b4 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 6ca47d8477..fe40472655 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 898b1cb5bc..c5acae3bcb 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 0cf62cb13a..c250d88d78 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 00e0f786ad..38f522e95e 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index cd75dc755b..086775892e 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index c69b147120..39bd9bd064 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 17ff1b5612..5a197c1286 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 0c0afb318c..d3b484cdb4 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index fb54f9013b..9adb7bee09 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 0cf36a0a0d..ae6ab24373 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 6486c00bc7..1d3a6924a4 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 2cc469a351..218c429e0f 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 4dd1b87f8a..e15d9742fb 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -21,7 +21,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 84fc83f605..abd525a001 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 72570dc4fa..daf9a8dd47 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index dbadb9f1d6..81bb04cc19 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 112b57d434..fc27afff0a 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index b447f0ff1b..5924638bad 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index b91ddbe8de..27e54e9976 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index 332ddfc58c..ba7caeb0f7 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index ed5ee31894..45bcba9e21 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 2c97d73e16..3a204513e6 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 4a5e3f7198..d57afb5686 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 22dfe0d5f6..bbf3c5c62c 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 5af1e40a1a..612df1337e 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -97,7 +97,7 @@ False positives may be present and filtering will need to occur by parent proces | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 50038aa3aa..fd2d98382e 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 1f3b635fde..b0024e160e 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 1eb10f9491..86c7b85291 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 2ce86bfe2a..961022da49 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 714b87b24c..f838a899a7 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md index 277f4092b4..058e672ada 100644 --- a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md @@ -98,7 +98,7 @@ Legitimate process can have this combination of command-line options, but it' | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index 96af2320bc..9bfc5124e9 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index d6165d454a..63db98ac26 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 220322b755..0749aefe13 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index 5979cf17df..a3345e7f46 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index e5ad7cad7b..363b4387a5 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index 68d8b11af7..b117314a6f 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index 2428fde8c9..977af1e228 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -92,7 +92,7 @@ False positives should be limited, however filtering may be required. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 76f3fe49d6..a32955e614 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -92,7 +92,7 @@ False positives should be limited, however filtering may be required. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md b/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md index 38a0bc3e33..29f3d586dd 100644 --- a/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md @@ -94,7 +94,7 @@ False positives may be high based on legitimate scripted code in any environment | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 90dc422735..345cff8038 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -89,7 +89,7 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index 817a87316a..d567c1cb8b 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -86,7 +86,7 @@ Filtering may be required in some instances, filter as needed. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 671785d68d..c7539368b0 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -93,7 +93,7 @@ Filtering may be required on internal developer build systems or classify assets | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index 7e4615d7d1..a5c516bf66 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -97,7 +97,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 1f9dadbed2..3e585f0ac3 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -103,7 +103,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 34e66801b5..a4da3cde5b 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -40,10 +40,16 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Search ``` - `sysmon` EventCode=3 (process_name=java OR process_name=java.exe) (DestinationPort=389 OR DestinationPort=1389 OR DestinationPort = 1099 ) -| rename Computer as dest -| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name, DestinationPort + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port +| `drop_dm_object_name(Ports)` +| rename dest as connection_to_CNC] +| table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter` ``` @@ -56,12 +62,15 @@ To successfully implement this search you need to be ingesting information on pr #### Required field * _time -* process_name -* EventID -* CommandLine -* Computer -* DestinationPort -* DestinationIp +* Processes.process_guid +* Processes.process_name +* Processes.dest +* Processes.process_path +* Processes.process +* Processes.parent_process_name +* Ports.process_guid +* Ports.dest +* Ports.dest_port #### Kill Chain Phase @@ -84,7 +93,7 @@ Legitimate Java applications may use perform outbound connections to these ports | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | @@ -99,7 +108,7 @@ Legitimate Java applications may use perform outbound connections to these ports Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) -* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log) +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log) diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 5a5e26df94..4142b5d2bd 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -93,7 +93,7 @@ Filtering may be required on internal developer build systems or classify assets | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 01c4e9145c..b51cfa3f8c 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -201,7 +201,7 @@ It is highly possible you will find false positives, however, the base score is | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md new file mode 100644 index 0000000000..c50ba0c257 --- /dev/null +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -0,0 +1,117 @@ +--- +title: "Suspicious Computer Account Name Change" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-42287 + - CVE-2021-42278 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a new computer account name and rename it to match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer account names always end with `$`. This analytic leverages Event Id 4781, `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 35a61ed8-61c4-11ec-bc1e-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` +`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$" +| table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name +| `suspicious_computer_account_name_change_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. + +#### Required field +* _time +* EventCode +* ComputerName +* Account_Name +* Old_Account_Name +* New_Account_Name + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +Renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 100 | 70 | A computer account $Old_Account_Name$ was renamed with a suspicious computer name | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | +| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 | + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_computer_account_name_change.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md new file mode 100644 index 0000000000..c67b4e4ab7 --- /dev/null +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -0,0 +1,120 @@ +--- +title: "Suspicious Kerberos Service Ticket Request" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-42287 + - CVE-2021-42278 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 8b1297bc-6204-11ec-b7c4-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` + `wineventlog_security` EventCode=4769 +| eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) +| where isSuspicious = 1 +| table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious +| `suspicious_kerberos_service_ticket_request_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field +* _time +* EventCode +* Service_Name +* Account_Name +* Client_Address +* Failure_Code + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 60.0 | 100 | 60 | A suspicious Kerberos Service Ticket was requested by $Account_Name$ | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | +| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 | + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) +* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md new file mode 100644 index 0000000000..d6d6c3df82 --- /dev/null +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -0,0 +1,111 @@ +--- +title: "Suspicious Ticket Granting Ticket Request" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-21 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed computer account. The TGT request will be preceded by a computer account name event. This analytic leverages Event Id 4781, `The name of an account was changed` and event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate a sequence of events where the new computer account on event id 4781 matches the request account on event id 4768. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-21 +- **Author**: Mauricio Velazco, Splunk +- **ID**: d77d349e-6269-11ec-9cfe-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` + `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") OR (EventCode=4768 Account_Name!="*$") +| eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) +| transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768) +| eval short_lived=case((duration<2),"TRUE") +| search short_lived = TRUE +| table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount, short_lived +|`suspicious_ticket_granting_ticket_request_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field +* _time +* EventCode +* Old_Account_Name +* New_Account_Name +* Account_Name +* ComputerName + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +A computer account name change event inmediately followed by a kerberos TGT request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 60.0 | 100 | 60 | A suspicious TGT was requested was requested | + + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index 1bae69e6b5..dc36fe0040 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi | Name | Technique | Type | | ----------- | ----------- |--------------| | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | diff --git a/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md b/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md new file mode 100644 index 0000000000..f0f76e3896 --- /dev/null +++ b/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md @@ -0,0 +1,45 @@ +--- +title: "sAMAccountName Spoofing and Domain Controller Impersonation" +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 0244fdee-61be-11ec-900e-acde48001122 + +#### Narrative + +On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks, sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited, CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a Domain Controller computer account. The only requirement is to have network connectivity to a domain controller. This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help help defenders identify attackers attempting exploitation. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | +| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | +| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting | + +#### Reference + +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/index.markdown b/docs/index.markdown index 94ea7dcdae..60f02392ab 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -9,19 +9,19 @@ header: actions: - label: "Download" url: "https://splunkbase.splunk.com/app/3449/" -excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **696** detections for Splunk." +excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **699** detections for Splunk." feature_row: - image_path: /static/feature_detection.png alt: "customizable" title: "Detections" - excerpt: "See all **696** Splunk Analytics built to find evil 😈." + excerpt: "See all **699** Splunk Analytics built to find evil 😈." url: "/detections" btn_class: "btn--primary" btn_label: "Explore" - image_path: /static/feature_stories.png alt: "fully responsive" title: "Analytic Stories" - excerpt: "See all **107** use cases, 📦 of detections built to address a threat." + excerpt: "See all **108** use cases, 📦 of detections built to address a threat." url: "/stories" btn_class: "btn--primary" btn_label: "Explore" From 50ba79335884b5e6ae93cfff74725be0c7907e9b Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 3 Jan 2022 12:20:42 -0500 Subject: [PATCH 10/27] fixing formatting --- bin/jinja2_templates/doc_detections.j2 | 2 +- docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md | 2 +- .../2017-09-13-detect_unauthorized_assets_by_mac_address.md | 2 +- docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md | 2 +- docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md | 2 +- docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md | 2 +- ...23-detect_attackers_scanning_for_vulnerable_jboss_servers.md | 2 +- ...-09-23-detect_malicious_requests_to_exploit_jboss_servers.md | 2 +- docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md | 2 +- docs/_posts/2017-10-13-unusually_long_content-type_length.md | 2 +- docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md | 2 +- ...07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md | 2 +- docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md | 2 +- docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md | 2 +- docs/_posts/2018-10-23-wmi_permanent_event_subscription.md | 2 +- docs/_posts/2018-10-23-wmi_temporary_event_subscription.md | 2 +- docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md | 2 +- docs/_posts/2018-12-06-suspicious_java_classes.md | 2 +- docs/_posts/2019-01-25-processes_tapping_keyboard_events.md | 2 +- .../2019-04-01-web_servers_executing_suspicious_processes.md | 2 +- docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md | 2 +- docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md | 2 +- docs/_posts/2020-02-07-macos_-_re-opened_applications.md | 2 +- docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md | 2 +- docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md | 2 +- docs/_posts/2020-03-16-detect_rare_executables.md | 2 +- docs/_posts/2020-03-16-spike_in_file_writes.md | 2 +- .../2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md | 2 +- .../2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md | 2 +- docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md | 2 +- ...2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md | 2 +- docs/_posts/2020-07-07-remote_desktop_network_traffic.md | 2 +- .../2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md | 2 +- docs/_posts/2020-07-21-detect_outbound_smb_traffic.md | 2 +- docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md | 2 +- docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...7-21-email_files_written_outside_of_the_outlook_directory.md | 2 +- ...-07-21-email_servers_sending_high_volume_traffic_to_hosts.md | 2 +- docs/_posts/2020-07-21-excessive_dns_failures.md | 2 +- .../2020-07-21-first_time_seen_running_windows_service.md | 2 +- ...eceiving_high_volume_of_network_traffic_from_email_server.md | 2 +- ...iple_okta_users_with_invalid_credentials_from_the_same_ip.md | 2 +- docs/_posts/2020-07-21-okta_account_lockout_events.md | 2 +- docs/_posts/2020-07-21-okta_failed_sso_attempts.md | 2 +- docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md | 2 +- docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md | 2 +- docs/_posts/2020-07-21-protocol_or_port_mismatch.md | 2 +- docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md | 2 +- .../2020-07-21-remote_desktop_process_running_on_system.md | 2 +- docs/_posts/2020-07-21-sql_injection_with_long_urls.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md | 2 +- .../_posts/2020-07-22-suspicious_email_attachment_extensions.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md | 2 +- docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md | 2 +- docs/_posts/2020-07-27-aws_detect_role_creation.md | 2 +- docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md | 2 +- .../_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md | 2 +- .../2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md | 2 +- docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md | 2 +- docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md | 2 +- docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md | 2 +- .../2020-08-10-detect_gcp_storage_access_from_a_new_ip.md | 2 +- docs/_posts/2020-08-11-detect_arp_poisoning.md | 2 +- docs/_posts/2020-08-11-detect_rogue_dhcp_server.md | 2 +- ...08-21-abnormally_high_number_of_cloud_instances_destroyed.md | 2 +- ...-08-21-abnormally_high_number_of_cloud_instances_launched.md | 2 +- ...phishing_email_detection_by_machine_learning_method_-_ssa.md | 2 +- docs/_posts/2020-09-15-detect_zerologon_via_zeek.md | 2 +- ...2020-09-18-detect_computer_changed_with_anonymous_account.md | 2 +- docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md | 2 +- docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md | 2 +- .../2020-10-28-detect_ipv6_network_infrastructure_threats.md | 2 +- docs/_posts/2020-10-28-detect_port_security_violation.md | 2 +- .../2020-10-28-detect_software_download_to_network_device.md | 2 +- docs/_posts/2020-10-28-detect_traffic_mirroring.md | 2 +- .../2020-12-14-sunburst_correlation_dll_and_network_event.md | 2 +- ...-12-16-high_number_of_login_failures_from_a_single_source.md | 2 +- docs/_posts/2021-01-06-supernova_webshell.md | 2 +- ...21-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md | 2 +- docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md | 2 +- ...2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md | 2 +- .../2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md | 2 +- docs/_posts/2021-02-22-suspicious_curl_network_connection.md | 2 +- docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage_via_osquery.md | 2 +- .../2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md | 2 +- docs/_posts/2021-05-21-winrm_spawning_a_process.md | 2 +- .../2021-08-19-protocols_passing_authentication_in_cleartext.md | 2 +- docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md | 2 +- docs/_posts/2021-08-27-exchange_powershell_module_usage.md | 2 +- docs/_posts/2021-09-28-print_processor_registry_autostart.md | 2 +- docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md | 2 +- docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md | 2 +- .../_posts/2021-11-29-randomly_generated_scheduled_task_name.md | 2 +- .../2021-11-29-randomly_generated_windows_service_name.md | 2 +- ...2-01-unusual_number_of_computer_service_tickets_requested.md | 2 +- ...1-unusual_number_of_remote_endpoint_authentication_events.md | 2 +- docs/_posts/2021-12-13-linux_java_spawning_shell.md | 2 +- docs/_posts/2021-12-13-windows_java_spawning_shells.md | 2 +- 101 files changed, 101 insertions(+), 101 deletions(-) diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2 index 99bfc103b0..c570a7238b 100644 --- a/bin/jinja2_templates/doc_detections.j2 +++ b/bin/jinja2_templates/doc_detections.j2 @@ -31,7 +31,7 @@ tags: {% if detection.experimental is sameas true -%} ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! {% endif %} [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 455b9a95ef..4b3af82123 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index c3a9b214df..8a1cb3ee04 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index b2e53eb9a5..994c664299 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index b86e580526..cdd6fe62ed 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 5375c0dc11..ef476b6f1c 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 7eef32f339..944f62ab7b 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 1db007281a..add54c77c8 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index afd439206b..e1f2fb67c9 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 7b784a60aa..4594fb7478 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index f8d7a0dcb4..06a77b0ac9 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 2a75de252b..a052304bdc 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 3a35522a01..27a1c6a08e 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 7d27c75c68..9b18393ec9 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 89f26464ad..4df111eeb5 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 01de59e01b..7cfed94862 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 13e25a88c2..ab5bdbbc6e 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 7ab8e16864..98faa510fa 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index 371ae39b20..f04e836c7d 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index ff364d2b70..8670eddf75 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 80bf394297..c90dbc6641 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index e3e0e07c56..05ed2d701b 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index a4693c8e2f..b26bdea73f 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index 7bbcda1b38..34b3fb6140 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 67c87e61c3..fd87407d7e 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 4acc79024a..03b9ba9906 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 097d2b4319..d1f4d53943 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index e7c964633d..e4136ac0cb 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index dcc2ade5d0..0774efabd0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 1273a9a86e..d0fb5ae155 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 494f9069b4..56da1a0fd2 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 461b3e2071..e30de987fc 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index b3bc479faf..eafb4b351e 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index f4161d48d6..feda7694ba 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 04e419a0d6..b90360493d 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 567d895104..54cbe330b9 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 811b95d6f6..886cce9564 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 8a54943096..f6b8e3d247 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index fee7273c83..77111d0d16 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 8d4503f02b..e45d4a4794 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 56ceda832f..b37b845b8f 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 820c32e491..5c87c7325e 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 16907b98e2..c3066252ed 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index 54bd047e59..5e464b9e82 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 0430827d4e..8cee8a7ed1 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 37da58a903..a5c9a21725 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 7812840cfe..b26c0dc59c 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index 055e3d35b6..69eda237e9 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 7bdf6aca45..cdc5b5aa42 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 87d7018f47..969f09985f 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index d1d6b9e306..61d5628b70 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 11ebfa0686..04fdfa0d23 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index c3eb8c9414..f3e1c859a1 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index aba20ca45b..92553d5fba 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index a8dee9f816..2c64d8bf1a 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index e632104e28..9e6f680cb0 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index 53f807dd2c..f01c3f38ab 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 84b3076718..da1c3dd75c 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 917c891929..3ccd85eae8 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 219d929334..f08230f3e4 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 991c26fa6b..09a634c815 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index f472e72c33..a9e9e523cf 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index 4795e1ad08..5f5c6f1dd7 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 2c935da8b4..8a2310859e 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index fe40472655..166e5b1ad0 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index c5acae3bcb..a7ff8cb52b 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index c250d88d78..01236c47f8 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 38f522e95e..ca3708022a 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index 086775892e..8f52bf663d 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index 39bd9bd064..bca76e453e 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 5a197c1286..667c0d4b27 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index d3b484cdb4..b4f87bda90 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index 9adb7bee09..51ed4a7b3c 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index ae6ab24373..77c96f1376 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 1d3a6924a4..937cc52bcf 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 218c429e0f..33ee886742 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index e15d9742fb..4b237165dd 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -21,7 +21,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index abd525a001..6d28d18b77 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index daf9a8dd47..8c4c25c39b 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 81bb04cc19..8531f0b3a2 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index fc27afff0a..24c34734d6 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 5924638bad..0bc6afacef 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 27e54e9976..9a3084f899 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index ba7caeb0f7..a0856f5491 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index 45bcba9e21..69558a9a0f 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 3a204513e6..724095d46a 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index d57afb5686..ff0531a18b 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index bbf3c5c62c..8e61c6c080 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index fd2d98382e..c7db3ec60f 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index b0024e160e..b00bf77307 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 86c7b85291..3ec80b3747 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 961022da49..a286e2e50f 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index f838a899a7..cd2d38cd92 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index 9bfc5124e9..ba3b0263b2 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index 63db98ac26..e38d5dd232 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 0749aefe13..55536c2b73 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index a3345e7f46..c9f1572b72 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index 363b4387a5..aa38ac6335 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index b117314a6f..0f76d78cfc 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index c7539368b0..5c2b0cbfca 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 4142b5d2bd..195d5cafe2 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT supported**! +We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} From 7c1025425aa78ec54075c125de9953f3f4b1e61b Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 3 Jan 2022 14:35:49 -0500 Subject: [PATCH 11/27] fixed spelling --- bin/jinja2_templates/doc_detections.j2 | 2 +- docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md | 2 +- .../2017-09-13-detect_unauthorized_assets_by_mac_address.md | 2 +- docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md | 2 +- docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md | 2 +- docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md | 2 +- ...23-detect_attackers_scanning_for_vulnerable_jboss_servers.md | 2 +- ...-09-23-detect_malicious_requests_to_exploit_jboss_servers.md | 2 +- docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md | 2 +- docs/_posts/2017-10-13-unusually_long_content-type_length.md | 2 +- docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md | 2 +- ...07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md | 2 +- docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md | 2 +- docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md | 2 +- docs/_posts/2018-10-23-wmi_permanent_event_subscription.md | 2 +- docs/_posts/2018-10-23-wmi_temporary_event_subscription.md | 2 +- docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md | 2 +- docs/_posts/2018-12-06-suspicious_java_classes.md | 2 +- docs/_posts/2019-01-25-processes_tapping_keyboard_events.md | 2 +- .../2019-04-01-web_servers_executing_suspicious_processes.md | 2 +- docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md | 2 +- docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md | 2 +- docs/_posts/2020-02-07-macos_-_re-opened_applications.md | 2 +- docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md | 2 +- docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md | 2 +- docs/_posts/2020-03-16-detect_rare_executables.md | 2 +- docs/_posts/2020-03-16-spike_in_file_writes.md | 2 +- .../2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md | 2 +- .../2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md | 2 +- docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md | 2 +- ...2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md | 2 +- docs/_posts/2020-07-07-remote_desktop_network_traffic.md | 2 +- .../2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md | 2 +- docs/_posts/2020-07-21-detect_outbound_smb_traffic.md | 2 +- docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md | 2 +- docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...7-21-email_files_written_outside_of_the_outlook_directory.md | 2 +- ...-07-21-email_servers_sending_high_volume_traffic_to_hosts.md | 2 +- docs/_posts/2020-07-21-excessive_dns_failures.md | 2 +- .../2020-07-21-first_time_seen_running_windows_service.md | 2 +- ...eceiving_high_volume_of_network_traffic_from_email_server.md | 2 +- ...iple_okta_users_with_invalid_credentials_from_the_same_ip.md | 2 +- docs/_posts/2020-07-21-okta_account_lockout_events.md | 2 +- docs/_posts/2020-07-21-okta_failed_sso_attempts.md | 2 +- docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md | 2 +- docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md | 2 +- docs/_posts/2020-07-21-protocol_or_port_mismatch.md | 2 +- docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md | 2 +- .../2020-07-21-remote_desktop_process_running_on_system.md | 2 +- docs/_posts/2020-07-21-sql_injection_with_long_urls.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md | 2 +- .../_posts/2020-07-22-suspicious_email_attachment_extensions.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md | 2 +- docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md | 2 +- docs/_posts/2020-07-27-aws_detect_role_creation.md | 2 +- docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md | 2 +- .../_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md | 2 +- .../2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md | 2 +- docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md | 2 +- docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md | 2 +- docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md | 2 +- .../2020-08-10-detect_gcp_storage_access_from_a_new_ip.md | 2 +- docs/_posts/2020-08-11-detect_arp_poisoning.md | 2 +- docs/_posts/2020-08-11-detect_rogue_dhcp_server.md | 2 +- ...08-21-abnormally_high_number_of_cloud_instances_destroyed.md | 2 +- ...-08-21-abnormally_high_number_of_cloud_instances_launched.md | 2 +- ...phishing_email_detection_by_machine_learning_method_-_ssa.md | 2 +- docs/_posts/2020-09-15-detect_zerologon_via_zeek.md | 2 +- ...2020-09-18-detect_computer_changed_with_anonymous_account.md | 2 +- docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md | 2 +- docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md | 2 +- .../2020-10-28-detect_ipv6_network_infrastructure_threats.md | 2 +- docs/_posts/2020-10-28-detect_port_security_violation.md | 2 +- .../2020-10-28-detect_software_download_to_network_device.md | 2 +- docs/_posts/2020-10-28-detect_traffic_mirroring.md | 2 +- .../2020-12-14-sunburst_correlation_dll_and_network_event.md | 2 +- ...-12-16-high_number_of_login_failures_from_a_single_source.md | 2 +- docs/_posts/2021-01-06-supernova_webshell.md | 2 +- ...21-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md | 2 +- docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md | 2 +- ...2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md | 2 +- .../2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md | 2 +- docs/_posts/2021-02-22-suspicious_curl_network_connection.md | 2 +- docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage_via_osquery.md | 2 +- .../2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md | 2 +- docs/_posts/2021-05-21-winrm_spawning_a_process.md | 2 +- .../2021-08-19-protocols_passing_authentication_in_cleartext.md | 2 +- docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md | 2 +- docs/_posts/2021-08-27-exchange_powershell_module_usage.md | 2 +- docs/_posts/2021-09-28-print_processor_registry_autostart.md | 2 +- docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md | 2 +- docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md | 2 +- .../_posts/2021-11-29-randomly_generated_scheduled_task_name.md | 2 +- .../2021-11-29-randomly_generated_windows_service_name.md | 2 +- ...2-01-unusual_number_of_computer_service_tickets_requested.md | 2 +- ...1-unusual_number_of_remote_endpoint_authentication_events.md | 2 +- docs/_posts/2021-12-13-linux_java_spawning_shell.md | 2 +- docs/_posts/2021-12-13-windows_java_spawning_shells.md | 2 +- 101 files changed, 101 insertions(+), 101 deletions(-) diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2 index c570a7238b..1674d9d254 100644 --- a/bin/jinja2_templates/doc_detections.j2 +++ b/bin/jinja2_templates/doc_detections.j2 @@ -31,7 +31,7 @@ tags: {% if detection.experimental is sameas true -%} ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. {% endif %} [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 4b3af82123..63635e1cac 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 8a1cb3ee04..1ce370f054 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index 994c664299..5337f62a6a 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index cdd6fe62ed..7c4dc9c10c 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index ef476b6f1c..65763038e2 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 944f62ab7b..5c88083518 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index add54c77c8..7cb062a67e 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index e1f2fb67c9..9d86d10c78 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 4594fb7478..1d5a1ceddd 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 06a77b0ac9..b1ab0a9661 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index a052304bdc..a4a747e994 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 27a1c6a08e..235fec05e1 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 9b18393ec9..fc46eeedd9 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 4df111eeb5..d71ae84c90 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 7cfed94862..2835a4e40e 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index ab5bdbbc6e..c0bfc0d70a 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 98faa510fa..ba3a15d0d1 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index f04e836c7d..d8086a4b48 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 8670eddf75..503ea38ec0 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index c90dbc6641..074dd9597c 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 05ed2d701b..8e002cabd3 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index b26bdea73f..5a972cdf0b 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index 34b3fb6140..1b89ba0d20 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index fd87407d7e..0e9289dfb6 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 03b9ba9906..e63b22f9d2 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index d1f4d53943..7a2b124379 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index e4136ac0cb..22987a3ab7 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 0774efabd0..a4aaf7629d 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index d0fb5ae155..aa1133c56a 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 56da1a0fd2..daac2680d6 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index e30de987fc..cf87f364c0 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index eafb4b351e..780e30ab19 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index feda7694ba..79490e9115 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index b90360493d..e3bf0189b9 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 54cbe330b9..ebefaebf7e 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 886cce9564..31a2c28fe1 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index f6b8e3d247..fa7612e255 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index 77111d0d16..446b6fc857 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index e45d4a4794..2bd70571d5 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index b37b845b8f..2b02f90b3c 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 5c87c7325e..ed581283cc 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index c3066252ed..4f96ebd047 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index 5e464b9e82..b42cee4c7d 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 8cee8a7ed1..ce7829be86 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index a5c9a21725..9b54527c5e 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index b26c0dc59c..6532f871e8 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index 69eda237e9..b00c47cbb2 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index cdc5b5aa42..62d18e5229 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 969f09985f..5304bff8ff 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 61d5628b70..cf9ea9b2ab 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 04fdfa0d23..5b48a0b52c 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index f3e1c859a1..16e5f54313 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 92553d5fba..824ebb7d8b 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 2c64d8bf1a..4b7bf6cb45 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index 9e6f680cb0..936ea6b5ad 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index f01c3f38ab..1e4ad76c49 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index da1c3dd75c..9cab8e632b 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 3ccd85eae8..8ad19dea08 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index f08230f3e4..6c82da2d3c 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 09a634c815..b0665c3e08 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index a9e9e523cf..ecd6aa9334 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index 5f5c6f1dd7..e572cc03c0 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 8a2310859e..21bd4faecb 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 166e5b1ad0..9b10f64ecc 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index a7ff8cb52b..93c3dd2be8 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 01236c47f8..f64991d252 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index ca3708022a..6433ca235b 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index 8f52bf663d..2d36c928d2 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index bca76e453e..c4160634b6 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 667c0d4b27..9547ad2f6b 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index b4f87bda90..479e5cee98 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index 51ed4a7b3c..5d058bd02e 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 77c96f1376..077649ca47 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 937cc52bcf..4a36ceeb59 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 33ee886742..06e45e9821 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 4b237165dd..1a9fe784d5 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -21,7 +21,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 6d28d18b77..91d668fb23 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 8c4c25c39b..3e53222c6b 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 8531f0b3a2..b5b9dc7948 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 24c34734d6..13732800a2 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 0bc6afacef..2f6499c27f 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 9a3084f899..9f5442976c 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index a0856f5491..1dc823f1d3 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index 69558a9a0f..a2e6e3c585 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 724095d46a..6d8f482138 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index ff0531a18b..c29cc0d9bc 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 8e61c6c080..67d0580c7e 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index c7db3ec60f..aab8f21b03 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index b00bf77307..a4d85a7711 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 3ec80b3747..6d495797e5 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index a286e2e50f..bc0e356282 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index cd2d38cd92..427c90cfcf 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index ba3b0263b2..aa5770e84c 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index e38d5dd232..8111844a05 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 55536c2b73..9cd388701b 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index c9f1572b72..c46271bfd9 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index aa38ac6335..117be67220 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index 0f76d78cfc..d83c8647c1 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 5c2b0cbfca..465d7feba8 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 195d5cafe2..d45c272b7f 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk and **NOT** supported! +We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} From 8f0518b5afc026e37bfbd5fd1522ebee16dc4bb8 Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 3 Jan 2022 14:39:48 -0500 Subject: [PATCH 12/27] spelling fix --- bin/jinja2_templates/doc_detections.j2 | 2 +- docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md | 2 +- .../2017-09-13-detect_unauthorized_assets_by_mac_address.md | 2 +- docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md | 2 +- docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md | 2 +- docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md | 2 +- ...23-detect_attackers_scanning_for_vulnerable_jboss_servers.md | 2 +- ...-09-23-detect_malicious_requests_to_exploit_jboss_servers.md | 2 +- docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md | 2 +- docs/_posts/2017-10-13-unusually_long_content-type_length.md | 2 +- docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md | 2 +- ...07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md | 2 +- docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md | 2 +- docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md | 2 +- docs/_posts/2018-10-23-wmi_permanent_event_subscription.md | 2 +- docs/_posts/2018-10-23-wmi_temporary_event_subscription.md | 2 +- docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md | 2 +- docs/_posts/2018-12-06-suspicious_java_classes.md | 2 +- docs/_posts/2019-01-25-processes_tapping_keyboard_events.md | 2 +- .../2019-04-01-web_servers_executing_suspicious_processes.md | 2 +- docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md | 2 +- docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md | 2 +- docs/_posts/2020-02-07-macos_-_re-opened_applications.md | 2 +- docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md | 2 +- docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md | 2 +- docs/_posts/2020-03-16-detect_rare_executables.md | 2 +- docs/_posts/2020-03-16-spike_in_file_writes.md | 2 +- .../2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md | 2 +- .../2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md | 2 +- docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md | 2 +- ...2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md | 2 +- docs/_posts/2020-07-07-remote_desktop_network_traffic.md | 2 +- .../2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md | 2 +- docs/_posts/2020-07-21-detect_outbound_smb_traffic.md | 2 +- docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md | 2 +- docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...7-21-email_files_written_outside_of_the_outlook_directory.md | 2 +- ...-07-21-email_servers_sending_high_volume_traffic_to_hosts.md | 2 +- docs/_posts/2020-07-21-excessive_dns_failures.md | 2 +- .../2020-07-21-first_time_seen_running_windows_service.md | 2 +- ...eceiving_high_volume_of_network_traffic_from_email_server.md | 2 +- ...iple_okta_users_with_invalid_credentials_from_the_same_ip.md | 2 +- docs/_posts/2020-07-21-okta_account_lockout_events.md | 2 +- docs/_posts/2020-07-21-okta_failed_sso_attempts.md | 2 +- docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md | 2 +- docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md | 2 +- docs/_posts/2020-07-21-protocol_or_port_mismatch.md | 2 +- docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md | 2 +- .../2020-07-21-remote_desktop_process_running_on_system.md | 2 +- docs/_posts/2020-07-21-sql_injection_with_long_urls.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md | 2 +- .../_posts/2020-07-22-suspicious_email_attachment_extensions.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md | 2 +- docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md | 2 +- docs/_posts/2020-07-27-aws_detect_role_creation.md | 2 +- docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md | 2 +- .../_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md | 2 +- .../2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md | 2 +- docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md | 2 +- docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md | 2 +- docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md | 2 +- .../2020-08-10-detect_gcp_storage_access_from_a_new_ip.md | 2 +- docs/_posts/2020-08-11-detect_arp_poisoning.md | 2 +- docs/_posts/2020-08-11-detect_rogue_dhcp_server.md | 2 +- ...08-21-abnormally_high_number_of_cloud_instances_destroyed.md | 2 +- ...-08-21-abnormally_high_number_of_cloud_instances_launched.md | 2 +- ...phishing_email_detection_by_machine_learning_method_-_ssa.md | 2 +- docs/_posts/2020-09-15-detect_zerologon_via_zeek.md | 2 +- ...2020-09-18-detect_computer_changed_with_anonymous_account.md | 2 +- docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md | 2 +- docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md | 2 +- .../2020-10-28-detect_ipv6_network_infrastructure_threats.md | 2 +- docs/_posts/2020-10-28-detect_port_security_violation.md | 2 +- .../2020-10-28-detect_software_download_to_network_device.md | 2 +- docs/_posts/2020-10-28-detect_traffic_mirroring.md | 2 +- .../2020-12-14-sunburst_correlation_dll_and_network_event.md | 2 +- ...-12-16-high_number_of_login_failures_from_a_single_source.md | 2 +- docs/_posts/2021-01-06-supernova_webshell.md | 2 +- ...21-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md | 2 +- docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md | 2 +- ...2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md | 2 +- .../2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md | 2 +- docs/_posts/2021-02-22-suspicious_curl_network_connection.md | 2 +- docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage_via_osquery.md | 2 +- .../2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md | 2 +- docs/_posts/2021-05-21-winrm_spawning_a_process.md | 2 +- .../2021-08-19-protocols_passing_authentication_in_cleartext.md | 2 +- docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md | 2 +- docs/_posts/2021-08-27-exchange_powershell_module_usage.md | 2 +- docs/_posts/2021-09-28-print_processor_registry_autostart.md | 2 +- docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md | 2 +- docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md | 2 +- .../_posts/2021-11-29-randomly_generated_scheduled_task_name.md | 2 +- .../2021-11-29-randomly_generated_windows_service_name.md | 2 +- ...2-01-unusual_number_of_computer_service_tickets_requested.md | 2 +- ...1-unusual_number_of_remote_endpoint_authentication_events.md | 2 +- docs/_posts/2021-12-13-linux_java_spawning_shell.md | 2 +- docs/_posts/2021-12-13-windows_java_spawning_shells.md | 2 +- 101 files changed, 101 insertions(+), 101 deletions(-) diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2 index 1674d9d254..c271e9b7a1 100644 --- a/bin/jinja2_templates/doc_detections.j2 +++ b/bin/jinja2_templates/doc_detections.j2 @@ -31,7 +31,7 @@ tags: {% if detection.experimental is sameas true -%} ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. {% endif %} [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 63635e1cac..e764528022 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 1ce370f054..4b1d45805d 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index 5337f62a6a..98bb689ec4 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index 7c4dc9c10c..a3fa6ef07a 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 65763038e2..73b559cdc7 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 5c88083518..8899aeda49 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 7cb062a67e..abed4f537e 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 9d86d10c78..21106203ab 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 1d5a1ceddd..fa905cff49 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index b1ab0a9661..09dc3ce7c3 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index a4a747e994..5d22e8600c 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 235fec05e1..abed6c2a30 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index fc46eeedd9..88fc78ffb0 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index d71ae84c90..2a41671e6e 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 2835a4e40e..4a13cb8743 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index c0bfc0d70a..b04d22b896 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index ba3a15d0d1..c27131ec6a 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index d8086a4b48..5c1c79a22a 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 503ea38ec0..d36385034a 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 074dd9597c..d87eabc15e 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 8e002cabd3..ec3d1540dd 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 5a972cdf0b..aa4c2545d7 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index 1b89ba0d20..6010dd78b3 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 0e9289dfb6..293057b6dc 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index e63b22f9d2..9f200d7288 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 7a2b124379..4f92e207a9 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 22987a3ab7..a95ffd32d0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index a4aaf7629d..4a01d6ad31 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index aa1133c56a..4cff77757a 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index daac2680d6..058d1e5dd2 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index cf87f364c0..aa48878684 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index 780e30ab19..e410b32710 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 79490e9115..29b6e7695d 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index e3bf0189b9..4243de923a 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index ebefaebf7e..6b57e1ce33 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 31a2c28fe1..624c2d8604 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index fa7612e255..806cae541f 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index 446b6fc857..e8872dea56 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 2bd70571d5..6697097663 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 2b02f90b3c..39b435b5c4 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index ed581283cc..e777a22344 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 4f96ebd047..c5149bfbd1 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index b42cee4c7d..7b6ba38e2d 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index ce7829be86..2b11dab2f3 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 9b54527c5e..7e3331fa29 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 6532f871e8..254dd5dbe6 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index b00c47cbb2..a4a8b0c526 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 62d18e5229..48c07da8a6 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 5304bff8ff..319f266239 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index cf9ea9b2ab..76f7a54e6b 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 5b48a0b52c..16c6922284 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 16e5f54313..24ded7a654 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 824ebb7d8b..838528a2a2 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 4b7bf6cb45..01fafd1994 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index 936ea6b5ad..20e9574cf7 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index 1e4ad76c49..757bd609ee 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 9cab8e632b..a2fb8275c0 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 8ad19dea08..9691fa9609 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 6c82da2d3c..0efdd8f5bb 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index b0665c3e08..857e9c0cae 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index ecd6aa9334..0659c04bd2 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index e572cc03c0..c6c44c174b 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 21bd4faecb..aabb178903 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 9b10f64ecc..febc2c7941 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 93c3dd2be8..ced5f95abd 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index f64991d252..0e8a26cbc6 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 6433ca235b..27938a0379 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index 2d36c928d2..bf41d76542 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index c4160634b6..821224f83e 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 9547ad2f6b..cc58a00d98 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 479e5cee98..ccf3405111 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index 5d058bd02e..558b8295ef 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 077649ca47..6ccc7e0c57 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 4a36ceeb59..08099e1d3c 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 06e45e9821..28c41121b8 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 1a9fe784d5..6830c99a27 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -21,7 +21,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 91d668fb23..d80392e8c0 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 3e53222c6b..04c0c6f028 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index b5b9dc7948..6ea9194963 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 13732800a2..99cff9d716 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 2f6499c27f..e652e13a6f 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 9f5442976c..05cdbd8a88 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index 1dc823f1d3..88b4e9883e 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index a2e6e3c585..f204dc8f9a 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 6d8f482138..4a129773da 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index c29cc0d9bc..bf387af096 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 67d0580c7e..56ec8ce0e8 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index aab8f21b03..93e02ebeed 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index a4d85a7711..34197f534e 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 6d495797e5..b14393b1f9 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index bc0e356282..4408e2f45b 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 427c90cfcf..c42bfcd7cd 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index aa5770e84c..ece38cfeb0 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index 8111844a05..9610e848a8 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 9cd388701b..d37e705f32 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index c46271bfd9..379c80715c 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index 117be67220..9c198f7cd6 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index d83c8647c1..e75547efe1 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 465d7feba8..4f14ea95b4 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index d45c272b7f..b443e3945b 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been table to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} From 9c96e69754095b6b7f05f8d7707ab0bdeb307f82 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 4 Jan 2022 10:25:11 +0100 Subject: [PATCH 13/27] remcos_desc_update --- detections/endpoint/loading_of_dynwrapx_module.yml | 8 ++++---- .../possible_browser_pass_view_parameter.yml | 14 ++++++-------- ..._process_dns_query_known_abuse_web_services.yml | 12 +++++------- ...tem_info_gathering_using_dxdiag_application.yml | 12 ++++++------ 4 files changed, 21 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 5bcc54809b..d0f3333293 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -9,10 +9,10 @@ datamodel: description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host highly - suspect. Why is it needed? In most malicious instances, During triage, review parallel - processes and pivot on the process_guid. Review the registry for any suspicious - modifications meant to load dynwrapx.dll. Identify any suspicious module loads of - dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. + suspicious. In most instances when it is maliciously used the best way to triage + is to review parallel processes and pivot on the process_guid. Review the registry + for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious + module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 64116e3eaf..10f3a9bbb5 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -7,14 +7,12 @@ type: Hunting datamodel: - Endpoint description: This analytic will detect a suspicious process contains a commandline - parameter related to web browser credential dumper. This technique was used by Remcos - RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application - to dump web browser credentials. Remcos use the "/stext" commandline to dump the - credential in text format. This Hunting query is good indicator to look further - for possible remcos infection within the network or possible compromised host. Since - the detections is only base on the parameter command and the possible path where - it will drop the text credential information, It may catch normal tools that having - same command and behavior. + parameter related to web browser credential dumper. This technique is used by Remcos RAT + malware where it uses the Nirsoft webbrowserpassview.exe application to dump web browser + credentials. Remcos use the "/stext" command line to dump the credential in text format. + This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. + Since the hunting query is based on the parameter command and the possible path where it will + save the text credential information, It may catch normal tools that are using the same command and behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index c068e541e1..d1240d9190 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -6,13 +6,11 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious process having a dns query on - known abuse text paste web services, or VoIP, instant messaging and digital distribution - platform to download some files. This technique is abused by adversaries, malware - attacker and red team to download a malicious file on the target host. This is a - good TTP indicator for possible initial access technique. Noise and false positive - can be seen if the following instant messaging is allowed or common application - in corporate network. +description: This analytic is to Detects a suspicious process making a DNS query via known abuse text paste web services, or VoIP, instant messaging, + and digital distribution platform to use to download external files. + This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. + This is a good TTP indicator for possible initial access techniques. + A user will experience false positives if the following instant messaging is allowed or common applications like telegram, discord are allowed in the corporate network. search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index 8c2ceb7026..0ded3e8623 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to detect a suspicious dxdiag.exe process commandline - can collect system info of the target host. This technique was seen in remcos, adversaries - and other malware to collect information as part of recon or collection phase of - attack. Even this behavior is rarely seen in a corporate network this commandline - can be used by network administrator to audit host machine specification. Better - to check what it did after it pipes out the result to a file for further processing. +description: This analytic is to a suspicious dxdiag.exe process command-line execution. + Dxdiag is used to collect the system info of the target host. This technique was seen used by Remcos RATS, + various actors, and other malware to collect information as part of the recon or collection phase of an attack. + This behavior should be rarely seen in a corporate network, but this command line can be used by a network + administrator to audit host machine specifications. Thus in some rare cases, this detection will contain + false positives in its results. To triage further, analyze what commands were passed after it pipes out the result to a file for further processing. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process From 3c6c0dc575640debff319bbd0e5cb3f3c08b2d0c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:21:15 -0800 Subject: [PATCH 14/27] Minor Text Update Minor update to text of "Loading Of Dynwrapx Module" --- detections/endpoint/loading_of_dynwrapx_module.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index d0f3333293..ca33e90a76 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -8,18 +8,19 @@ datamodel: - Endpoint description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed - and registered. With that, registering or loading dynwrapx.dll to a host highly - suspicious. In most instances when it is maliciously used the best way to triage + and registered. With that, registering or loading dynwrapx.dll to a is host highly + suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious - module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. + module loads of dynwrapx.dll. This detection will return and identify the processes + that invoke vbs/wscript/cscript. search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`' how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from + on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. From cff1c5dd7493fa0787751d2921d68dfd57cb9c8a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:23:36 -0800 Subject: [PATCH 15/27] Update Text of Detection Minor update to text of "Possible Browser Pass View Parameter" --- .../endpoint/possible_browser_pass_view_parameter.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 10f3a9bbb5..86c5a204c8 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -6,13 +6,13 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic will detect a suspicious process contains a commandline - parameter related to web browser credential dumper. This technique is used by Remcos RAT - malware where it uses the Nirsoft webbrowserpassview.exe application to dump web browser - credentials. Remcos use the "/stext" command line to dump the credential in text format. +description: This analytic will detect if a suspicious process contains a commandline + parameter related to a web browser credential dumper. This technique is used by Remcos RAT + malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser + credentials. Remcos uses the "/stext" command line to dump the credentials in text format. This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. Since the hunting query is based on the parameter command and the possible path where it will - save the text credential information, It may catch normal tools that are using the same command and behavior. + save the text credential information, it may catch normal tools that are using the same command and behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", From 54e6931e48d2acdd7b4f413782e4dea3bc62422b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:31:04 -0800 Subject: [PATCH 16/27] Minor Text Updates Minor updates to the text of "Suspicious Process DNS Query Known Abuse Web Services" --- ...ess_dns_query_known_abuse_web_services.yml | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index d1240d9190..f484359cfe 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -6,22 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to Detects a suspicious process making a DNS query via known abuse text paste web services, or VoIP, instant messaging, - and digital distribution platform to use to download external files. - This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. - This is a good TTP indicator for possible initial access techniques. - A user will experience false positives if the following instant messaging is allowed or common applications like telegram, discord are allowed in the corporate network. +description: This analytic detects a suspicious process making a DNS query via known, abused + text-paste web services, VoIP, instant messaging, and digital distribution platforms used + to download external files. This technique is abused by adversaries, malware actors, and + red teams to download a malicious file on the target host. This is a good TTP indicator + for possible initial access techniques. A user will experience false positives if the + following instant messaging is allowed or common applications like telegram or discord + are allowed in the corporate network. search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' -how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver - loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll - is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. - We suggest to run this detection at least once a day over the last 14 days. +how_to_implement: This detection relies on sysmon logs with the Event ID 7, Driver + loaded. Please tune your sysmon config such that your DriverLoad event for + SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need + sysmon logs for Event ID 22, DNS Query. We suggest you run this detection at least + once a day over the last 14 days. known_false_positives: Noise and false positive can be seen if the following instant - messaging is allowed to use within corporate network. filter is needed. + messaging is allowed to use within corporate network. In this case, afilter is needed. references: - https://urlhaus.abuse.ch/url/1798923/ tags: From 5702bf9c7dd138262a1fb941c2ff17c923727eef Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:36:46 -0800 Subject: [PATCH 17/27] Minor Text Updates Minor Text Updates to "System Info Gathering Using Dxdiag Application" --- ...nfo_gathering_using_dxdiag_application.yml | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index 0ded3e8623..a3e1ced592 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -6,12 +6,16 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to a suspicious dxdiag.exe process command-line execution. - Dxdiag is used to collect the system info of the target host. This technique was seen used by Remcos RATS, - various actors, and other malware to collect information as part of the recon or collection phase of an attack. - This behavior should be rarely seen in a corporate network, but this command line can be used by a network - administrator to audit host machine specifications. Thus in some rare cases, this detection will contain - false positives in its results. To triage further, analyze what commands were passed after it pipes out the result to a file for further processing. +description: This analytic is to detect a suspicious dxdiag.exe process + command-line execution. Dxdiag is used to collect the system info of + the target host. This technique has been used by Remcos RATS, various + actors, and other malware to collect information as part of the recon + or collection phase of an attack. This behavior should rarely be seen + in a corporate network, but this command line can be used by a network + administrator to audit host machine specifications. Thus in some rare + cases, this detection will contain false positives in its results. To + triage further, analyze what commands were passed after it pipes out + the result to a file for further processing. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process @@ -23,8 +27,8 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: this commandline can be used by network administrator to audit - host machine specification.filter is needed. +known_false_positives: This commandline can be used by a network administrator to audit + host machine specifications. Thus, a filter is needed. references: - https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ tags: From 249c784dafbc10868f6e7ec7ab65896bc8a39b59 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:38:05 -0800 Subject: [PATCH 18/27] Small Text Updates Small Text Updates to "Loading Of Dynwrapx Module" --- detections/endpoint/loading_of_dynwrapx_module.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index ca33e90a76..b45944aed5 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed - and registered. With that, registering or loading dynwrapx.dll to a is host highly + and registered. With that, registering or loading dynwrapx.dll to a host highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious From 7420f730d48834a5976af50a637f8194096c560d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 4 Jan 2022 17:39:17 +0100 Subject: [PATCH 19/27] Update suspicious_process_dns_query_known_abuse_web_services.yml --- ...spicious_process_dns_query_known_abuse_web_services.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index f484359cfe..f6dc150a03 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -18,11 +18,8 @@ search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegr "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' -how_to_implement: This detection relies on sysmon logs with the Event ID 7, Driver - loaded. Please tune your sysmon config such that your DriverLoad event for - SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need - sysmon logs for Event ID 22, DNS Query. We suggest you run this detection at least - once a day over the last 14 days. +how_to_implement: This detection relies on sysmon logs with the Event ID Event ID 22, + DNS Query. We suggest you run this detection at least once a day over the last 14 days. known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, afilter is needed. references: From 889138437666e115782de93af8477cd34d5e5b00 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:42:39 -0800 Subject: [PATCH 20/27] Small Text Update Small Text Update to "Loading Of Dynwrapx Module" --- detections/endpoint/loading_of_dynwrapx_module.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index b45944aed5..24b5b9fdf8 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed - and registered. With that, registering or loading dynwrapx.dll to a host highly + and registered. With that, registering or loading dynwrapx.dll to a host is highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious From e10f55348ca736e185971b3d2536f2c9224c4399 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:47:13 -0800 Subject: [PATCH 21/27] Updated Detection Text Updated Text of Detection "Suspicious Process DNS Query Known Abuse Web Services" --- .../suspicious_process_dns_query_known_abuse_web_services.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index f6dc150a03..8d6eac69a1 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -18,10 +18,10 @@ search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegr "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' -how_to_implement: This detection relies on sysmon logs with the Event ID Event ID 22, +how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. known_false_positives: Noise and false positive can be seen if the following instant - messaging is allowed to use within corporate network. In this case, afilter is needed. + messaging is allowed to use within corporate network. In this case, a filter is needed. references: - https://urlhaus.abuse.ch/url/1798923/ tags: From e396a3b9d4ab64684f6b99a87b8da550c1ec9b1b Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 5 Jan 2022 12:17:54 -0600 Subject: [PATCH 22/27] Added block_indicators playbook --- playbooks/block_indicators.json | 3808 +++++++++++++++++++++++++++++++ playbooks/block_indicators.png | Bin 0 -> 179717 bytes playbooks/block_indicators.py | 297 +++ playbooks/block_indicators.yml | 23 + 4 files changed, 4128 insertions(+) create mode 100644 playbooks/block_indicators.json create mode 100644 playbooks/block_indicators.png create mode 100644 playbooks/block_indicators.py create mode 100644 playbooks/block_indicators.yml diff --git a/playbooks/block_indicators.json b/playbooks/block_indicators.json new file mode 100644 index 0000000000..db7387542f --- /dev/null +++ b/playbooks/block_indicators.json @@ -0,0 +1,3808 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "misc": { "apps_list": ["Palo Alto Networks Firewall", "Carbon Black Response", "OpenDNS Umbrella", "Phantom"] }, + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.", + "hash": "753b457bfed5fa341dd36803c11b681681df46f6", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "70140aee-e625-43c7-bf11-da4d1bc729c1", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 27 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8f7b00cd-6206-4e1f-a1fd-c17ca7df99d1", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 43 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d333fcd2-eb73-4914-8e92-ad8551a6b068", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 66 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n # call 'filter_2' block\n filter_2(container=container)\n\n # call 'filter_3' block\n filter_3(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 22, + "line_start": 8, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 180, + "y": 40 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 95 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f157b9dd-877a-4fbe-94c7-7709af7c1ceb", + "router": { + "name": "metro" + }, + "source": { + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 160 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "98116e8f-35f5-4a4d-b09d-f2f254b3f36a", + "router": { + "name": "metro" + }, + "source": { + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 177 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ea7e5f03-8b63-43f5-a2cb-1adf63b89c88", + "router": { + "name": "metro" + }, + "source": { + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 190 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "429dcfde-c34b-40f8-9b0b-9614e6f0cb75", + "router": { + "name": "metro" + }, + "source": { + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 250 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "add to IP blocklist, add to domain blocklist, add to hash blocklist", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 297, + "line_start": 284, + "name": "", + "notes": "", + "number": 0, + "order": 14, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 40 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 264 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f19bbeed-6445-4a8c-bc7c-a2171961cf69", + "router": { + "name": "metro" + }, + "source": { + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 277 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8b252e02-8361-4d12-8663-61c2e8965ed9", + "router": { + "name": "metro" + }, + "source": { + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 286 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fddf6767-1020-4c4e-9178-5bdcc37ef938", + "router": { + "name": "metro" + }, + "source": { + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 288 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ea23ca12-a7c3-40e3-b38c-67a92493b1b8", + "router": { + "name": "metro" + }, + "source": { + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 293 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "778389f4-851e-4b64-b5c1-e567e1277660", + "router": { + "name": "metro" + }, + "source": { + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 295 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "a111892b-a198-4573-9271-5f68da45f08d", + "router": { + "name": "metro" + }, + "source": { + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 297 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c17d4063-43db-4dc2-9ec2-b9c554f1a1f8", + "router": { + "name": "metro" + }, + "source": { + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 301 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0b7d5584-b8cd-47e6-8f0b-455358f4b318", + "router": { + "name": "metro" + }, + "source": { + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 303 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationAddress\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 264, + "line_start": 247, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationAddress CEF value populated.", + "number": 1, + "order": 12, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.destinationAddress", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 20 + }, + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 404 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 123, + "line_start": 106, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.", + "number": 3, + "order": 6, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 300 + }, + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 412 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationDnsDomain\", \"!=\", \"\"],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 106, + "line_start": 89, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.destinationDnsDomain", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 160 + }, + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 416 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:domain_blocklist", + "new_row": "block_domain_1:action_result.parameter.domain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:domain_blocklist", + "new_row": "block_domain_1:action_result.parameter.domain" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to domain blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_domain_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_domain_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_domain_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:domain_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_domain_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block domain", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to domain blocklist", + "delay": 0, + "description": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 219, + "line_start": 194, + "message": "Configuring now", + "name": "add listitem", + "notes": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.", + "number": 2, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 160 + }, + "previous_function": "", + "previous_name": "add_to_domain_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 421 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n\n # collect data for 'block_hash_2' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name=\"block_hash_2\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 67, + "line_start": 45, + "message": "Configuring now", + "name": "block hash", + "notes": "Blocks the hash utilizing the CarbonBlack Response endpoint technology app, preventing the process from running on endpoints utilizing CarbonBlack Response.", + "number": 2, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 300 + }, + "previous_function": "", + "previous_name": "block_hash_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 423 + }, + { + "action": "block domain", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "disable_safeguards": "", + "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "disable_safeguards": "", + "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "opendns_umbrella", + "output": [ + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.disable_safeguards", + "data_type": "boolean" + }, + { + "column_name": "Domain", + "column_order": 0, + "contains": [ + "domain" + ], + "data_path": "action_result.parameter.domain", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 2, + "data_path": "action_result.data.*.id", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block domain" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_domain_1() called')\n\n # collect data for 'block_domain_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_domain_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'domain': filtered_artifacts_item_1[0],\n 'disable_safeguards': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block domain\", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name=\"block_domain_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 89, + "line_start": 67, + "message": "Configuring now", + "name": "block domain", + "notes": "Blocks a domain utilizing the OpenDNS Umbrella app, preventing endpoints from accessing the domain from within the network.", + "number": 1, + "order": 4, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 160 + }, + "previous_function": "", + "previous_name": "block_domain_1", + "required_params": { + "domain": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 424 + }, + { + "action": "block ip", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress", + "is_source_address": "", + "vsys": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress", + "is_source_address": "", + "vsys": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "pan", + "output": [ + { + "column_name": "IP", + "column_order": 0, + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.vsys", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.is_source_address", + "data_type": "boolean" + }, + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 2, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "firewall" + } + ], + "attrs": { + ".action": { + "text": "block ip" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_ip_1() called')\n\n # collect data for 'block_ip_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_ip_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'ip': filtered_artifacts_item_1[0],\n 'vsys': \"\",\n 'is_source_address': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name=\"block_ip_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 45, + "line_start": 22, + "message": "Configuring now", + "name": "block ip", + "notes": "Blocks the IP as a destination address, utilizing the Palo Alto Networks Firewall app to prevent further access to the IP address as a destination.", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 20 + }, + "previous_function": "", + "previous_name": "block_ip_1", + "required_params": { + "ip": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 425 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:filehash_blocklist", + "new_row": "block_hash_2:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:filehash_blocklist", + "new_row": "block_hash_2:action_result.parameter.hash" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to hash blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_hash_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_hash_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_hash_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:filehash_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_hash_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block hash", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to hash blocklist", + "delay": 0, + "description": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 191, + "line_start": 166, + "message": "Configuring now", + "name": "add listitem", + "notes": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.", + "number": 3, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 300 + }, + "previous_function": "", + "previous_name": "add_to_hash_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 426 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:ip_address_blocklist", + "new_row": "block_ip_1:action_result.parameter.ip" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:ip_address_blocklist", + "new_row": "block_ip_1:action_result.parameter.ip" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to IP blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_IP_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_IP_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_IP_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:ip_address_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_IP_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block ip", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to IP blocklist", + "delay": 0, + "description": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 247, + "line_start": 222, + "message": "Configuring now", + "name": "add listitem", + "notes": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 20 + }, + "previous_function": "", + "previous_name": "add_to_IP_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 430 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 6 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_6() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.fileHash\", \"in\", \"custom_list:filehash_blocklist\"],\n ],\n name=\"filter_6:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 163, + "line_start": 146, + "name": "filter", + "notes": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"", + "number": 6, + "order": 8, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "in", + "data_type": "", + "param": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", + "value": "custom_list:filehash_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 300 + }, + "previous_function": "", + "previous_name": "filter_6", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 432 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 5 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain\", \"in\", \"custom_list:domain_blocklist\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 143, + "line_start": 126, + "name": "filter", + "notes": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"", + "number": 5, + "order": 7, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "in", + "data_type": "", + "param": "filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", + "value": "custom_list:domain_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 160 + }, + "previous_function": "", + "previous_name": "filter_5", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 433 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress\", \"not in\", \"custom_list:ip_address_blocklist\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 284, + "line_start": 267, + "name": "filter", + "notes": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"", + "number": 4, + "order": 13, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "not in", + "data_type": "", + "param": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", + "value": "custom_list:ip_address_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 20 + }, + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 434 + } + ] + }, + "notes": "This playbook uses the following Apps: \n\n- Palo Alto Networks Firewall (PAN)\n- CarbonBlack Response\n- OpenDNS Umbrella\n\nThis playbook uses the following custom list:\n\n- ip_address_blocklist\n- domain_blocklist\n- filehash_blocklist\n\nThis playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The process is:\n\nEach Artifact within an event is checked for the presence of the following CEF fields:\nDestinationDnsDomain - Domains\nDestinationAddress - IP addresses\nFileHash - Files\nThe CEF value is then cross-referenced with their respective Custom Lists.\nIP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network.\nAfter the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record." + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T21:26:58.710395+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [] +} diff --git a/playbooks/block_indicators.png b/playbooks/block_indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..60fb2e863817ccabe9406d898254f903ce5e58bb GIT binary patch literal 179717 zcmb@t1yqz<+c!>kqkwb>D2;$1FfamwN*=<}TOt?zx;f2}`j4YTLIcV5@E_x@e=LPJf7l!%@P0|SHf(L;qN7#IZX7#P_5 z1bD!c-E>tM3=9%;TX}hnNAmKl8g9;3whopU7!O~(*19b#eVdlNt6X>XN8i`X$dsgCjj@Ivtr}uwOss*LKZ4GjDsP}xapXG zy?a!bq#}V4kKlk$Y~cI+id{xY>lD62B6U55I41bR0pidQ!(%EZON;Mom~=xNt5*sU z=M#*hm#kzokqEiSBsS*1bR{0dtli(n*|DV9d!CwkiEF((cUBc~hPaq!EAF-je_fyo zD}E-sgy!otG2^bsMN6tMCO>e+{_N23C z{aOsjPC&!O^b&*G%$rSC8qdrI*gq=corw_fa~Wi_4;s1sEoyW{>O`I~ph$ZXYI@ ziQY|BeUZu_Zo{F&Rk&0elFFZ`7-oA`(Z}d(@pjBu`y*W+EibjQkE_0+)=jn8u~Gaf z{(15aXDru{hdqyOEK}b8(nYq)el1MN#;xnegW+qAEfXNUzjWVvImH#T-nWlSdVu?v zT{CHiRn+3m9m4<*O2Z8LAZcywSMkL!s0VwN;vNlkgwTfQe#TvRhWo1AGUPTZ`NJQL z42=td{SR->W8eFV%Rc|%JITO92D*ecYpPqAQ1DHxs9axD?04)MB*!cfpVIRgzTTkY zXHHEZXO=f4Fau*=lrW}pG94xpG2f3_W|_qm8pE0xHAj!S=5T2j{Y7?Id4$LRg0jQK zOjI~={pFj5Rv%Vo;_TdV-$jRMsL+qWlhCeEvNr5CvFA}P_Lc9SqO|zTgNY86>_i4o zcg&|T-OlGteJCs<`Xs2uv7PF~kJ?-1bF5iDuGlSUuMM1w`;uAiKj^Ray5>#v_=X~3 zobNs=$b>su1Z-QIzUWoaBES%0wD7$oreXOE55r!C;MVE(6*ly!^(MUZP!=mwG zv~LqIQTpy~_4F-R%846q6V-xeHOcR3Ehn8WjPQA)#7HX+V1QOx>Gi}PHA0`to=pLmkt z)|=F3goX}L;+aM1vYkZoF1{#FFu95K;sI5H$4%ny2k#@P(!%(_Jn^r;`dRQkiN1Ko zsHnzjoj|rsXK8XTmGMo;YxCE-q}p*}?a*_g4{Z$<-V&77 z^L*2!r3*IFxU}<{2lvjX0zfUq&Y!3DdCvly@X-o6)P01dp%_?kLRs<3sfxEao>F;H zkWs3&&Wt|tQN2l(rl9neWjbb~LwZqVk!n$KQO1n8BIGQ7LYX~5nI!m~lTjQMvo|^31aNa_=(tvP_grXBHLsMLxl8kz2jD zrf&DYihiZ`nC1Jk&4;9KxisM);RRZwew(*9nKqS~n3x!tpqZ|cRGGe#T9Qc5f%WNe zUnPHyE!>1F(?kDosui{Bqg7BG_%N{ zWGcsB@3fxz!Ju*6JMl+l3T03Ba%LYiI|W9ygvjV*m&q!@^wH%g(o19P@ZgC1P4{zK zsX}J(tVy%z6G@mzI7q_6iAig3WQhiR{Y+OwA|U@+_w&SnMCZCFJN-TSgO`Udd0w8- zS2G;bG0^)ngGz!RLz8`)v3{`g7AjfNY-`opq|s#G>hOy8yYr`JL&T zqY4&JoGJ&G)4TmOlWjw7TQ-PB6h|7Z>e8YoC8}(#-t?)Zd6J9MGfNl>H3ggnFTm2@ ztqQEZSQY87O@j#SRhNH?tc=$yu9C3*=Ggs-q`I%l(9yTAvNy`~x&vp0zN6>#rgyS% zbUTlUR>cop(AetOx3R}tC1X2dfp=r?-oBf67wNG32j9noJ}zp?c%7(^&W14hba99gi ziy25U)SzXdtx&G+eV{Y?eOzm?;ajyij%g^GU?Vb}QheIRiLutKRB$z-v%Ed=^{{>-?wJ==2bs2-{yU< zV;W!Q!ymgO;Kx(cYLX zm=7@Vu}~x)#C_z`OlKaSmTbPQ@4REdo5VQ?slh9FuGgy9YVcf(ZH(L0SNd1B9LNr!Fz|`=#uImN!iz+I0Zs9~O?j1G1OvdCUK7?14X4IWL zF)cwck?On0s`@@ZdPKjU{k3ErC!6h*Ebz#=ht=}E)%Mr*ObTJs{?GxH?7qsrEovri zwQL`+#L4&1A1QHfsjjNaq(1oixc5iqaWKnZ*}|z6yi(lal%Vc;^>gbsjRiZ?lv@u! zJvq9`eaqT%U}QRHTC3h@k-{~v&YQ!ZH71XZ zCM7Xr(%^9(c0)jfX3*yemEPf{O27vbt1Z4QJ-GEuc7Iy4C)pitf3+>cse0lyuYu_F zT6-DKAk+oq@r<%ga*KX^O^$DFXPYlEOAz(3s!^I#TGRHI+Tb}S<50mwK0C;Ewa?6= z`byiO`}N)HudlNt6C`IK2bLNO_s&yR`5YmujSeGji*6f-TfB1G+xoWUl@=@QTIM=p z#a1N(kW0J%Wie~sW?u2Kyi%=FEv-&%v63o-+JKpepqvJ={j|J0;)7nit2PdOD`7moJq_N#WsWUcCDo;wQk;=RJ z`}y~=-Me$m#bhO#W1c(R)9$v;XR{ytYR^lMsYsrakjtJ+7&`vA{TN#qU!S~^d<<=a zUJ93gDZfJcu>ECtmZIys!rRRSOZ%zqCH=wu5kd5bkpYe|rNTIR79+2hehv#2s3p!W ze*+8t8E!XqX@|^dKjiXRlFrnZ>gw#Md!DOnU$fP-Rx@ORxYqj;sxYm|v(2;ZrT6?> z7M>4=$-~Yr+&<3KHZQ!L>-?aMN=cVe^k!^ibVGE!-shEttQdiy{JZ*H$FH`;oh@cH zX0FW!_!Z5MMMI*YJB^?{vIRAS(PiW7)4sj$7poUjGOx=v*Dv>xw9Gd_b(b3Z`;#1< z@5nQWSw>iNWGeigAV=XF38i04m0{{<&G58sJ&5-t3m(+LXZPr$OI9A;G$hiJ4-dO| zfQBd=r?*TadXQT7&T@Or<6&jU*;g>Jz{V{mZ0CCOUc zXP4#o`a-753*t7rb1{w&>FxCYTK4g^tFzhvBJVRbhaSelcp`$qvT}JD$bdx3wn_1L z5kE^VNN@b0AGz;T{vdE1w^my<1HXl;A9NJW2-^*o#B$#EL<@ep^+Nw`a+NlqbwpX} zKC)6(#oz(T1Qf8)n7dDxoY$4 z8#^%^10VQB1$=yRuzuGjV9&w+UB=!A-eKI=lz;RH_|`Ocv$S+_w{iC1$ocFIJRo#= zsOOG>LBo0V!F=@OCQu!7!uF}IhpwuMq`9-BfT@MEnWcb_qsvu47}7qHK+)0C!<5y> z(ZR`G(g(!;vxX#4zIrUk&ib>8hdqd0S5<>m-r3EPRZKusK!{z2h?SL9+RegB@`-}t z-_3zvAa)xM4;M*6L2qww0dEljXE$p>;d}S)2@2g2ymN;isKM{<>*QhT!|&wI@vD>H z{U}(vo4eV%c-T5Sv0n9SYUb?e0b*yr8tBj8uX$Sf*#2iEC-=XX1uRhT>W!eVfRNyy zzJaFFS5GB1Y<(;pbQNqJ0h$40$lMWp?^LFC@n)IE%=9PGDLXtvY!A( zGTJJrKLx%4F}wQ1JOlpS`t=QzF=gLHgQfT}Fu)j(6z)Iu!Q7s~&$#)Z8DqWytVl+} zN_Fife)oMa<^AW&*e_(dyYnMWz<*KpVG-T>i-O|j+RJ4Us+-72_WRF68#$P#UCZoq zkbZvF-qy9&-oxXtY?X+@&CRk+uP+7Yr!i+|(r{J6yI42`6s+K97?}Uh0vH=dkwC%b z*<1GittLir)H5&+Q}F-L*{@eNsn5Wn;eYW&{;xGDB6G<9m-zvGkWy1b4hcQRrTm{) z0@TE!JorXGKvJFsoeqt?LT^6PbV3Bv2T_ z|KF(`P6+UWF7NsOS`#yv;QXrJABHBmVYJS0ZjHeIED4*|XL$i1KkE_Mf1dpm1`}Nz z9Ci}osy6`PP1diDJ`vtyKV9`0KnSkuhZNmd3%Fc~E< zPK4JM3f0{9f5_4;hh=`s$1 zM5`>{ovOGYzl#G`r)t3E^bqaviUJvE{Nd6F^0bpuL^dt7)4}Og|^b}yK>Wa5J@c0!i zz*Jv(&fnrj@F@^;CYz=&Rq<|2ba6mAIeQG;?!hRct33lp5CF86ryn-|LxlgIH&9p&iEYz-_E)zx z3k&_W9BXx$qyW(j1Vn49#WDYiT))VKO}mfqp0{%QGq0b8-~}3rNDT_~QZ9`6P0Y;u z&Fx^=nU=(6s;pL~eSXMVmfu??&$SG16!TgJ&@Jey+pL`rV}H60p$58jadP|D@vv|W z=yr%EQUhZnzFpYdiqPB&p>ZOr4!U%xagG2tUP7%M+_$5|5zHB zn}9&!)~B~uJ+VZ%)`#4)LhEvNYN~^%XR{oL}`1<+%Ol!7ur%0_5+SJ|MW5@8jC9CmS^IoXw-~QIkrWtHxB3 z6wkq-t0%3wO^t$P5l?g`|L~!N3phH8sw2<;#osJo+YoU9AJ#xdf%=ZOuZyU;Tc|(0 zary!5LGofQqdOdON%Ikiniv%ON$HdmnMj{d;L2^3-}#LNTG;tcPL@p>2uA5OV;k{! z_E8dd#2{beVouMESe3bp^Ig-p8LxtAyTj$vwqf34MlNno=2*u`%Ve_r44(k6B2Y`c zP8}+op=!x$J0oM%y8gYftN-=^cblR)?1@&4;&DQu9MkU!Z(g%GTAPz}=DqPx*0Bm< z07nciAMlBnAzRC|-W9q$8qs>9o1RPlkqe;7kivy&ljl2Fn_$vzel{x`l|9<1xZ67Wb!KWq~cV z&Jut)Tupb{cT3f@v|i?~`s1^MrFM2@0nPsp6An%$QqT=J=xpQRExBfOLqvInk~v^M z*QM97HiD3vi)23G16Rxnf6Mw?(=3b60c~f53&9c0M73Ni$JN*I-i#hxwduSho`kqH5>TzgLO2r*?QOPEi*nzge%HH+-H7?c-x1s)*gVE3?t4&gsdR zeFSTDs+jg&OXIzbyoAyo_%6A_K(1!62X}cWOk*cyX{;V)@wa^0DR{pZlfAEBuoktV zlJaSZvHpZnR_1n99CWYq$eFv!wMkbA+2!wfIJPcm#vt~Uk0Q6ln42P3hP&XmoEL!K z$)Z23`2B0AYO)dex-Djl6!e zSosQnT$or=CxAXi>F|Eeg@Hrq2wVnkh10Bl1H)hc zgdy@{&W$t20^%A+gbQ{C>R%i(&Y1(VlN> z)81+Qps%y?(ARD!+wZ)-S;m^rzPpol=Xlagqocp}0;EtjTjRTyDdkYLGO>MFV4cBW z?6UwfEfEY7;H&R2n?!hUSSR3<{ zCi|j3n-5^LdDGm%ai1BpXpjWr04vo4_tT{y+bE6XkuJ6q4&s(Mo z^BJUD|29XHjrepko>f*#uA&&#^YMBl1-8f+r^=u*OoGlkOC*GAS>BJdK*OS);LxJd zdf@;8!t%&g+(5^an~uI{Y;sN!lK?)4H=nei8|E185b9`&p$SI=;7qz6Dby59P%;5Q z5-ZqrN}g)xFU88-DMqh&R`mw<6TITAl>c>gefo5@FKUk33mN};{@G{-f52lux=Z{y z%{p6C&x=){fMTQ%G;U}bVdO=g0y(ICSwA-KmqBULTjpT=h#H%g`OIWL;DrT+Z1P{z ziz-<5C5`vBgyf2F**o+Y?E0T;1SB8%RNbs&mvvW=hV&LnP*CqtTFc$Slisc#JoU@8 zWg}I1xHl8|EOe38kI`muP+LeiElM^k+JFQnQkiYJR)UoUe|1E3qZ-wtI`Z9bhu??w z!;EXABaiZf_lU#e=(WW}qE3E1$7|4LNHIi4UEj(umR&#@m`qic%dqX_MoUi*)rwbC zFo7#qINb&1Udo(tz(F405Nl1h$B611n4z#B-h&PtfYya7my8`ZSQg<&w4w1dz}n0( zKglOXF%f(LWoTohu>Ik6c@FBXvbYEYgH9n8nLCRO_?K z6_1CIUshEr$k|a?3rtw9F|`Ru?Z#_M`8QuU>x46T&GJjdN>vvF%c{0YT<0ZVOK$9P zk~$*5iCpW&xp{Oqk{Q3X>@i;6lHeZPfKe2(6`fs1pCd@t*LBqV8aX;Ls2$|V(i>;M zxE|Mwdkvc)D&+WeM>mv5S&QYqRY+r|+G`pZ2nD%Gn0eJp~1;Am)$4^J3lq0qjx z%x4w;?iBW?6KZ$j}KZ0(O|E3hbW*a1!D1B^B6_0JRHQ}$1p&VEM! zN1gnII>%^j>{#2FYG)_RKRmCyc0U6*2UY?Iao@=JJi@!>vZP%75Vlye$dgU(>J?gd zMSa&tQ2{gl24ipOEHrv~vOj3wYvzZ?!=Te~A>VlUYE`sY!Rb~)n1t0>cxLgR3-Ys* zNR#td^2-iVkW&uTdRk12f*VU^WMd!4NZXraq^lagwZ}u7SXGAV{AryegFRYlI~Sar_SA?Pu+C@ zOls~HF@E)_8@L10S9a{JQHV8S2FLOsUB}mh;oftB;?q8G{)NikG6J;U;oQ}=?O5}J zy-##W<@KU7Y$?`d?vnh-uPA{-DcmwePqG+=806fe?G3+SmCAN8*G?WGwc8}MA)gZJ zJ?oo4-n0>R&ng?_(9o@D3fz|D+2^C&?e>q#zqQ9nrys?=Y5P8In8MX-yacM5vFjBw z>xkT!h0I7I8f(B_{IJk(0Ft_H?0hn^GPY}HWbhSoZj zOz$DqvIn_Kehk*Gbu3S!+J2=1gBpZ#n!iFLNS@!6j89)92P*JYfaNBg?m)xEhRCl{ykTW$HJVul;$6a*9K z7zI7j4XAif#C!;V6dE!$)cBmXz02j;loPpm?L@#u=LnY> ztrTvk^IG@td#P`mpF{?T=4MVK*v87n?%IuhbU8q*h32K4tCaM<_V0R@RKI$zuyTHO z^Q&nBXG+0igKdr}r&{yx$44fe*OSTfGXu<0UBBEI(bOt)Za&tY@P=iFp0#M&N26QF z5&dO}D`s~~ajuU(hG(OtX-}q+Qfw!k9!LN_g-ML4L#NOVFilQyUh3}ra@Lenv*m$@ z7vo;_u}*E#jp8Q`gSa$C?1sLRoTe=|pRv!Bs$==qJU+~yddyo&5i7BMn&#^#6By&@ z`$capbPsI;OFvZ^@%?pw&ae-y55i^^SMU8%(tkqu&n`rwVidV!g1~<7g7AKsf7Vi? zkBtoM506jQ+R7rAIn&U!Z$5=q8!*0%LZsh_j3?KAn9YXP?=`LBuPq>{$=k5Yd$IBb zGSBSy)p^9?^>`}|+cNPjhIkFectKQy476-9$dx99E;3$#TPW2n+BYb0Xra^KL?Q^P z7g_*Ijt$whWm+V`bL9%DyN=Bkb=ouD+@&fb@mIjC{xQQtR=J8Mzs>lu5?wU4nk4_5 z{#?4qp>YQSTVI49EWR(&we8XOR$1GIBe8+V1iaQJ)E9<@I3?z68+ z{cl~DnF()DyPw;mv8Cx(YQ^7}}Xft8EMi z(0kYCC`)a_JRZ8-vsxHkBn5tgbHnZ?MF`Vy37t@U7R$Q5>wJT*)2#4-;r=0SS!mp# zuu^s{V$0S#bT0sn4;t>siL)>p0IO=Hcu?kt50O=^ofkL$r=hDkZcynm)dQRa(H#YQ2x{05$r^Jg{GWN zk1qb07=9K^ZsDZU0}GQYZCFfX7P;1e4_Yd&YF8&a^DXNY1z?om0FDN+LrSI>3H~nn z9dpVsX62&EQaR3YHp>)8I8i8E*tN zt=%<+3Qws9Ba0pGET=R z-;&NE+5N&vFH^h8qZNWaXlBF9yk4s;C@siWb@XI%<4hTORs@%DL3aDD5x$9=`LwBn zAisp8+tRlJ?kPhqrXVB=bz3!Witv(_4hg1q>XegVeQJOlm4QQ#WL#H6Bt8d@@YjZR zC(QvOTd$aUX}*UJd||uz`698mbjW-%(oD#hZ!H^r>QaYfK|f5!*1grSg1yLxgK!iI zCWz*5cvyEHr3~*3#b*u>B1~)qH6`{bR;<#Ff8-m9S1<2gH3$b#i;~x7DhFCaPm&!( znZ1!~k@mc|wC+xyddV2sl4GZJM24kahkew_D{g+@%9RE zdc94s{+An}p9TP&asg-hupafl7FBTP&IeBIN;iynfrE@y2N0VdQ&a@Dvw)=bjRTTe zpoH=Sl+j(WeU5A=R%A2o%?v-kJ9L*GgRSd+c;o(!P(wA-GLUz#z#4u#z9ulQT3_*eWG*9~9F`7QkcgcotfB9euKfO&N3y$8JA?AnlR`XZ_Qz%e=wCP#G9_J$akV z@RT-^A_TwY$BF$y_#3Cvh8<4Y42EPQtBvjH`!Ffdi`}6Dk$Q#pE*9TgRWAvnMF=}B z8JwC<3JWc9@Temxtc`Rn7Q!kUM)kdHx49U?ILKs0l{L4m)n(2H`EIeFys*^K&nr|l zH)3g88@Nefr=qQBh_?_UKHC?&G~lYla$^jA*f3dtbSWcs&^jPTEI?NZJCEA-*dB4M zc|RdI!auteZjaKwesmDid_uOCA?0~5)y)4((;CF*uZcZw*&Rwcst{{43e|?@vpIBl zUb4Y$P;rw}9V(^0Lg`Xi%KKDymvGBjT5MgQ(In!R03`r+VgWmcxPN*q9C?S1z@fKj zL$DXi;7hN*b~?6&5?<-wW%_okA8b8Xj76DeC#cg~8hZennCWoz^lrMVE zsiY8=gl59kc*jeKi+Ml8Vb%ddp?H2-I+;;GReVk{oJR+!zcAAiax2+e0^=0f`4U6f z&|RPAv2DDAfS@97b!TRT+wf(;j{w&De$BA)0MrGXP+?uY^y2vH!Xj6QgodQ3;ms`N zIJio|KWXxa(7a!RHlc$T>ZsLJ$dRN9K8p+Z?Ia?78jo18NoaIEy3qtRm%ul+pBG2VWn1ILD$ftPx1kU-2}Y|AMF0npDk+Z zrn^II9}bm0ep+#MpM@5`6fkj2c*Z%0Mhg^VIkL_M%=)ep*3Jb4YR3@^G)QctV0(i^ z6zaQ4d`T23j~~_&3%1_@*`42>wT{!i6}*`M4d5-&{wBd+lDR!X{G>1 zD$9tf!sV-*NSs_j?xOrtgU&a2yIgb7__FCg@P`%V&R5alfv`q(Ki#xE_5tmLxlK}q zTLXm$vQvAn`t{=lod@p8GViurCU1`xb(4@s^H&>s89EHsz5gn?<^0NMaL=K!UwdI5 z0)r{YOG6JK>ZEhX`-6IK4n^FW4tt7B5AyP71tD3#TmwV=STU%JDSoG{q@NP=+k8zx zk`GqKVei0?#a0leGd<{}DM4HScE&?qRI-shAR*_(-N5nEWExanIQEjLcGk!ecd=}pt$1P(&pXs^8RtJuZc%u9BmP@(guh2CykY#TyKPxv@{rbWz5~U z=VlRkpLin?vl9}thE0Ds0$=NWc)A3#e&aaSvtVnTaUJMvItq$3XKnNE?!)ecOz&OJ z>_w!OB^Us=8lV)m%+h8B9#%Nqj`rVe7A&q^;L_6)ls+vkZ#&e)FV|7U;yHw!3{r7P zdC&T3)?~DTu_;ex?FaW~nooP8qFX71Z@nF(Nl})Z=SFG?s6MtzjobxvoJ!pMY_})L zoams;tYUGBg>MnNK0joRB*+ znWXNb*6PP%x5QT#YvYHt0p;=lhQeYzCjz!bxQ03i?r8%+pbIwwXKrkx2<9M_$CG>Z z!a^J@IP4U;kd|S>E3nfXOi;0i*nqS69(^l6Pv5c_9MNHIYp{nFPz5A&36QnquZ@iN z3P{TGHIG{JM7Sbid}W(mEM@U-ceI{*M8m@8oVtvL+Z%wGHzZ5oc16!CbQN^lT<=B- zdZ(wneLyn>+AZ*Edc%3XL9lDF1PCjSlSL_5zK9Z4&ERJnNT;Y>+{OmXR@Ex3ZP{@k zp5ofw(V%#i_v*bYefA{AdJYK>+VW*V&{VH_RFJ!%J zIn!eoSfEHriZX!iq>b?g240|= zCExr?E^y_?sk!+4#RS+$Bf!E(|t)aamoK!Omx4$^wmdny1(7gIGaaefSL5dix<;B||M(l!vE&2c0Qx z+3J$jwPuxY#L8`bK(P+9IEj+5mv4A*I*X+^EV^Njnp~`}d#`Ay&*6kc$wMN4o()_W zQt_CR0F3RDIseuJzn=ec&mIG$md}#^UA?w$^>PO71I0@^GDID#E3r`CJv;Q9EI`m2 zH{CHYAo(b{JIEc*fU^=dZJggA}ffka)ph!CNhi(WiancC^@( zhp;o~>ZEl$QTC;wu)mif7sWz4%!r1@X!#PH;LWW{zt4xS$C;R^J|N|Mh6qMR2nL|w zrbp|4A(X{V;d|q@&;76{SF@olE^trH6pu6b3n(G-ayj3Y5@ak6c=URPIX1!qPm!(? z8_O_lGNk>WsQP)ssC6=lt6n7CQ_bncL{9Yic+x@#EQ3nzthd|L?T&ru-_DEwJ31-Y zi^8TG97-?_`3x?>Jd+QC>Pko;Adsnc@>vEe#85Q!Nh?xyV+64U%hGw8Z!^1mK6! ze0U@s@U<-HBcJ7OT_ZQeAhi1XBc|J2Th`;uf!i;7o)B)lFsqLtQHaFeb)9c6Bo>~d)va?ARxl-1ipu}PzZFFAui_PMDyc7!?+|2!W@V!QK zaQVPF!}TibE=xc>MFg7=t8W%YqWKbDOT}l_IkX2O(Kf7lg;@9_FOPB91A?lx+Hd4% zWmpkj9>1&Wcwo56K0^k&h+7cHN0+)yK>R=W9+tWHAHQ(fPJoj1@-;uD6E;&oJ*i=_ zetb4?3XN~#Hcri~`sF-n(8>Y!Y~%ND?*Fng=U%g!1c&OwMrGmK?rpUvD5uVMV;BL9 zqJx5S8lgpEA1PBTBVk0U_|x{JipK!j-P2^e7@R{E_6ib43)a}6o?6PXSPb=nL-nlE zIHz5=VnA4;0Ipx_Hi zX8{T}`{!&^w!rO+okp2kc7Lq}ZwQ7so@pmPy)?Eud|gsQDn8?8?`1fR=q2n56D&b= zZXZp<`E?PVK8ALzV{9{O_l`g9&jg+-lWzs_qju&lp{FF-XB`;}+{jB-UJjHbNC0#& zu@s1}XnAAv_c6>5+z~#T2NCU}BPyERPYe~`>8hmxSH&IrZ+rs%LPPumR4#~4+NYMt zJ!QeLkwNLkI|hSi%a<}vuJy5dQ0qNDBh;lNNKc(rF5^4Lz;1$5epZlGWN+9}&2?-N zSjG74LWcWb+0DH&kUy_TR$Opm<8G6=uJulJTN|+;jq!HTz{w}#I4{!Onj3$2V z@bjgknYAoeyU37TM2ST76*1f9E@2rVj8QoN4zMX@;qJ`vn13%r;f=xiR}8aC&L&_~N{u%#5bGtmbX; z%tKk!b6GsL4$fwMoS)&Ul7X{(??AKBpBU`DiT#1pMea^x&c15KV?_%4pN5(_s z*vGaCZ{{ooThvGE&e189D=gB6NDuSlxpzndUVYS460dAjA(k_8S;-JRrS=}lIuyGIx`DNPu=;TVm{ z_?B$!MrK65Q$r|0;Edy1lcy4#xkPU+OW@{yXe3%r+ATGdno@O~BU-r`^mBWim ze~GB&r38uo({oB^7W@I1y}0otMGiPgr}%4UlW{0Al1LZ#8b-)o2OnHib)^xH>04j& zsg{^L6Ad)fo(F;oz7Btx#4}3+3}Xh)ji8q^W?P~LE7cNo*VSo&bDy6ffrcuZ6OW@$ zgu2u3Tr^-1Ghw)awF{>QZZKX{7JbJpXK1~T?B%LWBhME1A>XUSPK3OneI=cBNe zIpTIt?l3L}r^J498@ zxbFpuS(`=%3ZV?r1jM)04Y4@KzA66nz5GvChdyiD>lC9`B%^}Hr&XPLWQz{?8`=QW z`*80le(uAg^MIHTV_^a|qeM1UL%`O(7LCmyT$eNU1kd&cVw?_4nUeHTYzlnkclR6D zS7fJ;nQ?p5<1vA-27DPYM1W9~To(eIP1&U+A84&158)l-5?`U;#l}x1spU)D;0XI2 zT5HfPfqN7oB#X~3o8V2dAN7h}9vNobW*y)w|G~qnrADg5D%Ug_JLRY;)_z|<|EL`SYqO>azJuw7A5&H1~5ga?dJAHH7f9?{*!-OvFoP0XGGqHqX zJdxdB+c3=zCJ_GC>^;M5g`ViDJmM`o3ESVx&+3UC$;@Uchfdf=>r)Z++ThQ$+ z)?NANV?op7!IEUAy@oFFwg)MO=}h@j@W9Qag=B_Oz=&H0^>>ljj#JW(1(bjhaHx+f z;6EgCRSc)(P_*!^opMbHSB;yS`|SA+i!#W2$Qif+gE;-eXOmfUuS{FGYZ+;{K^-Px z50VYJdTG561DDh7%ZRVsCte`DkJGNbF=^v~89_Jg0lRYiRQ-NaRXb7lD{|4JE;6G@1A^)Enq#Wqib)i$kW^%bMlL+S>_)HH*kn?fO zN*DjY4;Qsc4+Ym=eBNt-El_{ODH(^fBkjg;iFW#IPYIuCf{J_Q`2(~Ki*@nWlpDRV zK0sIVDoR4 zwedepsj;ssDU zgTRis(^5NF+g=Mh?*CNR^8{O&Q(5%r?mKXDd2Hqa;Ks*3A-`CP<@?O4y^{h%Ii9sA zXr`>Z*uzZWs!~*u+8MR<#sl0Ty`Y0L^L9yyKJTt}&6Tly!UE1e(%xh5N|W`|vGQpH zseHr8Z^73zEia{Km<8JQ=rwCfcM`YGKxY~S8LGdmtxsg|Ro)9J#C+mWTafIT@!1#V z#{7uaYcYdH(`F{^A>G9UBQKea>aT^kv>6G7D0&WePC4*3{Ac)< z5FeH*!1rtc0n_poz_(A*(d7=miJh&^9a7`!8)D$p3^Gh6c|J}=w{GtOO0Mr6kP79b zG2r7BOb(p9uA`0j-F&jyaSFOqBqo@7mZE6~;5_oJQh1&PJyNf7tK#Cwc%yqSpm9xf z7M~lFa)Sn2Wbp}EXNklaq=^}uE@}$9d-$4f6>8V0k0smo^>d+O5{0jW zHZFkmCUmAnMyxysux9D*la62T>&03IZ!-%EEh%p~rZSOx-nP-CI-1&=h)&!oz_K9r;tuY{@fkf*ahn6-cqv$BpqIr4-32sx zf)OV%cSAX+f4=dEl??TZ6Fu007;|P_3q##})=XwSSS1`XK`G5rrX7 z3<{HtBFC3N5I@99&mDDF+r$g6?!1(UOmDOw>eb)IQO}=1-SZi9>c4<`2zUgW5)b(@ z5SN{#Mg@^BDD*U#pdWfij8(`3Xv2P&CDH}B`ogPQ>J+nI!;mbep{jSM-r6NUPtBEB zH?rqSrW>NL4(UdpH;?rL48B-Fl?AzL04{dSJ@eQL`HA`7t?x})vcA@by+~5ovz0)< zD~K5vc=T?e6gHQ5X(qFJd3--2v>oN5px>8cjAW=Q?GkQw1sMMgnP~APXoME~%T zn10u@1|SYL-|fmfCTwolHh-k4MkF$z3yL>xG9{6l2wF3`3N6v`yglG{a9}YHtL4Yz z3RpwRe(d9k|8QG?Iw33WK4oW4vd<2*X6|-crq!k!)4_CEP>{(w|1Du-^;(IgFLxnR zxm3CdS36{ibI!$U2i&NYoc6^MT`%)TL#5QT@#)gx1;q#$M7CT}mtsviA8(%z>iCfCF3a9wPIs=}L)s$qeFw zN;aX+8D6gtEFR)?F&}sJRM)9|HdE%;c`Y!fR9bgfSbnMYy^7%d3v;Oq)Hp1ZGsW;N z&od6=I7k0WQt_YBt?9~!9h}c&LFbX>=WE)^(Y?kHpMy@o_}Ca$_o}r@T_%}yu`3v` ze9VcstcrABnri^Id$yB^BsG-1wo?Oj3hBMY^0}}p#A$~Y>T?PBrbzJ7sG)Qb_l_-q zaVnbAX3eqE7pDLUf|hn&n*ETl?_5w~ypD>$5IniZ@Cy)l{R9MF>Vto>6#fqPkpr`~ zX?)~y9|D5(@l?6ZX^Bb3X)9b!e40JS3shpDD_Y}EgT&@+P9#VJ8DD0iHQ`}XdvzSs zo~N>SV*8RntV#LdV_qOu%9uwQv6tW0Upq^0?7Q+^QAeEdY=i~yPfeR@tYihPPA*K% zA!c(9@A8ZUWS?8yaY1$N+f`osavj=ur|IN;D~6{*>7M%l;sA&j%T~wYv?8lTU&gus zfvscTYbw$d#0d>gP2S=mLl;)u_BXj&FTw)DKX zw7H6E=@o2L@i|LSYCjgAeOmoW9^#Ad&o97HY3K$6Vjlc`&c1cEHJ{GVX8G?TT4}gh zei7NX~L{3LFGd z(f+H|4m+^Bjr1Rb0O!I`G_ZXCVAu5D6>>Om15i6(t&TPRaW)K@0)i!3d>;fL(;04H zZoBsG>c3;o)~$fKHP#=4r2cCZ9D+~L;3+(I71_%p(95|XcHYwCmTinF($>wt4yut zC&NJONzQ|-9HY0S@AUsHMgA%`D88KMpV?gmqECTF^7pO-id^slkb1Vg|E7`ScfVlx zRSsfSv(#_0{z^Xx_5%*fQC?0apq~CyAbE)Yhfv{z-zyNh3FLQ?5f=R)_TD=x%5B>d z6)2#{6d+Mjk#iO#7DbSZqT~!BNJd3+jw(6lARsCNDmf>~Q4oYc>?Y~RowhTd;jAH2z(jiKYshOALyUnL9_uIFC3vI`%mxxl_;ouTf}Ii5wE-UxVDvnS)b0O?uya`9iiNT+sTr^3+MN1w*hcVkSFQRi?} z*95n;={jTm*%!k^|KNv^$nIj_g=xEn_1Zi5+d9H@%_%4XU|95Hp*C+nTI_!~)G?MU` z5=H^fvLhYcK?A(z6o*#P89wq~^S z8uNeWes66EEc_!7_)}&6=8z3g^B{^UBRv1oW&U?(cO~FDh+&38BVYFXOOv1t;A**T z?<I zVT_;@fY+Z4NSF`jyS4r3jzspAdLdTwn0pT%2$U;!`wvr>)#D8PM|DeGVW{oBR6%{=Lk9Q}h2J!;|xG+5G>f3JuAb z?Se4~4WJHmSE!FtF`Alo#&flw9~^jrik>?2;kwOzrA<^b{m-jg2L&b^D}PTpfOm$P zKz`ypG9P7s0$B0XWacBxzl=+39nD_LPGO6NA6u=D217+n{di87 z#{I&SH|ygetZKFoBd4>j1U!L(hx~E$@;94i!v@UW`e%cmpkpk6mn_98K%upBF-3^G z{Hrym5Iv|7*)^Bq z^q(4Jn_#dLMRv~1>4Ks1X5)!Ec#j4p{8HAL=!@%4appTiTuSS&ZB#EzY#rN?{v2Rq z1SdW$-!@gSCI8<5sSIM{u;aebgJt z`OXHClE&Rrb3DbNi#LbZ-px+U_q3@FwOw{S0qshK3wW3P3J#HVhdecFD(1Ng$=nC; z9-_P!LJmS#zq#Q&IO{|>qE4S&LIY!MIB~S%sOwg4uG}2^$+UlNm>qu?MQeWT=9A64 z&s#PsdQVD!^|n;J+o#PiOe-Qi16h%O0K)~mDqT~L*MhG5lTHoVM>1+0PlQZIOEaYZ zgryU+rC%84?7AP~fwm{(l$gGU#L33thNt`~zAfa|iYZooDetWsy- z?5DkpA^lC%?86)U(>G$abcZKe@db=*drc1`*1uJCh|`1-`R!UR(A{-JB@b<0H9s1Z zyh`VF7|?TIH*e~51028GnSY;jI`J*mu-a^LMJiv`OlqUg_!Ws^c@Gh8Hg)h}PrcR0 zT2H@?Z(I0#L%k{bZByA9d}>1L<#VISrnsaXk$6t^zYMIN1j|;a1qr=2y>aVL09H|D zS}fa&GjBqmYy8B-UFb-Q=e)MC%Hc;>Y+`e;_IG<+JU){|`|3d0ZWHG|8vPaxzrHq> zul6-5!c(6W+2JA5W78W0ItPZXk*=QgRY_hJm*6MoHach+d+dJP-Pv}iYpQ%dFr9eD zd&hOQboA-!S(OHRH_Bk-g!v!L(lNVc+w2{f?iJN>*s=c5jW5`U&s;{O>Oi<4(6>Jq z%?!|Mh#RX0J^<{$A?x%7tL-1Rp8kCKCN;)XJ*ign`bcT1Y^xYkD+0_zU~Pj%45>AF zdVemZE0`JCTAhBG#nr#Nb5M{)&YAo&b=^?2e-vDrcmUdPqQmw?XIbkGH`(ZlAmk0955rT|Hf?QKwDD&5|=A5137qI5&HvRC9`>zn|){jq}SOTCs~|kJGE!PikKY z40S}o%rrLsS#&%r(Tg$C=uoe7-#aOi542Qy`iFWponWPjt4n91t23zTvmq@YM7^Rn zxtcCI3V|X!^hKNA&H-@(Q`}0KCFG!sIZncHQ{AIfaC$%CV20~UDM#l|-Kfkzld}o`#g7Mceb@p(FkM%=NZ$3|#px_B9mOU!xxd z#Nc$}KcvX^QCT>tIEdT);@zZUI^up&JgCfx(uEYxZ)a|A+RY9Oj?P4-v&*SLKW`Kso1K=p`K_pKEfEsiM311$R$)Lc zl^3%yB61oqw=o#w*_tRcjz)6V&k(kzEZ@$mp0%OQ>=~BSaBYIN%ha^!B6j&5M!; zt}gQ(c!N4! z0E=f`Ra!{ni-y72=Clz7=Nu(-sW4k9&AB ztmbpDaSyC9bE-Bg5_o5F@PvWlF~8}Ci+v|%@TrhAM)0vzKR1;95fb1a#b)Wt9XG(% z@>m2HKFLd?K$sRzDMVbZc{X{#=BDPSG_Wp%GULyvsuL`vcpZ`Z#X4wAehmJi6j+FT z2MG}{LG}h%U)uae30U7UXMhehv)UXcQ$C3aPI;Ao6W{u@ukGwH>VujhKgXbi1FUL% zedDaEY;tS_#sHf3X8b0r)<1*c$BU?vk*K;l6cg+qwgejjnTTxJaUK9d??zU{I-iip#V|KR637a-g3YnSs<7pv>I05!!;a%iz|Mihx7VpQB& zhUkElm*13lZDkFmgswz9*(C#GiL?9zVg~F+PDwp3e%FK`R-r%uGb?YAf)UnoAl~yT zk2gSVxEM0=AcjB0p;Nrj^*|*j9WwE2)>h(6P5NZ;ZQ=UuG@-&!|7&!2!1erc+onE*M&nJ>m74+NUc0jx@6(Rxw z(>m&`tpVHJ7f7A3QcgV9SMe2n>d*Dh7>Di#XdH`S} znAn!_sE;nm#J0OfNM`?#6qG5O;vYj$mwcfDQ?eEtTR=hqb~x zXH~y6^W?!}9!CLD9eALsiS%#Y0s=-!XYIxal_i-lJz8I=v^& zer+j{gN@fu3DtL67Xi~BCRx2DaS&k0%<2?g>r=LDR)$;|_AwwMVqnX(WBJ-dpCb-t z-{6W}V(By>%XS~cl)+j|0F2yKnZKOL{h4W~8^bp9)PAqLSQwJVGt_;7C2=&KHtjUk z^d7zK2C*O*j1}Uv_FgqS017&?xpA7rm){YaI-pdF{8AW)<@U~LW-aHv9J~jME83~T z_D@#$IMIADlnslxmr!=@Da!u5*OnqhLzm-VAU0=rO;iW#Af#9h4JdbX?;zZKNmr_l zSvxmtA}VQ_{zPVU00(~*p|nAsI4#ET@M}vGKAyMd`5V<}sb8heBmGq&OWA&ms3|~+ zs{;MDMQ`sW^74M#D&9Q3#g9yUh5_VXA4nxzl_TW`s;4DQ+b?|Qz(Athxeraov{-SK zvq%<{`3nQ${>L0^{B$6k=6O$;P+Unuh!W(uj+8yo;oB2l=NwYMSgc*qpRAC1;?)oa z+9xTnPhW9XGhi{C&UMLz9QO7Z7#da1rJK%Ha1QS9)l)v1@X-WwbWR@BFSVLRMfi zvU?3jM&)G!Z&@Url(@Imn&O<0DlgsQF=!=B)HNZv@co(Uym(_N43tb8^}i_0cC39j z{*oq?h1|3}ZYhM~f`;yRsco(vj~8dYBf7MwY%35ixVVzi@Wugvx?!`|9=eb2xxYJl zNfXjeVVM8$yr-xXue9OZld|p?mela5IBeB@3Wv=)Sz2JJvyE56mq$YSw968V@rvpN zjVV$WZe#qDZ_9KDFT96M+dwZL&5L%Trh|2U3;ENZ48fMsG8~f0eHyW|Nrq2W-nDqz z>1s$FeZHHS% z5z(iDAwXwReh%M1KJ8u#FKnAWn4+ii{qgCvpvSlPVAlJ^p@&%}pO3)DL881uD%vcM zMHyxNgAgz-LpZxn8V$XT8JLumoas=&d@u=nNI-o>7AOI~B>J?Z*_Zx7X~~9O<67gK z^ovN>oiaDCCa1k6`ZobFyEXH1_|_TT-jzD888~x>C#MYF-cdK++?P-qSu&;99PVfi zqW5+yCB|kR=HdM`G^vLBAZ^AZSq&Y>_iX2^?D)rsda59ckw?EPm;!xneEwL^YT+uX zjMxNpGPgSn=PS=`-Mb%lYSu!Y?r`ng?cj9)MPa6gqu8+~+g&TEqrscnSmximK{t}M z*I~9pQFqI8Hv6RoqJ7+b7i466GXE}=8e1_%63>P}dCZ}#i%oo5;MtxN8#`L(+Fz4JR9d^BinZP#$o z@mzr4vdQNF$Ii!PkK4i5`t%UzYJAxF=G^In69^RlJ+Q-!SURB0f|d=St@*Ui7$C+5 zU&f$gY?=A4x%Ij3wApF3ZtG}r7QIRO&`z?eHjc!PW;1it*CE*40I@U@IR1s&0$dh! zIT7Nx?G!4{y0cOge6x}3zt%p$M93iNXoP-MXFr@3^ji4APM zTS>ZOt)#^FnHtIgnj6bcF4jcnYH1u*%5dbnnAeCYO@KvjTa}t}qd~C*bYO0ZfH8e4 zQn8$#N2U$S*dQP0Z zJE})LFCv!?W;ea&z_2Kzsbc$07PQ!3&rcsGy>QV4Z1aPsR=}XSz6T#6|6FVr%NgO|J68m;@ zybt@RIWPbV{$r#GRG@?DX;mstw+~it`-zEh?_aDLWBY%Wr|{LCTfWwCF!P)Ns(@dKfZW;+I~Osp+u_m z?7i80OFkZ@_EaY4H|`MPpMSd}_Gn-7Zjk|%^x3k{Ct)EHZ0f4DuHItfMufK)DGv<) z+NprsgBT{sYcDTONq-C^-mx!jyex3Y>JcOGeQ^KV8DKxM1Jh)?TBFJ+)O*Usu(wWY6Cxg{AGD)^4#GY-N}OJY+IHOcCJk<(um5m zUhj4v`c!&)<Qt4!sHLj)NI^ zxyQq}R~rul^>mvlNfY*G<5-@xIgPMAT{xf>gS0grCK+;iu8(Sb7rH`@7`qzpo5h$^ z0A)l#t0~YX{HCAtRcJto(L3b)!=W99chX?s3Nd;b6G8>4s-&!M^Ax9m7=3^NvE5E0 z633U6a_iXvv2!w9J|*^Z9GU?Y!VZHn|08TmA!y-FYsjC*0+b?4;t(W-$X z7S+yev>+99#?KbMuR8riRjPwaoOT1IY96KP%PmWoL5=DY7Td&Clls;O1~Dzt4;2?% zS$g})u37|f2l8?_YfzTM;odt7&h9n7#xtxW*h76np%ts5ZJO~fx2v~qD#Kpn*SBnQ z>68X_-?83)BQH-(oUe&&E`!FvKbEc4a>#CQS5b`ND+We$L+jky}@2BlygxE77wiRfZ;`n}ky%l8* zyQFc*u0wBZUPto=fWb+5@{qU84yw+-7+dZS;QyXn+-bY-O8 zNy)Z}e;!nNGdd_uY!@7DLPGz|oxoy~lAVd276c}6S(N9R;9@mN=PCxgk7!^B?fh7oT` zqUS?@NiJrseVRTgWm~c+F6~PdY&q6ub-SrYXpA>U$3oz0`nG+4mOrcfqS+kLD_LS7 z-`ue_-doNLx1W56j+B!-lDt1?eC5#+-=a&wncHId1)70Yv-4R8&+@qSm1sOalaMfagZH)7{1xO}AKw+C=!kf-b1WGM*V3rZ;7=1SZCC>&Z|@T~6w z!j+>tD@)#9P{LMX)PUu*?==_^?*B5K{-z=_;Pl9STK~~vOMQr{$oueH6%Q3sc1I5C zja%e*qtuHS#Kckx_tu1BI7A(vS?Xv7cRhvrZA>r?95o585%e9%u)+hw85E#sgK)$% z;=%9hD>G9S7mNMzGzNl2P}{lT1ui(pQ0xcW^>LNbyYK65jM+nCr>L(xIThg!CX>L1 ztmHoCL7#i}>K2C-aD8!h!=lkmPdL}>ifvF+kw>6^j89=BKZ`Jv@4=(sOJCpoHJH`H zPbMGpY3;Pu{Z*N5vD)%ET1LNTG8uEze z1kY0!pe;SEY;8?};(bf5ON0&{=?Cn<{zWh7(gtT|Ao!R{N z*C2TCKqi#Q&iOKE&D0cdhE0?XgMIFSkGq@(b4+0-+){jSVO(>M_Xm_{Ng;{b6m#T$ zANjKpkl%v3Qvs{oP=DpK6!_)v8oIpvRt-xY8eqp2#&5n5CFNzYjyFBX{Y7)NyZQ43 zS_H`E9B7QUi?_LQqgWKx=nx^A8wWBN_MPVBa8VlTwZ+tJIQsGX^R@U~WZBlkvL_Z( zS>d8jp~d2lF<&nP2Zco;8@)Y@SmE}w)g(wH@^Dw?@E+uvgiGAX3Ar=!V%9;tfweU+ z9~w&v8#?>=yu!9MTvO)9UJN9_Dd~y*Y?>)4Og1QoP8PZ7#c$;EGppf<8q=G!+!@Qe}nt!I>I{6ze611n`46Sl7B*G0k zbY4`)l8XidB0B(MfCmmxgooY)!W`^hh_VMe;qf1aJl0;l^h3F^BUjd=?~+gMj)*{} z3ZO8>J=-P1try^6^ZmZ)ITO+sOfeAy-v8jn0lNUa@cy-ctcS~_eeGhfGCu`+I zH-Ze*%wpHZ%VcleBG!Bs5fMlTO*q9D0kvdj+zH{z*XI|t zD4~i=eU8P&Q7!f38yf|jVh;0L6Mhtf>Fqxk=8kL}(29ALSrn4cS53pYG#b1pB$3Pr(IT&nVyrMzgD5ptH zzTVS(&1AyLx2C*FDdIll2V6YN_xfVcu9xV;jau2VqXVx+q%g26-Pl_tyyb`$x(ZsmIGM+BO& z;LNL>I7M$5=bC0`rSu1V4ur8Pb-FHZ-PVW^PRwsYnMFs4&4sII>t|^oag+pTa5$xd z!UJh=1pyTcxWa*xd8J?RsuuagmGBQ|SZHy46MQ1w6zc*7a0zV;erVRzs+b zTo_V9e92&FnRR=M3ytUB@7R20P^XIKC5|dPS54-`;TwI;(m2P#a$QMX6vP#YoC!hM zY*D10{;-=*p<3vW<9^49H}R^BK$u?o+n@?JsT145Mz(dbJsGBSR5 z2L=x*3qv-qqrmMtu~!8K0JomZaABumsG|3NZumiF-GSNsqC-qZ2D-=_-GHC3d86L> z$0-EAdS&y~?OTkVDfRf#nB(C=-;G97oR#(3dfr;WcNNLXSI-ZPoaeq<bIG1w@^So1t!{mqyV6k`JWOH}f?%kfw_@0p=2 zgOiJLV>OYX?f9i-=<`C0ISKDLtvlGjAR&p-^LN2_XNdOAGraDEyBsG=9aHVUV2pEz z3MU87gz*ZqoOf%#IoH1jivKFu^t7`Sg>Wi3{dKTC_i3R-bdo=;-U1nG4tB}QRjlB& z@QNaV1=%lM zfJ%j&@4l;}4>tbXNd}Wu@pYSNKNxJg+#|#Hys)hHS>mk<4Gxw!G+*79 zG5hyF4`J;_7D95$;K5^X76RMG4>+NzkquP>Zy@>|1WhkDt7G+8_ zdtr>uru4^{c)d)z&eb$lxljPoAwEBC5f*Mh^meNFV5lUx(lg>o%AZXF*28(iEg_v zPijWD5Xoqe@SLh$lfinU%*_H_SjbMV-0tl21C(r z!|fLg-{&w+xb7$;n-x$n5AIKRm(3~{!|e8LITUVr)T;zu^iJ$FH?)FZ&7~&SSX1uw zE2TTx;qF;lTF&j1c8IM<$=cjpA-ziUO1S#s8yXYi)Gbbn*ih!c4^}E|1**DNjKyxD zqEKYBG0KJ*cm2#W*4%75PN{f6X5;V*StCe%l@>#{#AIY-s9rqjg#xZ@Nyd#inMGUp zb>4v@%iIARG(SbK#|s0WVWQ(PPcP5P^B45HxG+XBG01ROhzsk|PB3KuW!EFbY~o?k zQ@TL@MwL-Jxs`{N{oX6)eZp9l3|pJsmd@XYOq7zPr7nD#1w+eBn&{E`Of$2ZnuMiS zXK}Ph3_3e$Ydmj}2ADK&l#i%%*5|0%{dHdP8}an124C>1TL=gg?O z=9o-RJd>+)Kf<-2`G9fVVVY1g>mz4UuKcAwL`3)-!9LjR-+fY<1a;4OU9}@}d^UHO zxmL&mLzk3`DN{mKg? zrlrDp|6bs9-F7KSane8~Y0;_gg!kVh~#Cbt?6QTB4_+z`&r~W^-v*)F% z+^C?S*c=sEG~Ph|ph0lKHqc)*F=Y45*#QSfX7w=E`+Zb2+e78XS9xl)rmpt(3qbJ5 zkqMfY_}q;+h6{PUR3HC+A5zWR`&y2xf)r%JFVhqgymUs{l3a#88YurxYuq41&z|X2 zBW-6JK>Us#EpG+I8zuTAv=3oRX7a(0GhWkP2y2MS2WQ;aL8j}PP;7?VCG$Ouf5JKj zvzgK8djVzqCWziwhxVw27z#}4)K$6I?=0=tqcbGW;( z^e^%c;p|fKFq{^2)@WvTRehydqOqjptvj93Kc0(U&l+GndJ!S!`Cd)*W2osqBivuWH3tdik6lzhKXt$8$So0K@Xq% z4spptTCmlem7u1ud$z0XB67u^>N!U3oZmAaE`0Y8&;Y)F8ma`oTf?aF3LD{iK>kO0 zzV4-k@ zh2IP1Mjzh6So3Ia)n7YhP}VJ>0)#%#$~hYY;S%em3~k7xWa!iA&JNlNwy~+HZHosa zf4g1jShkcHhK{c8sDp5wmedqTgaCrEwTOTo? zN|@@8?=ru&b`t(}z?AAEy1R9TfbO2275w6u&Ch4P+o3@8I!lLq_+YF;o9&eQ7ZX_V zQxh$v#*|Wsk6-^U=O53=7^89&tZ*(VeC=}Ku5(Uzz8=ZqX3~qjgLwK%gM|l#?uRFuG#9-A7WUYJZN899*N=7}~DD6kU^RT?C6K7UlGxpk8g zU&4CAkD#txSO6stE+`!I3$t9ndzc7?LZ_ek-)*E+mQj+2j628?9Sb6shw}i52%e~6 z1JOc<)~gA|oT=D+jSzIzb(%kS-WOjsDm-CNu@bxCY^7caM;OZa(sXidax%PcpPTTSV(p%E(Y(5oeJL1U75xW@>@9!vvH+$mjOM*ZrMhBa;4xiAc$b9K-7FJ& z_Ix5+Mvn78w=0pVgKR zVhdwl`d(@l@EzhZ&iH($TY`|Nb$8b^dEfM`G&c68&2N$!tNxW_VJMPSKiB9%&X<4`Zp4r0 zrEe4F=b4Ybi`_pr2=b*rTJ0IB2MUMSgbp1A%;f?Mve4?i@j@KKF715|9)t(2o5zB!{e3PkO)p2N!%Cou8Jzi3w?Va4}%7)RxiOr zKagzDV|P;=Sgx%~4Q(=+n#xkkfCo@sMJdtGp0q`U|AHEQ(iCT6$<5|2zn7NJo!~Ef zy9$*TE#CV1!6lBb)`)x>|CulS%6$$ShD(;EFoGT4cc$D3+&69G;ZP3;l*A7NDvPDB zl=uK-ve5BaydY@5MZ=N)pG0FBh=%XGF3vm5R=K$R32&)@We^S;UZRE{eSf67_#SO! zlPOwOofgm%SR`Vgwcm)1q;*sFO|uOJsrkWX4{^{@;+Om2LS+B=r_Yl=IOZ`!BCNmt z5@CUkFoN(tJ(p{&_xQFl;vOFHZ1}>=$0it<4C!)6Ej=d(j%$;=BRvBL-ZbI+*(YGH zPRS-2V%-!l+-FL}TVFPrx{29UP*&p#V~+ooOnP>IiyUTP49io5uL5JpPlj56?F}B* zdAk#*{jF;;DTmiAUgYsCB5@kS{BJMd!C?0eUWh`}Ysi&jQeiNDqeCGmo#_}GRjzU# z7QefhOji;Q7X*^hk&=)Aaod;)a_Wc(dqlyzeFK7p)w&K7^%{CtG>sSpY+bL-V#tK6JwAE}_uRtTeJ z2HI$Ig+Qc*n1O|H8VemgpPMWuN3)oi;poNHxW-w+Zi-n`xnk>Yk+U}q1_LITE^&1@ zN>O0CA`Tkm7cb3aQP!UUvKtKe>uEr+-uYei#HoM6^~zHy<@t>#kd4{8A}I#ma=koH zZOV&j_Bw-<>z3EKO)JQyDJ6*~Dju|~MqJyYU6XKDdVd}`Ykj4W+h^lcf%5RY(<1eT zP$2?DDj)44n1!Uw@7^Pus`kLsd251QcR}&rJ4# z!!J(})q9#b?vb%Mx2}|@#4vhIXerF%`KQ#e3i|7tk1OoAz7#KsqiLiTz^4{{%U2nt z;%k3{KQYFi>dwovo)ApV;|q}b;l9`ew>Pvq^K<&+?6Y`%$sZNKF63%%a_n6N%xNkx%Lgm`sF!>I zoL)YBHl`9g&!*8DUfO}MH_Fhe)E$Z7Gz|}Ds4K2#w0YK)0J))>2F1{N4!xnuDmOsF zkrB*5^V0oj%Ys3&p6tpeK`nF=;_U=g@>RMt8tyMH!ht$CzLYyxOZT_tm{NqCVD{sc zq**e4grjeC?zi59fFx&t&~wiN+K-K=qKv}ApCj`96RY?w&_YF4ucHfQ|vJ|tnpZr<^cW5j%P zf`B(#b4`9e+-S(YA%=*=aueA)-@CPT&Jpfs|3N(0rRsCW0E|B^?w#6^%B?0Bysq?8 z|BaX?uO;%ghVP*p?=?-K`P{o9+QSEw%8l-hK1z-5gmyo>MIfyYwf*0n@*$6>5*dy6 zUkou!-P2aHacz0qjZBcfgmDaz`tW8NrzWQ_5}EWVEpv}3$}f(m;y(FN4 z4%p*Zg;zUjAJDKWPUC?K}N>87lQV@hO!o0|B1xv*18~w!4ff&3Gx<7IB zd!B?oo-6oTCh9fsf2OLe95{iqD03XSEvF~6^@{P*0M-ZlpPoJ&AgV7X=6$SsQi}KO zw)P(vfMqm6H)(UE9rxQ)lSd3+skKJnVc#U&u+9%g-m1UL0mbWW{`Ac6m<+CGaylZ$ zZt|fV9w_kX(^LV5fqJta(m3~>j(o7DG`&?~IKwX6@^P@;=c9)4O=HA&f8noi_*9)6 zeeM1-S8?k+Xrc(E9(}VV_EX??_Ul51F(T@PQxr0;Q)`TMM-C}Hg@UAyGL8YZZaB0_ z?HtyV%+;p$o*5ahlSvj<`MAZt3zkJoD5wMKzoK-wElXcCAS(NwfDUm{n)VWGh5u%i_fjKJKesQ>6fb?b zKk7_kA^dQlLI|Ar?*WMX8IMJ z^GO1RX3U&Z1i@bwbqM)I`ce$DsX;!tR1rU@gJAWM9aNp_*WA+6`5di~hs3m`80+Fq zj-RS{;7D+0Wj5UtvSu%GMI%F!Ku((4@e>y7R|)C%9%_~z%*daz=mttq+|c~$n_Fgs zHsQ7Jbn;-ggbWyn(+Y@#b-l1Z=qwY;uBd;+=zYRMuK6{<@B4^S_^}gAQd$6yW5a}2f!JP={fye%N`DW+@cy(K~mqjHl6j^6lK z(&MKZ<+h2RG~MI9#(PJcbe%HbEb85cs3~Ds^6J<^$#)tKJ-trB8Qh0w3@})I1&QN^ z?xpxIXNLPfJ6(9b$X{UY3BF)GL_<`>84D5pBFjXfC8~Ddh!;=zEd}tWfJbc*VM?zLD0mJRV$CCe@RbpfnA6A@f zj4i%tmCF}T9IRcXtDjQi{wTE|%Dx^az94G#b&~i#r@>F+;}@EPpoXShx=$IED$E0^ zLa}EljlD|_{J5>3a0B&0I+p6%V^I4E0*!$`NIpOjK@g3Kl3=vYIYqEl$R%=Wl4Yd1$K{?y(&#I)@9(y?IbFRH~^tGqBn)8(>(q z$xhJA_24%zKHzU`-u(wJUL~`ekoi)d@Z1}8)Y8G>3TV{1?l?~9$E}Cn-QAb`Hqk8l zMbm@%WV8^1(10MB(2Ierd6$3;=iNh@t+{uxlIn*{P_}yC!>!mD{M;2}jYMcp4ntPu zWsSny+F3WR4z}wXFM;3x>J@VZEr8hPiOAH1cZ% zKKG#v3kcP$RL@)0l5chALKjAkIU_k!{vf z*RQra@P%^B@bqh8myrZrJbhU$z>BB+>o)P;COlkBI$r6RH}xqcij2DCoEHi& znB?!?9vD3vBR!V2j@5$0b3%d&U0iPE+Xx_#0mMIo(V3aa__Wg+b}2E(N=@e4`FTtO z0%MxYWShmXJfyO0mgraTI=;N=Gpr`N-=Es~99k>gLLd=Gyx4!<-a1jkB_GThN!^^B z?bmuDx4L4ZV9Y05LeC5jG|^FyN}vD&pYjxD zRO_wHIF@j4@bE5|T>>M8aMU$sh_hfTXLZd3f5kijMIjayoj_Fz%^Fw1m7Tkxt?TFh z-?%aDcjrAw&?b$nx3?#I4QQ0Dyj{MFU#uNFp~tnlUC_zwMHAC zGjhfbC%U(IJ*D2vPYkDpoJ!Var{&yb%k08^E>0R1W`e}~F+9fmy~Y!gEv6$l!`%5` zVDWuK(!)$`kmC#l(Wu%be|Z1k4{!2QqGv#}N(dr<*Jj;B@#pr(dR>#}zxe|L{CQPT zpvcbN(gpphvDl~I7mkONu-yyxw#x?4ZKUwmmgMMqQ2oHJ{v)%tmkyHpLwh*#5VcdA zt~xcg@wg>F@$YtG&dcGdB~OQ!*|7<|`C|i6#5hERYx!h%gbvgS zhTrV_DJ%TQVe48062oL(hLHi5>)t)wTF_nyj_e<|M3sDXz(&q}5?-Yz%Ono{080Z+$g&8S?jU!e+NrR32F@DwY z+Urf>$Y)5#>Y$ig<&&OWw{j|nLV5}hl%Qe^0pYhcLsU5D%hYBbeZ8mf!fL*@-nU!J z3jd}e|A)9+dbizTU?h1?EqksF4Cgb-xin2@%trtquP=feXU4)+za+km%6D1i7B5SlBuf0xtMA`!m63QO2gd_?O_QI?7#zZv6(I_x+jv>B-swbzpw+Y7yG zFtmMu!d#pq?^54_ihvg_>*=C%=Vx^>DYhXw`bEMGG%w9(7Vs#lX|On8i~<6&qYY@| zk5b+;F9(GCBR+fPVnu*M%T7o!+vnmty$|56x=f+6^PziG0!)~Y4;W5**nXENY}xGg zlmO&N@jH%eo;4f^qWZT6+t^j#r0n)3^~!wX;cJFpc!G9UMuf12)jJScz9T(JFZ|lx zv}cUwe+}S%ze?ltZRQMHa+Dl~hUYL_j*I+iWJHy14|S|bz@xS%B8ju0Z*8AlMGTj* zS4E5@QzvrbhPc=%D0Q6;J9p`y$mQxMYOXQ|e}6j3p!=cbDEk$#3-4V-EV&fll&|Q0 z0Oupje8BgN0}b%IMS|=0l!S^gtLA|i{l_U`$ZHO~@$^0&q(z@Yb!9n|P|_8u~!N#W?Hk5?~xap7#=V4T=0#4QKBf zz=>-@Z+;_&CMJ;VTy?v$(Zs>g?R@t0Mn4XY!NvJrud421ueaXC3T+RAYMFITU>H9@Bm z4A!p>>y)mi{SAn{6sA5m{RYHBFf{X-N^{H$t?b{m3U9(sL6(b=nHj=sRFCgObnS&+ z2Q@6$bF^ox>6fK@!vmrFZE*`l+!I|eIzq1Gl$3|*mG)upWi-B9tuey6vqbT>7y2=X z=oJtYi_%CAJ(_GS54Zeo%*ZlqoUUt6#Q;b<7a68)+kJgKku0PYVsv9mGr1U&u>1&N z)6-M<;}*SMhSa@WT4wLBoN3k1V~NiL5K1JgcIwFHP-7Oj8I2;G>5vo$ZHzF;NI#|Z zp1eJRu9|WRiv+z)AhsnO8!doaB+=i044F}7cEq;vMYg(@Ia1wDzx9v<dchXrnSa-8Dfkic5vTSQ9@!o!Y9HfGjH7!x7hseB4`4i@4 z{388F0CUY$e!`EoGs5;V6Zs8fu+LYIX&I*dDp;9q&Q2~70!$kYH)?dJ<24o=O#kS8 zO3{(9afC;vwWerbVt|O24@Q+W|FqhQp?vA-Fj2 zcNB>!LhzbRLmWBzTrSp$Ig40$gB8xqa^;$F!v4ZzvKgFtMY%{@ZTAXLE7}Gs+~+>8 zTpYTlYO$Da)omgQa2F2uKuNLrmkf_*#(H;lHBwaTUYCjR+YQEPh~?CMkuJB4t`HRf+yyr%|NvpT09 zwki1(Dz5}ZPQ1#zu{Aj6e(hfAagss&>yFr8%tJmF`V8T$ryf<&2Gk zhW!E)hBg@+2TS6~B8vAtMvE6AI{F%PJ6o1skc-Pat!h151&JnqgNhN>`pw0RqZ+11 zK@udG77r7Hq1nA8Aq`f%mrX>Z;eX=Qlw5E;2(Voo-*8>#4^;&iVH_Wv?8(i9A5Vn_ z*|rJg1S$Nr&NRB>wM$qAdF179wS>q0)>^CC>f7TP91sa*QUD91;F9Mzn9I0 zi2f$Sw-KR-m+nZNv)I1%p-8Uh3`irU3VvBCzG;lHbRI@K&tlD#k;-;){WlvY667a% zI=R`{j!#yV_%_1f$h%~7RN$qb13JSI4W{C}eyS>Jr@5F3oI6RVDbhk`2V}0cn>_j3 z&-Tu2%Eb|N9w(Ot^ew@tAs>C8!vjB$-ebt6$SElJuUi|uVh}EjQg-IC>50ZB*T5&Z z)sqiZ%sVyA{pNH|eTjiy5W;()ALyIqWcf1xOKJ=DC2f#8r2Z-Bd;n9?8wV{GPtvt2 zY&ak&m!9Uwc~tQe$8K7xWZ>?8PuL4?<<`V=J6Q|Sn5pv>aj{Ws9O2l<(+uD1lX8bBd&M$1GimIvZ>8!UlkIfHD-+Ld@a@~62ws(TcTQ}2lYR-6io zd_WP)-Ey}_ceVWIS}TtETr`sBC`HqfOtTpEZ zwR8iaV=5VoH%A$&E`EO(9RLSuNU-EBb1_)_~ z!`tT&C`~xDN*fzjZ)n!O*gO^^4x1tWAUO#<(v`O@oGO6){|0+GcK#t78`0?gK)CI3ko; zEtW3B;&@Kupghaf_}Ol8GP)H{Ea&HQ@R*#;C&@)UeQ1Z&_!@Hf0kCf_{^8(LGd%nB z9gozzci1*s40qbZtUfELWDUHi-Hvr)pjl)}Rghf7xb6koIas`$E_Y%? zgcnL$aoZ?F9`h=e^$1*hp~(5aF_s zk>{47$+#N(?@y-_Z(kJjA>{nuP3MWT-QfQC&V15%#RE zML7YyuMiBSmz3TMdt_bmm=PD-%=o;AP-lo);VyC8gGjQ9M7>W{j{bjX_*N7FdTu58 z)xUBbst0<%6?J#oC;fkhMjL5pxj{3|WSRa_B6RGJj1{K&6|GOZWKJ<^iAQD(DS#C( z5geL}H-+Ct-CY6-~gII?*cU!@3R21Uh(+PzbREIM;kdmBdiE-pXO zE6RBMR;Ey;499k5HYj3t&QB3n)f9>hGzVw2$P_K#>z{VceaNiRq-;{6KYun=h^x2P zCT1{7L+7zJZ#k|y`ZDB7)e3y6Ze-^`Nu(h9s|Q>_2g%@LrwX&Xy44bNzNLN3EHiCB z+VCEjS1O(P;5)G=%=RI40&B1MVS^=0#y<1T%n^_)0nH5@Szs248Yw_J$ov#x8iqdfI;s1=@;a z1E7j3D=nr!hVNa$Mg4KE419CSt>c+>8i3&zVmp=xRRS1!?!V)l^uHZv!79WbMLE04 z0|VtvjCASO3UEOOJFz-*2qB?$g74ycgV#fR;GTyh474ZI2hx8J9xzKoo%zJMkOH*o zFB1_Ec;oT2?S~YhGoP$7erF5@MQvp-{%u5a3vtJ>x*B^%${^m!+63g$7A1_Lc zyy&MMf7Q+d0Ub^q~^zk#<%;L?F&K37R7YFaYYKhiNv7 z$+c)o$s*iN+u;PW1X+ER2b&Cp{L_DMLr0tL_XFGHIp0$SbB07%+P0)ST+ zeD^xw@9O!;K4@+Zkj%~vbOJ#xcmEcdYjBX+Ot$;Ag!tdS$a_L&H0B@30R}Vw9w<7O ztUGLO9}RIddS1ioH2~lqriXr*>t%3V3v86+^3^PcsiPWpkQooFeZowfwv=HRNqzYm z!+J6cChwQofSg{R2zX#m_a{R!df05MqhbRqt}0O2Zbmelu*R7Z>gaWfx}lIJkE7GM zYQGA-6PA*p1rP+|^-MB8)8G_m{oou%g_FomU!Hmr6&h-^c;EOom3KIFn(b`W@$yU97Q+RfkF;t~EsN-$8<08mp& z|3>eB@Vgv9+e0FBHxajk5f+-YQ0rh}avar3=pP&k=HmRE&DM_=MS_7jM4cY+4ek69 z7PBnV$+Mp^Bj*Ws?0NX?<}V)?8{+!KKvZK1g^;sNj`8I1W16Zrd%7zeN43|NS7W@= zMP4a{g{qYP#O5)*e&47q0)SynlVW>3eH1`IvBW~rz047*>7z`Mej;@?Q%_}m*oeqe zs4XY0aJm$e)<%_r4eO~@F!m+Uz+kM$)!~L!A8BWIItm!Il@F*x&ZR$Ty?gWw!0vgW zeyb7fww~;xj!B*kRTT{h`cW}!eG-wrzG=}aITzG&Nk2qKvcKZOU|`LWhgl*(4CD)- z`3l7+0g8@0R~@HM$>{f5Q`+RB{;7#I{?^0}R+WIw59a>$-CvM7lmObUwR)8Omu=*O4;35vvC)$(@3|+Dk{qOs6gW~Apj*4=4&`Rle*s(5q<-n}+L!YGs zF;qzS`ABgqJ;}p{GJmYsDlYvF@c8(mKf6i+9_V>>ELHr03Q!vE@99+7-;r0A)P;ft zeQkYGxIX?+Uyb;LKE<}2bmiwK0Zc6MtJG`C+uv(si_ZETr-ecwf%|0sBPFoVeX_AI zaF{)Gm~9rJ%NOnWiV47{psm{8r1nXk7HRe|OO;L`K?&(Y-=$QpOYjV3;UJ8*oPX6} zRLECX3F;ddQ61|ZUN#xz0P2w;nR5L%%-RHjh3TI+!oo2r->gI&^7(pI`8;|-v%L}0 zp_jGhMoz86i&|ds^qjcv_Tg-*v~~Rk!W2N8@B8~7(w3dkfPa7#t(WE_Qk5Y>0@}w% zLJW+RbwQu69BeWEmXvW^gyLNv!XC;>-TD4_F``=%;7<6xOp8psG|;hr$@wKkY^s9v zXWdU{BYghp*F2^UIC_sO5Qn31xZyEpFC5+jy2y5IvyqW=?b(r)eIESW$HouC#kRO+ z!@UaF!UXlO&_yiw`SMh{w@ig^%ArK8>f!iIG1D8s=_IB8l4TVPAtdvQA)YG7yvO&^ zO!k)7yrNqwa0q^gwDyF?wABdqO}AFAUeb+8aYZ*+WXCr&=Ip$~-V7a{MMs=img&~` zc!t7sp5O5q*OM$_fdfp^r2kZHwEvavP>cV+f%X+SUtl=@vyk4#YxlVDTRLjZ!QZm( z1Kw1QCQ!P&R_deH`y6oHdK?Ezi!xqPqd43x=1i-7-hT#-jXUyWI?Fgau1WiSkgMLl zk~;)Qa|J4+P`xRSAQ_!-soT+lwCF`s9Ep~gO|4;93ifRSkB18*H6W0vUa+*{UBE!+ zZU08E0h0e`%nKmd(Voi#PcyDu2)wEm)wPflZTYabV4p9fe7yeBsc#yj)SMY75GG2TAShd5QwiUQYyp zzC&iPr?r*AV72a1FR2hrTR*Ogc=ERs5YZ(3GiU8vO=vEZotrVC5F#Rw$cH^YK(#6n z!GuetpYZc#N=Kn>cUwE^%~BkGh_LPg74e6vt3^NYxZty=7W$tY$4rdJ9!9?bXQIDp z0o7;9C8+B#=}sfLTtv*kCzlz=_2T(dg$?KJ;oYNE3m@5wu+*U{S4MId#8#TJL@qF4&|T^2wKf?+<`7i2dk5v)IrwMh=IdaM1!V3-)5Z zx^wq^YKMNFJCO=V2}7XL(f6z6D+>67fD)6Lcoc-(;B7Z|>~{Es3y)xm42yu^6avJA zM^I=qqZL1kX5OQ~z~GJ*S$sNSUIOE{Z;?vrT}6P)lHkd_J`}NSz-3+|C@1Gmg1YgA zWD-a2xsQ*1?D0{p^~}&#LpNNuLyY;u4`7@ir8cJZ%A`lVvQaB#3wDMatOvFwIIhF| zO)h!tc+L$)iCfOHTa@o1v?D=T5-R_&wk#y*<|Ib{0nSph)LQ+OK?#N#iK77JRQ5_8FI(f;&ijYkVAKFPvuso8YJ_(NEA!{ijCLzGNPuzb zQJ>+?Xc+`>n|VH0kXU&@`;#~VoV|Oo&{ZtZu-qc&_Y5y`;I&g*mdnyfjKNXBI=b_o z*J#(04P}wt-MN>3i{1S!-nbfjNw-i@RKf_*kGD1cd-0locK+(Zyxu;4XNouj<-G+| zpXC>uXd(Difm~EGLbGcNH+Yi2bGjBAe;fQbwNRrfJBY&K9xK8P!XgcB{jd+r2A-Ux zVG*-Ql6}$Cz>*J>w>#hUv0J)zyARG)CDXAe7)%Q(+4XEj%-FVniK2K5y(c3K`$Kz%o7I4!^sb&ZTnAW;{DDl0gKj zD8+eYGN76k$9}+6siY15_{fWGUc0MdpVI@SyN!Nzax<8+Umx@l)#<1-gjS5EZsT?y z;CN1dnSigkF^v=;CJvoqQ9w6By-!OXFbM@3Z%#Y{0vOi=jA_m<@Ne8W?;n@_aMYlu z1>>4>Bgg^XOu9baQ=1tkKH?~+PZzN$qwj(FKQG*>e&PBtZMZ_(qbDs$OH2-T64kPOZ-eo(PVgzxF9J!V zx^Q1OD9!_&kWPY@7Mv+*J!*D)r)KBo{q_XTT(o(fsCjAxH&?}qvuXYz=bWfV{Q1^i7MXu<~(I$k> zZ_nVjyi=#)N)s#ioPcIuLG*A>O3^LiNrN+JbPdMj_|nV~wHOK)2d(Fk9pk+Ba&SSX zU7DU$0UA#sW5HX|4FNu|Mwu4=Q-eak>MpkTn0<`KV*W_f&RiVPe?_{0((7^Ije z)qIU>IJm2IINme##y$^6vW*OMYlN^KZNMPndUsdHkP_}gLW5uVE7q2N~XpS~L(E2grChIKZ3*;)>@0(hsDSkmik?kSLP@|N4tsq*TpbLe?o!D7{0h%7B%v3ETDMh;mta0FKWUz-{JRxap-Xe-wOqTF{Nbl z33M$uPXKBS6D+w-N#pOWTu2Y>R%mNF&1L_6u{Wtj(h4pN<$Kz!&*dZfq@NO3BVDzr zk?EY%QtoeSn}{IpxyZ~ zIQ`6a!FKRt>bAuv-`^Jt^QfZyA|mmyP_8X%u_pWigb+$M{$AocAtD!3MAt{^=k=(H zB+9%yqk64AVWEcTe0ud{56K*uLGVqCKV40c@D{Zhx@ra_ILLl}zV{NSzin8sdv~+g zSy{ujc4Oz7BEO|3*)lMgzke&kSR*A4q;gu=vsp3f{R5hUY1*^fyDs^@?u!qIa_d38 zJ){NgE)>oJ$%$hn|G8S-P@$-{UlNg}8%eXy z!4iYQ=Y+h|qY)Oo{GKMjq4OL7*5xCH-h&`|1M-hFWM%56ALtNyKTaN^1BHT6mSRX} zC!9rJuyrNiLuD`k6{4N2cN{7wWOg5-HDeMoOLZ&hT>>)7BeGxVd^2UQpwM^y3qIkHLdixzS&QPC&832U0CD(OJK* z{K?+CI!NSpNp#ejrqiDPqz<4nML3l_pPCYGtD8`~e)cBol48bGdZhC!ITTqQ+`DUl z<@h^VV3RE#d>69iI{IM0G68hsu%5);A+Ch@Kvq^{y8}0)`pYIZ5GYj+><7$sDRrSH zd!U2ilQ@wa=FHHg*_x4PBE-~CG#c&0lt63amMJ0A6%4gANYUyTK3~#2#7%}h9snyZ zi`A%ecnJrwFBZOoLM4dF`yOx$0s4PoNaTy8yGeT!%5n)f$aE415V)Z9VUutNT;uA$ zvx#_{t^3tjvT7VC`jZ!dIf3z+K;F4PU+BdGfImxJhz3k+WnE#*nIkVfs`jif>y~-> z+sOn7{!%C;(63?V0+>ia3)~tdd;mGhn!w9pM}KB80NJw~&}jjRZ{N+4QZPVN7Gq$_ zSK=?uMjqQxRnJpsxK~tOAT3PH9`jRUFTJ_x3$K*&^o)yceAnj6dm|PD#m}f#UJpr$ zgG5IjM&>h$-)FI_z;+F^DE`Dk<3qtDRKn5XBv4AE{(fm-IR*1PFt3(w`D7%)Sf&UD zI0*QUH~~s5G&;2HJ|D;*h{v!OoZGGWc2*~i9r*@cu@4(?Xd=uL1VtvB%gBeuwlt-m&tU<^D^Fc$h-e?*C zQ-+6^dxg1dVs*A&%r<@Vo- zhxmqs;ADLOLr4=L9Zuv2*y*g>Vt%uje$f-mhq&t>?F<|XEgr%+KG&@crL9SNYQ--O z$arI=u>sEu|LFYduW-0)wz{?XL=&TKy&WFE?H@3pb__rJ@#Du*=Tq0)rCEXbdIwod2zBwA}jk8;96LlpZd^^!veUYj~?_|UR ziu{I9FT005v7G*G92NWd?6_G(z#ir={UrkPe7AKf=s5_qr80YTlXM!O8pyhD1Nuu~ z)>GJX*K#k&$ql<&(B0PP`~^JemN%X18+Wk9q(`4v1Edrm#^pqt6r;@%wFsTwN8VUt zEI4T0;4>jKmf$lfdQGrlRcLgYf&vS~6Ia1Rklx}4(Rd#(3KYtbbru0~W;7BNyr@xS z!=#J9izc1rtr&U@R7TZ-hTPDlWB)G@pP|`}d;_FkO!5!oPxlVx{TuSf(jP;2CRN>F zwgU+pNln~7*h^2*ds1IFoO3|4Usp<2c#ran2L+xEPH;xTv>%o}7AVR=ej*XG9;mf70i1|8;S@s3-SBnQ}DP*=h;sd)lkbhVrxw zfhqERFk;>Vg7sK>=wt))P_niU0)-l>8+iZrS)_e*)Ww2b1#mN5`pvyNt*;x=-%nLh zg%h*e_|5&=YHdrlmF-Q%SypFT+;rvI7=^ zygU*(E#D1gQ1M&OU|yY&LUs&67j;KsolKGr1Fm2z&Z>(&ZUl)8S@5`yDEJsLm;|dqL4o^K9~5=|pQdF+p0ZvvjIO-h;b&y8-raXtggVKiGTIme3bU>s=(3{U>ux796n zx_s{j)&t*E<9zT7pEOk@{ZT;U!xF1S*}Sl7JyLrF;TgHt*$Ya_lHgPP9OdwK|CEO8 zF>@a$wz)N;3y+GC798NzePA$xkF_~czzhK@K>!xP9BUp9@ua7dSP7CoT;W>t|2ZBI z*zdR_ahvPt9a$*G6y41 zKbTG+%Otp(WX?iD29Ot`l>{rRXb`LiRofFcbOp4D*96mQ!VO6vJcD|C4{BK$4>s5w z3Sh^Fh89q|UJ?Ow*|JQiPWTkB6+Toq%c)hL@)`RZVL#N)XYD}8u` zA=Swr)bk0E3eszI-blLqu>Lg;VVCbSZaI#`$zWLTwt_xp%7A210c=;bH=oA}0LS+1 zk7RRFK6i&}zj<87FN-Yl`VubsF;KU`@kD@0Ib9gD@?%%qyeNUXIG8?j`)7Ou zwenR^Xd*n&s&3!jflm8Fn;Aq$f)=)@9nYeLwY z`XeKOL%+zTU+%PrE_P?jn~D7qGqbBqw*iN7`jJ(ON<=}ff3^BR(cxh`s(lJjSvMJgm9Zv5|c=HikgMx&Ay;aaNIakCxYVbgpkzCv-Q!RzrUEutBi3)HE6Hq}`zkDD` zhy%zsM;LusEEELm*!?{Eq&-_ZiWCWfOFbOIiic-4@})V-^Jdh^Bcg+pX8H!baPH+b zTw+I|18Xgx+TSb(Mzx<61uI_IHM+gRyAm)Plb-tx37lLVj{j z^7SL`KA{cQTkwf@v;j^>{A$-LGixF)drJ(Ul03j1G5(jiQmaujsdV+VW(x{mM61oH z`jNG_hc2Jta~vS+=?O2^hm#K4D#YJ8uU&~x#CPQb!xawenCiv1)RZO%3@D7V~ z((=B{KMYwT^g{LKI4Tenl|<5^+?eoJgQoJ;%i@EzT)f#a5Iv-ck>(0%E1|bTku0(bCQ^bMc7oKuAZg3=m>=V^P*t#- z1RnUL;hY)RFjy*?V((5ZVA97P{T@V(*)9MlbAe0(cm1^x2#w4+6os3IJxfy;;n_pQBD_g*!BYBNIQomm&n z{!x*HljU75MaZZbmmTkX=+Y0v`Pqf8XLSA~A3y8~we^A=U?{OjF*u>f7y7dSYsd>Z znLPGb$`i4ni`yrDo@vKcoS|Sjtf}q{4_=cVq|I+xrlT^)HbmuUFv<5E)xIi~B|$qZ zB@Fd^;uoZAiln470Ax`gJ}L04c|6tjY;A(9FOh@ooH>g22&Ctk_0%7Rb{wh&paAY? z6m9-p{eph)4l?G3o2^JIn;`aptS{QK- z56Ak_&VB||fe+c1v`E?}OuMer#8M z#Xt{{$OvALJnw6M;gu2tjU{82s0felk;7zS2b&Z7>Bt(cLY3qU8Gtq`neZfgY zGwTJr+6{lVmX#KZuHxElfh&SDz6JXR&`W1u6KH7=B)-)}sR{H|$CrGe4iUWaje*oF z2ERt}r<#Ba=l4WCeZJH?E;f!KB?Q>L9!opQagqbmLdapsz!!lX)=(E6P0aEU(qn#k z4?-n3SOz03o?FfTiZbdIWq1}(OzTqNmpoYl6zYszk>KF7ZI*9gVVlNA-3ED|pIM#vtk!>}X5F)Oz&sEU{m*03X3TTUs_P4HZkBlrMiHX(2Jb<&32iG3YD7 zbKL)GmKS~mTla3tUt@W&rfvE3Up%P+@q|sviZY;6vz+KKyxOGNRyWOU(AZTSPTYqf zFTZPwMRJW#38HU#)TPH3&!(>FjF5mK6JV_Z#u{+Z7P?P~AIAVsuQ4Eg`cC}*2nZymtF(7MY{g@9N3av^KweEPWHWEMrb^jWQh<1S)#7O0QXOm=XQ{Jj@2&F7lBu zUj(Ks9?i1-(r5Hc#ypZox?MX{y@>h)i`fm?s;8K=$=Iw2?;@wGpE1tbfC;9 zZF=WG9m#TtC>dd%h##)5xn{OX^{jfjSKcx^G_{uF!JMfA9Y=31hJpYUoHjDz#mU;8 zfX7GO;bMd=3HAo7B3QC}PM-n=0M7`xo+8GMA5es+2Go|rSO7x?O!AcYuJvpE&34@7 zUk;-5fG87^3%zxDJUf5fa`19qoPIDGfd(!=$1`D_69p<+ktx{=9CIo^D6Z<17$g+q zmT>L~Lq}Zy4DI!-gX{GoPW)FDH2so=P84Dw(nxTx%sU!sq5_+)M)44(FMnj}@)fdT zmRAMjMX=)1G3Y?!YEfgH+Bjf5swm%0<(AYT(OJF|1o0(ww0%qwU`#0K(nMnW;psPT+~q8>-u9ZZMKJIGe`E#Le0SP+d1s70Nu0-_$VwlJMoV zxkeX5!`2qcw_PY$VJOh-f0+*=h2+@44eGCo%)qEuu`68+S{SOTzu!ok<+yi@4&_wk zTZ(Eh$v^}!wCICqj%dIVLV3_+0Y#-v*!Fa_nZirITzDYqqjsd;$BzIO6YKh72X(Ss zPwl-<2H-m)1iSax>%Td;`O&)Jp#R-HgNaV==7X7T@g2~|@9Q#J>U{LoeK05yl0IWig6Sddc#o46dwxjMN>vXZ>9 zNnj^PF0=&;m|K*%-IF?8{lg^}*=UQ76$AaXxJbJ7gI9b(g65C3%pobvKPC2Xh>Ks~Ap7l}cJWZpo&`2)T9zQwA=vmUd<{`;<2wc1SL9+!ZQH z!9mBr68E%;2oDdW55a36VT>q=6%GZ^`DO!y%kBFamqWXEoRbV2L1<6dFeQ>RNghmf z(4PDYVFEfW(6;{OU*Pws19oYj)B$}iHc3RhfD3;seQLLx@j}E!Yw#8GG!XKV8GOk)i+Sh;r24j~7j|!(h ziEC-)joL`=8K@@5x6g+GSrglFeK3S+AmztLYn`Ri`R9wd%A!GZG@d4-r2*Qh01JP| zU0`Mc_9TSN2|Ovhfz5t*R(sg{Ka^B-uryH*WR=fPT!)b!z#mJ4_=nkmmZ*O&sME%b z`FS5GnJ2c_L|VfGdI@EDeae)lE!x(JL&kgfj1{^x)OsNq7Ms7A^i^%~=J7(f^BVLi ztYdAbu3-mR$F{dI;P1`k>8&t%4uO*VO2z&mb_f6ZUD2Y$F_zQ68<37?>))YQc+HRi z+zj&p5F?9N`ekfeXn-lB6eAOpy%ktclcALsQ-)Je3f}h3VYR0{tZ+c*o3RPyd8~}3 z>+R*^7a4-c-Z##{(G1?-g=H)0!Y`kpwA3S7Msmf7Sag5k+=R+r7|lmwzO#^N95zM( zwao8*EUzKizk;Ba$^Nb1e_?7RDS6^_ae#i=eJ&R&+8CRv=#ryYw2TUdkhMF+?7ku) zPY+!Tja3OZwEOuiy1|?f%&vklvQgGK$Db8}UIXA_QUtj+;ILyV=>>%j z>V5x-pS`eqB@BoZ(&>x7i^w=Mxpb4OD{>kpu|Ts#wS@0dCglYj%B)TNs0 z{~TzRG%*3Ov3ZxxYZR!_UhsfQt+umfgC`k|7eY^z3iy6@SIi;SDTzwSD_UUEgxrb5 z4fw{tba$7-RD%_MJjWaI*w2b3@1hKXu{Vaa#@azC zTM-$->I3A85y(&=-5%~>8_f9VIPc;Ce%p_As_Uni4|no@1AE+JXZonEacqz|)nVE68BA6_=B&)B!_sMSf?l;DPqgs#aWs_;Q!ECrh z7z}N^=<63nz(Es?f1^=8)06PL`x8|Fp0!TV#G5`~>+IS-t*1p0_2j;O^MbIVST!4G zG1ZF*&=0mHKgbw1Z`%YWrYUX?a`M?1^WD#oOE1PeDw&uUShE>-X#mfT)?dkJ)_-b4 znj_)E=`omN{^Zc5o+CBDZi4#Kq0{ctYtYtmyqyXT(#XJnjltG?hz9HMqwl8kxkuqS zZ~V=(XEsV!2Qt>}Ym%-;3OCFyfz@?r8pTeX&u%S%Cv zs-=~|eSnyIa$A~RjQP*d!uYYdz@sY}n=AOKY4)oyuy!1T<5fP94;-k+){5eQgxZ>2Vl!+sn%%`F`KbTNqmw-r z>BVRc-#la-Rha)`2MZe;0b2rlsU|65_uZ+OYv~Pz-Q}>v=166_rcy;=h1tczp?jT1 zr<0q>(ESgUdO7H&&FLhM*PqvJ-ZwXm&vjBwCjB15NV5V69}O^&`DBG`mC8^#Uw7t+-qkytt}b=+_>}% zW(aY?Xvwv#HJba$sgiH`l+T5v!!?>GE;$+8g}sr47qILd?908^YKupXu2mfr!5-LJ z&R?dDL^_l~GJ4CpymdF3S&`ph8Q`ni@<>`N3NK4dIjsh{Z&K&+w&czA_sjmvwTsL& zfZa|5S89BdB6944AP&WR{DRh5C4iGkz@wUL*(XU)01XW^Y`Bllp#m;aj!K3r6hPD8 zf721ly5*=5yqn-Io>-+v%kqTKWgPXFp0dI}q5^(X4R0`ZpVRxp&6ppdnr5diVs?D3k7U()*gwmgc=-RJ%%57C zal1^+P!%7Y>5545tu`AJKVjl#C(eHI5D(yoc(}pd`g-Rg=1B26%TOZunLWy_piK#y z-REi(zh(?Psc-M6-7?}iG%Hl-5?w$jC@5J5ne!E)oeBC$%cacC8^kRA{gB4&aTAgGj6rE1N2i5bD{3>$7K2SuK78d0+%9mcKudqo{C`TP2HjSHvlPL0Pr` zB_RJvQ(5^kuy`Rxa@b(4Sx16??lbc~1F$9zJO&;@z?dl2vz|z_t9*C&u28-Cdk`@M zS%9O!sTK2VYxEL)*>|r~^4iTDVaZ*MCgg5Nx;t&b+C6}E)gDxEZXo6x`=#(Pio?}% z-&Mp>R8STdZ>PnUTiQ-JBx32(+ ztz~H<`rh-tqwE%v$TnK}TN-=g2Wh6yyLV(pBSWKEYG$JpahEcTEn2J(Age9=`0f+x zB7CY_t`hxP$wG9%l(WLA%kqK$%$R6-sVHcFo1AP={Ue8s}&{)DJh1vHh+L3DR<~%HnBf( z@#K-fSWssQ!t6k4ag}8!@DqZMPyU@l2*?40P!a`15G(GF8I1&mH^A-nnqCooApPX! zr8hQ5YN|07WGaAy;vWn4*9B4%7K>acgaLV#hYlpQAMNpuH}2Qjgj%-9oHC8txbrjR zH;C&Kzy0r-8#g}JUlqg10#27CdP4Zt{1 zHXc3*&H8Zsr*C|u+(67FlTF^{=6rA3Yv=sCXK+yMv(TjQ>~QByQLov?*Xg1@8Bg}-(}hYrx+6lUuhI*@<@{M>WghC~VowOo zQokJ0xYueqKkJ`!F26lT#Oe4niCIVw^e~VVUW?rnptgQ4;x8?`*>74gbGVvpUAHN| zzv#!HNnH7uxy59YcGAv=MNJp8b6#resW+Bh>R>QeTQ}=`m8S2Pm*&HLxys1v@XMph zZ))Zbn}FWU-tH5cb8NWVeb*!8Rup#x!RiHRYxhS7F9PV3xf*osVy3u6tl@hO+{mCV zW8nH>v8*_}{p6)B6G=}0>2{mi?JnW2?vh=X&&^RzQcnL@tgi8OQpe`+R-zQ10(VeH zljs1>m%7@$xR(?Hy~&kt=eoJyYqrjl#ZNJ4n{mA2XALcMzJI~syh1F`6_zcCAl0|Z(a5w6oo zb6Nuf166+-(Cl(gG=dMv1O~mnRcRk?v-`yGDT{Hs@UbR^X4x>_&Ytwo%@`H8XKL|% zBzCsiaVS@H{x$X0+GT%s>3+P(y=8}D5dX>}?N}+rDe!b>VPVd>(j?rW+k^}S%%Dd5 z>t5(H$`+S%^3fX?4wX-$JvisZC!y|XzZV1W`Z88*ZhAS7dzHO@HsjuRi(VUPRk`~3 zXQ--gSUK0hp0<_P>@>TbFiqDRtQt;nL7)250`h62lH#}50Pebs2U1VuP_J3m&y z)|ncbU*?P!< zsvl3e^7yBb;>i*hjFC?w=Z_j@8Wh{dSk>leiun>=1waMn?eu<|_zmgZN;fQvAh?P( zT3Jt&JZ;~_HCQj zw&PPzD^eKqxqQB#5mvai{dq<)!=s(bob_T8qqfXFq3A6WR00=?>ZyIx?8a^WLX0eR z0@Z8P8Ma1>G96lk^BMja12+gF*C3vJ=h*j^K&!c8MdTn}ZLXW9&~NG&d)(`+*wZls zZ*GsRH)QUI?fX|;e9@U&8rB!ZAvE@JH@qif9%^cFw~HQ#rTJh)(SgBUhMCxh_N#{C z`pogtecRR(8!{e4!w;W@TgW5t$C&T+TaHS7;^H<2!!1Ki_BQCqzkQhN&3 zf77(*t)n%Fs?3mjm{PlC-!JRmt$FS5?B7sFUkql@i|M$g-tGt>7+qemWE!|T2c-rI z-4DNVSZg(4q-j~q9T^^uo~x^RgGok%m_kGQB&Sk&+rPs;w-bEyR`y+8?;WJmYOL`0 zzTT79D3J=!dYWE;9?N}xf5o0e{49rl^t|sm@6uPZj0E5T=|-0k)lc}Z$|u#Ew)E@L zefG7EH#U;q;W4(>UnKE*42Ib>s=M&_cr{piwx8K}^mArv%jzjUw?laC(^oje3GmK% zSlfO+b5kx5pSp7-QaBLVK@qa-i`*>}5fNTxp7a7_9hQBAD^m6kf#%x#ITiiiK%4lV zfmZ(zXq0J?@Sn6s;LzP1W8~|k@GXK$x;sT!hlw=ZO1ixZ-ABC5p zP)C3XWhs{#c=Iy>=+f}3A5|eD zKjl}G-FGVo4S&Qo=~$a-ETW=-^VDfS-V4>bVisz?KB799^)ml?)ZJf}F0vNZO~d{u zZ~vnV<8^w;V2o67eL!DB-TZ-#POUDkeseZ5k&Qd1jWU@oeTg#s@V%igZfsZf_qU^_366CPPg%;Tn<1yfor-gQZ-3f% z_rHo`?pNe)VexUhVqDncG{5S%F8?zCm8E2rrQwqn78aR3Zmx7Nt+Vm|qtmcb&C!7J z>TJj;-1Ddyp*)sO#aDi2+sb$`7lY8O`^7tdf))!|xFz6AVET8()l>e*(QbNJaq29r zh;CY=AUmK8M!HihOqa zK0gf@X$@4;CKg$}9{b1>7iuU=$%2N$k2x$hLlkw`FX{P1!1NQC)>r(|!(V+Oc4_qa z+1cg$H+9X`TKn~Dt<|HREZl}3p8ZJ~`SPT4RyXue39HW*xHal8nK+5F?zG60LBtX5 z9U!z~xmRQi9R3{~R-jFT5=?1nv}~WRp;1wk$YsiV=70oe3W}lN=lc@nbckP?{sT})_J z?XUm0oOsa@-eqXifpTtRPsZ@#-E2|m*eQ2!q~M(*@5(#HuMMKL^aQoFwN;nOLy9}| z>OyOI(;tY!A9no}uu#TzdsGawo%7`pv(>NNG=2Z; z$}BSLg`$0iT5ksqHY7Ofw~w1F znEJ4%s25c8%{(jOUsSC#*WNi7yny*LndoHgY`gd6^^TehY!jOvIPd^Ad}I!XcGFGv zr8nm2Z%V!IF#57rm>WjfB>a-@P`=fQ-E^^JlOm&IH?wrL;spdAr8;&VqHP*<2;jc` zbjoeSQuQekX|jL}bN=CzG=erW_rhhT^66TPBC5oIouj2hp1Cn2fcke$f4k%reZ-L= zKlA6?IcXx04N~%6`l+Y?iYKd{3-sULcd|Rab(~EpakXxEKVLC%_snDdbIy4-_2}U- zw&H9fqxrb$2rqK#pG?yyM9f)80YS*fQuApN9nlig=|G5*=H8-V6!@^x8p((QrwA3L zO6cLd#30={!YdMY6EC$1z~O#KC}8u4!^;3OM?Mj#0s{s#-6)?tj?MQe=H1d!l zgCIPdh8~C)Fv$uMV@2SD;E;6Z*;p&yV9x*<>*ZLm_|2Bd>m&SB*P24JwkHDniKKvn zpj?K5e$`%6%t-2{nmP;xoxrey2V$@oMaF>hq6d$IB+KV91?4qq^}U6tFz~BCayd&O z`7vM*i!lqi&n2Z_ez5H%2T~Z2%KzDyS}cm?{!7D(M@(*36n_keyn&S|`hvPw7x$_w zQ^>4kOyD#IFrBSOSiB*Kg*rh!3SQQUd6=?jC8OYw1b^M~GQc5luQMK4#Tsr+4x_q@ zAiJ;>Vw)@&C$QKKLqd@!%<@sv?z~M%y1YIywtk2RuK#{BX!OX`lSlJ5wxxFKoHXGf zB1(G2HAZ?1K_H+n)9=slP#B|s6y7W+!}7&=;aS|?kSMMKQ9iKsueM3{Qzbei3D@&9 zfIDM;YNWMuM=wft<+_GES1BDTPKyboPWe#PHB*L`gqcdlhfv4|QYT*+xIM>~wR-_bAkWi5B5>N!BQ$VGqrDK5-(nvSb-5rbd z%s=Yh``+j5^Pcy)o{#qzFN?Xx9CPGv#M)_Gf?p(PoNiNH0WK+!nQDh~lTZ6twM;l? zk3F0fd!lD>xcyu=2Lm_7|09J=x59;(N{Ok>5v zU!*1mu^si2*&6@&L0jlFegEF(l1&beUpNCjQQY9ICduQX%+m-)cdw6^NP-0|-YeYM zdP2taB!7pROXX;9nbYlfFI>Ocxm6Rj=P~;6(*dzO^;@wo-8|Q15u)8k(GT$tHzqu! zf@AF;*nhV}Ii*^RR4@u!Zk-kvY1iw9RlbtmE(Jm}`^A-&&r`=K^%ke6 zYBepxFTyV1i0mzLw#=~hywcifY2^$rDJgm1s?hfNd1&amb$*m*k_Uoem(zK*kwQSJ zW+T<3Io=I<8@0yZk=q&n_@Vb{143ZJ0A(7>0a|(Q^6JIks}}^%@98OqR_!sje;!qr ze|RJs!Z~k%+BCs|BoZ6^L&@q%HZ$F*>#D=2s~+k%CQn?FP1s(u-ZT|-=%rlf*g3*% zB9m^!#MMcg3|~dcr;Qy_PVj~WB)i|CykQ=b&RHau-L*?w8PHotbtJM&|b8`xck+q*g!b{#Kp<{8m9ef#)f4|nFa;2vl7 zM$o)v^-7W*8)?_bgv9>Xbq<%kZ#C5}W4^vE`xN6*JRTmJ9IOT=1xhW3Mrs8378DFK z$ErgP^bYJt(GM=ICxv$-X8L6qTiubbsLSRfMh|%y=zvR;sy}{QgBZ`*xxKsGlYw&k zNS$N`E`QEz3V;x8>zECRE$ziW88cz?7RtV9@RB^oMMmsT`v~#Z^c|};r>)u45-9 zMcVVk3X-o37qlxfZ9J4F@Fr!nU0zsSFU36-kBg5>Ew&5!th*IG4&85t#b9=o7t6(E&MFY>AeNWlI-W4xEGRBh6*!rt#e)VNKmKWtDK%IZy@1J z!3MMLvI_<_PaTGjJENS|j}6zZ?H4Udq8~+jhdREi+aI{8S@-H_*Ng%s%*KL#6AEL| zvC(%z8YRX`!vnF{*V`u$t@hS zuG+3%vd_uJ6Y1*lhJg;Um35exo)h3ZS9&at4Hu?o5#noXuq|4ccEqmVnR*{`vuyX( zCl8n6VZ|X*S-6SQC!Gw3TexEmO{ePtcLU+j-SJor^3%Y6+>88c)wVeHTTM;WZ%eh1 z#fCM_WX$huDiWUe9}dwCh6WgJ)1-J$9ly1_PV82jM^~~UCA(;F;gYb->7nj~9W`wf z$4Mo%0uy-qh3^}@?fU~s+H1o{yR7GF%LQDez@6K$7LYd))CVDc?E{$3uKcK@5Kdhh z&vP(U_yV%Xa^64)e{#)_m(PK|^zn&egYUMrQLC|Qe%HsV^Mm7vj2MkA1vW3ozmIy% z=X8G`H|qO91{6OlS*^xUv9hE@DL8>!(X>q<(@?sEk$x~LK*c=t*)F+9WO|b0$J(Cy zi#61By_-05(GjP!-FfcnQo&TqT6;OX+AU>YnM~Q;$NIEeq7=ysd!D-`dthB}-!HY1 zKpsVSg|=`E5kPiWU35L^5Lt`J{l_aCeOJ`3bhuw)^7G1@QJD{_gc}n#>!x1HCOvgQ zy?13lJiRI_xuB{}58`FDo)3+dq=|Zo-QT~{>Ln&Njs#LIlyUA<+w**A437TFM726v zh`1Yd-Tl)i^0OzupHYes^sq^MVQ(j!zCD&dd7P4eX8eA%-)kssJhbjsRi8N++Qznj zqR#ED7zm%efJKU$EOqt3xv#cKw!_(=SJk2DowSN3gpOCQ$8vDilFh^t$26Ytstv(IuNCS?8+fdQ}> zS>Jc2`|@Vs!DJBU;LX#t`xx^R-4mA@G37@zz7mWalM?&L)gXY;x3J=JPF8%d;Ie3; zVcJ_;Ct7nF^?{)b z6UYTco&0h^X2pXdvIOF)B-xLLLHs85{#gO`AfHYQT0Sklm)IADTaMDT2v197>xA3Z zL;j;dGON4qP(3|c%g655rKyDabm(Bn*C?I_lJD?mZdc#1yW9ojd1H5pU=n|JahZDR z;L1V?gKOmd3N?n)IL=}mitvhJj#W+zfUezAjfdqp@OZeM3|N`@Q`~s~W)BwK^+7Js zJwBe+_YgJHyxsX+1d8{f^&Qh@obU3Qrr|?zFaEj9=Bb{RK7M2jJ%JzuF{P^$ghk?j z*eA%X)5vDi1T~NoP?39o1Ia$x^iok^=?ee8x3V#N*~T13q1jgfGb{79j@MJ?k@7@Y zD@AG`NM?_GBnU~seYB(bCvJ-Ci3f4P=bEI!m0sZtj*El`sNAvApC2XyAxpIshtTp+ z@97r}Mi4H2=IF{QQkBJw=cxf5fuHQ;1sxLcCOf*tQxC0V6*%|}*|oL?uGoND8Y3%)gCJ2ZH1eb9)*5#|3T_ME^j9zJ?OTXZ z;9IYAberXNI3qI(6eC~{lB6iZx#jmn#!AwBxj$dU#q zNZC{v?k_1u{5Gr>#_H zbky$cMH}n3Pz8G~)_obhA0s1a7|O*9bCsfbfEJEyWlc|FoMuwEmeJ+u<+DXV#FJ~l zK2mBKX>hHg+;A-U=7NDYcA=XF#2n!8A?6r@xVP>EeC74QFcoc!KS*2Ieo+=>=5m%~ z7>tybR3kN)q(Mgb*d-Z=;HaC1#M7s*uj!q{XgM>5UpI6)mapKP#g(p|F*LHeG^GR) zrJd9Xm!vn8M}=jMy_Hsu#1U~ZGgZs2JdztKG?TCw_=F46LD|A27W6XVH{y|Qbik3+ zftT_jAFjfjdTRTEg&ZhG(J#fgpT2sg7_OER!+U$$nNaZmKnBFam}JLqDR2^Zhyj=(`f&(Z^#@fe5a zL7HGq?`1UfF!oq8vq^bF_FR8UWtc8=1u)2zpJ?~xt&IX5IM0or>8kg7=$s`$xwf%eC6~~Go zdD4^-{UI?(!y@B-XhWH6cg?6U2_X%=4fLSjmoCg3Z$d_Ah!u)vb$;bwv?c$UH(S?2 zcOc^L_{S0B2LPdBw70n&;K^RQ%X$e7@F8Cvkls<|tI0M+9>s7h2F&Fb;$M8P`u`x@ z6^p?RBHX~p)C4^U-i5egG@q<_9nc-gdoC;F9IPMs5?%5*6>KS22_s`>$Zs$FvTiu# ztDBd!1WQVOgPOCce+4yJqO76(FwFOdV7-N>=M4afJldfslLHEp(_O0$a_@Y7K==_J z1{=-hrTV6`n85h=+13B~Y^}R6S+Z*kSSjx}3h`l5009cxvfW@K{BiWT1*T*N67Cy- z;elA1cQF`ihzknvA%>U#Qua82#{N&j-L`NHBIB+$6rze3(w^R=c9N#C@frEn8vQ-=$oHkK{US&?96+OK+ngr}AbsW%+z<5k zU|jCc=}_86^U6S%3ZddmPqfpw-`CTdVxar@;X^Z6Nu|kZxNJx(3)dW?$b8WPFk3Ye zm8?gpqH7|)nrO0;`P>Rb*uVg(Kn6&Rxn?n#vlzfGGuUTN6z`Me4dE+oAvx@%T}_zr zR~=fBB8cKG%KM)g0VK{f*Cr^zL~(;((4n=_Zfn73-#GoyQ&a=?_}#H8zj6J-`AP=@ ze3G{T&uV>?14;5Nf%y1J@-kzGh`s}Q1&O=wb;Dy^%M|SxO33J9K}oz!GTSw#%^bYo zcF0f!{7&M}0mn4g)E|knFzw@^TP*(0`Ghxez3V*(KqtL#JlxUYM}7*KX&?LSo_Nim zMzZ9SZZvNa7Wx-FKI5Gyu{@R~7pWt|eSfSBHcNyiZ9WO*3K;Tdgq2(bQfDaZlY9m4 z%K}UZ9aE*aC}BR*pC_kG0U}BB3_4Z$pU^1;DwO=B=M+Qk4X*IvphV$ZJMYPQ*B1^M zNfv?#LS-TK%khrJbz#9JN@nYW+FVIwa1AyU?Gbr%mwqCPT&mXm^zwUamD6+HCT*fL z&9F2~99eN0o8^=hcm!#(2kZJ*HFP#&KuL+*a)Ui28{NQWhEvsT%`(@_y6FI;438oB zsk@G?hOS&?v@RP=D(0@w+Lw4|nkR&2ESa%%z{Wv3G0?7_-sZ6O>e;t^{JT-yI9^XM zdK2-6_lsq9b>l}}jupRC1y$1VGs%U zAljm1VU4@%s!pVk<$Vs8`I`b;;G+Nq84nDX1>uS%0-nipJGTi5Vy5gJsf+Z5W=px%uq7yCT>qnia6w9DRxk=uVw?vN}5Y zLkOqBiugCIqR{f?oV5b=Ob#*}+@Mdc-p56Ee ziy0u|x4S>2HOfk6yfqlLuSQW8VgR`ecnZm`?=ASNK;XxAIB6diW@nK?uakv~cMimH z#lVIvUKZL^ba2fCVKjsGPmBF*gk;)h(z&oy+-r2Rt}k1k^8qb}t&HRbe*IC6TWYR! zV&&Zss#n3JusZbNREhgn$%_OJ7t*iWh2v=)gX)#T>5Tu7iK{5h8<;9C5Y^B|Er~?D z4JJ|4RC{1C-hxu?9`$eqyGSb(Kz#-VIQ@3v@$y~Q9!djq5J5HnGVT>64F`rVO8P1u zySZ}ZTn5JBc4063TNw56iby#Y{Fo5me0Go8ApV=P$`cT$NZ!_wA@ELO$-fR;Bue&> zef%I(vkDRflDrGj62NJ!07WffCQ*&>J&;Oi5r#he$1igna>E7u=^2KMBzz#enifyy z$8-`(jt5^%=$+B`H`TXfdNi)3Z^DpuVE`OszF|Jzs^D6!TL3wC zy!4-z|9Q!UV83%PeRS|v@9PEN^$gFxi=4jZBZGJ7;qNiij~4!@yg?cJmB!Ftw7KpJ zGu7MOr&_HwZpU&YpTWww?sRLBScjt_2XiK>(T=w*|gr#1s%}=k&Oh>E1lp2(Z#8Um;NWvASB({OMDZ zZ(T;*Prl*B-kIeC80<6sNEz{O(}pmwEP%adE^VkEVq;jKQgXhS7eE+Vs3UlSdjEV2 zi~#Fsk{V$R;x+Qd0FOwH8JJgb?&{t|V<`(bwS2Rw!-#<5o;_Qox zkBh1bw(@F99+{vkV8^T^DfU<154Pm4N$?2&-ol4sqF0LGc7rh;Kjw@B!lC+*5=f1@ zr=%}mF+T}x41UrxfO>?wx)i@?O#c9NemCQSKFIKE%dn)sF)-5_b%{wNR8sc3cn?-M zgIVS#`EM2e{b(@Hr=oS37O90QaWH`upqw81LSKpP!!t8EF@prRO=xx8Ar&rHTRSxYY(eomd9R} zESukmxn|JiPJVweGzqz)++0PRAU0 z?Qi1GM4=8HYN&8Be(nJ>zB?+q;<)bPhu~d}(}yPdMb3VLM?v>wZU0{P1N6#p==OXhFN2NXz{8$nn~e!BL|oKlxs$3(1(FiRq4Yh+K{Y#T|KV7yr*|Pb1x2_FK~0mp>L~-n*KJ2pAn0 zUb@LPnWNyGYdfxRZ>tRz7V5#{oh`)S8F@14Hc{?bB3M+r8 zJl^vXC&GkNb1qS^q~$56koC1Xaby|S_du@-35jw+C5qd2X&3FNgi@%&3jnrfW!G!a z6HLh~t0nL}@Oa`N)+>}SL?n&KvhJjz6V;Hof2#htb(eRHiI7Q&jx0qqkcQ*Lsj?78uu{jjrZ+`zTOX3NA8Hpr?m*1yV#(vfr2#Gry0n*ov*xUNw~3LI zQVMDjns*~ZHhGi8+V2TrxzkH!ZcgZjMQz&B2g1)^xE%Jq!%(eL|ME;pPNB=Zl9`ni zk(~oNxqbwv4$(&T=(_yGfxi8t-LhlMwTj4fX|4JZ%;6;7bhW2LYXbx2T>^vUg5r7O zyB*sRy_!-q&Z8R_xe_ES;|Q!y9y)7hL;Y^ zXoQ(SBf1n{aKdwkI+iE8`qGHvZ4J`%biDo5b7{ASOVV~mRcU;SoV^!gt zy5ofUU;kx?^M0+X(lC`l%lyq`{_JIu&o}VGe8RU?g@TQ;ZaU^6z+ksrgbHeoV_(gO zWeFdX4U1;KxVgN?r=m#oLEb0>x?S6-AmxI|m8nrIqe5G0^j)j1-XOc2datf`(K%ve{-a`*siBG+# z)@=zyk_?BJN{+uH&bkd;Tv?MkJ?B2qD9p2!0ah-3H2T zudOV-u+ALo8zNJn`Iy6Mz$J6Sw%@}^WK}hXJ$XFY8NN5)DQ_T%<$k+^pJD&x`(lD1 zpU1-6Yr=`X2R3dhckK1&2n;yoQU_Fl3rKaV&=o&kR?0ZBiAV07=~(l{XVKb%`7e+o z*<)g;^R`n+jTKdb@({Kz`S8Q#_J<+h3t%*rVxspmF4*zpLWn+{o=044S(N~Ox2uxYNI9OE#6l; z%3gY%&1iC#G)i($r%{doU-(&n`Ic8vC;NRr{EjiaUP^qB>9>4U_zDsDRWmp1YkUBx z%mWMO-pq&6Vr#OOCF1%na{TXE9T?xn3Z>5WPr8B*jMg? zxW=JeweY^5M`)+MD{CM;)icIgqgE1S@%f9U{WHSN*^_LlR&_^hI#3e!IOIb?9W;yh z5K-SB{g*^>@Hq{fJ0~I{D=DUdYZ)tMl}Bu0KDv5`>W6GzwtvO=&b{pfvDaurZZ$I} z#i(3L-J+fbVMk!BN80afx`7xubj&Z>?XmXSoCLrQi*qX6N}a2hMpKRAZA(D|0bdyY zt4mPtyuoD=*RW_hInbvJMZ80HvXbA_HtNLD2$4m87c)7+0uO-0m`LD59ii?60k>`> zX(m3q$$!t@hSRGB8Ya5Bx(T{S5&9es7r7jQMOS2=bhOZZLlt`D6hbnM5X+F3_Y+^s$}>j-vll(DZu zx&7MU9221(n^Mu%PqmUi?w&pU|IG4i1h&`o)un`IyQFT<$Nfo^)% zv;9Rku|OKZv7fgluclKKTaib2+63ML?gd_GU@rk+?{%|aA5Tn(y)*^bf3nvC#^mv&2NSj< z=YN<1bDPjlf7~gk-fQSSr};@C6|@XJ!qS)$&y23oD{zY*?(cL3kxqH(>fY9sS9}1i zNql|DH$#xlb^8@+Lvm|J-6PaxtwN~sdLaBBwy+M1VWCG!D81cXZZcpYY>m5q&<^o5 z9P-MmZk?Z>2)lJnCdIS)bO?tTP#U3w2`D83lqy*U`-$?x9Wz| zzi=S?{*--}&4JfTZNyi|K$!%-oQuK6FUrV2Qxhe;UG}+Tr8$v!_;Fq{{8v4nLw`*Q z-+{pU3(H>w)_8ZSP^4AFZL{c4r3(j2N0G@M)(n(x_GEbAU+FI+;^~f3YsxjzWjF)L?RaI2Y(Au_6^p@%ByHAp-I(P;gX<8&MWKTd@Zd!*M{wLrB^Am^V&P?jjBP$|E-OGd)uD0ks~3! zGmaT~g!^sH0r>k_#q?ZNL<=MR%y{bLubMqEM{p(sx@L^pdD^=;OGZrKJ9a{K8e%+w zQ0n+)uhc@xE(rP<4Q>Os0cyo+7z(?c`qd!RV{32*U{v(EK=^Z6TMG0$@MkGM&;m98 zaMS1y2?LJ(OT2vi1wtOhEZm8A%19R|DJ_Qj*Nu_GeI^5))wW_fAc6b^}e>%O6^Eo(B2UKK*i0r!MRqaEPo5gI_Chs z=&)15p6_?M_kqi>Hy(k@6obpC;uLwHyF!;a|5_8khQItD9cjR_KM&$OO*yeP2xk#$ zd9vZ@&H4Dp>n}s^F}E3`Ywl&)x7W#q2u#vO;W3iY~H&TFhXybhFz zq}O8&qLH)3(MhCs{^*=}5>3iBYZq>?T5D?dr@p2RaT68E!&_Hsd*_mNoN;kC0KS_6 zCpQ2_+B+g#kPiL(qmc}ZsfDBux#y2LIq;-G=hNE${E2P_rL!I|d)Y+GsbbJDNC4q9 zj@Zs12^#u)$f00s?gfha0Xw1rZ!-PUCclMCA|-U!R!@;y$;HKYqlAt>UgS3}gPdDN z)2*ti6;W@o2f#^;9!+25wo^43{`@@0;u#gCDjTgBqiWFAoBBt))G7E?wt znCgC~81WSYINP^9ASES0O3pg4VL(do&V?xcDJ9~h0Z0BN0At}lzj59*TF_S8r>3I> z?5EvsVW7`IZ1qw%g$_v}o{F1}B(JB2;d38rhCF>@{WN+mO|QGMCZw15mJGuE{8;5h zbpI(G6{5W&pA+w(5?+CC^!~_c zKj8CFFh~H4)>a`h=vi-XEccU*(6(z6>sg=J_4TY867hDv0B6qX^cd4kkFW>1~k+!ufYo9$&3W4py2tLwU7M zi{p!Rf<&tz_H6dQ{ICd9g%a8tzWE7PT!eap2l7>cdl&|w+Gm)n22Ue&6_j2f82<~2 zi3c1V?}s?;IjVRFW&SClzSr?~aV;Y+`)0fX?t$yAZzz_xoH!JHZ3hGtm{5zPw3M~W zimL1m&EBc;(w>DOkM^T+6YSpYIE;UF=CED!tsTSr(rqkagbi5Xe@|;~*5Hg&#Jr0k z+j*#xdlonyhz5g?H2)Ur-IjA()~-rH zb~3?Z_4I;@0Qw4XK!wNU`?igwpbtg}2KVIvRjR@FE4ZLS@PGxq_L2IZ4!;ZI{b`D2 zOAx*&hG83bqtauA7ax|PA;8*SkDQknw2-vkphCS;5DB8zf%bE9nTLLb%F9hSii zos4IPqWE0(-`x)?Nfcn?@;jDo2l!Yr&=P$$q5{af6ipz~)_mhph77?p(1w>U>wvu1 zmO;gmX`IG*I0mrgir_mlF8Rs=r21Kkp<2=-s59ax>p&j>sw*uz8fx23z7Gl=J(Ols z@oNWapoa^Dz-NavTk1wofEre4KxqFrwLD31Na(kG)hEB%KvN7I5_R8^?Ik$&1*pr8 zUQ+o&N;u(*89D_d+#ISDlNrcZ_I!88vq9O2INhIzmm?KQp((@Z%>imiF&MOM)7 zE9qQ=s#PRCs<)tH)Ih03#_7#^!ogKsG>8}IuYR3#%c4#49GVYMzbp0gUGN3)xC?X& zf3hZq2#~`Q&O-rOvGBN9MNt-NB1ex1Cl=oD!vObG0)KKRQZf=WwbRH!uBg{!0)9aB zL%fdpO7@=zNwPr%z14bm){#O2<|cHZfke=ZA!*F8cCfD*K~h0N&ZbcO3awKW!IcTA7b>?4wTl!2o+0XYC>H;f;?MK!Hox ziy^@Sh>Sty2Prs%9{8M((xF@FazJD>{K8xQ02TsCV{WcrjD1!=V9%0`QGF zwX`3kTR)o>nH*%C2Z&LCvhZH$C#UT< ztYv4MH)Y;Et)?(A6ca zbo}Fx+jxQYese6)CrDNDEtg5|ZTU;578h%R0$bu=3L<{ndB5S6Z-n`W5G(XE*y8e$ zN1j`nMExsL2PUj+M=F6yp#L8Xj(rPIeI!Zj*tC}e=IeCt>)szl8+c_-wIvn7d4Hh>0gSgbeTf0JN{!)-MoxDK^*t*j_y>o-t9EXNs;m1QiQS{43*(fuSH$>q z)oToc4>Z@(4Os3x8{lviakc3_{YMu6$#(#jBQY;VynS@p4zt2}*E|#g(0ncnOI}T= z9NiR$I3J)4MTCPhF`;XL2}&IkAE6a(E(6et!6 zI7kdW(xijU;`HNfW{)Z(RLWc?Fa6h7aV9vqaQW&rp+v9i``{aNL@@?VMSur^|A=gkgxmb?lsL@Jhjko zeHGn1d`Lg07Tn0YT??icHT>TyuEMaIl-3H{s#d*EcJymRFqG7pLn1c7)32jaMg1 z`XXiVDV0ERBSxiDu5|M5q4!-hkrQt$^brB9)jWslC6x24BQIq}!_|=yb45BWf)48v zlzZ)A>DKx)f*QmF1l~johPP$&K7CnI&e^jzXj!)J%5zDaZ1i9NldzMK`F42te&(X; zbX0l~sJ6e&kf;z4+}$FJO>?aq{PnV%aqPb9{vyi5Ng|wXmM1UpJ$eofx4Q=#l}R^w z-~8<_m7)xyZQX`V#t;+c2_BE;PLB(F4og!NQ8gc3owN6ab84s$oc6m1>Y*P_yoI>F zdmLwiq(-0)pW2o`oj0IQlX z&fLLoC-~3+Cb-7->l}U*enY%VMnXMrFd!Q2Jk9 zo`YlquavJzB00#@J!PY-`nB;cd0zC8_uYT^X~-_Ctip~C zV1e+yak>l<*c=GJxv0;}d5UU@B2*l=91u~_r&SF9_f+Jsl&8-wGP|pr;*k82X8tQV zqQ#(h8Ha&R!{v4IDLjUh27DFWMHV#JJv5}aQJ(>d4skf!S=4&?TSfo%1aOyypEs$% z1EC>aDPZUG*S2@Slo?>>n@We4M3KW3fcvu+5x@TP75?RS$#EDvn-~Q6S>?A?9MD$) zMEG-2$pb)%So_KJG;Zrw>TCS7Xz$;=>e+d(u+J_-WbzQSP1dsj@FHlC0^4g1eFq1l z_*5{Sx6I-0f|YL6p9$)}csfzLpJ!-17EJDk4>E|-c`JTTzNX2UY`|hH>b~D4v~^?< zWy0k2XTI`ps44u(k$YD`+UH3N^5ctjwmRsqumDG5?fOqGBTu$EbZ>@N{RcwMfj4k- z^#Ub@OVq&IhI)cnw4&mj+C&$Pkn>JxiQ6&MK`9_0@G(2P6;I;Sh}EFRe}eVoQQ6-@TR#T1MlM*JJFkCs9Bvqgp?Em~Tl8W1d`kM@OdrmiSnD8u~4pY0= zp?g~@9)IPG5zWsr^EkjDgqPf2#YGsx>Ppg(;D?j9a&|ZU;`5M~r>%wg4^NMNCmXR+ zQ1B1R4j|=h41kRlxMc&dIjTR3q*P*uEL=t_-L+2VXHfNROuhA;snf#v-NNU{k@BKP zCY5Ds_T1xwyNWomS(7z?^AM=vB#|m`!61OlOHJoLEViP_69Pu;rrKcgn zg8gPwB*WCI|p+-%ya1Au<%yl{!9=@LUN3wPnVXI7ZNnfD8RS!mBIlz`wyS113 zO<9uYps6iB<*c9Pks2@vvkj>>I|Vnl_wr45roW9+eexLhTnHPQ4(o#z(&TH%N#PrEoP8`$ANklUCqPWd%f`9AXSEkujlObE> z)*j^(CTsl%g!Q~Jx7`0#gnlyxedNE9zYN#qhtoJgh{Nrf<7LnULoT9MKk?!!@_$C~ zQprWx>Svlz)MFq?cRzj$!{_I7PBuQx#oI+5)XyX6&ST;>j}%m}dshgGk8%RmQT#u6 zS-Z?ljK+zo_$}nFm8ON_$*WAqr06qc7;nBu=(R-91(@`}t{jK!*@oCwtUN;B^Z5j& zNYt)%-t}LY#y_~K3@R_RX&kU62NWA>d4LJAcnzP;H21P0#r9W>yY|@aARI$@f9!ct zc+iGcovZ1;Sh7EZe^EPl1i3-RWi)euv6Wx};6+!GMOhQ)g+mJ0^2b9P@9m^hIx;a* zqpSZw3jki0@E5FHQ=Azx!0gu`9k7ZVZ<8tDd@%j%M5c)^;s6mfu)Jd{hqa*mC_#Fn zTCVf|d{zXGBLKMg(fR-^)CwTK{A)Bs=@l4N`Yde%-({uv%DKoU$49KgE~I zcvAqa;{`xCdszcN70d+v1a$R|wY^vi+R$GMQjv=I58nKvuHgbL{S25Yu+e7(T_V$l z;IO|yT(#D8-ou@3{OK(&^Y8TYTU|WtKY-rmG(+K^`x5@e8=iq-G(xaxToJX7njbw* z#B}(yAwF0DW1<1fM|*KOP?XgRbO80%$T8B7PBYM3Fp#AX@oxWFnfm*gGF7#`)26Le zJ)O-KGY%7Bs>U)JN9VaU!*{SJc{F{r? zfR@YQ`Au7;w_rIW%OFzdb%G%Mr}-O~Fu2Om}+8T`v3e^n~c_vmTucT|<$d1#5n%1W}( z7+nBC#x)RRwEdvC>}3Np0*e$MQHZ#_vwiHlPf8JN>*N3C8jD~c z9D@Py$14VefdOO*Uujj8XxhN4%!KI#V_*J;Fnp46ns}a19NI)t{~?(3Y=B8q-PBVO zIsR~09smNWB&MLlD+ucF3TRIOgE=%S;LNJ&@nr`31httCI0O9)(#!uL8ZykOJtTG4 zZ>)MO{(b9hfJ%g4EQs(vfC%r#Lt7T~3c>(7d@;%*4el?TfX?<&vXsjFe2RZmSF~(& zCW_~uT{ljYBd&q13XEntAg;Ut3=$sUEq}4v*Pni>Znaqud*0fMYDs02?dW92n7~S;O&LEK-UJS7Nt$j2?!6Q8G#5&ywk1 zRS4286&5b%701I3<{FiJ!^t-&)=GN|hxsO<8Woi*XW9}6#Oo?N9E`PDp;v*%g{}~AxutMf z&IQ_RofKi4cP8Rv%fxv7^9>nb?x3-YRw0B_5>}@Ks@30t_%H~#5(!(vcpk8X28EVr z-F5p%VGN^FktOiXioZ0CBYPt)0cdjwVD~1UEfM-1tU;R;QEu<_X9WcR%#ak|Cw!B! z4MFwd$(0p=oD*;YL70+|!RTf%?D6~Zc{&laY2a1?^-*MfLQ~7PPoY zP-kZ6ghxdQsp;ynLxq^}{;1?Q6%C*zieS@QNq`E~-?cGIo(2s5g%z5)rc}^LTjGl* zM*xyjjblQ9_ZqoQ6fEQ(3}VnB3<3vWE8@X+vu8$9FJQZFN8gg`Bt}tSRD=HZ?b}v# z;vsQVP~j(@H#b^H@lBx-@~YWHX{W5hlaO4l6(H1VUzNwa-$@`~#k++ira4@) z=_h%?TO1U2GXU3pTbeuY;7o?o(DT_6F8X|EnRIB8JmriA4@JZu&Vg z@`JX^K_=k*E%8(CXmS`XLm#U-cI}Op`_U)DyLth*RNTF`{Pyd^tb(Q1;q%caVqk-o z%Xly`U|9tivd&^3?*-jA|5G-|F}}!&tJoFUxzd{VQumkm1 z6mdycA`K@3k?iyeB$PHC4Xxu<{( za5?ALy)D5ut7_m--VSM38XlD2>}`xboJ2+D(Zh2~(qv?7^ zbcIek!$O82{lzPMD#0;#6vuBGsp+RqD@f(napr9eqtEt;x++c06DsJAT@X1UAyH90BV;w0M48CA0UiAVfn(od@s z@MS1&3&XblXXzJ=_Y`a$rx4%=^Eo?<-L)*c30uvhxmIHuv&YUOQ|2;%+3Dmvrg6yj zhqwwsnM`dkmlq$yr8}l*)IC$xHzg;4C{H+ z;(@(3amzrW%Hgc7690!Eqxao$qR#wdJ!3w!obb4m*JL1gwIlI|eJdyjp480YPwXw9 z??6zUZ-yobJkh*p<|i`1MJ3c4Nv}|Us`@_cjuby+3&|PgeglokK@Fflqxb^h)g}|; z)!oB|XAlDE%4=^hc?b$ZV>s6Nd&f7L4_j@)yd}~^fXr(zUAlhavn;~K$9E|h?yle9 zo*zh0R`)T9l)7d9Zsv}_L1f8hVf{yH&^*ud=se_63B2+<5vokIES?N+IJty%?uE}DWpS6bX&sm_u({;b zLp83spS#g+YjzeCEq=ckkym&jW(XS*=dyXvQ6 z55zl7nc2*IS1-aDzhBIK9QzXwoX(W9wG}b+;yk-Z(FAn96~BrdZiFDPCr92tljEBxCJ>?s+UwK%IsXZ@he|SmRcVl@M*wM4!fu|k!lP%ftD%(sN)6NAs~(s<_f|dadGm*x`$0SWMVR@pq-lI z_y8|Cie3u1SsWz&qbK^rcHB$mS7MLH#RM9K-eVVlWh-wY{m%PC?K`gOdyp^prTwvg zB52-L<`9nOTooUXEcadFy^Oeui_+GCH=78wGCv7~FN?2PZ_DM2c5@O1KVJ)aX8u-? zesp=1%;>y>l+3f%i-?8ifEjYi+~QK+4(Qz+AT9xoX_W^USKxsY3G|Tl&__SH?CUth zygW!>dpPh;M}+{=A?@1ELv2P{*M%>g{8;eYRs`Z9$WqB?VR-N0yU#C{&&nSih+F9$ zfR3?6s0o+y`9~5~e3`F)UvBg~2D8W1Yyoia91NO*U+Y1B8*l6zguV{{2i z{4xjM&Ucr&JnkBE8GdJsuB`CMS9A)5F$ARC*a>)O7sLq&SY81@OOyGB9nHrjLp3#{ z4g@O}Lmwcn7t4_!6@0}mBjMN~={Z>DvCmA`yP_=aXjM=__=WIo+(*#LrN&?nD&z&w zya3dqlw2hm2QmXD`q4E8`cFt*CwNqvTJ1}*FBh-<6bKoAupmZYN`_;F$dIPKqfCVj zaJ;rv6fV~c+MMD?2US7$o=mBz!~Db~eN)R2sjH0#f%xhv$hozB=SfidQ39aZ9MOHN z2Cta-7<5}3vNV>Y*wV`Jtm%nP?qXx>jASXb468RSt}?Xgga?Jb{Xywv z3^r0Q2)aj%yMwE*gy1uRRCI}G!HVXifM&P)(+;_ zvj}|#W_Y*i=@GA1pI=OUAS=bf_|+9Xj1~xD5T9y`F%B1A*vf&bGq`Y`Xt`JDPJe~7 zdE@^f>#L)p-lBhD7-T3Jx?>1IX+h~4QW`};q(LbKB&5@!q@_d}L_kD9Ksu#C8tHE7 zZg^+(zPEnwz5Bs_w#OOL8@0 zs4@h0?_SyWmurK2D{LCAdL5+^yv^_08-b;0gMtvbWNrb2k}B<^_5Vdjo`rWV#%kS! zUHqZV%$*OtVT<^zCQ*D@s{hRJ|4{D)1Jp+dKLp!umC~g10QJMAqBhN^<>=i60Il`* zGhLbKXzPi+4U7sG1~TL6TG}Ss!g?;Srf_bQGj@45V3c2k33v;Dq#`-O!05C+bifu#KdB7AhGt3%a`Ei`gnVT1Iz>V>5{_q(JuBm;vgWpDI zVM5n)EIA-qH%p5m zM32e>Pt+*$>*JnN8 zsXm4kzn}qr;DMQT9w`{Ym62wIJ#`u^v&yA#cGdCS=T-Z+)C(NrzR*3D@EFgi2Xdoj zX4T?*4fJ3qqwOciFkhW9H2y8XrdmK5rLEc)2t)B|a)V++xcrOg;iWvoAmGGF_?=~m z&nD^IgwDYt8vtR`g%0dYsmjuu;@-z8R`&IS=QqiifNI9?tFI&+3GRQ~A_v*TXXY?% z5Ca}^q^J2fk`j+kOf2rsO!A8Ts5Se#Jbbs#nBW5zh%R&4?Ll-U)nCT) z$U}V)e)ILd`lTl4+UlnI zbHc8ccni~OtKefRrRPAAC|D5(E`l|JHEHtcAEe6+IOqf}p({PG6>`l^^YGvrJf2Eq?saR@jT^xv_<(Z^zCe(7UTB7W6=*-tmrW|$9NC&3}i zXa2w1m)Z*fO=JLjjb-kD9ixFcP;CEJ{hE}pj9Df)@~bLP&JWJP9JRb{{BivWYiu`& zaLHJR%d^8cpQ-~>@a&+s;U6B{nQC{xTo*%hy;BBT#X^A1Kb(77DL%s@Pf~1#MaoB2 zre3c;o4NXyG`nIkWqNLkMya9{FfT8X9>}=@FlO-=c_B@q!@USzD#aZ1q9gQRH5!~_ zGW4^q)#OMF+i?V$1)&s2+XUVveF4plfiD>mSD8KIux1ub!kJp@Tr=^4fGoM&@L}m- z!x#6MzR!NlH*Ydo*rzDayNu`ZUVb_TCRzpW2~~Fui?a8m#+9eK%l%BKKT>;7yr&IN zJ3m4E|4u#*PM!v)Ds40Bd=9VMv+6yN7hfkf)t{oxKq&;U_HhV|+vDS+kB?VmX?Zzy z;qx+Z@Swj3e+Ui^F4}?VWk2gW(6c~X9Z?(v4-5J}QFA67=NV-Hk8*rj6Vm~I%6e54 zd4iou1M9cho7%pxF?8@#maf=REDt{G>Ne#)91ZNcn!|UScsX7pFX_^e0LpcKzGaZ< z{DB_$!9m(YKA+oDZ}=X6h$YhYd@LoEg!u0IXO*;ZbkUWKeE{+$IoC_@jM1M^6%{+O zh4aK9_X7XdR6t!}J z2%{9p@QFcwtEi5}y84TPEO2>vxMKFgF=ax|M^bFPyvNAI&}D%;l?3nLRoa`a)Sbc} z?(DZU;I*Yi|NY+R+ij}xS}cm~N1I~izb4ifQ_sONIiZ(aRqJQdwM#!4MW02adVZ?@ zwamTUZc|tog~M%h~+(8ebJVz%D+(-M_t%Z$7$k-?aG0g8I+({+CsUY@@0pzyJN!<}sVupbYd{9zV^7H!=?_*D%^QIL^Zk9kI&Z_OnM4`zGQtG>|_D2_~)i1ZFYkQoV z^`0Kh8=1Fs3OP_#riG^XIO;qc!Lq2?*47#!a+X*Jljnpzb%yacjP9&1_ap&qr3yJa zJ-%MwZ_^;CF8^k7a)DdorN+*lp(`-3La7Ncixr@OWFh!Ckj74kru5)IEyb`v3|6QD zEgk`Zdux0{3+#&Of$8SJSc47CmT7P#SXBj8*h7se9f@5&8qW=9;fE?XFwk~*Glp1s zahxVTAw?ANVHk82Iqd467!0S!!1qEqsacy_wA96X^AtaCLx%k+7_{Rl_~z8$qEk4-hf-k6Y>#wMkTn*BT9QImNfBB2#FnHzSkLbi{F!O2 zf@2DHOixX>H}v)f-D{6b6aS^DH3&_>GFUNBFT`J2Fnu{ymxNiWFTZc@bLU`=wFtdOp zgk4I;#9^~l&3sPl$Pxx*7A}iXdsXYWFZ#3pa>D8*=Wc6c4=udJ)OkE5NX$oz}}?+kC5gSs8e>sVrFwkH3aCoLn9*qiMwq z!Grjdk&~^ZlieQ3CySo0oZMUPe(vB>(s8u$!sWWAP3>-CVz*~Z3bo@^atKQ%*)9<+ z%-5F?CVqV8p`J~3x@DujQta?B%ht?#syI}|*+T8o|4O7{gpCd}gQc(3S@Die@s~lu z-V_Nn6^iZ*@ZPa#fa3at!6)>&`q|d%!=d+XsK>S8!k{4-XOzqbyfW?|qSQ2T#fQ$Z zb1sgy$CjKJRv)a~e6?1VaBejwemt;VYPC<{zS!uoHixs--xPlH{$*KQsz-5s&B5l# zLY{FWWY4uy-W;x|F$=WwPIHdJwfw$BWZ~gqD zlaEaEzNi~?&JtvdpiTx8x^?*>{?_f=Ayw0t@DvFbb^N5ea{_m?YCecx zyLH$(Ew1uMifhk1uJjCUx=iJ$TQyEn$8y^|*}OPd6L4CYBC=ljGn)`la{Fg^Ro&$l zpWfd3b}aX^`+9s9RqvRO?dtX=FOSagxHl>-Qa^n&u#H<`zY=>ewe2NW9f$=7YcgQ5 zJUWfH_dCpj#8MVmzvF`K`aI`usfv8!t-HD_D*BO$RUr*#za|rnY|P+__h?isdanEw z!cURQf_pz*@}B(qW9y(+E9i2Cq&Z$PuW$Pv;8>si^=XM~jm8Y6VU{v^r%3qri;$kQ zdZsp$Z!C5S3%o(~BD3VygI`1#JGn*J0_K~w^y#kEroQP{-f6o)p`hd_2_XCy=)uCa z5$*56R_8A6y8Pp@pLMemoXt>7IE)Z8wNg45PV>70ALh#H8-k?C{D=(e>y!@LsfDx9 z1yUghwPBIQtg3Gb%}i+U>HMVmU|{`UR`3;DICjK_Ov4@7;4f2A%;*MyVJ(ip|e&um6cfQtmz7@aXKIcdAfKL0XW~wCPrgd`7`IX|@Nj*DV77YzD z3ffo$A^{&k)y_wj-zNZW|nOCpKO8O%c9h6z#gp z;7=R-xPq6}V=u~I)6DQ1)ge==529Xk#`7u?;rl(0Q8+9seaDYOg-hHS$1S_i7BMtm zs83!CXp(O{9H&uMAF1VSuB3-RNUiq*;wwcpc2L6as%JD3!i z{unS63Ihd0G=?Sl`no{*wCtD7?uWLwYR?!+! zf5!|Ahg#cc*7Fd0xI~F&GaMggLa=Qe_5yb-w^uBCr@i!&lSLeZdBtmpI**CT0q_wAVX&F6f-%n6Jw?JX{AXU`e z&f#nQo>DWUJxQ!A;kDa^EvMv=7DW1{Q?k^nnc_!yi09@Pn3(XQWMA(KgDU%P1(F}% zdNuATVhCYi!grzp&m|$UPVl1l7`O1gIobTSK^BNkZaK_(1QY9j&?U!U$q;$UVm5bL zVzHWlU1Ihk56@Aw0s=|J1+N-epsrey3BRG@eIEzHALF+ba^u{jL3ZhUi%#$)XSQc< zs~I98`XiZoB#%d#X=RjM<*{7hmFkiBFcd7q4vTZ!^64vNVU2^91Eov&>Ma{YdYH~qP{9wM<1{X^`xfBb?A|1*4Uh0#K*HH`ZC z@GaF;<(PVPgR^$ai%ZY$w&qkaS23p(m_%QGx%d;Gt*ZSue|X~E=U*MC)(YBdex!QT z(#QanZlHmj?H&hhf9^|sbp6y(K*}M&tC7f32?Ajv5r3Hg9J`rXzfnpC&%Bo}dkK zyJpM?`9|Npk^WEy%P1SnA9iry5Yd0eVcc9GnR>kza*1&GcJ=Hl1@SCKucb2*Ij<(=u4=0aq5Ow zXjt%W*?>bncrr{#Uieb?;kH6@q+SXQP{kR|v62apMYn^#IcuVW*;#By~ zuax?zz)017JOtJ*4isF&M!TC*+^pM(Ila-&ta|u0OOmcAQe(DVR(aF zBWBUH(aHoP8tTYG*}vylC~s`)Mn z=K~>(kp)b?jX4VGo*vdd2(99g~HpJb0vm+sg001 zbVSHem?k`F!jZk9_49`FbGoH)lY?NQT)pAWyWRcVf;d#v$O9zwXq3;uHA2&n!f@;Q z);$UvLzhj5{OnV3-gtM&q+=9BivH~Sr!7NNe^m5K zYQzIZat-4Y2z@jZ9LboAgnT76jvO9Hnl01mmAy!bQG_Na2|>K|_BaXM>?%UxjS0ow zTEWI|(nfC7spXG+b0J~=(DJ-^p=d5EIKlT}Qvb>MWmrcnubm(d0BzCbmfj>9@~cEjuQcrg!a z*DwNvI|9Nh)t@UPL9_D*|1Nzf(@EEWm~H*jRN3J4xn@k5u6n~(AiN7x?vxN{J-q~R zA|hGvIgQ%IAKDzYNb#0?)myhGRfE$RM;=QK)+ec@c}X@t2ySS-1d%_VV?4Db+(<2D zj#+N!ITzqGD=TZ?aQ-(ViTb<7@XK1W1RW%lLagrm%3kkm!l57;WJxF(4FjF8?2 z>jF5CH<1K*Pzb*U1`_qb2a3_44ua;+Bu&|$dl~Wcwk{#U9^(m4mQwLn_LvKb7-1-H z>FQ``EAn~_@%$wmtXcLE%ktSxqkniq;jdahKK^E~nwayj7OTkQVhe|XZ5k-HJ(=JJ zv28Y^*WOcS{K6yW^`XqU?fR^i+RCme2SRIZX}U#_=gu!IJntJTSy?@`NXvXC<`T7X zedXcrK6#yM=Hw=BItu?{kRK>MT_?-+yziKeT{b}PEy|c;*`&{`C4iH=PB*(oJ zCV~-vfZRtXfYr1}q%6XH+jRKEMhJnd{QlhXVl-M$_6Nnb$NLr%Lav9}O_lyl>snR9 z-T`Xntba3|Kj%$0dJJc8rT_CdCs!|$vf5ZE=u|2EZ%*S;-jU<}DD;_btiBGRgL`ADj=7N+h2pR<6{Emj0L_3W#N zD>nPU_C^=T6KbUPg9DX2JMKMMt)7Vb$?c)yly@&GW=dSr!X|30SZKs8eJNIIO<0ok z8Ehyg>CAg#LnwOF@>-}Qj#MhYmEyI>-{a)|ASRnK&{as3>52T19>)68e%0Pl$4b1P zIRvYXm&WHqeXt~r$hc;3gO&T6`j}MrreVS|DI`=86J_Rh(6;f*xNr9Oc~LZ?x!d*8 z7xUL24_YkWRhv*fJOxRPk}(nFH)&BdqS+nN?}d}!YE+F&tZQ84w5$J0+-><($Exf1 zrh2%TN2^Y(kR1axg(|{d$SkoQ31t)1CZBV^;u0s%u15%8y!ov^UwH#m1lvU!c3N-U zofnySUYIJm5&KAEK>dO3E%0vO%h)-X!yrs>Cg98=(BMTTxGIRE zt{Npzybua}_LX8DK^f2OL$DlJ+B1x5@z3Zf9zb>mgQJ~B7Xj4i$QoLV>yyJm* zgI|j6w))c&^Ef0H`C1aSfYoF|%<%0ptKsBnx}A4#Y)b=6rz`ku&dfX0c%9WOe4IE_!-b)Xob{%Wa00{&Bs4bZdA(0v%OAek_jZN?p)f}4u? za@6}hUMQSG!6w7@>#h~{Ax=AeChj}^lIjIEad1Doc`Gjbc(~v8y%&poU-Ys`7~k)` zZ*BvuygWWgZ}X67NLX54Z4Abu>ngLoOnb)|B@_8bTGR=j zcU7byR;4<}Ena_KwmUvlqfk~|07^kYIaj16Gc@9SQl)V4^RH)vripre1XXWT*zs@L!iV`3R;{jv5R28kIhpU+|$1;8R8FhikggB7t9@q0xsL5wS^Bb`U8^*WYaKk5ky z5nCwO28Fv{JG*Qkfu0*eu1|9o1Iop2>>?Yygpql1<4Jh^8!~1m%ZZOSYL5JWXSPLL ztKd^ys&;hT)-G39`{HO8!V+P;NIW-LxnFAiOO(5Ip>bd)e(*=VOXsd~z|8MW!&kSl zG|UpS8q-#=tB*GxjR|kIX{0I_JQK{$@yOv3%4P)j8~%6j7B!6bOR$*zr4-!Yc+>Fv zgI}*n0#>q5@x4hF+`w9c`#Iv3jvb{JD+LHf_y{S$J)|xF`Fw<6FXk4=8fPVdlxolk zim?bg_7sNmz@vo7{ zYY%_jsD>tpB6C^*bq%Aa8eW=hLn0-HBS)zkX=&$j zd=9afdeeHjaEnL$a2UMaU7c@#3R_SIHEf^{--kcHzvV5h zu-eLUbiNs?6kgjEWgwbU;C}mm-mJVjc$vno{R1SBfe;)t4ZwMG;lP)KimWf_rM5`# z=zK1H<{o+Etsdc6*X*2>K}i`@w;!l$o$fdB0pzY(lD&0uijnjQ(^0xnt5)Z02}V}U zISZ-*u;l3}blqz2QmBJdBhU7Z(wS4v{s6;yZeG6Xu*btZUI7WMYk-6i&3K^0mYQAd zT4BM#Way<@;Q|COdI$G!a7CQFil7750b#*FAdN4gXrTVe7^K+O_Q@x-SZti*<7a}Aoj0Xk&vhw_(?Ra zk|^-}p-eLb1@4jb)7lYc|GcK_ZyIjI?>)=_^;-^s&~NW$`z!a?Q;f80=sJCUq%c2s zsMdzkefjo2?=8pWZW+hAluT-d(crs_mvegVlB z`N^+A_Z9=@dJAnCD>O`jVh~^&T&rfgX=88nU0LkOuH9%yxTK7l#7b?{F3*l`F?bBc zbG6QtSoFNxb;7E>o>Thuvp3j8HuuNd94NU_z0t`a2@S~U>)Y-!V9|GF^%|wrPhP9t zd74=9PBbc*Nm@8AYXQMT1+w)id=BC)*iCm(@^jXUm-WrIPb|i=7=LY z0~NDn$avm%NO9d%zUpkgN!v-O%juhTeQ`h< z@cQRW)AmoCLtQ2kiEQINYsXi!^64EmL;O)?zI@F-6ppx_oa7&6*mHzg!8oO8if7- zQAQmj*|PmpF**EWc~;MV!FX=Uy{#rWK*qay8+qhj0s zJux(0l__7}fhXZ4o{C*aPR8~1Ea4}>8>17v30EaNj%7S&VX!uENd5<)?nxAK#4{i^ zdcdw~4pgrv0t+SNw z-X_G%i`{Wa@8Y=BsPDe`B#@&%0DzITfo%NdY2uBd3{Sr@$jNE1hLqL^iB0?qNzdkv zUZa@b^m(Rn<2<)FnG|5h+gJ+7gf`|y%sD}d!1L36DDBd|T>Isr{XU?h&I|dP{4!Kz z$^KfhTP5DTrDy3aqWRJKoG4lds36~I_;<@Krz%$QX8l_CM3R=X-8Z8f;&uFtVhKbG zh4iV$v6xVhAL;*dV~u6MJPFYhto!esj%W7lHufe467D|;pvWnH|4OTeZuFfIN`z}}YEr)NW4YW6JM z^QzQZk7h^3Y_2z2>Y|BRPSeKzQ*V^a@0hspH+mnz*;jT|RIt3QxI85WG{|m6(%-5# zZ`l6n@jjy0D30bZ*E{AnPsmC)yi0I{u=g%u#L|L)z?bW{(S1w&Fb`?rumF&W)&zv_ zxv6vt8&;fT`0(3C+6QL(yv}C)HWOs?AWU{cUy=$LHbIbqRuZ@^z&+Z(+SPsf)Xe&f z`0|1rJpCXTSin{AellxEArREjVEpEP~*TV4y8{$t<**;W>-3!6W~540rJ7{ z1Rna9wzfxA6;9v1J8pNFURJRxKTto)u8VJxKZVHRdtdDXQAnQer~#uFNPA@D8Z8Rf{E zA{E#fbgTC-F_Y!=-vIXND_sFwB}B}GF|tiFe$xEzS{`_8GhK$)YP2nk zpg@bvSDFU1I^NuOu;@6n$Gq#Eg>V1AED^JJLZaaY;#SZ2Jq z-8pHSJ`P)rCVwoiZCQ$#BVnl^Yi`1z!sSNMe)=l=ii_Z3aWo+e7OnHQQ$rf!XrVFq z9@}xX>9jXjl0+3O!!DOzB_B_4}oi&;?Nzf~hUeX53W89I!5n*gS3 zXN$vzlZ{~^!|{r>AmDHOE$XZHOFT~buEuKvG$jF6q09C!=;(Ug)v|*Z@q(DMF>#;c zDFF#6=f)Kx+4v!0sNa$*PZn>QWsqw}=a2)~NLOZfTpZ*CT|(oIK?v6IXHI z8zGe39i8e}+J!;`J;?v7?aAl@G7W$sb9Pv<7*Ih_&RBAAiRBI!1%PL+UnE>)StZ_} z!Zr9PWC}6n3j6T+-I#x-PsrqF#cPtvSCm`tf5J(&C>kySEz%7i(2=P%TOqd`%6H|i zg0~A?gEUj=e_>~Q1=9r_X-5?U3GEGoV?mJ$7^DGx>G#Q5JjFt8Zj2FsMCv+G0+B&z zn_il55g=YpcCv%i-?Qm?SNp2b%Q3DWykrE3A9l=SaPa?CKvyaxS-(h1t<5e7X_U>O zXcLh6k9q0$h3SGov9Y&h5Z)criL`}3a7!XN569E8FsV}>b|3Rj}s z<5RP5G2cVIJ8wEeuGrkiX)aX`N}uOiLu8e5l@=t?COAur&Ky1S2~F2=jW32t8%6%= z!`uJ#VK+IQ4E!}Kpb$!Cek^d97)X|p6VQHE1>b1C(q46rts7=092^S_(`Z11FuVQT z+bg#3j(A32OCn+GBSDfxeyVrehd76^f}i9lwl z)QB4}R2V?g5wZnS95l^9@vMJQJA;~2!5~IKKLET3r61#FV0^%9nDy>7m=D!_!GeJS z&Ul{Wu}mI})}~yWf#5v&SwgVYoqGItS1oo<{BiKWs1Me*+7v)c{xGzd zWH??u)efuw@sffJ4;?Yu|JKv4N@yEU018oE2J0jp1dtNUXg}#4ab1$?xyveR0jMQN_9)RbZOC)(DZkwn+8ZZey8(=v@L#YB4qt(nLH(4NLD9fk zM$t)g2>4f|NILN}475=sQlstTA+1gJ1Cd)ESw10KM~9!^tQys1ka@fY4yg9NVmM$v zGf-YaM6^tQU3T+{&CCy(4!|VSq<2f7H!Zhz&m(C16P@h*?_Hn{j_d0{n-?i2x$7&=c*8VpT(r* z&TyVvQiOJ{z1B5NOOtk6Bz=Zk$>;uhQ$}3cuz=`3r(5ZIcxa8Nh68YqhuhD=*Ov(Z*Ak3x-PM}!5*84| zTfzLO5aVH}$tK>LRLIKxe7bLAE zg`|yT3me8^nL-QsQO8J6S-`)qtlZuQ!;8fnmXd|+lAla;Si z*aw{>oEwe)dH;6waf@$ppU0DEI?~I~^WPwuPmQeC>90Rg>6u=0cwF%o?}um7zzTq74^lypWW*Tp+n`Xc->)&z8yr&!Vu{|N3D^NF5DweqI2! zBDCxD;-|1^-Nmb<5gyUdpj{#08OlJl9?boppDb7*F2nXyVnX}LQj$(80pKTt!#>|9 zVbNFXkf~=ZPAZct(GcmLJN zTX0u#PUUXl!gz-+6(KVed%9b<;^nDzr{?mOpay*tw$QbPW6Q6$D(w+uat7j6b zDW<%zSZGsA%+_6b9b4j{ z6Eh(jYz(>4_*aZ75I-v9{3j}t`2i-Mlv#QuWqX z0#`cNxc7}ro@p!y-O4~xE$S)bltDp=oI*8wSJ z3k}#e1@bfw7}OeO(rcM>eGwMH>mfka5uM}Q=F zV|Y-eA|qN@g=#k9b;%@-+IyNiJJh(9#+{m@U%j1)mQ<^2Ouhc-Os9+sMz3|n6;e5y zqAc%|e2FhbhDEtv!RS98GZ|bS^ExMem@0wGym|s7QJ#`W`%dvH*Vg2_;8iz=h_jN@Ig42+a@d=)6$j2tic_L_WSA=8n&L_ zA|A==Ul~e%kH6VnG0Y|&59&GCmn%OQ2}szt?((e~HN%6hT%jMUqr<9eLit= z+yw*vt3YB&TS9bsM6CSJu@j#eXN)qzThKZFe5?F0b0pfN244hBcuKojOU!2gau2d$ zh{wSV%qaf{K3W-zQnwwIKaOB=%E9y-jA6vWjEekCE`#--qZw;^8)as`UO0$QgrmOr z9hjozI*}FwaXCNNK5CkJ-nZcQCu6qnq-}!6h1mKyY}$(!JLK{RzEP()(*HO-&iI!3 zjPii@MQ@D3&;EMo^j(F^5b$DQ9V@j1S@vF}-2hHfvRL;sCOJM6l=0uBn8?qV23hf> zx;|HagqN;Z16x*;B&;6c8}{t43C8}z29dE6_PIAw@=T!%Z zdGmuF96XXSL6DrfK8ra_51FWGIEo3OvPXUAV`==}ExVC{G%1fj@27lXmR@R<`UFA7cgBFtd z11gwf-}BV=(SM5ZhptgKs_-{W7CRXq%ny9Mnx-M^uLsjj9)TMSpbc9@ z;V_csI^jbV*HHc3P+J*BOoqDwJO{XI3WH9-NkW;;!s?@UK4pddb)dZeoPW{CzW)HA z{*(6~*M)FWd+@KQBp}i`Tg>gPwEX!L?SuH<+TiYatYU(<2Z0Ty&^ND>RZnA%HOHDy z_0GBycn0>2yg!j%Gh{8A6Z5twNg+}4_1`{kjFnV#KLD=Nav^Pfsug$9l&=K_M|}Dr z7ti%H*J@o|yHw7q!0Jj(C+KFg5G4)DmH5^{NR8Z2LK&nr>#-qm&&!WWZSi%POOz@& zTZZ}{U+j)_wT69E#6#Q~~! zAn*wi*bl_wS*2{Lho`~B?~!-@0J-zOvj-+IG5l8lH53C@y{|OI;K6bb;HyIl0`Dqv zqwP1#iqknodQEw1Iio0#cb~o%u_M~G7Q_2!ckvJzRunhT@2sq>{K>2OO<#PtO@I)} zkzwy(`#T^$$!-%VH1j5Cj&O_?a$Pd6*)BvBNQKFaDt*x%gJ8Pm*zeDy11W zmg$gCA$xn=zn)EzX*3Z2ZPss1XmBa(cgU~J8^oYts|Q^I*cArm`G1wpWf~$D4mAzO zct&Ac^ZH%cm#jJ_V=3UQM+?>HRJ4ESJAZkcFG7F&iXbJjx?}f!WAUoqA+Uv2CM<)` zcn|h(dvv}|yv5HS{rlnye{(AChw59I7nsp z69se_tOxV(mpWr~3{}-ba;DbovPxdJgf#CFGQ|hAQd;rIvR|1qFvaV6%&3tBu$(!(Gd~#38FQ+Rv@5w8G)rdE8Obg0 z|9>oLz>{qcA(vfUtRnuApZ^%U>BNTo=^{Sb^YyFz^L+j18yPQ{;CX1zHxw^hnT4K2 zJbL+rO`1bjc(`o$%fYc0QvZcefSOly+8;u{1ao+(0L%^+n=Ci>@GARZ2Y43+Rbrvu zZ;g->e!UT#bOEUb;~nj(EI4tTM*aC=yaqK&)d3?n$^!I)8;%d#bU}7t&A;OHV?!j@ za3Nm%%S&uG1V0ZxeVC1U&V1)X<*KkIYNR_>A#9l$+Oybg6qBd&E3`-GonMI)?$#M5 zBW80*_OtmI%Z@mPSV@~NO3lJJ2fVHN7ew;c^HO47%K2vrX7x3n>K_lKoSVV4;N4K% z7P}-Rk<{Yt#_N0f@z>ty3r0X_g;(S;N?kCpPy?(2aP&AI1Op zbKISwzyx1I^XGs83~;Zsu!(5l z!8_S_GrFCgyl}bNpw_F}!4Y-YitUtK^(br)&lTrB)N!2MrYhWP=;9 zpPQMaQPy04ckJFlIBm3>6#k)7iN5=yTa_@WEaNWuoepdENA99zBOf9jJ$@J3JG)4Z z7#8z)|2;e%_d9NZcJ1gPtv;`uTl*n?W8th_rq3LkK(`Rc&t6{CgWSO9O~mbjKSoDB zgN?iQwcO}}5ptOQ_#~Z@rT%x9_SKy}e8fS)-m#%OeN1p%=vO|JzF1kzk-9Af?l6%u zHUHHOY?ixdbMpJZ{121;;7+IY6dnwNTzo!nrOgTE;Kjp*XsH2+!sDJ@_(!#DI6|>! zQXPALT=PTIG`v}-r-qUl75izuiKWR$JA@*HjfST~oV3s=M_$TPCFkmVWR0OwoS%f5 zj7J|O3jB>uxrp}xjQfL>PADx80zx^P64`3KwBxkX8d@tMAJVbDHqi2@>!@5aWMHZE zj4^%LDeQ|90;w;~+Y3)yCYO1Z+Bhkk>Ut{Z+(YZ3B7k}v?0Y5e;r-SbT!*%Q|KyPO z)ps@g8vFabjd(cwjRJi&wNVc)~193Q>n2L48<_u4<`I%m_XAFTnNxy=6Z_CV2Sv~&Z=oT4}2?$ z5q>Cd@aF$)RZ$6DaHCsQRxSHEl&oJ>eWVN`yUZWn?T@sYhM#;0fMxoqD3ddr=a6dO zvaN)(CdaPzrisaNdK;)-(@R;uH=1o!K%%4_08$TkpVLUX_w0>z-`9I_Tn2^|x3o@H zgsDbQ>YsN82&f;nz>r^=ep^Oe&!4P&@*9RqEeBBcx}9^8{wh>li!;U}rYdjHkTTf1 zMG(|8pCjnGYBZn=y@nxC4T+gxSj~j*ob)kXZ_@+vN1O7DKWTf-1dAV`QITjG?}cs9 z8A$1Q{nxOV;0$P{ozxqdSs8-oip6_*w(!tK6|LIvW!L4r4g0M>_EA6szaD7v)o5FZ zqSe_r14HoKYpF$~n28TIyJ~iGe5S-^hxosx-?h&h^9V@0Vy zZ1pVuu?%_?ymOZHwzkvr^t;j8gw>NrDAmw z2FfI@c5HI9Y&4!E%%A#F`Pm@L(Gngv@92Kw$fi7&@>nJ_sB-oDX1H`JW7^<`!-C~? zYFm97;#*SdI!E_v?EAYPuM9Z%@BH?{e9oge#cFiGd&}6LgaCn@r2-~7ZjlIgoqL%o z`xTUb3ky~q-^rae$M5|a{Snt&F!1@67|lTsT(A1Yz1j<;RNCOPXyd$GBK$uSKdf!# zk3PFy?JO{NCUR0b+s*`j3%-tz2;dGq`Cu~FtFm@c>F9LMono5NnacvJU^5O!u*!o3 z&}Z_ovDx#B$A@JOKHFYIn%g;P8H_8J(%VGz^ZNyXgp4wTwD&&C*b$^>t9b8<)EbaB z&%4q`oQ|V99_8wv;vEc;MuuGfn4TY8Fm5|-Sy^D$%I=I?1Gic-!)a@bZa8)d3FMmR zJv^ALl~`-=yQB%SFAaIK&moSsm#f!)>3#lQ2>Y-nD)}9JiTWZKvBPqw zT8nc0X98-0fy77bYZqfBPHO|$YxD>{Xyb$MJ?vKEi;I<-1nBW!O*$$5g7eVy7B zC*?Z>zthcy>R8Eih7wQ%ED#S_r8=G~wue=py0n?6jI{Y|ak8`4??zsFycsa^`9={q zGI+!71_Ovyxd!Eu;WX=0_@C8iuhK12J>@vTxH`?dV6paO5&XD({cv<@LoM)v#73Z{ zzoi0MDpbjD@Suac24Nn{K+HkU+iMSI-6!{*{DjIhBp&(1d`rzvF?%S%mCNUIlyP!- z_J}7=!Km(;otM7Bo}16y#nbT`E0N1Gx9msb%=D5OlfzrD@l+&au1zu6a%BLt6gb#< zmHlYzsUJBHOYw+2PJ)IM*2{o<%UmOP2ts=b!c ztGDHLu3osG#bNu?+o&vFIqr_y_D%25)(Gm&`?jnGVJ*9&bo*u8KHHi4P18GzW|4hO z*ivT)!K1Ie8~5pXbn5H8R?nXb)PC!osXl)6> ztZ;cQHOlK{hUZ}?|C1$xA==41xw_R@g#IS?0o(VmsnHsGHZK6ySnO$XnrM})whc>ndk^tcl#b9!FxGjsl(ubq^Q%4cJ$yEY zm5!vN8OElG&ZRCclsY-~4bQh208+5 z=Ov`28tt>cbce)oKkcqpjlzRw2K$l+Mxh2hR{KhS%VeRzWu@5Pk@eHD%zeTD`5+CG zM>MfSN~+u85>Gp-`7zyD4LD4ci+lk9n- z#Ukm*@MY8@LB@p6kSW;i*BGsTmLil*t{u6OXIYgJ%R9yJE=Mq7zyA8WFSr_L5@lyB z1BNwy90TBuMh%TIpBpe=UO1%9|17jt^lB3`(mUeSJ}<IU32FNZRri?7%gEGtY&fX&mk?U;^6M%Ja{s1$dq<}p$b*uWz(`FGhl9XA}+D# zjX(1KN+*|YT7>nP|Ax#9UpOn9AD`lPt_)X=&b>J7Yn1^T%^6J(?0e@?zni^&h*hD!VLT*TL@T zeU!l^e)yh*!){VaTl6PICtaH%@xYlRXEO{W6MN)$`kV7+);jGxt31aFhpw{)Sp-n9 z*5nO3Yjajr)ecof(yoEIPj`^0s1DuWC>}$uR;JH*uf+{!)ixjX4$YW_o(&{!4i4wd zoNHcsUvj6{c}7Z{#d7oG@Rsa0YK@h< z4Igs8&8GIW)^?TK!KGvdU0`T5T4Q7KgZe{;8KDKSfBAde@;~_-i^aPZ_2Glkb7ivE zkE(VI{NV_}4TPN15}h)Dxi7B1x}W_U_j2u;@VfH<-y=mYwUkPdvETT70*ypilrQiY zds8EjZsLvt=BP?zwL6Y8yj2^6RgVM^kWl#hmU^;cIoXU8EbaRXFH9EHNSW;e8!1?% zgVSw3Q;FTXOY-?sbASDaN?+=F83&Ko7Z@T1&Jv{`FXPIo+@>M`D^5>9qEgK6Xbubu z@GHc(Plc*z+(5b%_0>xU&u*O-4c13M(~ zxU*U?d|tqM8vY56ki=>!hRJNS_+2C{6E}|1HdSuU3`EOo1XX^XtE}x0Rk0&Pr7DMA zWmCSoaI9rlm8rezQ8cUV*$$`l@SqpcW6AWvwe6xgWIq!-8LZd-UyS`_RMcJDKMqUj z03rht(v38NbeE(8l9HozN=SEu($XbeQqs~Pl9JNh-JQdK&*^oq=lAk?>B6;Ve~aYSH49{|XR5P7UGY#SmiI{VSkcyOU1j~d z!u)SQt#BG=*{?BocMCf2NA;BwnHWJ66qSo-GwfsKxqmM^Zx zM3R?Wef`k3;&p8DZ?8`JI6(JFZJ*0L2F}lxeUFn81EGf3l`ZMH;e@+WJ}p1IoDX%l zoc@^oaxZF?2*gkovAh3Dr!X?fPTy^}7q7TCX3Rlg{gQMCIgP@McZdvCK>tR&^p%@_Ezo%lFkX%ZzN?i;lkk4bP-l++oAk2T zd-XlA^%gRyst<-fI~~l+g%Ys6NQ15RrzG%L&rzi(sr<$;U*i@yG}g~m8f-~(+7k$I z{op#y_H7t=A0yE;_nX;0pV+VyieL*Or+39kL3S>Rv5GFKB2351fBpnOOstm^Iqpk| z!JN_=KksxM_;u)bvDPa>c3s;rX*e97%K7>5>3>yRQkN(}%l=|`xFB7CL4vRTMfbmS z!Av<$?VmdZM%CsoPtbUw)FEeaz=39bTio6{4^;Xd&V*d zfl~j>2><-x6U~PY)2_J!r46V5Hw)kz3r9lwh@#X&>tT5dl|;zXZ_q}3>fMy-h*Ee1 zKYijh^Va3^2n9-}h-lX*gc{@%!FCdqzQ?^Ku-jESt$Q@m0#Z6pKuV{?mc9yTh1}4; zw}GNhNobd==zQJ{CP}QcJd?4(zD_4cbH$}T483Jk%~w_Z;4^MxCFEVcP|4*yaB;0L zebsa!D(fHom~NoUZiVxX@8FReyv}rUy4o@#p&OK>C(zt_u4x-c-kt5BtF<^`33y&t zsk&7@Ew#Kyy8mSG%MP1NNEYl}&Sjl(#vu{0P%kn{+)yZMlpYkCQR=j7d^BO)yDGa5f!9GIMOF)nfk#k4D@mkG__=n-;mnsYwY=9_T~?_PS8&}Y)o22u%2&_! zP>9OzSSKPwz36#DS}t!Z!DIrSZP7#TSULrQ{N-|=<5EGJ{4_xotZ7j;c;FWT)^)t# z4OGc_*H94(!A?fqv`ayK(JM6y;=@kL5loqbrUN85n@O1tiO*dWo{8&sKNG*;v2Jrs zEOB~r?7t+wJ*QNETy`D-dgUl)hpS0)mD1-K_von{HkrO*ee2`O8$WFJbiAN?M|E5l>ihb%|Gv$p(Lh1{-rrq4$T8XqWz zDF3v@(QaJT-1_YUGdM{&^0uCr;+<0yYb-9yY`VR3>g00Uy4pxRUW>sNC6^Q4ZdjGQWa(Pb%{I4e@xK-6(~#L_pmMVNV(M72U^Lw%U<&Z+Pa{x;bn& z_ZMewyXZv0Sm@vfUTamF_C1(L)DHg%7(jEO7pk!!)Jb4diuBh z$<+mBus)8=7qv&^}g9^c60cI zyuM+hsY9BUhbdLmJ7OC$NU%+Q%f0S@apv%yIl+BxT9ncKd{@Px!u7B8lKBTg1RkU*g#c{@}2ho32&~X}9izx$8H%soNIOh3lkpEF9FN2nxiZKSzYL zfu@_{ts~MCu70Uv2bNX>O-D4)S9YG?JSfc0Z|B`)aAm*DKCY0!Nb_6As%q`%`lk@aLF$Yy&%=WOx^!x9={9_^hJw98EeW%$-O(h%@OyT~x$aQbW+p@?7A1LD6(-Yp$ixh!N z4NSdz(etU|?&jhx|6A#Ann$`3fjC&(V_)~W%w0Y`mvVvsPWXI(bl&EEFp{61(?8aa z(0}b&Q`O#9)aT=^CkzrLJ(x32BaB7xr;N)WbtQ8EQSO(?mwCRx0_;ee~6SVZwT~lJtw) z)Dbzi1rI(uu7DAj4>7tA= z4CW6@Z0NpH_~Iym%7*Igc;5pt{eVKkB;eSr6<=;RqcI{|f?;)z8&_78&~eLo(ROnX zy&t45Fz?Orfzxq!RO=z4VMuXe%4~4U^~PdEiqHm$Ri`?y2c{JBFcux=rRWdmRqk99 zHIWDy?DUkYg=qe26h2!u9Le?*Iyww)5t%)laJn)`4rj7Dbe<)5J+*V&Nu$z^(hpg@ zw4dIj6Tu{%_t+szx*uhXDZDQ#WUt_t1i?+i^+{b8@1;%7#1;{~##P=cZst(zNuP4N zUk|sP@=qoLbw${ow+xlS@`KjBl1|e2t}HEPn*F)>s%_>ZyjXjdEL5%kY&g$5RmQmd zO3M_hM#)d%xFd193iR?Qu)foG`K<4uIn5xYu^h2g` z3r#Od6{Wr5$!=Q}_$mRdpTmTx8M2ugB5lTsqt~Ust!U!2U2U-5%H6olkx(J$uau}2 zj&vvp*w*#NGJGX2xFPAj6-$WwYo4*dr#BZueQ==5%u zqEKk2eEAoeA3DaeD!GX++EycaBao@dwu>;;NG@QNj)=5YcZ_`ZTHr@KhTf$XBopehs?@YF|*Y4NZqd+d0QN$nBmO{d%#sOZExY5ovLw_(7uTg5j<1P-vX}ai~ zLfC?~NtEl2!_t6q#?2IYQy1Eb!Mutw)%b;2XfiH%Snmzvr?2okOI#qxz}Z%WhlE4@cKdB zu56|_(iHupVhH!gbJTOUD5^0`KRgPM9M}E26!f4C(+1L*)4f!OJ@gx;C7JM{rk^61 zOfVE(ZxjOmjrN%Uq%kEwO!%y_d#g@Bmy=|(nZPX2-R1_+YG!3Do`T zB0Jets7$rvo)h63VW08qB%!xndj;)e7fL|=U}8606l-p8)*Q#QOu->G8%OJ6a*jYwj5r z#ZLXa(b?FQtw4xSupSF4=B?n`+H>ttI<+vKGhH`ksb|;l7xf3e!A3f242HKiCN>OM z9X2jUS!g3q}9>X#juIocH2=c_+QdXAXN&s9$7ibN6~%v|cFx;%fb-~CzG zozgglG+G@|`Hahs7+o_N0z!v87LW1J5RO)aDWzrfb!_eV)7Z-PJz$rG5Z*Kjp}5OH zCH(P@B4ZE5_NSO7sP$$qUZySZ$CTb)@TwPU#}IQndzSB%J);un#udI>7GqMQ-CJvE zaBDg;uyIbv-cC-6KJ;;ku6mw}Z``fNIX2@F|aeRXk=K!9>Qyo7C}(=0%l` zyQYvs&%YRo{_VNd%W*LNGlHp`r|>c8yC+7z3+2#3l!Z`pRD~SQ#x__e@xH=NgNome zB{VBrF^C=x+7aoNTgmmmw>~#;KXY3W&otvmaI`&6ab5*~j>DTt9*275YOH~beoY{EBQ0Uc-7Rn&lkG8EZ$;P*q5 zmv&jprLa;l7%cl!<OBZ-(fb7=7tqV!h42z2id?y{3pgBR2wj{$k_h0EfJ1PKNkOBqtR)F4 zC=H+V2k1OEdlZX|N(%zpSv%t0QB9CFhM8zk_$!h0@w+^cJwe>}iC9`HY1!8q0Vj_( zw?DHwoNWr!yVw%Z>5D9(J}^LiPI^oWnsZOhKp_q;O~)5#+aKAV&Jzn&23rz^9RoVG zwb0JlOjjw{v#_YQ3^g_oXaED%o20$sAr0z)m)>vkyuIBe&CE-G@;sK1K*;RF=xlF0 zw!M`Vy2ASu%P6847*dm?sdxA@1@=c1MJsYKCLsN!Pu%XL5^$X?A|VE z)?U&3as_R!Oei7QQ1P+78KS?Nxf|)9+%4$@Y;{|-0zs^fVSaA^=Nqpp3kRC&+h6dz zn*!s%(rj;CJ_jVgJk!2w6e*%%;6cANR9N0tnDo=nxj)hg$%v18p?yD_>jMFnJ0-LL zx-^n$>|m=A2`MmNCFGc0DWho{;9a0@@nKWRfvgS0XcoiR;W~$%oeCR=U?@Z)$0r`{ zk0WXrgYSGyYCyhgbYlM7*ibLcpY+_*)?MR|%z zukT=vdLupQ2*j^IqcdKPS;x}=C}i$`gN$t7@KO_^QO2;0ZNlo zt}HW8jA;mZGJ0eS5|2a_d@W)tdxc{wtxOqZhom68XueIa zdAjx2p4B*FhZWOU%nmsHH4B)>ziXnQOD9J$Arp@^+p!4rf5>30Jrn|?F-DkC10eg_ z&8Bnk4h)AvQK7`ba(FF_N!sWQ*=A`1W<*=a^g)FLh%cEBX*`i@s#;A|VIB z_18D@Ogg2FU1fhkAfYi<`TBHA*bDz-AXGd&4*mxl?`gIt@Xs>VR36$pOQ7mU82;Wq z%Ym)S!$33()w>H31tAN7fN_y>{mHc%FfaYrAfza^{NgD!DrXtSsBBpPMCkeJ*RQ|M zLx29*Z+v^?=p6t_WrH<)s3gva{~6>o!J{adog7Hzm)vDFyd_*wi>kq{iqMwEarsy2 z2Jt9RHiCxOgU%l*SCnkGXwZij*lkg!97kY)syQ+b+C=n17DJH!v|7ILoLcI$`d7MH)u*a2buRiRJX30*~KG5`NO<^LK;%7oU+tn*v zZufF)yoq9Tf-h%|MH(g2s`N@(NOv%*GnLt4N}Kp`1|X7M%pZDvZm^gOQk$rIuB4Lf zR{eTHl&4pL2W#!I7N0v~5;#tMr~O273#MoXP6Crjo0#0L_)kDl>`VIaeaB?b;I_1S6( z@S)VjxJ$&|Q}4U?_g%Nr`x4myZoZ}2s^mzw=woLHlU8`ikbQA#uDTURn6CL&?;Paz z>GXG|vPnv`%V+7*Fn&mcK!J-M*JnntiSRnqQr;mnRU=PISs{NyelAh*X~^NP$j}0f zJ%Lp|O@xx+EHf~Ke?uws8wK{ArGY~BMi0Ylbe!w6J;{Z^WI2U|k_?d9lO4p^o2kkH zel;=OiB8C3qSjik`es`&1y0s*%9_22NBD+C+Dxrom^4VGE*(0V2PudD*Mg4~0Xii> z5xNAbdlia25;CG>)&=?p()w;wzB8u$MRFhnPK>U{m=~1eC8yM`+V!fE0TO8dyjWcl z!n@D|YE;cHg`oTHPj`T*kj>un0_7s-94Kow*EtZ)h7k6I)}5telXC+d&vKsIU)W|H zhuEq`hR2#slb%Ocrdtg}e?P-&*z}K6H1#226{94rS8L~~u9!LHrYk{Mqif@e(mk(# zsd?e|#pf_<{z;JJ#HB89Y;3A4n}3N)*lj^2fk^5_hU*y3O+n7#LsUVepqrq>PYh~H zwO9$IV*938{Ool;ujkfRLSzXUN>VVx(Z=-cUz7gNO&462YD#XuIKGz?yORl1d+_Wl z)UVadnCC)qW@$Q5O;VDezBiux_y2T0-#iPy78Sy*c&|M~LWoR+5bk53TJirF))GD` z3o;@#9?(9;GK}DF9tBul%~Rp;R3R`_B0^Wy0bqlF!3BYhwJ8Q>NcJtRlt`f4L zpR;9Yq8Odcdlxp1m&h_37~D1kAb$#V3k~w-k*ELXQ45{rDEDNcaTlAg*W@eSM6+@sB2up zv>13HBJ%Ch@-Q-3Lf=t%OwV zfx;(Sr`K;C_GXcWDv^AZBU`*bPRsM+Gl;E-kVs0-6B)_24qt+q#L9*!WhAgBd$eCw zq?c_n6sm*n``KqZYYY`v)Rph> z9qF%sZ*O1`C-d+1wL$E)*Y;piWBXnI+T_cS>@HSNUzBmebk>j}V9a^ueP*owIN`1y zD+LVqmT;KqC)+CPPg!+rg8HIdxtb0_8Xr&2H@O!$p3t+oUNK268rQ#DJv>!aN_4YM ztbNZhR;)f_&X1{1P5^b)hX2ZqdJFw0$QfL^mC>LfoCra#<)0-08dZTH|Jb4&OWrA= z*=y3-ZiYuK7O*%ChoF;#F&L#R!!1zpfW>QFDMQ(HWNrqfvl~X!+>dza91XhPgFEbn z8UI%u6!$!mY~NwO?{jv_wCMdiCFgms&=1Gy32;SxX7#ThO+mG0>2D7Aa=mJ8M{O{f ziRhqQhCC;ofPG|ykNmdEh)DgrZqgHw?Cd9=m|!a;yq5lGs-7c5?wLC8W(pw_^$H^% zEiCkVlYsi{cK>FigjHtM7`K_QkItp?&HcW+#Yk0BpC{>Grbr~x^`BfQEs66rhLO6& z2Im(qL1E@KAN}8mt3Dohd-%k|vbQB)>E9`L(s!*9S4lm2)O*<;M9;%VWDUZFzAlUb zh`4`WUbs;#!n@W~&3_uo4_xDqv0>j_YbctIr+1E%=go{w7#6#w{h)VPKe+rsD>Y3T z=oFTfx2M*dzQ;^^s=%QuTqitIL=v}#J$Bik%|fD9^^T)%{3e*9aig76W+1i7zTd4k zO)#=?oq>Qwqw(j@^GCmb{~lgxBF_SO+4`IfzP^qTY$8r02OR2CkeMPrJ%3+IUB~9^ zko(rKv)98Dhq}Pd_o)B|vN{q<8byIe*tze2eoMbjF)j#IA$)ELDyjGENRF23FHf1y zTEuPs8Y-Q}`*nX=lebieDcF#0;nMiAt}b*?s8$-Anb~4CY+#^OCc1V|WHR=}Vf_!$ z)lVXHoJ)xmr#>QUl z)X8()2oiL*$L7OG6OTb1%vuZKqh=CE7SK_Us}T7}Z@Nh~;RF zjWiUZl8Um6FVW3jqidEL-4{N+`@lHMCT)(Vy1wC(w$nTDla=(>)w|r`V8L&gRDNO4 zo9P|o4xV9m4bOGGQoY%}Px*0a9ixI#?aEFEOM9+bfp6otp?iuIJvy%u(Gt`0jsB*E z%>79YXw{wnj2S7o!wb(n%brcgIDjbHHK%dQ=o6N%tDbs#XG#RB^4QE2=58Em40_&_ zdLGxm%WE^9wHPU`GF!B2coX`*MC-uY+V3UeEe$eA}Fas zWo^cJv%s9RG~oqjU!#kz#@S;Bgz2CSs;=r-ywn-sx$<(aJ zrcd>FtuKEp_<*X>F{i+EZI4Pat+ehx+h*C7D)ee()t2^f(_;XeDIn-#PTdhCtV-Eu#7p_7)Uq@%rC~HLU!s^7<}UrVp~_5 zn0yBho8~2M2la6R(*&1%#EIEYqPg?M-7}j`2OoeWIQ67hD;sLZYHJ|_7%tSmMf#jF z1G3m>{EFIo5XR=bcLl{~(@rJ$a}^JtPu?D3W0hVdZ+j}STBAoB4`xzW7G(kl*e`05 zD&v0n`7?5yQkYT(7+0@)giE)2j42aIinF7ho;70Jt8%_OMK_!7tt}NPa+~qg>C3wbzvB6nqM<;f%PZ(MRr+%w})9RH(1s z;gxruOkjuQ1vy&cG}N3|p&LG!yJ(f%7 zG$iBr&VJcw8^jfb)*J(z52opw+ZA#^{bYzko$+OTwI!mid6n=xQ`#6g&ZWrz0-L=$ z#|go^97}HPj!ddG#kx#>Ek?H>faI{Vr>85VS-^g93S+T1*`F4le|-x~>Q~4&W>nBW zaDMGXDOF*=spj2sp9GQj38#%|!tT;+reKhmzV*L+z+zi)?##tE;rik4_H>+PMu1+=*N?brqTcLTj+lXL{g@*G9X2i-t z6z&-Ot;LZ7A(KV|GlG@$yRxnC`?&{M7E-%XLN5e?WF^XXUx)t35%7 zuPt2-2lX-I#rkyYjM$Hax>P@Sv=zT`(f@fq_~y8_|Hx&&&T`{PFQR^*RWo8FUum$- zUU59jTr%I4CfNP@&Mwt#)^AEwr|r=>8gl`)66k3XL-aaBgmch*DW8It|9%(P()_bzl!yCeA+Oq>j|tXd=fLuhT4xZr#k!sRnsq@HH-Cs~r)ax|9R z6rYzz+Jna}HuK%$a94T`?}A(KEGyaJQWs632g&AE=?m5u2@h9axQu7nJ3(s3hT}yiV9cze?)aDR(IrN}xOX z!aQu|tD?#A6)dZ47JQ|{h-qL!nk+ghucE0jj(%q^X?M&%VPs@ft1uI1ZH9}D*>o*< zs|MGwo+a2lLB^4xOuYNlp)T?egLL=Y*!iaM))zO2Lt>v-ORbfl)s|Pz3iOaNRkeBtB6(R^ zN`1w^+C9OGURNtk4$WJT3y332sz#TIYPpI|$GwM>_H|8MUL^@z(l^1U`xKY4nmbc! zTUtgZhfjDX?>_zLX>EpDWp!hNR%vC#yb^inmN;by2w*{||2*r#=xpEoX!Z;}yTNl$ zU+|RO$tJV47tFwU;Z+_hfX6<4Ntb7P_S$ly7zcK6@EBvhJupM69cdSe?>a3a zX@c(Y@wdm7p>M~Z(i7m2GvEhv%LoT?6j_!HSak(a| z(yYhTU0s7WtzPAK?fK=4XE zni35#4yxpLBQyIoAsF$e!GzS%VkRjFV%R=n#kgYkq;ss1=i&S3ul7KofjYrw?#6VI zkosauqDP!k8y$$L64p?+SBM}tb;Xp`TeD}F*29m*nNh<6#3et6`H6w3Gn8_g0rQld z$07{E_+<`O^$H@5_Y~16jmRT@8j7A~lB_B#Nk$3$uRS{a-%nKKwIjB~yaAH%eN2!T zhnNqT*yXc92}K5DyCnui%sE)@_No0sO#Sdeexg(P6LDO~mx2&KKaBYIVQ31Y9bca*WVsr;ag?o>t%u8n4R;W@QyGYtLoE#= z>Eb7uF&IYTnpqlJD{j(Xx^&fj>KmA4-1sxQuxjXJvY(Xnso8X&|5xh9z-G)+H)5r> zKGL*l6Wop>?K)g1@s7sl0dgFA;=IVqW@W9W3VdWp$8#}C36GjxBHvbIT?SOJp*r$` ze;|2OEGwsMVg*J~#qLORPD8snY(&pn;FHaDI8Pc6DGAv4H^eA*Q>-cqH&ksoBKd?0 zHpFJ&BK@5)?IdI>RIdU1S^2;kgb>vPPa3GQ4`!gxds=p;*7qOY60B%)%9?rLM~f@? zoYSS{Bkd^&?DWU#rg&xd<2^t21v@2aS;cNrt6VC&vb|!?*3A%~0sD9K?KtfgSZT_L zgpBj`>pCCg61phS_6S$b1O3Ij&Cs4ismHj)s`y47!4LLAv1$Fk4mCehBVz3Tvc)^C z(kows1NIpXAy*A%qKD5Tomo1ZMe(CT3k?39{rz$^XA|;_2@F`t#Fwo3t_p6wU3~FV zzW@CP-HPG;1o3t=;VB(X8HZ zV6b->|3#Chi3e5F1_8eeWf3wewNbSRqb3vDPi0x-YN9mrhnV4|P@bv{7H%q!Ymk;$KGF zQ%8{lVvMM2u2x~7{!}jTlOI=>dWgxLal=RJA0QGXYtRU2k)$qlV_?#h!>tJpRw!b= zk_HF2V+@G|<8!&YZ%-hu0M<)3A?MW&hOw(1)XDYWyioTMLshj5@=(uxK!~BPwf7k> zxvgC)(UT%TTw+0u_O&lKSSt=3tl?=y#f!MHABV9RIG711!?RS1Rd`0ZWvh_c{>ua8 zF}n9|H-9cA9Md9W34FOA(2%GgZR$vMn$|#xF}3P=KhAdrflZ4Uk8ug2eo&(T5}T+| z?}ZYbMOEu2dS$a(&c{9im^)+^yV=!bO4}+}a2O}40}BXuG5-T|)ZM2jT3Pyo zAfIKrC)ia;2cV&r)yV_tpatZ3{bRRA%%`m#`RhB)7qZWo*#&uD14fy`$n=yOZy=5| zxel+fD1O=tHd{j&kft}R(jSf5)a)dTfDM>#X#W92_Mq<708aOJkb=@G(dvzpM`FWM z(XuY=cOZC(>3+IPw=+=^v%XGmxC1C-SQHfYn;|OjoKE^%x6_*&Tp~I_CYtx)S2(pc zXb`Km{{oIlD%D4RQ=!)s`vh#9WqI#*-*+kTMTxBRCa^Fv60p{F`Jo#s|TzO30ArF14s(}OI z6a!0h{-9Mjj#Y9z1H1oWm7F7z<0&VfyaL`ooLBbp9i};tCs~0FT1dcnyTUiED|1B9i0@MfmL>0?nTYI^b3ilWQ763 zW{Nf;{(C>y!clW#mRY-vxAwcWip*NF_))f76oYZb3Zl$O^o7{3NoiMaa7xdQF!vMk z&W#VFSl3P|?(63y;OnOOwJG%bs8#H3fmiT{ynWUm0L^qou0p}XsHOPSdN$v6GMBhp zvSz{Gblh=!oBH=mJet2w^Ejh}W4uDF)CN;q(Hi$E&F|P(FqeuJR(DX;1&#?zBaRg2 zl@uub>RknF51}`hl^#>LT5~_-lT(s+ktS?Whppbg+xeIO`<4&e{hEh&knWx6s`;}_SG#{-*-r&-@b?LrjJp237Y|lAc*D~# zcw3A;A7h&C!e^uR71Kks-F!te2}V3ksLpAV5rctxs>oz}?tFh^c(5&%U=CwiS-;Uq zN}29;&kpyE>Sdk!56>#CGa?J3dj#g%mD1xSdX|r9rCf{UFJ9g26q4TAtl3*37@>pt zA8anKH?HYYsk|;-(W+3XPj|<3coyuL-51TSM(8RmKzE6i)sOUu#r}*4<6}ZavXc`vesNT1YHZ=^Qeo;MUMq{1H?N!?a?(?~^y?$})63z0KrrkCmIX*An$San;o zFpmW|o$^Qio|bKcz79%Mnpa*e`*$Pv1HrfS~ zMOv-bmN#bjJAd$zo6y6W!MwAUF!lgZ=AT~ZrXdtw`bez4kZsKpPo6DHG-`($n(CC4 z@n`rUV!$|)`(b?R=US)g&W@Ki?~!{}1#PDIn0>y^e?R?{>Hf-gXY5hK9)C0Ca0`XI ztVr^eSKBqMCh1v!j8Veex$P5Ic-er%x17oguSdNd{*ksK4ZBJkJ*J_A{C#r$i9)gk zk1xFf1fL#aZkXENWXU^CPDCcmUChp~t#(z4#*&ma^6C20%qO4IkuoeS07COlKZ6v` zeq}`{N(O+zk0 zFSH&hBI-`R;6kqngS}vPwm1lEUoB#<@a}27_*J6j_3fmrQOP}he0;p;TrfQLts&2o z&bq%lPoy_RZGTveIKLEBU=rKN)}r8>y1BMnh)$CUFHaZ~d^>nQhK=h@Em0`mK1I>Y zJ}3l_iqTAa3BbFxLO3wEdj2YIw?oyNa^_=8wqCdMg4-LBE3^2=&#LN*wd>lyr60}f zEIp900{|SPK$T)#v`#;0-gBE8s%R_Fd^vQlp}#VJoqJ#M z|4` z0?Kz|jD?8*^7H>EoCY7nlwqrFb;EuNbh5jO0z5B$=^2L@X|}p&+HM^T_I~`pm~@0} z?vmdiA#{?kA>RT=Asd{rX_g)>ONvRB$HE=BUKDmc{~R3C`>;!#QXQGThTSyHJKAAq zKD&6OQAy;hC0i2^`V68uo}X1>Jk^;N|9g_$uU5d6f=B_yPg;_1?w;-SrU>U4!D&`_ z|Cv|5FY%F3Uq7XUwp9^RiK?>#4XUo$5*^5E_hSf)du#KlQLXT~y++g7wD;No@IS@p+e4 zl1@C{Q_!v0&q;&Fx;fXyK7@kCFhwW_UMSNh_9JCk#X`OyY}@o@W7e<8;$+w(%>8nVz2| z<2*H(5IP$;a!!b=O{1Bm|JC6p`U`p+xZ-)oU73j z$D3X51ReKTTCVPL2e$8<55r!!>}Z(sZxc-?6ug>(y+hbPfvglW2zSFAn8k{g{a1aw zXFG$R)ex5(`Da_0p+e1+e8d9I11?E@Q4yvwG({4P;DzxI+tq#d-spwPni%i1 zqO}%naR?B)d_2*jJ%V5?g!2puZ1ol8V2aXygwD#Wv+NC4yQUJFA0~!KV z3p<5$0B}i!{oEDcMAGvQ1WQ|@UwR$4jAZ(6*YhY^5|bFOeKD?kwQ+EB(8#ECd*Wrv z|ApuwdbY9=1tgYmXso$Fw{U{JVB*DUp0R>R49||YC+}W@j&Tco4SNGFbUe{I)XdlM z=NSWl7Y|BLH!fmFeF(T6^`Ge{5_cBa8?6YkY5jAedNn90sC|4M0z;fDL**SyJdXgR9uZf6JyNgqaFm*$O130-A)t=JitA#MSX zhwwn#$6o;KiH!ooT8gz74uwzw5d>Sj?Y#UNby* z&w+R{Is7Q`_M9C4C&+=w0y7EI(*n%TK17XK}Tg)P{E-BB4?Pxk$w+?-U^B0$hN0l8WF} zG>0byom$!t(N{)|7a*4a|3@2AOsLCvFYcsuQjJX)5C`{wgXt#}FB{*sfKhfR2=E2} z4}7BnH&S3TBA{%*u%QkrHNm0;m4UKTLZaCCLrioD+1=44F-R2<*CT8==+F>#1hu;SZwq5Ddrx`OklYO6FE7ph6*ZAQ-_Q!Xr(o4epzDW@OWY zVPyOxiZZ}xkR&3=hXQGu@IS1O|L0+;TATyl5|YRc2=7G}*h6(jA{}Xsuw5?ydB`DU z`%^E0HBJwXHU4N7D8>T(!jAS{#iw|(H}9#$A?V*&NHKhUfWL{+OL|l)=Z8Onz;W)y;tpDe>4S5FHdH|6F z7<&=_0})aRM4UadkV#kyQIFz2pZrUCE_FAJq|J?V%m^Z zxL`HGo-6sl_Y~uwUp)UQG?gYw9bB|RyE2wJ4jh?NG2QKe?pyVk05?E63t21Nrwx4n zL(L~zeW?g^aXwP?1?nFu9e_Y2Qzbd<`i=STXlqnxcjG?{B#ELiQX&^3u;r*O9aPBz zz#MN`E6`_hjiBk6tG>#%6=bN{D4U!y@CrfFm#`>O#D^Y%TXwBj^y(MFR4x2G5C8yw zM}!W4>) z0iNlFywCYm!FGty%Tb%voL#Vi01R~e=NQUg$$af*h8dSKz5DXh94rcbbI-^GwIAofs(4R@8sOvG6XC^ zJZq2@fYL|o>_6rz{r{V}WPN`kWFbV0!zx1TA)qg(@@G8p1_X0ep+p0KiiyQM*sG+! z40xh&M~~Y70YP4$e~f@yto#+Iu3doH4#huU^9egJ9le=VOcW@$5sy~k=%q}I+78(3 zKlv*K&?QZVfWa8z#rBf(y(;xu5K)>D;BF&AZf=9D_7P$lh$xLkze=eZB1+S1LGu>} zT?#>22`T*ckI?QYAXS2xVzOx25LRS|I3Fbt`tO07ucX4qQROLENPItqFmRzN|K2MK z|Ia%3R~-OBbWDXLDih(NM5eu9&7UB#p0@Tbimz9nO#12_cjO7G47(ymz_^N}7e~rl zO+9(8TPB`|--K>De!1?v1K+)ko8ehldYxA_jE<0!^*fC? z8o(GTEB)`MjRsI6{2m~~!51Ccypl&X06$ITWbh;k*;mCs(5Cs=&*OZHI>{7`)?s&4 zZd!XLC)c=XbbMTX;mwW0L9?gvrDB5|*r9$bF9($%e}oB9s|Fvht|=N=ri{>5_ynQ- zhzA)3e3jpf(MRBO&D!@X7@-$={z-tUG-A?cNT~7vt;)zjW5DTOln@UV=;C@ShD8uD zW$C?@;l?;o<*|jURcDaIRjN-1)(*=i?9b(tmMUJKQLyNhTn(J*rH)!#Q&)Uf_zH zg(^ec2NSL2mUQ-oueI}}mUQ@(j>V3}UOu@?<;3{71sc=nWYJ793T#1ryTKuDJ&${2woy9Xt45Z9 zJ<(E>tjF8@G)L{~V9r!^Ydkw&^~sr9{umasv9)SUv3?ULw=p9E6#?Y;}9R!I?&}dKR zbIQ)D{M}${unL!GmPB3|efKMV*p?hH#>POtLM81?vCtoLvwnEINrrvOeDvK;j|`cD z$^XaRe}*-=ZR_K(h8B825fzZoL_mrt(jg#7lOi2Kf{GwrsZv7#6+wzrQJM-OUAjsM zV4(_1m5$P+27%C%{O5zNz1DA?z4kfpx!#ZG!{UmI@H}&lIp-+%J;s=q7^iVtt*h(7 zK`m;Jl?=9y)qLn%$4s@3ccjx5JX-z2Apf`p2Di?V)-MJ>mA)ddS(Kg?omz>-gE7zZK|tMoYx)cM#q;#$>u0IJFM_0w zpqE9|<-nHKMnO0qi_utiByql%&{u5Q%a{cq%kXXWeA)wB^k(#+Ab+OT;PrIe>Q)ft z*@hhxw})-aZ+=Jz`R~>b~M&|J8wA)Cx&K%~YBZadUcB@W6v{%h<5DlmJ{> zl(u#lv2=Ra*Jrv^yj5@zU<@?``K>vffTX+?+cn%8E-_sZ{Aew?eDp6^gz(?7h>=1K zLncmz_oT*?=*suoG$i49Gj83F!wLX)(No(M-dMFhaiMmLu8w=ZtSlK8;v4s5uD`|a zsA?2p?oNZH>vaORCDeB)yYPDGnPR6TFQ@+2XCGFxe7&BZF^`e4?jK$dGI5W5u{}lE zjMjTrirX}qP8w=8Rvt{YV!X5CRwuc$Hjw??$^}j#o>@0ZINy6%cUpd8q<_JT zV{;VwF-&FET3AFRN&KPD*lmj;+{4~aDOcWU4DM%{V`I&J@l8Ia5}j6Z`Ik?C*06N%$&T?<~A^2_jb(u;t(@&MIwZSF2VfDGYD$N42pJ@ z+eH!ad~C5cjcQ~|U(ws(7**8>5XFgZTc^YHS;F-IO8XnIEBY&7r|3^e`c&AE6`dy6 zvXZT1+Z(~w_4O-qZWez00zl10f1~E3L&Xz2EU^H$LOv3FGaEEF()z?gU*kv58|$Nm z8q-BqB^UaNT#`)ZbLHk*yT# zI$T|?uPKUlJji(uu)Lu4J;{^{5b;(V_efQ1vWa!iAlF&#YV= zoP?qz9Lrbg+o_Ykgu7vavo(q7J|l#{?)vJ-+q7*`t-9x|?`~dDo#K$Kmg$;+Y z%udJRZVK`SCGPl&A3Tl@d`Q%xuHz=@%93|2*>oJPl^Hn z-1d=sP`+sImO6RI_!tAx4e}4(L*M+pHx~c0H^P{tqzo-BooeybA3OA&Ec1z)i>#qLqTRLml6B6-+W86Q>2Pp#@sF+9~7j`x+|jf1%mmB-HP5qfV#d^oVX&+uUnVZr#(M5hGvERCj{l$iNlK zbCHVo8P4ca86 zBi}IhN&PrBp>E)TK>XjPNBiF>E7jLmOQm1~Y|GXsthRT`N-fQ`?}B&)it~VfQxm*# z-jWpyf8)cs^FiorCf;Z0M3?XC&}clRJ0M8Dl7kkwsVshsK2Ijn>u=CZ!8nFzg;R?8 z;VO!?DqzgBz3dr>2y}O^8g(_m6B)u3Rwgl7{u@glO7R8qt84L76=v4nNhvDzlmJO8 zqn#>BQuy%_?S|<~mm<3Pt4=BBkh966n7hllxiGoG8RVe{;*?)_fmh4V1MmUXR!#~K z^IDzQ4C6iW$C!gryf9!A7lF3HwwXGkl$Z5{zh>g?C~P-7p08F0kaERG`%^a>X6P5e z0Bx7{2UHYTf6BD}f*=^TAj4Zj{RBd{rwTGuPWXTvuEr=#$jQEt zs;D${{v~=FO}Lcan8W&oTuGjKPIeg!KRCeh`HK?Gmumq$;fEYpP)J&UGsGE8ABJxp z1bG?1;>O>jVrBV!>$#|O^I}zS6l4A*sA5`qqR{2}{NsgKS4BU$9b?=&x+LI!nU(WL zePqa>>zXzC;r6yzhuH4Ikk)X=g-1xribB7Ds>eM>M|--D?q1NMBXm(?MM7{>4vko-MW8 zWpcy^&(=**coX%`Eq1xCEsn$>rp?NSiC##KX&W??~@q0u}V5x zVtgf(Av1YU;}KyL6?Qeotq9*`B3GU6oJs9hIpD3a^Xfy_%*sSiNbn_T`*nsL-0;j5 za-JZEG3$faw*J;Bokbg%@|GqqTxII{S5$L7Hgq!c9P>uJu0^>`ox)nZryyX4n5a%u z)BSMFV9aW^P4eu8RL6W+Pm4Nvh-CJFR29f)XsdxT19=>=KdEqrSpclc037Lc19;PQ0Eie{BlJau=^~ zDdC)J1mBNmaW-LJCYTUxR;T7etF8lO=`kR(C7p|;OvGNL;1M`IJwX9LJLE&PC&5MQ z7M9rjh5EPPpqYh{q&JhJNYby5SZ0~+4e!DKYU5k zyRG$Rb=@)*(Bd)&0pgxn7I-$6&%>h20=U8xS!Nk^9kPIOHb_W)N*2|6M|0%h=K-ai zZ?*vqF{}>Y*lR(@uV>mEUJm8e$fE+F9FbqjH})kI+gZ9QUg!a*++F{`i3;7G`Pv59 zMa2pf70pW|&Bj`nM~s$7_tA~K=4m1|AH(QXr=1Gcp!D+(JrN;|C(a@y-FueYLH6@@ zsUNYI+{#?H!S&~QJ7+LXHd`fm_K8Er;}oDFr?vlz;0Cg8FgXKDe$}*g;6W^Xjd{(@ zqW0S}6>;}GXK*D~5^H|8dOScm__g|4wFYTq7r8KW3>ylJKDSpD(^@R_c!y{1_4X8*vKsu7if z9PwN8T$d-u4|rRov7P#qK!5(Ga`v}0Y3sP`3{m07^p{oO!l$#TRU_A~^OnW+yV`km(WRSaxaj||gm-t3P@NlVLV2GcvYPSBq6YDxXGU&G0 zHlL+p>BBr5bPQ55*`pjqVD~)#IurbE;f$6NZG%!K0rP=cwXSB-+r7KcXDTj%xYORP z-&%|zofBmItqu4`lsGhFXHN=T1{?V*&aZig|M)g2#yAar=w-FuMRhHD7)Sxjwukh5 zKLjS?dSyKZSTnJMFq?-5|D1?7Hp{h~ifi93b}L|T$=bSeEp$X0*MOs{V!86(u-1l6EJj+PP*-}n`2DiN04)x z7&dEgM%&~t`lWI7A~=3x;P`!yyN-h!gA_4UsvFJ#rTTsR5KmC7(u2eLBJfKHg5N%= z@j_}ukNC2gbV2)&y6f_Ats!G{e!t-D?zi2PY2xb#DJsZ5V*wUD2UvG6{5rHtT2lm| z{d59QV`=w>cfZoo3>3E-6u-NHr#<+_C5~k2jO4#?>^86JVa3WQOXU4^*(J$WS_T0bp zZ@4;giNj^7iAW=g^6-eS*={uIsv6sOr1G7n|Ep0hn^GxzM=h-W z8boaW8Y{M$>U-UnvySbQ0FkmE512`J%&as~fxi)|vL?26@5tR9w!f%E%j083s4|vN z6^rt_{O)ejp&cy-0^xGDN3xjrGIp@&>%pmczKBKT=C{MaiFBmfvjZBT&W~?gqE=;{ znzngN_1!f?ioJM_ncD{_kM+`>#jAqgFrG?Wng4-l+gWy~qy*o1=Xk0PVH&##93pU) zDa*4%*D>%g01@&~9(w|@Aiws6niygusxpvCrr?>v3^i?pA|dlD(*%=hGf-P>3}e3K zYjfSwRl>{Y#Qr1r8oT%Lh?1F&pFU6l`r`cj#9IQWv;Xzv>Io|)LmFVhI3nH92)p8-^4A- z9kd)IpSyV&YYRy)UX)Q|mF_*H2e!V0|Bk671D7n~q0%SVt*Xu|E?`drUKQ-g3a}?H zMwTj5ssbtm0gKUvV9H;s&C4FXbKWwWf+sICD1^n6l4nv_g^Fj5`-~bj!|=0(c|qf2 zz5Bw2WBdXsjHX~C{%f(tT<)(4t&ztP@$bvB{a9i8=aw^H-3SAltBmDN!S@S$eC);Z+Tx@-Y#g8mBC0DzyLK}yN-;`%)l94IB#@e-jw&Nk=|2fH

&QksfgT6(@GiA;SRH$+P_RFPhLD``WF1 zQNhvbheAGf*Mhso1uwYqm|Ciy{86OyXGG}dw+ldE7udq91J70r_r?{!hVYh664d58a#*#Rm<#B{vw31e(xTQVS{818w29DpO(GnJhw4f>f#hXRlmMybcZ z1ZeQV-&|%;L@ZdYWdMn9Ok5l z2s*PsmHtjd&e|B}oq^jz1WrNU$ti6p5jnTutYp+5hsf3x0?SkGpxlDz@uA&u!pYrrCP6wz9-y(Igk49)(?Zg)Y2X#uxQ@h@?Ws#Tku+Y2+}?W-H9g=k zKH12XLSgTFz{qfl6tAZl;Rf@A8K4)b|B}v$OD+X!5OYPz3lY5V+fdjM@#;@^EfZu2 zbGXR4$eabw%`^&Lx5x?FZF&(jAw3O;Mkw%WUdD#`&cIE%1qOrwIWgyvnP6fNll{lM zkcfPUb-F65AP>@!C>aiA2A+NG&f9#Hz_FjV8ah!|e{p3zceU-4!Lic@A~FbYet;?m z3#K;TGWv&p-A~!L$In>Jemx2nRl^Yu4@9`uxN5>vz4r#sk;yQlmHuT=vj)E;=WBW`WS{7vo_L*}% zz&->oi3?9Y?G;0BJFW2bTVyX$TI8K1bP8>lIrYOfYSgu_FWnU@G1pBa$s#)`-N?)ADC|Ry#yeTQo-1} zBvAjkkmi#B2b3%D0N0Q5lT%p1Ym9oeAg*pt4*`DY!IPVr3?r_ujiUA0JL2!pxY+-oF>1Sj-tY-5K9+?QgA=CN1u!NWVATpLANywdq{xEXBMCyZ=*l5x0(w4+Z3H& z!h?3{Tgvr8JaWKpXpx=?cO@{t+}YghRXUVs0B(Gv@9Fi98;q8sl21RqbIx}Ty}@2! zul^SSc8SMULIPaN@JQH)Euj5>)3R-eZ@s#@O0Ca2e?_{uxSZdN!`LFc zX5ckYdL6i6oAk*|UldI2J3FF1o>Q4wvtE4{0`4bf_S3!&N24V4-MfizJ!ge?xC64* zM#?h;XHM?f)*lDW-%c9&l3MO%zjqwi8yMMdI{lak0C(r+?*KjjMLg(XP- z`FRnCF5r}q7&epqGL|4Fb@kJUn+~*U0EWt8;8ajEzMCv=$(zq%s^wu6uQ-0`Vhi7B z`0gEw55?}vAf2`6N%8oT45?)9}l~(!|a>Zuy>5pD}Jc>(6 zSKdbBk9>fXW+u9R4U+TnO!#a+4FKx7CX#D1l2BpkwSH~WmaYO^@?LRMI?2s>Y$91D zB@IDxsxl!rDvx8nasJF7?gWXO_{IL8zjMd`Nyxhj$o=d;_eiI=XmFxzKgWtLVvF?B z-fE70qHaF^gb***XSDQaZ?nc7xZ&y=_ko_hRj|yic_9U_RpmO8Jyx$`*k2NVrl54G zP^uv5#f$Uvv+()&Hsch&lwUI%lN4me>&wv} zrDUQVV_2a@*`>LH`jxj#UfvEpP8*)OX$2UwJhW8LCH-NeP`CL$DN7vORDam%OJa7- zL>x{bx}JWM>Ui7GzP*pfw=Bf1V_)38TO;W?XCn9W3X}T3&5Y%lYwt$n9z-Yaotf{1!?vRR;wt5I-QUe_u-fV# zA_6dAa+K#{f64R3Vp54Mlu?b2EmpsBX_roSx9BIJAL_PwckEze%(#%NxRvbDZLedC zk(kpy+I2YBsPWZJDrpZlY=$M@rb1A|r(w(SnLfBu4EpBjjYAI0^Hylw&+WXzPeIw% z9!6!SVn{`Wh4Ff6@|IXQM=0-E^ZjsP8`WBok+A!_ck-!rm+1u&uJdP7F=_KAJN*}X z7?s$9D_mX5PGQX*evDnfVNhhtEgu=iF?137nXc;t~LESU?vzPv&|sNRls~sPw7Tw znDKv=41$pKpQ{m+mLH)UYN;UWhkITLn?H)|5|QBUeKE$q3mvw-|nEaa58Ts#FMo0tR8{&o*V~^ z?b?RD$!VJFklFpiWc>XTH|&Ae}BiHFaN){{V9vzpZ-sh|7E}Y-!A#TUGl%xC1b=E zw=A7xSG{NX;!64;831DA{>u*gi+pQ90CZd39HiEcfKNY)_D9DA>x@5g%iy7)ahol8 zL)g~2-jYL~cHQouROsHr{wT9Rp{jr%{njaXf^VGl(d{2!N{QhYJ09=gAD=8!4(PP7 zgVK8cQAPeM@0QXNIQ^N`)G|siG3=L#^?1c5ea}7xLNTV9gB&>ezk1A-cRmk`^|tSp zO#>41q5Uz;=l|7Xu%T56*XjcAmf213xV40C4A1?JIDqr?r~m$!Pq(2gxxL8pE%@~L zG6g61{$y0ulHz0!clu(1gL#FjYxOrt2iHpz1=s$gcy0orjQ809DC7cQ9vi|gA(`Q? zDWesZjE}5jKkayoQC<(OS??q0?W#{LGH#3#<|IH@E zrh;+E(vm>&gAfdO0&{b6+JVVpT~E)^Sm0dK%KuV|Dz;aO%0B8=KhEP0BGrMhhr^@C zYV0H01IUZR&nj^}ZZdwqTrH;#<=sZwu%XAR%($DdZT{I$VW zA0YXlnCfR$aB2XC;*ap@kvdes1#qzhY#%BgcDc^^egO!DKk4dvhaP^VcU4P|)L8PJ zJ!-7^i+@}FC*0&hfrIYzVNAcRg$((CeOmO9Iq6inpv^l6;8jvH+(F+c8(lta-9yV@ zZ(4egzOm~ehx<}7|NXCD1~|DPp$N)mR}?8YHukTe&+ZE-e^u?YuDuSf3yAxF(~@kI zxp-{S-p8c^7x9DmQIH2$8Ou_=lu}hD07~C1i^)!-Z?o86j@|se`9B}YKg=U@r4SH} zQ0eJ}+kRP4y$#%IrwK(%zXGyqSHl!cj{Yhjz9s}w*-5hso zcpH*_{!bk9kDVf{&PQ-I)}uX}zUm>O6YTA6PmU@VYwp#*`Wj8lu>C3$-Fql08H^m@ zLYl8J_%Z$Lzxe*{djXN>%iM>9gO_q=4X*X0K;n(_*HT=pKZv0 z>*3Y`d1R~J1?dr)>Cv%kYQ(z-n*M)3MhMsc_mm~NEi$UThO&Al+!_?XrdVBhu{S%} zy-g8P5)be(Kf-{Tp4>z-6{7ovmB^}c%H==slYg%p4HRMEtmp z?V~i!$NDg%_iZSP;cfqZ9FX2Njscpi*Qh_?AhsOJ$4`39n*k3Hld!`R3vI%R58l2| z{lQPN(JK9c!M=C@VH}cTAg1{!^5{EHECkjWnmgDY!JhKBXn^k=q~;s;YU?evS!&t` z#r^*<7!(^QT`*8j)V;`}c^?c)DECC^{a~};|84>qsF@A|xMi-xgKo5^=R`kgik$k( zh2VnR41<|RpaM%`5KJOn;Rp{eP<#J8gl$Ry(-=f66EyTbvUgNs|! zX;I`_6Sw&*AA;Bkg5HVa|6wyWC)GD-91}lR#qsT6#Hs!FLI4i?`2>(0D2I(gal)!& zDneL}AEZCO`GoDkvKHq(+l+tM4bU28s$|ybn8_|BaBBlFD(yKMGeFh#`fbDCSEL=5 z9m4WLkM!gu?_nOhKyRq<>hF{NweL`pFg^{uzz*llaF17SxH}X4U8{e)c%MNvT8Nl$ zbR?=B3^UC}@yNG)Dh-~)PlLmLVWI!_ky(Z)MaC;-q|nqF<@NEAl@1PZ`L=fG8Fp!Qb63vzkMF`m$%@~%2&-&ZvQydQDi2D7B(s( z=L4OM|K+m%IZjnr^`Zk6--6|23!IXV-!00Gc2pFX7C^&p7R2nrC(<0#EzEtxT|7rfyv<#dzcR2mlsxv8F_$uBk+$Y6uH!0Ugtwf0Qjs9oCeweQlt8EV#xc zXUw-OKw*_w<8=~xtQ_>%+|Clv@&zRkLhZ=}b+Lec@n3(SC}H<76Sf2H^De9FYmKL4 zS|a-}7r^&|wSdNXWXv&1g$<)TzgQAOunj9_<6QKfZ-Hm5*oMK_P5=E9p|@mO+Te-I zNtc@z(vqW6PLC$h;M3!(qN%`f138W`mJ2VbRzR&SHm(6KZ7r4|_PCfwgA;1V@lP>M z1ntWl-hZf=wDk1eT0+cA0LS2 zg*^euwwzv#KJ-d&w(^u)z^&_aePuB47ZNH!?Hq8#Dj+j2q7*-BDR#8TkAQYgwqbV^ zjx@|SLJ0Q16(z{Jp-rGuy*<8UY1{X}Cl2Zt0AffOM1?+jz=&v0-`kR|Z&eS8rzY3J zjClWfz6|Uq*us|ox*RRga#+bvGJ>rFKMxg~|FcpxI3J7*lavVnEMYE`Y{}NEcAQ1? zyv^i~TH6c?CLx)_`sYs|uTcH-OiIAD7YKS0d3C6I4&=BUPJPE?^LAeY{6#-v>rX!H zZ_5Q5_o(bO?zw{^Kn5_-OYc6*4Pf@dyzguNgUo<1QCTob9<|n%4p3fJ2G;YjNboy8 zo4oqwk;48n0olz?M_ua-q52)i$`-SaRC9B4Srvu4kQ4iMP|m^e5(LIV%*>^};?CQ% zLdO7s2})*IAztzCF+6si60UkfKfDuAtS&&JS%n{)#Q}Q1P`V>?gq(PeK3b-i?!390 zgesO^;!GZxgjG=IOddi~QJwS@#Gy1c;Bp6Yn{ z`{X0*fCx8MgsDf$#w$$7>rnnIFW~H`7 z0Gco8twwNr`tdIHJnc=7>wWD$*9YP{cU`sLGQdBR?J`+~V4&5KA##b7j0`hQKV%Es zTNwOLQqMf5ZwWcS=;K>lHTJXcSfNX!8mX}t7BoN@8lXG>$bkRww~iJ}JSb(SHCqk` z5iC88L&Vr?+5^{rc*{?-ov(Gg(vlOo*e||UCl}?ErBmhVo!L0fW2ps9d=}o0xLOI7 z(J7EV2i~XRd-Of|-uNXXM(hEd-Ov1epDOMP1(k~zY2Uxum#{5r!oOms{c&tNbu9dH zQ*-4|%yJb=?w-`IvfZBfWHv=ePLJ;Z*N}Q~WnCxw?U;CT6a>3~;-lxC1h*Gs8Chh4 zSw5-13R zR8qN-4a1CQfqDe&U5ocSjn?G5Ol=~bK(!y=oMIa-Ly`Vu;zGC=BXbOSt% z3vOj3pPs71W8-b(b)}t@PYLbKnDv0U4E{ih?1ak>X%OV@UMGNaHZO^1i8C;eN3N< z*STtA+;TMIlDL)FWA7cvn1@xU#1T>;m>siwN<={tlxx32t(Evo6%7EJ~x;mRiM+B=;mG; z3{nXDfqtfSIL00_I|YIbg>h0&rXHA2f^~ooUBfAf#MwgIn;I)YbW2r%M>MXHqIU1d zU-|h9LlKcB18%LyXIA)kVK8LY@%B2G=xVdExJK~B}ZC-=?EYtb%-PJx2 zuBHV|QPcJwUd$>ve|imvZTSjm6Of!YN0MGbQr^Yjba+O%Qp5?QS}{pP`_nnz=bvau@dPX zD`95C)c}9H>weu8FTUlZ|8jR`GjYQKZ*&Tj#|UML zN&5c39rV*s!lpA@!{ux0?)kYDg}p(;-j+^Iua8FDa9Uw!V#Up^3|&bcvEAK&@6f^R zjux|)#w`!JzNXrcRq@nUOgI^8S`Ruc8onRPZHc{|=#?3bT+gGs+C!ULYWKjA$#{JK zcvSQ@W1PndyPAmdV%9bNxY59~w@mjkgP|Dk2HQ>Mu!7QbcM*pr! z6zJTxh9k|z{%&8BxQ^opMd+24=HH#Hdt`lk`jqdNZSmHYNs?}2JRnM4eiNnI9sg>T zgtU2FuUEaqvlB#E4sjmY@&N&W^-2Sr>d2KlC9qpetkZO9o)W4{uXll=s0C%{eneS6 zZ%RFx#U@k4*2jJBCc>bHgHcri$m;D99X|#ic=goeh1EvCCwutt4DDy~^sQHrZ*Z8; zK#QCof{0ciotf{|&O3~zjvi%O%_efaritz~wsGpK?F)q+BoS6~cb{B9jAPNIfe2 zUriO@k_bab?gDAEU{e3^TONCmw>AO`+8I-Mg3)3kPq!EvJqNW`-H5X!aJQdVhH}C& ztm8q@HS(xanj{~htUml9Fa#;~kY2DL8dXCx2}vLzvO6#2JKNE1&SGeoMh%a1`Ny$^ z8C0J_Jhi)qXpHR46Xa2FwQFeJYa0{~Byg&s)RHpqa;B|BqbL}}a7=z$j&Pe>Bk~GU zx=mOrC5EN>F7Q*%&OJ1IBn0N1LQpM&jEFJ?&xvd>U+G#ejSeu1A=n}TM?vkvbMIK- z_m9Z1!6;C;l?xYF+6k+%rQ(%xvw(}QR*5_TId9`eAnM34;0Hw|tpM$K*)FPM$;QEN z^@smZ8~rpvumPTJYaWAw_IlSv{Yl9Y@N#GrAi>zyEOQv8>8*2F5u||@roVlW1r(MT z)}4s|BA6})viB3-zLgU}JnaY)Zp5H(U$PF0MuvIzO1=Re{t4jWhlAE-pbzK8{UIz7 zrN$q$<7sF;*iaIxdLcM?7S!+dGC|$78|*4gzxn7?;K5c>wK9g;R!{a`l-nMgdugu? zV$9hCCwj?C6=VIj`A>%|^v}I4qhN7#be!rE4QWfu=>CobBLH+cYIgXHHRXaYY0 z@{4jG=}=JHqpfa)QUG3eYvUU8BQ(+- zI`;2Rf^}}MUjU3y9Rhjy8+~L!XSM?{BM&dg z|1Jlz6k<><&fAs7ThG}u$x)*TiV!4q5q^7T3^cb>10j5aAKSUbk0{D{e50?&WX8tW zkq_S>ZGw#TgP=t8orC+Zp0o)J=O0}KsLX-%2eCziC)0<{Fu%^0#eZ-D<*c?k$WLQm z&dexU+OuTS3ImCQaug^}vju*eMirE-YDv;epSTb7$??W^6|mQ_^{`P=)h(~*J?0HG zZ%|<%LT)*?q4zK;DXD(Pjso(NB0;!eTVg770Ct!D!K-5?6=Pl<%C1hzr-R zWP%&uZs1;MVo}?arOPAjsz(&2^E%eIH8osl?3n*j;MgdYf*&E%}QdObhbR2TB1Zmh&*@2@q|Ws({-!tAK-&SPumwd|<|Cl1{gJP@jD^xwcy;q>`%g)CB9#*R$8PID zx13wJ5MlRefd+kf{?}**N^19>(1FtkbH>1F@fv9n1h{VVbgrf(J-AKf-Gb zH^BO9Gzwre((K`{7Ro-Xd_CvWX^iPWWsAot)V47 zE$}6{ty=vMIS&=~LMneMgZ$d)(xpE8tb~IUkQb>3MET?701!YJILADc=`VEi9rhJI zZq1wZ{Qe3)No(BgQ}np?v02N>tn<)F#p|hNGUC~-GGPcY@{rfFpcD&d!(tbi)t#|V zLv~-j>rW+gV*uU|frVrxDLBpr=RxpTnsAzt=LKJ*YFB=|z>Q6dAb66`T5cym5akKc z@kNXYveDlScN||sGMtUtgiJhW%?+50*DFGDuotuoXIlMq-(l~u+s?ZJ?!o4nzq%At zs>!t!uMB%moE%l&&uY`C>qQ-9@@d)8PRRF#x7HrU7c{A5%oX^(-)5VhGP^t@l38E9 zc)G9qKu5_jAuhYT{QUUmF$x#FkDjukWi~<<8OLw)8l1=9 z`F!oLCWGrCwcgG3x=&`Eqw8X`e7bU*s9Pn&&3IG>r6<2-*|BmRQ*D|gj{bIX#x7`6 zc`Q+>)_*8cTCdJzy5os>>vs%h>%i=1l@U3_oAtXbrJw!e?)V?Am=|+zRynX}!rhT7 zTBVydO?u=DmQkx-9-)d*5>`F@hg3oUtD|f7J7Zes7{oEW=;I9+eWKM@f(%x_1TFv z{8DFM(PgL08tsW@XpD|s!1B`_KL0v%^1NPF5e?IBYtXYI?m4->mKtCBg1}m#Zak(r z?Ex5;rY6{UXA7(ZVw7ZbkD9VsqXiQLm>_5SFev5;`O{ zwy%A0#k9fClwaK76NO!`)%s-TnP~GUSnn=Z{&cC?#GCXNl1);GxYGv3wvYVU7(1%- zdgBp6Yh~!RU=ndP-8)tXPm*ub&WAAv5hJ-HkH$9Z&ap9Or)S0L7|r3~BC+E!IQjmT z82QVfHMGL^dn5M-Zt+{iNhSUdk~})MvR~Rz;(NNfc#|#ky>Buf;`Hd@-^%F5!E0U< zJNzf-=3QHd){;1iOKGn3XtRZ9rmx@peyeFRTc{#4gukeb~mlDQsfG^L~T@zxjS zx*1BXfb9WR+3nZ($-oW(!Mx}Db&QVLU-pm6Cre2oR2WOqYxh>O&5G02Tga>5+uZwP zab8MB#U6v#XIMJib5m%zgN%)1QQ3h5@4E2`MVG4+25ZYmf;gEWzrY?-Ut;y@QzyI8 zU8JE*b}Sp}W)hob>=Snt%CW7!Tkc)=(F`wUlzhm6 z#7|X=nN$@^9YWHYn0YToM?-z%%}_$nJfJ9)YNwWl+>!tpY;VM-nVC*Ep58N&*Zcfs z@0qJjT$2$vs~@DVe$vk0&SFUOiSFdkn6I-nAh-3bb1YvB(R(!h0QlFO5Y3|Rq~ufT z<4il-Ki{bP-q<#t?W@QyD@b3y`Mw0Lz{9hl0xEUgkRjUsOXSNZ^octI!*-xbm$e-k zTM+Dn3`2$45+{@{SrLoxW8rzlDM~I82N-gkBMI3{C^;M!-pzg695h{Vw+6NCxUsr+ zkob_Itf*5tB&d}B{GTz~Sa>TyMmsR+_=q`6ZuTeHyF z(Xn!8*K59Sz+qDv9C$Q1S#?`;Z7YL1o$oO=(U6|cG6u>#!IX30JaQf;Z>bLeI1p}a zn1c^(@hs)W%AsNCSEtQ4?@)Qb)qp>^a))=Zjr~x23JHJrxtZI!WPUqw*O= z>9gJ2=YNS=={v`pbDJdp-YHBHS0#sC4%&^8DRnCz-QthOAo+X-w1Nm_+;TB?rdW!d zK*CM=5#<*nbGv>IM(ZgAA4;8e9ujY>Fq>9xPzelLpw0QJZ*en6^en>g zB;x6E)_%{4npsm1YevY7p{ z%|?YIcU}w;gCmA2?CeIaWQ*SW8v4`HjUYgH__A&*I5hgz%m^0lR!4|_i3&C}dQ{iW z6@Ig~Lb{d9XT)+&!k4)7SW4IZb5@kTq@ljQObgvB&g!P6j!M~U70=Ac@}5r$r|#y9 zdvz(38+BIZ$96M_SdSANW|uY-BEQ z0eh!e0=#;mA_dS^zmG~AkmPn$d;#rFN8<`G)U@;!M^2uEFlx~2vF>2rm%4+GU!BiD zSyAx3VSSTfo0%?|nSM6&I9NKd!i{48WoyNB3r6k97gs43-*jpd16M#-eeTc#B{K>M z$5^CvRORToz%TgDHqq8oO&KSN+b&5PXTps1$Pe372_NJO{MQ$*5F1xb?K9@sQ-GC8 zk~a9Z@cHq@;w*#fhDOF%I1WfL>8F28#YQfSrsrCE?^+Dav4@f3wO#3*M05!@_G+lK zFmYsKL_GPjZ(*$vNRLt>@&5g|__02myXK+KvXXR;YTxd+XSi^>Ir_N1>I`Jt5=ny) zpNDJL6+V1rg@6GAy*Q?zm2}d=abxR^*=b|e@J#O?IpUE3qe$MuC`o+sjf&ry)m>Vd zv5v}uA#v-y#b2M~k^C|9_vGH}LsfJI60<;a4j4}g5dRTK{O{j&Z+)?nT;rtL>v)J% z)fS0%<^x`!JpQcd@e2Tif4u?P3E8mr(^1pvv>oC&X;pFcjl%lpT9ehhh%UK+5Y!HU zYOxDKs# zA~#WW)ORD$-s01+=i*eK|1;^j@8i2;L@jTQipZCO2VQC^+HHM)9$hvwLiU-EN^U!A ziD|LUruOMj+VByeU;%yu&pmFBXK81FV}}{VB=_|95AD=!zkM>f)?Ih4lifc;6)b}x z7Vao9IX@<&l_X~Q@c@hSMG`ZpgWB`8`O!4Dj-6T}Nq5xH4EV$>jZ9(vrR$b7U2?2N zv$jucobitNVoDzRU`@ziw?0I$O@F1YW+1=XoveN&eECPHj}GXXwctK1vt^p1FvSG< z1OAI+B;GkKI>&9>r2yHVliiD3!$5_HznlE={P;j5a9IRqQa98k?8F!`z)3y^EkjJT z>%%D><;WSE1<=eJ(Hsm;!I7705y8+Ypy9J}Q#^9Tt}n8=QKEPQ7{%9Mm3Mh`VFnTaPDDdSVoEp-zcrSa`swnYK+ z33zsXADrL!=P@(QS~*0dI6_77t?yO@o8;}!DF2~(x3}u9Zx%Z=)5Bl2>B+Zdvy&S} z-IiFs#3%<8_w@D-%k-8aHcp4kt|OGFGm z@4ASsiJ86Jc4;276PT08Rlf-``~nMs}vzLIupC**aP92m?<1pU&9 z<;6v>r6$#UHqe~_vhnvBea!Wvn-#BrW5+3(t(TAb1_G~qAu#BdmldUd`IXr+29!WP z`DM?)zN}b~DI)a~HOYolZG@*PT}gvx{_{Q{R1m{W#&}EmAVd6))^Ff^+#9Biaz+F@ zam$9I2UzG>1M9w{W0Zy1cYnr(pu&)WDe{P?J-0gKW~x>)*wG#IY9|s+spPFaTc*}U zGTj}3#oxG)b}~?U;Ju!t*I?~Rm6L0`z>GLpphKDDUaS3_0AVqNu4$Ufd%(a4F6jZO z9cCL0tkhLvvgS94E3d9hMU2ba(o;%;f>YL-s}4{*TXoMpW#s-csH8aPP4V%Kda%1e zH?#S&pq~@NuGe?Xn7pQm?LQdQWNvhw`X1!o2sAe@xOABrg#KU8ZD=+D^58pplHI;7 zzZmC$!^_WPjgkYGS;lVOj$jPCO~KMLFSvfV_DL!+KVxtx7YQe{b-iQWd0cw|8S<`$ z0aijUfnb#{>7#hxOMaW7W}Fu+J?36LytXm4V(r^wJ!qIwRaIw<45>nQF3v<(FD2#| z)t&-pk#R}-Y*CBAEmGe2N8FfP1t48D(bG(7=2fm~XQbIlb6d&w8G`s)GPW2+$+ob$ zLofbNFx~HCi+u?x8AW;T-Vw?N2QtZ0McT~>5M+QPw2*IXYU@DdqivE$KDKV&zc*D} zp0rd;^xK-`v+g$7XVd_+JLoMOaDbX#r0QDR90GJCtw{%$oq&Jb{3S*&5KB(d*gFTv z1s^@E3@)}&BQhQhA7{Gp$U)I`I{{CW@PVT-8jEiut=zwnWgT#5XU%uGdOGNwUg&3x zLS4d&FO^))-krQ>-wbe&@?>^#l5w=`w}U?J{v_a-KyFk^I%Xqq-h|qoq~MmxyU`jZ zc6n}!6OIvdBE0-Q6xS9do1voz+0Kz0Y-bS;62=NlK@v}>15=T*8 z&y~^sw`1Lowa-+jgr;FL+m`x@d9#_WS0cf4Zm$;lOtxpFPc6KYKk!1_gNFCzKDgJe zVf@a04dHQ{Qnt@O$piAt`*QDB#wh#HG<~UF8&&a(KW-8c!h2$!lm}lgGJlnM;?O}A zXJo`d5jq%eCOjngj6;`yqWhZnRGR%#+|Vc2N`V2}GIBtMvt&w2`)>O1g;52v!aK{9 zuI$+^@4}ZhSeWC*=x6W0B-~z=ChKjl7+ow%Q0V+}NMsiu!Yy28&m_MH!B3Bb9B9&Xqa-6!~zmOy+yVFZ*@yoe$*24dX`( zBjY~d@zbJ~*GIiw#GabbFdMEiaGf0%nJn?+t=H2|S6FK+ckAWk)4&M#Cz`UZ%(Q8A zV^Rw^yAE_Rz4)&BC{sr3>$lH@6{RlUXLhXe>F6`0GcLz#iKCi0RZ1}rVue|E;Kt_N zr_pNR<3hp9&N1E@&yO$!5g1bzI$560)PT#?VS%I;P3>lH1|foKcxG(9INV%+Uo>L= z$dE5p{xmv=mc`sgVk4QmcWaWQk^ZdLsn7Q*`N|5rae?{86uTD)o`g3i4S7O%<-! z5_e71gj*9uWp=l#x$kF4L6T6=IE$65jVCkZuy*D}51#YO2i!OA-Osq+41Y2_=%TYjCHU0$_P3K~ zVgwxBY4$%5pB`YDi1a;q(dY(cfqU3(YvPfTELES9@{rOyeEj3$LSz2(Qo;sE+)3BT z>$~DcxTgsT2Q51LT!v<&{f`+uo)kDX{(i~KT4!rzI$o7RpgXK(tV<&!+K4IF=$`l5 z_e{awYZxa@r!@L8-J==;5%z_&g$Ey~g-d9hWXzV4zx~N&@dX^-kt!>)(>OzvRb2}M zy!En&{>7$s7hkgxq?*A+8yd=!g8MYWr@~!ogH2Y8yTjlNzH=J~dQPC^y_cR@;*XAh z7!~G$q4~dB*(D*c#Zq&%SB#5YT}A~2v{~^xPcUwEPq{||XG8-oxu&x`kZCBptdk@b z4{Iq%-DIak)jPr-VG55w*jCv`IedPfDrJ?$LE?U_4DY^EA-*5)#(!2w($>9sNSJ?_ z15YVY_XtB{6L2a+$gxMzCXw&`Y6M7cJiQ(G{d3#@$Jko{MIF6=qk_aDqPsK_vUE4n zwWJ^^(y$65V1OXq;DR(riZn<`NlGsuA>AM$DcvAl_pHC)|9$T}bLZYWv+fM;cXpri z9RHin@v0y!A`?aT){pLo4uBig)A+cmF>8>8tc-+p&bW#s8e zLPr@1*>TX~s~W8SP>#?_+pvu}HFLjWUw>;8A()yVYXC1smMb~E9R3<`7Lc3!ty$2q zTrWrqZAN?c^d#vewJWO$+&}k*|9J2A(BjJy6(XA7^DFEzBUQhzcVjBtx7^VYQL+e} zJA_iEBQX*#wv`P~hCH@!H?iYMd>LCETC2>OzMhT;BT&UD5<}^^_n)}!O!@fc^k2jY z2ngic!~~8oc?2`|&G9m{lv;Gy%p=uC_ERO^`J`#S8n=r&h>M;n*a=_P!E0U?(EK1H zL-BgD{z-oO#&NklQoBQKYM|-Luv^_`#ij3JIjVW2O!2W{M1tkq5|!%#tHPYs9ka5B zZtV|AJ|^U-r!g-d+=gSnR#prpjki2aO9-rgIIa2r;zM`{WW%0LZ@wkIXO*XaGdaNh zc@!Nlkd1+rO&IT3sbcTUKV?P+sMIM5rOo=x(U;Qu1>n~AQ=_9+oU-a%wh;A9?^oJe zaQp0@Q?o1FpdjS;ooOG$y>glT(b@-@`9&bJ7OI)25WL{77?gEq+F{)5@2t;<=c$09 zeY<^0B|5|HM5AXdWDKs}_BHmyTlfrid0sihhvYA9TSc&^*#qGIIM*yJu+_iy=~UqadT{ry^bi@t+f&(hiMdetKxOK^zr;@p zwRqB@&4Sn?!7;4)E2APmIWEDC@Hm8gGxyE}n3noi6c6!{ws`YHA4 z%er6-k=zobW*#=s(gTU<-rF#LhhFNl!;C4rhL1Y?f3%~6a3NDJn_pIt?kUb&Gg&#D z5|PqEzC1hLR7-tk=ZV9o8*R)!CFvAq-YGmL)#=Z(U!9vM9?#}pw>{55;M#PJBfm!A zJ7?Z@TcoX&+?jTpQg@u{9q$&pBL3U;%2ubpKSfND`#kk+qv!Ra&|z}fyPa#>Eb5Xv zB|467L054^Yze2Bd&}SZtekCMhEXZ3sZ-;NGLN$iDGl%aDA(A05AHq%UPa}tQfcy! zucryPUR+nhQ%9lJIH?P0t%LPZ3Jv#h9@@2e{4b-fZ zlW*{mUyM5b(a3WNi!qve{QHYRD*~xErKYlqkYe5oi4^%dZMU#iT+HJA+WfnYrsv>7 z*Zt^vlyBEX!JlUti{Hla9>;aXji@MjMx=4JYhJKe|7FXjyYRmO`J{Z~paeK&5^&3^ zCkUNz>CG@Rf8PxPA={aFo`%9)O_|(BXJO8-fB%Vz03|SjEEkFS#g8Q_tX3 zTE0ewNT+(UP7dWDy8a<^w?H_r48`A9>e(0hk8@WiC_X6E)4bP-L?fLgzYWjL`CJpg zT6la6J%m4g>G+>HsLC;~t~ZC&@tP*AtX(Z7lJQ zU95Q`2h9-@%^y zltYk4s;GulfAU9voHsYOM3v6NwDDzj1(li%*3>4QGU69xwjNkULm6LJBE#lT=)0l> zl`hJEBetB$#pkaG6{xoe6r=Sb|?l~aop>H)an*VlI# z0`P$?3?xU>5*7WQ!kh12RN%aZF_3bYpt|(GB5Gn{)>h}`9VLb1G*ZOnXlR=Ws3)y@ zZq4C)w?im7dykPD5x?{Fez!}LiOGdMJ;q2v`n%!?$)+Ruq}Mg>`|u-NM$(h|-xqw1 zI8~ZLedeBnxv!6BKX`YS^@-May+z@a)Aa#^^YxX&sfdV5l+nn1%z)^bD9>eAFTB5l z>g_zBKCpK<=eri4zoSI`Pw5hFEF+OD^Esk!S4)lQUh_sH5;7-l2aw~R;TM4RFMoPL zv>>BEpd@wjy^eZplnG$q=>BV=`h)jrB9U(+n|MvkXHLnyoz_LN&(wMLq}d}j$r;(U z$}KM5#|*4Ef8%cEvC2p}MzVbyY}8^~TPcmX-%jCGr*M9|o#MK6>*9QOmSIPi_50lj zsGadV1P4%+jF8=cB%W=Z6uP{=L(CxR=4~M%UgP!2CuKh&(D@&)MS!}@NHT~y>|b2*@o>Jt((g|8gslLRNjkiLo0b5D`^$EuoYE+a#?HBx7Pd286-Uq;ql zx4Z@V1a7&|1Ww0?Xa0*gV7WJ7xxugq@5!kE0c+bomNPN2=;-JWGqW(MUQs1dnS-NW zx_W*>I_Tn;6wkvlaQ~z2Hd~kD>1)g*ITm-*RDF^q2)hab zs|au6hXDB)JWPMs?L1O^Kqj5=O)YG07)nS2NP-qWe4;#MXsuJOO$32_)ED_`R**^& zY>}^Q-S?N>al!SgzWAL@xbI#Y-L`EV2MS_a&USVa#7uH*BjumfgFDsPuU0?M`<_yK z2bWUcfQZHb<+Yl`Ey4zfoChHCcR~3ZvrcSvJ2SBB3n9SdeTiFy?S#YZE;1b;3CG z3U9;N2Vvmhr#K4_!)~xX`&QTNwldG@Xbq(K8QeOqN1}8Io{eBk=Ttg5dpFs5itMNqNyck_NO_0bYB`{M zAkkT_Ac(KA^~%(DkNN10wesCLNa=g=Vgig~ZYF4g5hrVNtu$RwcaO{putH+ zp^e~rasxSl*)HNbj0NUYsEvq!38?4G02P?XP%!$M$lOpX_CC>(CibKRyQ6Hp4i z(VoEO7tvw~0w-2kHxHI_Q1|VSZ4BLkU@67?*|QN(uMR_TgE7l{Dgn&AD(MCh(7Ygi z0GwJsH4m78UpjzPW2BJbb{qgMS1KQ1kC&C;YpmX(YdTqwPBNNc6h#z%39SXR%F<(C zph6!HxvKe9I4);KIQZf{l^X|kl18*%cvw(A1Xuv$UoCR*=rTdI97ec3vw^j=zU5jJ zL>dbJp}1;ZfD-xImo6&-#mJ;Y^x*|ilIm1I@%97$Wu(g#MZ--%qA9Qqi*aXbv41X@ zUg6sZiQ-#8O7z(3yf(b?Hmmc)nFa>`gj-(2gVl!^PZW9~j@n~>@rcY`p1)BcjHmck z3yfHQS;-2}ZXN`Ffd6?RtN?KYWx5F6IF#!1&dVa^k=$reQ(M{MgATdlwJl6-DB^Vd_mScbpwJw|n%Q5Kv_^M;WbXoV-JFjo z07fDjD_gF&m9MTmYk4mx`u{(IP;1PAa{=rT%~s zhe7`*&;eEb;89TwIArw2o)(Y`g+zki*>#1BV0?sZkgo^Of*UwOILTbVCums|ib|r& z`R;_%W%F2g1`}K3Bk>kP--laR41=$NN%Ih4xQqn>T7M&gPy+;bKiD8HhS|hT7aOYO znUBH8@5Mc|5XihCR$WO&6yb8j({fIBmWH?Vvrlq`__7bo6bPjWhF)b8FLj3BqG%ACX|3~ zB?8$XXjY(nIiMj^URFPBwu zLs)y%gw)9arB9iyzQY#P{%*eCV|FjJXSTrEk1teq>o!BMQwXO^Dsm2Iw=KIpIT_8} z@t|G&Cjr?eI&6{49k~+1{z=`yA&srv1Lf~SHSY`7HV1pnR_y0q1M^9FbHCyaMqZ@g z4>IBtj0XA*05L-EvHrm<%L2RCDAe+v_=#Z-{FXV+cQJy~2kx&2pd31d)fPK>TgDHD ztg>e8U!PYHy{D8@!|BK%2Fk<1ez5<{lOI%L1QKM6J(=^ZFOBoGwxnZo4T!pWdgzI- zEnnn3?mqa@!1KV?akJ;68Bxc-7*ieQdlY)=rYsI+Ue0X&A{iUSc{e-dmm2H$-W-c- zZ)F>+J9UM}+pBkg_z+ryc~W z!U+n~`u0+!3z-pq@^#m|%QTOHd6}Kd#xhw#i6UYry&QjhAm5a5t#u6P$yPh~@MntW zX3cn>%AmRQrITvQnQ(!1%dfjBL&;H-So{c;PbLWji=ibC`5R9J_&@vawXw-rC201f zM5>zYi;~$rh+^}*&dvBGAP86Z$>8UM@r+G_IR0XYFZ6Oj#BBT`*~M4McerWgs3hsZ{?rV9hI=iIQgt*#nFC2!R?k)o&Ba*T6Pm^VV*jN1#R_;y z)xL?PTjQJR*^}r;HMinBZLN>W2~d!}2Q)??#NNQ3z(F{p-l9-nOk%yy_%6TCJrS>3 zW96&(2qGi({NfOJg#IZu2rVqK3S{69d&L_FRJDMJI3f7|SXn-PM5msn7Wju(6ZRb< z7bwH>kp+2?`?%)vM}9ra)27l9Mj@*+QgM4pVU^#d_LISVEe7OpHod!}h6dkW>Z^Z= zU?>YIRH2n9XLPz)6VdtLzPm6Wil@hkj}0<(-V>aL{xCP;{p(Y#DIu|hCyTS{2~wt zUmsK$__|gqEFW`Jc_QvwWJ4uehU*V{A?#4-*X&DGW&wvx&bO9IiV)me_n%6Nm#9y_R%)O?LI%)$sNpC#Rz}XBea?}#0Xb&No;2aPY( zWIVzmic(aR^*p&4oLbFdA?hyXM|?F}%pAj)UR}sWrzq*Cp4vB_d1|YCIuG4zGf8zG z)hq6><}k@EN$Zvmn!~>p4NO6{sT7C738jT#puKjvwUy|WW^umU9teDG){{Zjf3X7u zIl7_9;Wyy^Fn2Z}9O!o($u>xbVCeAIcL{@rUH4JSe^XG?>EpBRX_J*ZlwaPQ z<*r;ygSyrQO$uoXPPquHDB*7=gx2O_zo9En2HTsTPGl+Sr1KA2yOsAMN#QsojBHL< z-&fVo><0OkplE;D%JoB=?&Z<=G8OhwUyh?Qe+M!Sia+9%$O>P+M(f~D??AkxiEtj( zY3xwe&C|G_0#=oN6R#7aQ*$cVN;Gf+ov_`TTd9MyAHCigX93IU&0M_;Vy7f10#Wym zDbE7iV*qPHFpX&8VLTm<-|`!Aokg{hY;?crwgC*Adi{N5yG|BMuXPXW{lM4XC3gDG z#9v%DHt5zqGNdA#_q%eb)d-tYg87?2=S&XBb>{uzC3v575a!I55WF#qb@z7m&2#6W zuDAnk7}FnilK_sxB!)3NUTRdi6a$VeDagNupL!B#Zld-SugwHD9<3emJ}%AiYxE9) zHgk>T;bW-ElxxakL@{R38Xm#7(vHoAK2v`m2P^oVqYO5w;+Uuc45&sFYKy^um}+kK zK&ClHa`Xdp+o!R5-<-ji@(R_xGT($DX{q33jN-kuB68Cs8YaIS&oR(I<2*dEiqABA{IweA|0FZI-M1ifHODz z6X!~YER6W3^Tip-;c;qxxYKfd2L-vRq5qeJB|mJstqeJSz4P~+?QnJ{dE#NHalq-g zc~c%8W@RP-{gn`ghwxxXR|TZ2?PX%%xClvgUaz2T=2DhiE#LlnI{H@KLl?~QdV#ox>Y+H)}x__5|7~;i>beY zZOv4gaQ`9GavTCmBx&aIh0^0N-#y$#H71v$IGA4aK55SScizk|7tHU4h!7}x-?so+ z+`yqxY~oT@Im?%?I6csd_1^xJbw&~14iXbQOOu zP(>c5s9Y7{ug)t-_}`wzZ0X?3p4)rKoRjO@Uy~nb20`_-8L|rwKXD`GLc(vss_%#d z!xlOp{;XP5=T!Rn1xGwiE9AjSt$!aYIs8tys(H#UoIM|hMGH$A&bF1=VGr`*qfRNW zp+)xQG^pGf8YYJgQWH}=fTKPw@HMjikTpQ3E(U+x`!TDi=HeO`B3v^*%dY+z7_O&T zC$yh)ZDjxAZHeci5_-`o>?UA6czHlREkWj2t{5>c4=rP*sr?0~!}o^KSs$|Phx63u#7}CgcZjp;<&=~l+F{=;dzc-0oI;JPB)3jH z?DNO3wP-^qk$jD-zvVSFJ5J1d5Pt13S{-+NxFK&6DYBVRkXrThMvFgDxN)e>Qa#?U~22NW8>vH ze7Y(|+U@8T8uFl8y~My-ygh;57a<U8*d>HL`gJ^4DSUD;_15w59x7VyGi#vU8zCIH_)qoR{1<0J98opM zcuh66EcDeUb>j!iT*J^W3*R)A85AInA0>9EWL;*wkh&A9$(n1eiL=Dpc5H9 zmSM2eZW#OB(V}5#*@Ai zc`}ACbW)E(QPBChMk%ayLFcYCXohUFzixw4Q51)?(>~K1Vr}YJ?nwkrqb(DLA*7*h z*UP+GQJ*VcYQ`0e#J7>kCV+d1Z)- zs!HCsrh$;i`Ww_Tv!^U4uPN8;TLvp!jDwP$Ov2B{0Gsz|7!Q5jvz*=Rs7!G9ZO;?| z#r036&p?!v>V8wwWHyGNp$w=S1cv{-9zRauTU7Edp>SvQh9CT16}9mH)ghK`^1`^p z{+v}9U`Hj!CC2l<#0TlsGi)wdYc>Y@*gkT4Hq*p}a}Ag(OO%CP{m*eFdGO^uVM6S( zd8zy#bl9Hgxkw(e^``8R&`LNPPf>vgBFO|v92Yb;mhOY`mi$jpe70lSR4=Q z!#Iz_MG>U*MskSCDRQmUg^b`kG7`w~kE4n>_k><}#SHbPnE4%j!gT4tI zPZPz)>WGG=$_GL5xSszjIZY85%tIc6Y(spR*3M%#bM!_JdXOP}1Hc?#Uk?aq=-N`o z9i;Y2RSb||IQH}G56?ORWm4ntSaqhpW$>dcIKL{lqJl6sm8X%M90`?pCVw7gh;`A_ zPl;ubT~vKt;g6De_xlkA@&2liZkWYOA)Fa2xIg9WP&o>MyGs8={Sz+^!H4Iki{M6Q z|5@*h>!Y2~{C?Lm8MyyPBRDwiqyMVxbe|%f{EdW8Hiz(Yiy;Ni2wH-oH7yq2-Y5yR zF#6V8=HYm!NNk@J-sO!#WxSN5(DRG3dJ89wT9JuIaO_3$6PvNM#uockZtpI5&>r)L zfKv}lwIF1V*&*;n1gk2iKOt*ea#snZh3n!9<&(`=4etKC{i^*}F4LkCg*)9yW;c-)@=8wu~_Y z11Xzgm}+ch542a>CO0r&_A;%omx{s*rx=Z*^|CdmY>U} z5+z2Aq7-$x-W729TwRD6HF&ZY8P+J|N-uU^p&&G{`3VXnQU3nvfp=C3t9Sl#08~y9 z79(NVrJp&LV5Wq7i!6FeCdn}90kf%6?ohyiF^mDkiosBk|-7}dQfEiAaG9A;n2JQF_z z%`q$sRRI*Fo!>~f(Inm_Y_DCcKG4-3#l*}!nCwQlI$iT_r0Cs;Z$(4-?a`MY_3IzcCS(8+SU1XwvS$s5Ru_V)t2>YlHFhzS@&AA-*JHH&g1^u znVjyX53`iLWl0*l+>S||6gGFG)*iNR z*qk4|fsY4=^)Wpiy{Oy%9r|eFTii}ZuQk)8RT#sGUm8DlyQ;FoHRzbJ=~hGHN^}Dp zSXqY$e|%VVeaVp`?u1ZM<_l~}9Lwm3{me@v{tfqBU3C4 zCVCIij=P7v$DEUv6B2x_m5=ga|H$)Gyz0%2>@}A$6HSTo#fXh$C-5@%!^=YEj@G=N z^mwk5w$aCTD&d%s8FO1!W@g?eCGYr0?WX;sV-A8U6Ny)!BWxz42SfUvlfwp~(UuB0 zs(+TK$`~1bBE3!K)K7cGb*|K9l2oacEENs3h8Rx6+h^^Vwsg9zr^dlBc~|~7A59v~ z>?fQnp%k({?s42xhh7{Gdqie7hWM1o3t4_)FfL*tT111ar8w;~STs+sNQ{6Aw{#_X z$HwM9rEKV@v*HR1isHIDo?YIm%U*2Mso6!JtjRp3mpY#g-N)U|E;0@r6xk@-p7zkv zGb=3=Y?@2&BMW(}F!ZyQ%S z-z4KUip4uZf5^EKY7GNXUlLxnWj4QMK2&;tRndIz2bdQ*v|v z1;taj)hV#u@59x3aK2hKJc63R0VK<+Fi{5p$dG|goUd6S;_K#I46wYiX&0$nn4Q2R~aj@{}Q@NFf zglZ5tj_3G8MlX@K5yL#~d!%c9MNL+7iS_S|{71*INwv_$rU-;88o-#9ythNozJA=r zXC8i78PRrNH5}+vuoUVhJotsy2Z2-kxeb!>`uuo1!|U83J_1Z>kiP8ed0gm9us*P* z%3+|QAoFtu#O3q`im#!TR60QlO#V1jWPSmVhXNdkczQV)JsVnet#Gy+Uw?RPFQuM@ zQ8WZ72~Mw0C{U8z9oa*ZJPCJfoNUSV1T4pu-^YVDFL%C>b;olUWbPBf{rP+JB6#c2 zHPZ%*3O3}br0hmqD?UC!)||PT;@cLn@ik+p;WjFGb8{ao0!jY!L8(9gB8V~Ml|zEnoUj*&Lza^#J(i@ zmDf-qdgSWYbl!E=H35T>!VzZT8cW0?T6?X%u?k}FmFrJZDOGQ-#x)z-qru4F$FW;* z#Fsyt+#Szi#E)0i6+_~*s2#Y!O35Bg(O zc(=`z%c8m_%EXip%U=i9P64R&fX91dQs*&W{6Hm>;F%Mh(qmT+tx99cLwCszwtl|E z|5ORY+rzy(Hbj$eDkwlSILTAaFoqN_`#*-n`uz$akvsj`Xr;2hU&G^?g7=`r29HSV zBP{~Q%)w!BXbEBB{&{^&Xh&_~#&2ECwuNbYxc|#WUkN=34BL#aC5D8>N3Ce8BKsrb zOx82Idb(%aY~%zWJ^840z_a*w*VC*_5O#S;u8@b z!(RuB|JEWW53lf>Ji6SO zN$}UpUZKCO3tc2+V8E%BNp`-o7%D~{+zKOp?OBsI8l#)}WYwRYSB@D4fm4&iU{DzR zPZBsEujx4khTh@6r-V<@U}L2A|G?lbzXV4WkcNFF>&CNAInAY4`1vd(o2twJ$LKTs zL%f^Euuq~o#kid;GU7ZLPYPT!PnMOF4gf5kBB{{(;k3I0jp;16KVe;9FA%s7ghQO*3 zkNP{D6DD zSsu3#I1rel-JRqcSfLn{IiBXTJJfhPd416m)aL9VuuQp$U&4ToLf)msFf0UW zVADpC=YJIhY*|2}_doq})pW<)4Bf&()6cJh5>65m5%Y0}-Q9xEUwk2$Z^qr@9LtDj zz#(T$Cb3z`e?9czYrIQQ&YgE{5CE{GDQ+`j!C)=Emhbd@G!V8!eg~E|i(+tuimF}~ zTm_EMu~mHv^FJYz*heP^L9VjkG{(omTZv)=%c+y^+S zlQyd#KlLzC>{#(-)u_9B>G?JsOsf`I;r&)lR{HyWL%!W0k zskun|DLD1Gj=MFATKgl=L687Kii{brGp){OiortUix8`*IB(S#%w8gvUp>td`K}1v z&pJDt4)zYTay3lzo@FUjyy$&-=Cw^D?(iqb*1MmCCNVKBc+zyzOj`c3!I5CkXQe;w zxQFFf9*nN>nkB1-t_bj;Z5Htic?RBbyyMZ$`?lTCNru|rjAP4uG@fs)X=e9lH8MEu z@WrLT`x&ou?nLL40r(`^CvCbzW(?DDrZpb94GKLPp!8KeT)avK%7dhkZzSK>d*88Z z?itbPA22FFH#pVc2=~th0e)HV=ZXqHL&Dysb}dcHjqVp6=P|w-FZ>CN{3Ja*6vvD8 z8P(+591!f_hB#7M@s?2Z1Oo~OMgZ4^w~Uq44ouuESn$uUib>_=VYG+7+&GYIKf#9k zuUyVmc!5!Tk#UR(>CQiL41frK)lIh%^p4Zm$8jQ{AA9#=2y;LS z?_F=XP=D-(xuu@XrziUb5BIa{tN74t-kbCIYaQ&fuQc;JFsQ9T{Ew4ih#qK#adOlBwPteTCwK#1D=sy*WIeu%49JIgKjbihqPjN{*r}F1qFOKv_sN z`mDRJ`@?-o6~gPk_hIi>GO5sg*=3g9`IfF9Rz%FwQWbF|Bll?rzq|03NP0GDJT)6m z#dS}e>WpDsi>E#ttYcK_5=X!oE*hVHbZl}TTde6HKTa+PlfLgdRR^`RrLcYhHc3g0 zIDRSul~lZ=JbSepGi#M_z74jH3cL%{pA8EJUkd6yQ z%`++uj(VMiTa_UU*?&BJt_x`ww&~{MTTi>BB;Q`(5w#ovZBCipE;{Y@JJFkZ;+eMu^=&Ugx^*f2U?w>Jeg`nm6_8uF_xzV?#{Vn-3cC}qeh-o zV%nnaCzcY*NQ3HK&B?|$)Nvf9Mz@4W{hG@)W#ksolq*k;YB%h@JllCbAt8Lo#(lDQ z*ZhOR=*!W(CmRo1k@I`{xhXtv7*9C@!mAAP@zKCU<}oHx=44_l?jgF-J+o^>Tvr2P zw&5J|FxUWyzriYBgD=x$LOne!kJ(r7`Ybr}(&fUxE z4ACv*3u0xu`9o!W*9tfcsks*fuv+I0jr%@FHOb1qPU~JA-lMX~Gb~@$Aq594u>^Qu z1o*HaP#tNWMpcOi?}Tp5h?+;0N%5u2uxn!h8)9>M=@Z`PrL@_sP0xeQ%zaHPv%_Uv z8#^R8)OMgDf4bSkDykz}-hSA?z|W3AO`xw3raT)g{oJsYk5Y9mk4M4G_`{f-{ZqfT zq{>&idmIH@=#^3ig{RsCG8=n78w$E1KI0|1w-5?%?Jx26#Ugi7tQ1<`6Cl0T43n|J zMuwUBtFk%&v{$0o_~YG!IXuNarJgJc=SO?W_xEAeW%Q1H^|)WH0}S^BpG2SRW-c)o z*@uW~5g@uDhD%fm^5gbw7 zZ+7whr1``B&W+LrLlp;=3tBs}kLs?AKlQn8x4hs60DNp;aSO<5n-SQ~`Rfom(5_WT zl=bVP&2M>vyp_wtc`jwP(7i;3g2?go1LFhl^zk-xc@PG1e^TZkA#$czwHN&UJE8Zp z%yATh_?8#7bE0gfE5!DE?*8qd=+3zzToc`-(c-?)hKRmL1eXhf5oc4%i3*h^SVF&k z=GyaPKxm=w?UFMjlkl>CkJw?_v5cvM3XTd}|56gIxvHpWphR-DZ9EZ+f3e##e|%#x z6v>st)w1m+%Fg)|0US-q1Q&Q2n4_TzS-r)^B&Rlv4#(i>h@}1)%U#< z<|KSwfo+G*-ZyGR1+i7H~s|O z%6J`O@%~_+@VFc2rt=9Kwa-WKoqqI}Ie&R9m+b)!F=ikA;?sl>GENrsfQ2^=mfVDa z3g24NPWD0IMzK-ndBND|hKOo29`EH_d32*H|7kZoXoc5=0a^dTjbIHcX2}eX}-;G_xujc|CDEcf$2o`9yxB4s;De4K~EFisg=dK;9!Yaxu7B>o3d%Sl_ z_})1@?SF(#iR}53kEFnKLp;GG>QiZ@{xZha*I52TIe+|@@+VV5vmxpa53Z?A;Vr7A zczbdBj>l86ifZxT==ROk>g9DVD`~3{kLGUP-xJM!)DkLxTU0q=w?r4Pe3%y#W7EM~>sFv&S6iJMQLqwAd!=f>IF_QL zJE*PjKuh7yrsJ^TEr!y@lOe3W3282#y5KFV1KHw>DZ~>ur1x}gDzN$5UsyZJRLMDe7wT*_cVdz&*$S& z&IEnU1A#lQ#_XaG@FXNA*7ARg>R#64`aI!!03L*p~$p?UE^gj>Af=f+1aD3pLg?*N4>HseY05ElNbOn`ruq- z3{}n@vQ@1Jcr#U{s$6$ekG9Z+x769)WxUd?EB)k~rhVdO@ssoYTGrinso_B5>n~c1 zzR$uH@tj`j9U9VwmNc6OR8m)IHF};}pH<{LJiMi`!Yn)XW}1PKWj9*)e*F&ZeCWaM z(LoQ=k|}rxeHlpS{Wks4FbPA?Ct+o!xu@O@JUc8|R-M=r*Q-*w`!=B9$JlRX!is`C zYEC5r?Tl&rCt$4T7jsi8M%zoL2r6hWrGaEwdVYN~j?sBCj>);P!e!TBm;h={HaH}T zMS;Lj8!F1-9~MDxcBLZc4`nBn;Sc30W=n4V%&o(ZjTWu0x3W9MP0HyCx~tD+%+bQ8 zEb>}hgggS_6@%+cJO(qujzC2j--10S#bKA$ihur-oca)a~Kcvp^Kq+iG{HiLql51XbTt%Nng2A#BECoshpQzgSjBI z0-OQy+h}w|t7$056lQQplou+iJ_&~TN)S-TG?E~nmCrq<_Df9gecT&}MrB37b` zB#u-z^zyX=hlblaNX_ex8?l5|Pn#XC3beB`#}hUMByh#KF0OLr)|2f&>{fF%BI-8IyXKN0gwqo|+`5W=w^f3x~=@#;UjIKV9U zH!D!?`BixzGvq!ei;WqMFc06!KnR!gM1;@>8k(j0A=e2r;Al&uNX?Fw;j>gM~Ihrgg7L~IZh#U5#x-ZTh~IF^5^YluJ{C_flZMbf1Up8J>B zZ*er;SqD3>Hp2Ws%ib7lXR2v6e`yG-$yaIExG5y%4v<^0alQ%r@2XX?$wRYU9wQD0 zwpdP0zed-`JXM~fMl~#a=+$M48Ja-X&k%xMxU&@c#*=-It9>29#0AdkH5pBCcXR;c zLU_#p*7#W-d3`lyQhS&qTR+NC?@ZbexT5c6MpbsVYV#L2dVlyG;)FBn%jMzmEh;^O zbIXlFv4cG46!HD;9~mWgGc;xBiZm z%;c{5xEOz#dbe8Bugbc|>uR&PUj@`(V*77wp7^|d>N7-=U_Dg=f&I6|qUd2ncc4Qh z*y@0P75{eMSeA(cfx0|D)(&MMIxOpCBcdsqKiRWzwBNe-Qd$a(`uQ}d+*8F(%^bS- zgyZK=0vaq-K+)vVmso)=Uf!L7(#KXct=OT~uEV!rv9%}Dgzr-``a8}jY}cf69mM_< z|NkF+AQ&3moV>#g*zi`=ZyL8tr}^b?He}6MZ0>WZE>o4lADm{7ta1qX5tD9U#9AUn zs`_)^wkd+ur6;Rm7{9?Chu@##j$2f;$o=2KbAwS}e33z6;2p8;M0F~8PYS#h&n?ej z_zFQeY#bgGMMecT!ybsxx^Z_Tq1ZQyck?0f;KiajnN)OD)i6-A}(#0c^z-6li)!GqTm@bO36 z@1AI$d8`qqxo?c*b0$RR>1N-GTpvw zvb!Wb$+kuvGSsE>F|&qs5{BaS-3>)O}2HIb`2^=XHa+X3#g=MLiC! z^c%m=(Gu3}f5BzgF=YR|TP;zq^s}*Piejmg{Wnvls*CNKQRX<((k|OHMTVDmFS+7b zD9p&1&=d)Zd@(h1W~7dCIs%$Dxf$`25d z2q`*0+*0@9Hc|oo3r?}#GfTY7oro!+nw$4Iz~1?#Q%@1MAskFM+lg=kC>7TK52Xr{ z!w&AmRVWZ-U%beVGP=v}&zqx_60k?F09j`G`z7HxGc;f8H+7y?C7n)GdI(hX7Phh? z6alK!-wXn;BYoOr7*snV9iO);JG$HbO<34{Epzmq1PtsZYk#AmL^?p8d3HXV&uM5i zVb`7ix`zlGn9=;6%&cJ0;LW(F|1whg;)d7x;qwWz28w!B17qhaaOdT~1LtYibx%Y6 z&j%Y^wTo3rYo)BI(RV!Fe43MWa!q}Vg0O0)ejzQTy;Hj zcVGN7OrSLz5j26FeHdB3SnrVivhf5dpR6b_D zJU=ZsKA8A;S5!OkzGMJ6F>a65KJWUjazy(0hx*L;(d|_NSk?Bl8mNddSUzNWBewJl z%nW>7xtVS1j#gS}RN2a?_>gr&a{m{Jz&$J(UUq7k_nuNV3=L=dPsN?O&KqKWgEIMo zSTOF*`X^i-ABUcwP7l>9s!`>u8h-X`Bj;k7Tgr8%`udcbH?6JPTI%TM`@g+^9)5vn zcKGl|q!t4-#rxkZLRIzpKnr=3YDvQ3(|6vI|!Tr zv%fz4*Gg$(#b7`WIt8Y$g5I2G9D*#vUiOAL4wCW10+(YQ6i&mM!P;zcs;1rCmBMaU zqZjL-?N#&oChuSq1CE(A)7CE@@$=bx;td|~lwSfdJjv4=hBW6qj9^@BJe?A$QrKn` z^xr<>F7_7%qdnEXqF@If){ptRrP|0ZEl!olW^uKkbk9AXb8eBLX|ZxSvwoNH}8Hud+U_;>Uq#YPVZ-u5AR>dwGfS) z$`b~#$xVd)@4`{g2+ZMPc4x`q)x0TDO)ve^@r!OXI!q~)rb82Kgke;!SH2%{CTr>~ zx0XbFYxXe!J&vsE7a^&hn=s~r{u03FQ=Q8*Z?A^sJ8y777cvY?)lKC}{X^{^s%Sk; zGM_)JT^gIpACJ?|M<`Ui>&^*Z{Z*=48MGe;wYI_IWMqgf(efkbF=I(%mP}aPr+{Gw zw<=sGRMYBTS_w%cecvG;l!|^BOq%^m8J7C83|~?g1yQXiyhAGy3?U`Sru0i_u3l>2 zxQHM3&{*mLrB&5{3~3L0ZwQR^<=}PO1+~|5H3L9^uSr0=y=v>j7}$r=N`NIw=tV@^ zW4QVPB&Zq)WQZZVA#x}b+Owj$ZYftAO7PTkPnf4YVOJ5-NLsD~re{Bv$}|`(dgM9c z?^!Y`|M-{$rmI2(Q3+~u6wUQ(4RcS%(!5uSL~KqZ>^ke+udUIa7MX8*Cmz&=nQIm4 zXyDvv*q?ONgkz_@8mT5wPZT#5_W-SM4gJH-;{U6?w~mXl`}#&@L>&a_Qji!*0UZzo zq$LFuL$|T|Zai?cmo)IxUi0oSD0iiq5BXJ_C@|*LWU%$?Wj`+DlsL~> z&7cXL^k<9L1g#r+%QNp^R=y*ld~T`lo*ILBp)S#JvVxPmgpHjwnDnYkR7B39;EH9c zk1OFytT&ez?qad|aKzs7TFF$X4ej{;@Y}L}ji8N5#pG_9Z+UOk?QO`7VUYFT*bV7@ zy5{n*Q($X_7S|)s8Wy2FGMinPk6hvtgBqX({iD zwMS8gvRi29=Lojg$`MLt$rYLPRw`9r(irInZgum)TX*Nq%@>Pf*wdW{+sm0CPxMPa z^T^B}u5VL~Bl}^dUU{@OTsPxgxn2gj4oP?Y;Yr)4+;*ls$Pq5xA#0Lz;|sqUdqKct zoDA~U1-7zVpt8!M3a{2#uw0OCmnl6<(Mrp@cTZkf9Q4UeSvrOxZ`^(^FVp-z_}c?E z&_zJQZU3DLAzEAfezA)R!I!ZV)v~NWywFod?1`TxOwOO!GTiXGzQ|zVZ0M7 znl&6plXtfOQJ@hhtcE>rUWi_1IR{232%8jha9acC+D)VlFhN10`4bNx${ zW#)`LT^G>M_pJFOJHx`XaRp{R!VT|Qus>qS<@TO7enmU1%k53*ob-jxd%*>uE&<#qFBfpEx96XQ5-&%5L zE0*lA#3K-P>L%~<{uMH(mn6sZ$`fb{x*StY8W| zpv^tYeR-)&24XD&KO7QDq<%QinwI1G;?34pP!bm1bgfT0{~sglzr4#JS(qK|!3Bd3 zodpF}m>j%nM=`_|YI6Tlzb8XT@qFELvhnTP&wD zBYHm2-O=@Ui(=i4iI-)JqA{f=-pI7<{K{He3~C;Kv)H0P{SJe0^Yyf-+io&`Zgl+_ z=L_eWt&S?Dwc@s0Zl?wHum6bziX56qErvgpxvAQ}&Y6wr1ewO463%NNd*Zej#aiTj zBx%w0G1U$1c=lDRIv8Sj29D=y_Bi~NfO;SJ<-EOBrGSSYHB}DqwG04=*?5a5wodJ7 zqMhXaVM>Pi$N>MfttSc>5{HE1 zBZAZD+nIFfdP^paQz?S_4l8c)GThJeaCP(E6Wi*Gm-W1${rN5{tDv5;daym*rf zX+{U4$j^_k9NRv;5c5vJ zI7c-JrvQ0a1;)i7VMByc#d%N3&c1n9tH)JB#$*lV%$J^azaW!Rj+ELLglZI5^9*FI zOM1c9?#|D`h8Yy=-?9xg29=bR--qitH@iP>&0zjHL6@YVx~L#GA!&ztVAlQB%OKx` z^KEVA+nS+sdNW^0l3D^cwn5T{JErBrb`4f=t5`bQ?V3&6t+BXJ3noJ16H*oa3|~%mAY8L&fQWfpTf@mT3yqJOI>VRJJ}rvPr@dtgUF2s zT=;vQg(0gNYxkzGUj}0+?~TZ%81-I#i`KXN;h^pbS}?8^D=vm!&*1sM);EXF`Cx(EN&sYDkm~!PJ*};`%a5wu&6m_PdRk^Xl9MG5p79zCRlSJYnd|Id zc(GgP$ElgE^=3J6^Sdpl+WU+o0C>D=N6Y#-$anLigxlK-eRbU=+_zSIeC|L1E@kc) zI{h`Ui!w_>z>TsHEw)U(bEVFNjn!!Ouw@ybKK1AX)T7^HO^QswHo{;=f1itSY06Pr zKOekoY*#m#zOnUMD|hyqLO*J_-_mAo15;VA-t}GwaoSprFz?01+EZt#UphXmXX;2} z)eYrf;|yw6U@QnMwFB62C>_-)u=Uin4d)Rd46-yj*Y}S4n?0=SnRd^4_<&SuWx_JE z_ZDmNB?aE936A#zH`f>S=MCk+M*0pGvQeq(7FtHlkada(qgPIou--iNhUGyu`%E?Z zqf-*NnQ6o7{=F;P^p4O>29tWdFE=$q&tx zMUATTZA-0#Cm~&s81~rl4_N^*45$M!F5zX2tTgt08wqQzKk>ZzQ5CK}6~FJlJtpDq zr!mE+Nug@vbbn)KIp^K8{?$@9U(&7TF&9~WJ~`xGo{>4c=ky^c^RC>-%^1r=nIvJn zawNL%r;VC~K+tK)jhDA29ha!BL8z)4lrO{s{63SG=r@aC*MnBw4)^RyA_|wbsRkA8 zX1jq(rl-ImJoIYI=xIQM)l%PUUuqdZs8Lq(pu%h^aJQ6{ULlVLzt?%*q97%Ba_vtT zXkv&zE=C}`T$5LyPE>mhl{oVBX6b3;l%s#zmSIH8)&%FL+sxt%EozQSq?CLP9;CZN z&9)K*0;??)#4d{`8wQi(-0lZ7A-Ng9{$Lc|DO6jC*0beGs>oaKkD*KXZ|a!nb3){EM(BaHFn$f_aZtIn0xavdziU z!k!kftBSeJ1SKHrXb`Q5rP7Al<|mPgpMlS?1$-P4rL*i{No`g>Jbd(cO~8W8X{kT! zP4Nt@aG15KTFPnVYeN3uVh00KzBAQ;XXu+{%#d5QKO8`N({`|M%nHzzTDHu!$&kd| zisIIeenq}_{y7`##<#h$Q^tAPai(wCJ<;c)nEwt z0X#M7>Qu-=WOJnGl4|1N?n%z8H=^URoV@&~4LrWlZ_q{`>Gm z20iDMSE!fQE$=6Dh9Y?xLg;D|@~jT04(eX99fq7*E5{nTVbZjNP}0t3!^)SZwy}K` z>*~xD>NSO`?bRsExO0a=(MHE9!+i-dkzX}uK1kk6HAaf{`SPJR*gvaVDde`E+MQw zoCpM)U?&TZ!Nupz)S9p-!=n--lEwj!dFj6rLjbc@|c@kav z?f9$yR>~KSlEhtKkGbG9mDSWT`U6PcY_4qg?_gRHy9~nSGAPwpUbKz2>aT4b5m1U1 zZq7fvVbP(2lvGRh{PpTJ#{v>LyH%(5Q#0clUFX%BdUGgESm`7n3RM&p-Q4gEF$;ae zYa6a(lTKH`#x#jvow)kVlKIA#2XiI_YL!42n?tL;nMY(;Ug2)+Qq>ly z^_V2OwP-r7_8Ew)d9r3}M0>%v63SJ1nQPRk5A=KA;0?>`3(r%3FO0cY1H49L3s2Kw zHVvg~QeD*z!d9l_Hgg&a0;rE~9zr@PE4kSM2`0-WU@l)ELKaEvC>x9RjjJ&9DC03d z0x^Ia#KM%Y#X=rVXT2gfkzY=Gv`q(^&PZAZMD%U3q!$+_YEBjz;h7(Lo^M2r7FQH~ zbJ0QRSGAf>%H~+F+_GSeougv))A5L&U~vY+Q|m3AW^=>Y%uJ>HAz*;>{V_U6boy3MMwO4FHrmM~8L zgx*XE7xVCda|{}j2!C_jP;rrhoaB_r*_E*eeAQFWfqMU3L3yWwbYgt>N3fA4owF^j zE3WsbGi3Hgil$0+T6J+p+_F}$)KD;j~X%8 z&UW*sv(|bg{|)d2I?}q)^wD90;e{Q?a{o?As12XP2Xn*lN~9ME+~q)zyWg$vsf@?Z z2s)AAPkJqY=#KB3PQswfT0u~py)C;K6v9^}QcJ?$3$HW_z3h-$0Ofk*PD~e8grCEf zALCW}NUwkpk+GsgwgoJsD^R!M@9G=?QAz}NO=l}klMx}Zu89ae4M4m&;3@PsK+C8C z$?WGRQ}Xe3B+uud{w--Cg0POYDjK7|!6wls{{w8&30O2a@D3?+)U&BoYco?D{lQUy z7!H^jDL243x!D+0kUk-=7j~Yc4fKo!F~I1PN3AUe{)RTxIR6i5Lq0wxga8tZBsYzw zPRZ=D;e8uQki_Qn4SRZ>9`&AN#3ZIJR4C>=^(YX3yK{ilV@#^*Dz5?-3aIdC#pQz; zbfQWj01V;>zz2Tx0`zgmy_~6lT0Uy!_U|XTQXQ;(qY1$`IYijF0Lb7JyJh_oy^Z%* zgjNHzz?6IiXdtG}!}L3jrJh}4$MsDxUryG6(cr@YS>T|!f1UnxJhzaCaz)YV$EgW+ z!BcG9!Pfw_>Zh3|0q~C;oV1}5J|Q1ZN6L8I8TSZ)QaXhJ5E=N2C6U(s<2JAWkd+Y% zBc}mh0QewqimBF#g{xo|JSYHf2X_GO?%>YNWf+vEjg1@y@G1k=1iSjo$f1!(DqDnL zF)|?JldNb-8XBvv(nW{>+?NvsrsUOoDws``WOxO(kDp<4tg4KJK6Ud=wT@!?mC=MtC@ygx1f)-h^ykV?=yyF{z0DM4L zT_OZ&$0jK4_-OjWGI$C`_C&jk>EH!b@aJSM;QMqazt@wP#yw*p^`1aF>#t{y7tVKp zRpg8^Gv#sEz=?l=r0G#Zwj!6MofWzgx2R3xe zcnmXtgZfhiK9Hc0oUW6VuaSyufqX*!&05wY?2B66-{L;z`z{s=u zqIe)7pt-Nk1+kSL5>OFYuKp8P(Lqr&1~AtEdSs9BpP)yK6M)`!U1tGURkPvQgMe6- zXZrvZ>*~5ocsSlXn92@4=7AEJy{KpE0A zPQ&AYxqQeb3rQro9hvWgXS7=RnlX7R?rb!dwGt>PT`sUKvWyg13*ffew4W`YPe$;Q zC-_D1pSoat()R%)ik^x%A@3VTm0Pb0F{`So^*xPALS{VdD9p)b{C)ah*$YgA>H)^l z8dyZ6`-f66I3VoP4l4uPucK?LUfq>Fe=HnHKsf&3Zmc1UKs%In-pJe6!uiiw3`D$> zy1TF5b#oIndGbW``Beb-N%E(UE*y*W@G6+$UFn|Ywir(fwBd4P+F$sVT4dT!Ix5~J zIw{A+ikA%2VLq&#r&F0G-p#Y$)at1izw$OVcA>N|IgEY|&I)U!L(dV#2BF7&TwqD{ zp(Q>pc9h3fiY?`0GFQa;%VW7|O0R?<6h~SvDQ2@(F`F&1RL8SrkN}<_DjMhl< zi_DlN*6Zl4H$uZuykW?Z!uM0_+pkPf>TJ1oLj^q_e%&Yz3VQug80B^0a7KFAzmOg^ zaBb3d4|^{8-8~uX`*RWG{v=+0%!niJ#qPou)fK!JZ=0CF3jP;oqT->ys(drzc z124Sl$J}XU|2=Fqx{foG0-L-9UP*$r<7dzt?_8sU{Gb*e8UN6``^uV+zv?+5E~?#0 z)5uUIS5&mC4cIwf2>a9FGmQ^TNdB4V5AYP&5SNC@-k?)vRcL?IRh*Voh|2D}tJ?MQ zW+Z4>HSL);TibZNB1Zues2&e25FJ39SIT$ta5VVl&O~>^iM@>pzfgiWdo1O%&(AJ9nBZSJ>6Gs>tip&5Z|jz3KzF z>1?LKuOUS=;v`tz3)>g=D0h*BC%-c#+SvR^ftTF#?`SQQWB-Hh%2g%GbJY*7gM8MJ zbYt}rD{N@qRnH$y=JkK&OJ@J)%hxS?#{`ttj`-b0t%ncu)!YQBxV5qrikJFgVp_>t z_FHi#aR(+(Lxonew38Wn=E9ip&=l~~QcDRb2Gd>n zvu-A>s{NpDKDvc$OBNViX_3FrjF&{zrqjZtXyoO@!0-TYp5jSnZ^PAo2sKYWt>x~1 zh~`W;(tUU3qr7)(+NfA*mg{@S#E4iQ;uPBNLX!NlS?B$+ag9}y7L)Y;3q}@9YU$Vi zy}4x%%5Q)D`t>D#R`n7oHUZfjRE+Ao^XHRr1=h@~0s%~aTH)=F&d)cYPWOKr_K7Q9 zo6vZtQ4i0lv>cwiW_(jG(d}H;gW%T|dPjImN!(tW_L9Az6YK^N-JuZGre2Uj^|)G+oieR~_m*laonhD7tBhG$~^KtTMJY|UGYZr&a#zU_6iZ5k)w@JVQ}`;i3KWOVql zdCkcAXhVjm7t%SDc0+sJE3ciNf#c3jHN3lQxQ5>E)_C@-9+TqQ)(q;CBq5n~m%!;i zLLxF@l=7~Sq2~((hTcI$w3v3FKP&oX1+bq}09AJ01%0y98?2Ic5TN2!{u!_|odCxg zObD8$J~vbgvO9dh9e#eB^rGamyWcGqkqLg$Q}VM{xh6hhT%u-N=lh@~Gcvz=d1VaVuI`G$v-)uAPPzN})<(hFgd&R_B^S-kc+|IUOx z1O!12mjNpixwObJdgTSsXk+FxaqQ(tSI7IjN$^*0amfV+?Gr`5()|oCHj9Cer@)dI zodNK{)sRw~DX)9KphSqS$cBbY2l;3;(&dsr9B5IaB93>No@GCczVVupa+4@@I z)?`Kgch78m&7LtpF<~GAD|V>gg&%+}AD?aDf9Z7$wDVL~IdwM`LsnTDa&0{CS8AEKx}FD>UG3hz!kva^ zEu*{H0rV1wjzfi(fo_Kr8ZWYDI6ACjOxzCmmjK!pP(%I)N%RE#7R*VESjXyanT6wEbk7Gxvz;(z z%@zo}JIUo?rkl8JJ4u{`#C)Y&t=~lvqB}l8+|tsr)oYkEqtx21nNZuz+_(drobIoA z@$J3+{;>};;;u6oUr+ai7o~>k9q%Ajza5v^!V7chdP1wzbIcFO>9o44meG3}E82!I z12AzX;E%xx0AXST(DGahw!X`_RK8?@{xcQlllVJN86IDHZ@-Z3<;CZfj!S)SM4eW% zlCTFYYUbNN(7lfeoj{~;?EIo&P7%nFxEfn8>B<#iTds(V?%{k%#l=PQ`*|`POGg_5 z*AkC(immv80Oq(^^^rEx72bN!R7eE8$w4`FW{8?t;PDjRU`*5{URl21l41bZhEWBg zRyj_vAO&2@ufR!%$I$-*af^?10@ddhoq-f3;_{tzG0lT_@7@);HwpdFPB}q?w11_2 z&`HOf@iRj;%lyd-@CQ%J_YlB*i3YA$*<}wot|%M0@2E4l{HnJf;%JPGb6m=Tos!(g z$G=!apTzchJOL{r{|m&@=MXT(I`XvJpeM)2hab4m;TQ)u^MU?FS{W?FrYJ}yi^UIs zCXinS{yu^u@F^q?Af8xxN;~GYE_*-sNutjTI$1D6i`RgfPwgw$Bs&Q-2I(2Xl?y0J zO3DR1mtjh%a#WY~A+v*NcfOQbmjv^7qA(NNe}P}EuH{%2b(6m-;=Go_h-x+b1)$^h zc26tIB}4JV?`;|Iq39h#nm(b(wG=A`N;AB7s-0Wsifk69iE{!wLT6teNQzr0@YCtf8x% z(kG`90IM4I&-ttYQ5A^>MyV;T@ohj&Rr()b9V4)Zwz`>g6TzNPRfh@{2EPXhm;b%hfq=Y|gM1kRVtRHblnR2m z4nsmP*FhShqfc97RsoS^M!&@zmuojJ~q!~U}oZ5ewr88RH+uihmK8< z4tQ@`6%62n?*?QKnUFKbF+MrmS32hgF{=!`CbJm^BZXkuSp%d6rUD>7{u?@d<7j8? zx~FW6Nn=q`1V z$*ZSGcfl@`)0-uf*u)L-F*eC9=iHn?lv_G^e z!Pep8BvL5m+}=9Uba`F9ID7qM4#M5 zxXMQe?@^FO$XLr{u@b_`FU3e}0wi#mOWJ641{e-bk2+BQLgqUO7wHmWR7{ouKYU0` zpB#8aH?M5MhGWixw{kU|C;8CB;XqAK77k5?Ngme7}oLO^_8ai5ZfD5DYW1>3xFo)5SKgP zroE@w5jktq27n}T`sdPv(D>+O?s^jXz6Rq{riAxq=K4@s7oW=wpkTRcPcZG!aPq6d zc7yXd7F#M7=@b_5&dm){6(4C6aHso1&$uD}SrEOQHBM#sv)E=R=ID&{!K5*BV9Duk zR|l8WjJ!oaM1kRbpuM`Y*--kxTagQJ2MO+kJU>hXSY`l*=S-&uE~SkKVe%;6w|;!j zQx0yyI4Jn4-m;T_QWpcmv!J_o4k4Yw32U5>BmAN$P+xi`tPSGGgX%qfyAzB_CwzYp z-IB}HZ@wRUf&kV_dui#Ird@_&u7A_i%rzmWCy8_iV=>YPcd}Qab6~_=X&hAtPyZb4 zgK@pWx(E^Z z-5)_|ykg|RRJ!L9$yGJI?IZ|pwZ&uPv8MgQ3yjo7MH=xuN!kaD&Yvjk02*Db%yKp1 zSvtNdY9<&>W-yq#>qH-)kh9zs1MFRuDSv-+s^WPaF+>soL)DMFn+dvbXdseaNoR3F zBysb7Iwoo8QBkP$5g-YlyP}j51Mc+gu@y8?1%OS)I7QEAn2W`qJHR{DM&O;}c{O?p zgy6Q#N-@AUfTdB;?=;9L!PAIxL&z`bSMS|(f!|M=0$kD*_xYseBW(?2p!l5ihlf*o z>w6X#!4%Q(Noor_S*ZF*^8;N8v3I@?$>jn$eIInAi=PcCS;)hXq6EG*rxMHvQFH{f^5P0~LCcdstYSZ`gs{qQ*Rt_q zo%w9ODG`wXgOJ~B+N>RB%AfE0bs8sq*E<6xj}*U7wVe*CIRG3!pI6}xilF;F#PxB3EwHgsfJoC zlZWjCI@7F@rh*TOwZYR;Bme`G#8fSj$RR!-{`2S0$t6oC|2u=5;e`&l-(q59MK-{W zYF(Bjpn&9H_Z^(@7m-L;bVth=7$1EM&;eQX)OpF$LDc;!@0GyAI4ha^@W_ZuZp53}8ou>r}AlH`xh^MAVn>&g|(wuHc#- zkZ$WY;hGxK%ly>c?m4QJey6x{0WiOe*X6`O*Nf^(v{`9j#kA z&njb&4jt6|H3t0;zer5UCm0BiQ96yB7n` znS^be_HUZ%_nsE6dqIZlsebH@8AuNF#^xWH^hNmlO3B`YO;cX7@Li znf@M15==h4W4ot^8yZT=OF2K6drzEf@-Y3`bYIZA;k$cP&lc|md3Wgs1RkWx`!b^i zeT%veP`JaqDktron3w&2@wTIh9Bfu+H}y)MgzMY1o?q_I@2Co}+gVw(!^o7Jt=+9+ zh+vXT@ElD(&2MCmvz7kJOf%htyu;#cKCR+aXvpDlwDWq=*8LqWM5K#WVy$XDwec+6 zlBkh}a_ZE^o|uUall}IK(b6M1)b_g8yf*1di_cf0>^kGKT@~>B@gWkrfK(eZLxz+Xtk2L)vy;nZGrZ}K2dZZ3ZoZh69 z#4&$yu%xT&?tZ;#>3O>0u!8c(p(Wm6knOH zXra#yTELeJ^^hy&i*r`^ua~U`KJ)XUDyeBZkO7(t!IpUy ztQ9ZO8SD2j(I)~6dkKGRH0$jeI!b!2+;YL_bx=neQK&JEMmMnJb$%WSp(-7BwEcRm zVq32APGc3_j!+!cQQS^rymKH?Jm(uB+9~|7V}DlI63HKgVhx7tmDmvXo6@~`B4h<`ieMt* ziex6sP(%8C6_q*9v=l>o%ImP3uv>ZAdwZt>q4KzbTkqn-y2im3uOGyd^%&*=hk4q% zdnKP#^>s290`W1l1i!z}fa*T8ct@Z$xY2@0W3T}aPD=9w4CQZaZ#U>0i9NA#Sg00`GxoYI^K~-`%RnbMwTet~ ztK3ySv+g?cBHXQ%>&3`X=ZElNb!zpaw{m{5m7iU`46oIiNOT2!fp~PZse)!!HT^yq z8fyBbcj`xha#%9i>2--j%=M$462YUYs4#Q<>ZoF+tWhkG&BA?QbY3#qulVAaiT=D- zM>o)iPgXfjV|dspSjUZ49IZkwse z1T|Tq7E=mI#lA$5uQhAQ1x32(1ZSy_vp?WY_0u1k!X zEu^jFpY1RqvNq9iyML7Jd_*e86i1h~-is3GOB33WFg%TWtixnwY zZq&O_s_U`F5ZQ1iS5f^tyzZ7lyY*azC*n$yrCe$?2PiNeR0{FV#Xi@38& z;G}0S&)B%QA8Whcswn)^X44v954EVM?0>lSoN_59;724XPFmL-myh>aF1+#46aV1H z9O!9K){m~f?yE!Jiklen znauRJK*Q$4_5M{Y%GFZt1#!d8eBp}G9hRhLU$M3ll~Y>h?63Q0Bp>R|H<4^RirXZy z`?+kmGrN3z<i0ZW~x~ z_&!0%c6s@ygblzG`5Ee4Z6W_`_diaJ zAuhxr17p2RtJc9p#2r%Do@SdCkz0sb?ATH2MirUIS4%3VC)up^G!*QJXR`$bM!tx~ z`RDQC>VZf^)f{SbJ!Smy-1yDex7qKdDW)B05_{eO&fWp;<{csw6r%mbXn$!6uAxuQ zSU=(r?tXff*Zsb#Nd?14wdCoYzBHsL!3)kgk8Mg1lz1wlR>QHSV&T`$KYU5dTHy7K z3BA{HB;qj>}v}h@w}g3(30i#j7Gj*4HG7xQ)*Lq5nU^z#n0a_vJA8u#Vo|dk#Q0{a7e&BL7V>bm5x^lTR>P-sulA;EA!;*B6h!vVHXU zfw+5m|5dipvHkuJ9iGz|@}nv5VnuW?Jdw^XAUSA5nkU$JJk-5zQW&L|JCwUSWUE-v zXMIW6{|i^YzO(FrCpM`uJyx7@n$~ueuT`;>nALsF)p>6wLvpnLA%3aMHUNcWkmGTtbyP?Yut<kMV6s)+YEi+jKd{Qz7)p+1Y7xfYmR9Qpo<|H=tgc z%=f)&kt6=PapaP}I9;c^r^1h&b~!(r7U7O|>$42QT0#Sru9jaNcPlOgu9kQgO0M$2 z>#g${2m1H=J*2jm^|BE&Y6@n3%Xo<~`Weq(JIcddd4e|>Zf4r108VgTWJ)wS3!gbm zOD?u3$P)Q?MLVFrv?Qm8MUC!$vd}*_xyV&Dw7gniwSHS}p+rV{9;H>HZB;DiH@sdh ztnb=eoI9%c>KXs7Yqj6V#3_xRHnd>T7sp(-rL(=hC57=2u`;2D{a+exFPT=z`GH_w zo5_ zf=k+o2@*9K=W@@AN>z;a?@Aq-1<`HBN7^_pMFo-Ds*qFBxk-q&IAT`}O*XAM-h_2l zSvgCUrqY{I%2+voxwe=0^Ty=k@1WSdF?;=W%pQ{txt<(|qD$hJQ>9-`I}qKl&`v`D zL+i<6HC*+fH=`AOB_v6$6)j<2sV?h_Xqvz9)Pj-#M#Tcu4E8)H`0pgr%cV3^SqqPT z5v%w9#+04Q*_qw?xzw4Hn8dR8c`PIO8^$4KHL3mL&n`Q+vFWK2>%!+B_J^1H>Djt# zFPL5rvFBoy3j-6pGqSn1@mmyNc*JW2{(>ZG@KQ<^blevHN0_g(?FZq0m~YtuH=xR+~gT+_8uM*!ksoVo=m z;2{F=PzIL!?(aNo=DFJwT;dYBG+Me&^ix2pYW1e+DA~7tU6Id6!=9*#2)d@}X*(^O z2a$ticP2qZtAnwxdr-T-hGilJt5uQYZn!p?Urb?1#6f}XH5n}TIi$z(qTSY+z;dmO zOrSyU4C!RbwTdFc!73yDMdcwB{rO*asU_9F?*XkxH>-Mq>z;X8L(}(tcfEw(~Y^TO3&-@7?$Si^W_Y4 z36gc{bENExj!ClSh43w$Ju!->bbMQCV%Ar&Uo3Dw)s;BR#eNB_W!5VtLl)G>-n3_9 z8Kq3&+UQlk%IOm4fDR8lS$sv#!FF&HnhC!zh2_fiWdAL<)nA+DDJgr(m8T=}_k{&* zBznpy-|Uy7Z3Q-My;XNU1wvnN%QS})IJ|)6uRr9k{(UeH^GLBabli>88L-v@)<&kkECg@E1?*qv zWE)B1xCrFM!tzvb`ZV|+L#gh9W92{qNMFPjA1#iou5Z7?**LR)L|w-A-ZavmcDR`H zX&}HJ1mjq(br4~C#>9I6JbarMUH!Fj-XbgW3Shh&Fa-7x9dGBPk>{yR;t#8_7)7O_*?i~uS z=DqCfm`>MoGR?lZVpw3Av;0%d!+M2oOZ)zmB67`pp{p_X+SC=qR4(Gj-hvY=ds>o~ z+^sGRrykfeeX`={>Ev-eBSs+BRkOArP$9#5HXRP<`T$(s0@gsi*<6gxBYp)Pnktqsc*6Mtpdrnxc?}j<^H@i zFmSF7D<~6R^~es*k}TO##f!konz8f8c?WKe8sjfUd{D~@sLpJfx44wa0oZ#$_cEvx z9VPL1&xKDN_Cd1C>DV!tD4h|q&a<$S*An7n6=ZIE?6;?#lvw)6EP7G@da91lwq^cf zzq$Fw;p-sZ#GfGPh_Fh4l2miGb8UJI*(8Fy=0~Ef!-_@TYb+h{bUDVqngGKcUq;fa zoTrm%tX*N@prGFd$>1ldR@W5(v0%-L9oL^5e`s-#^MyFf&Eu*&wl@;ESgs(KIzv+^ z1&IE)W5X#2F?DRS`OKNuR)!zfOO|eyk}*0`%528+pP$^RSUWddvTkPc19!d8ah%v) zrGQe#bk=lUXj^|U)nOcAD2(*;I4C`uzDtUpPjU|2Tc2jenhjuA1Z4MbGs_q~fPG*} z4%Adj7Kp9RJode>&W*R+IRK1Y1u17oa)|OXY}U|fUjgRa>0HO(`6!*j!M8+Z{lXA_ zV{6Xx;ZdkN!?r%p`G@*S@GC_tO8T!@#~egCIcHoMzuVM(mQs-ka@=V~ZY-lQ@sl-y zUfkX_*OfhHnDH`@H`O=LGECUW!?%QSt<1GAQuS4D0&PF{Mh+{w+17bBZ4LRc+B!x( z(+*MAJ&Ax_qrhZ6(jGi03g0Ruw z-k~apP%I?$8%UxWTxAeHO*e3y8^n_Z?yoF=X6i8EVSRA!;e$9y)7WFq=x8TLp^SQf zHUubiC+`b;kFRLe9uD7WC@DV+W-c!~-id;RuMD{JoWeW0pc3-$x%1ULrQrGg%B;+- zoIQ*0@C;hj0J>!Fa_UmbASEL0R$Bx6mVkx^fyrlDO&Y{pTH(IJfU%u-pz)PH8WNH` z9=#?0BFff@9kxvg%>(jEE-RP^I3>jv>~A6hlHT0VEI_Vy|Mc9Ti)h75D4G=x5w!hD z{)QYF38hkz=9A_q7$G;9FHG4z`s+C>&~)cM%;;i=5jG+qrt^l|k%QZYse@c6eZj?$ zzs5oU)1=It3NE>*Z4eJ)e6YlDI|@2-NVAkm(=^SGgeOeEG(jlq{9G(2ohp{amph_^ zikj&ThjfY`;EXaowI&F9{(U>?^B}X%BTL=m3*L$WH7=xZ)=yeYu7+T-{|R4FP>EZn zzGKZQZNvzE+?cvT|Cctv$um>?-r=zv3wDg%O;&t4*t8;sM9QGUt=Is z)YEI3e}CkqZ{U$>WUtOrvhbxsk33`e|I0^KOC8L5U+Bw^LR~bYc<)2Uk?L|W7nF_F zk_ylT(vBl+MQ?{@(E>Gd10m=KVJAZ9r~mT$?%$j64fGbO#3ecxE#Yx5@&ofd7Rhw; zC4i=!@Wl{|AEct0^Tu2~m#dG~E3mcGC@gbsf6{$a^`Rb)9yG1MwyF4z`jF|mAZ5P* z3~<=k0L5Ro2kCw#-^BiLdapU0x2-(z(lBlV6}wp*xPBC>U=%8=k<;f^_x7WhcUH=z z^edK|KyoN3(sR3IGAagjVYSBd;K8X@^rKlPKJeWfZX>)wR8u_o)dNkSW}n2z*#D*( z)sKnA_kKnO=-FZ!Vp#RdKT}^d6!ji-Vt@!T+JpVnV5seBJ!p~Ki#mz)Z^HM-Act*a zx552;BU5Pst)2v%w%d;~Pk}k(xeG%6t*zU!iSfkCeYwQogc~wCq#-=!s=?WomX-#K z!-WNqYCZk0RO_FN>wkRN-iePNrXIsONHK%Tm7}g~6sSC%@J&6-DDexo(bJEnq@|;) zYapg8{42Z89fO+(n`e`Kix|NCH}V?c@0>(p53{|d;yGVxl}F&9q+Z*mUTwR9upiuQ zB~Y;zc-;>{VoyOvMmH!xLl@W0xQ|hxy2X=w^p7vS!|Ne!o0A6&wr6d<=MyJ?War

|4>4~qer)K(*Qv3F_n(TUzAlwMXWJ$AD*LWQJpo;YUfVYjHiVnf(P|YzIsDHY zDzu@~_5fVkrpqo}E*S15`G6vC1o<8;uEKiR((kIg^`b1?-+NippA?@JKB22e0WK}Y zuOHaBu}_Q#d{z9m7!CqbFYRATAA^k)B=`5YA92=U4g~an*zf z&i@cG#`BGYY+EH1Cgo)gGf&IzJQ8Ye#MpAyQ+eK-`P%9ikZZQPUZKUxV^-Kd}eL=_HtcM&wYSp=lP*Q zrA1{>>AlKBSM$qvjBcg%BG0}4Q=a?BmvQ#}D}iae=ToiF=-dvkCaWXd)63Y=FSpUC zPvaBgZ1x_LO}2KvMXxoNy<0Gcy5Ae6=8sOVzu@t%0x@<}&d{!{xYXKw4E_Ue6;97_ z_zg-p3Sa7Y@Xi}s8tSefCB-}=U^yO-s!+hsA3{|N`g%y8ca+`#?)?0H1^COD_9%j7 z+0!_S<8Su+--i6}7b$kY()$NWpZe>!fB*QeRbAQ>tk*qU(YjzO&Obl%U%xvGqJX<# zJHmhUJ^23+`9GZemviwi;eo{Pe`NAMSFrz4od3$S{C{DBpgjud8K$)>Bl-_YZ4AEJ z;XS^(U}V06?Hmsb4X-k?Yf0m}Ypeg!L-{{?bMfW@RLKYFNWa7i8#Db4DX>9evZwYt zNc>u{v9g96iGa1L?bSanQvYXf{&sLmtVU_`(2H|?g%4##oVIR>xE{KQc)Fz)h{{~3 zu~W`Q#j*WfnYaHtU(PIg19zhpR5ymlOW0K82I$+9#bR;;?9%TC!{V Gp8qe4X(z(~ literal 0 HcmV?d00001 diff --git a/playbooks/block_indicators.py b/playbooks/block_indicators.py new file mode 100644 index 0000000000..55297ef4b2 --- /dev/null +++ b/playbooks/block_indicators.py @@ -0,0 +1,297 @@ +""" +This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'filter_1' block + filter_1(container=container) + + # call 'filter_2' block + filter_2(container=container) + + # call 'filter_3' block + filter_3(container=container) + + return + +def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_ip_1() called') + + # collect data for 'block_ip_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_ip_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'ip': filtered_artifacts_item_1[0], + 'vsys': "", + 'is_source_address': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block ip", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name="block_ip_1") + + return + +def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_2() called') + + # collect data for 'block_hash_2' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_hash_2' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'hash': filtered_artifacts_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name="block_hash_2") + + return + +def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_domain_1() called') + + # collect data for 'block_domain_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_domain_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'domain': filtered_artifacts_item_1[0], + 'disable_safeguards': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block domain", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name="block_domain_1") + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.destinationDnsDomain", "!=", ""], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.fileHash", "!=", ""], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this domain address is in the custom list called "domain_blocklist" +""" +def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_5() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", "in", "custom_list:domain_blocklist"], + ], + name="filter_5:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this filehash is in the custom list called "filehash_blocklist" +""" +def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_6() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", "in", "custom_list:filehash_blocklist"], + ], + name="filter_6:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked. +""" +def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_hash_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_hash_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_hash_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:filehash_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_hash_blocklist", parent_action=action) + + return + +""" +The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked. +""" +def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_domain_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_domain_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_domain_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:domain_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_domain_blocklist", parent_action=action) + + return + +""" +The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked. +""" +def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_IP_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_IP_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_IP_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:ip_address_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_IP_blocklist", parent_action=action) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.destinationAddress", "!=", ""], + ], + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this IP address is in the custom list called "ip_address_blocklist" +""" +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", "not in", "custom_list:ip_address_blocklist"], + ], + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml new file mode 100644 index 0000000000..4f4e9e3bdf --- /dev/null +++ b/playbooks/block_indicators.yml @@ -0,0 +1,23 @@ +name: Block Indicators +id: fc0edc76-ff2b-48b0-5f6f-63da6783fd63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Response +description: This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. +playbook: block_indicators +how_to_implement: "This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record." +references: [] +app_list: +- "Palo Alto Networks Firewall" +- "CarbonBlack Response" +- "OpenDNS Umbrella" +tags: + platform_tags: + - Response + playbook_fields: + - DestinationDnsDomain + - DestinationAddress + - FileHash + product: + - Splunk SOAR \ No newline at end of file From 6819bb1be73ac6d320fdd5c66ba450d09cb1171c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 5 Jan 2022 13:28:38 -0600 Subject: [PATCH 23/27] Added email notification for malware playbook --- playbooks/email_notification_for_malware.json | 8672 +++++++++++++++++ playbooks/email_notification_for_malware.png | Bin 0 -> 226528 bytes playbooks/email_notification_for_malware.py | 338 + playbooks/email_notification_for_malware.yml | 22 + 4 files changed, 9032 insertions(+) create mode 100644 playbooks/email_notification_for_malware.json create mode 100644 playbooks/email_notification_for_malware.png create mode 100644 playbooks/email_notification_for_malware.py create mode 100644 playbooks/email_notification_for_malware.yml diff --git a/playbooks/email_notification_for_malware.json b/playbooks/email_notification_for_malware.json new file mode 100644 index 0000000000..24f8c4685e --- /dev/null +++ b/playbooks/email_notification_for_malware.json @@ -0,0 +1,8672 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal \"file reputation\" and PAN WildFire \"detonate file\" are used to determine if a file is malware, and CarbonBlack Response \"hunt file\" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.", + "hash": "cd4b30ce1b1555275490936455ad489a860c1c98", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b019e440-ef29-4772-bda2-a9386a65fccb", + "router": { + "name": "metro" + }, + "source": { + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 32 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "eaa4fc01-be31-4366-b66d-7aaaa8cd5967", + "router": { + "name": "metro" + }, + "source": { + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 171 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "74fcb7c5-ea09-4556-90ce-c60cf8681d04", + "router": { + "name": "metro" + }, + "source": { + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 767 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 16, + "line_start": 8, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": -120, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 1394 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "send email", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 338, + "line_start": 325, + "name": "", + "notes": "", + "number": 0, + "order": 13, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1880, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 1571 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1af67ff6-453c-46aa-87e1-3731e1a659a5", + "router": { + "name": "metro" + }, + "source": { + "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1682 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d4f646d5-8ec0-41ef-8519-cd07b8de14f3", + "router": { + "name": "metro" + }, + "source": { + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1834 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ef8c12b6-f42d-459c-a8b1-b04690b626ee", + "router": { + "name": "metro" + }, + "source": { + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1951 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0b2d5872-1c82-438a-bf42-2ffefc4b4bb1", + "router": { + "name": "metro" + }, + "source": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1954 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ca25cb81-1e40-4c53-a811-3fd0be926cca", + "router": { + "name": "metro" + }, + "source": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1960 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d3d6a860-6f58-4b63-86d5-8c1a7da31e5a", + "router": { + "name": "metro" + }, + "source": { + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1967 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "50e35606-e056-445a-b71e-84a1d6026b43", + "router": { + "name": "metro" + }, + "source": { + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1969 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:initial_artifact_filter:condition_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "VirusTotal", + "app_version": "1.2.37", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.ALYac.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ALYac.version", + "data_type": "string", + "example_values": [ + "1.1.1.5" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.update", + "data_type": "string", + "example_values": [ + "20180925" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.AVware.version", + "data_type": "string", + "example_values": [ + "1.6.0.52" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.result", + "data_type": "string", + "example_values": [ + "suspicious" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.update", + "data_type": "string", + "example_values": [ + "20190119" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Acronis.version", + "data_type": "string", + "example_values": [ + "1.0.1.37" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.version", + "data_type": "string", + "example_values": [ + "3.0.5.370" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.AegisLab.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.version", + "data_type": "string", + "example_values": [ + "4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.result", + "data_type": "string", + "example_values": [ + "Win32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.version", + "data_type": "string", + "example_values": [ + "3.14.1.22785" + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Alibaba.update", + "data_type": "string", + "example_values": [ + "20180921" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Alibaba.version", + "data_type": "string", + "example_values": [ + "0.1.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.result", + "data_type": "string", + "example_values": [ + "Virus/Win32.Parite.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Antiy-AVL.version", + "data_type": "string", + "example_values": [ + "3.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.version", + "data_type": "string", + "example_values": [ + "1.0.0.837" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.version", + "data_type": "string", + "example_values": [ + "190121-00" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.result", + "data_type": "string", + "example_values": [ + "W32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Avira.version", + "data_type": "string", + "example_values": [ + "8.3.3.8" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Babable.update", + "data_type": "string", + "example_values": [ + "20180918" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.version", + "data_type": "string", + "example_values": [ + "9107201" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.result", + "data_type": "string", + "example_values": [ + "Win32.Virus.Parite.d" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Baidu.version", + "data_type": "string", + "example_values": [ + "1.0.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.version", + "data_type": "string", + "example_values": [ + "7.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.result", + "data_type": "string", + "example_values": [ + "W32.Pinfi.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.version", + "data_type": "string", + "example_values": [ + "1.3.0.9899" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", + "data_type": "string", + "example_values": [ + "W32.Perite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", + "data_type": "string", + "example_values": [ + "14.00" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b!O" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.version", + "data_type": "string", + "example_values": [ + "1.1.0.977" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.result", + "data_type": "string", + "example_values": [ + "Heuristics.W32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ClamAV.version", + "data_type": "string", + "example_values": [ + "0.101.1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.result", + "data_type": "string", + "example_values": [ + "Malware@#1b1651nqd7ivb" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.version", + "data_type": "string", + "example_values": [ + "30310" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.result", + "data_type": "string", + "example_values": [ + "malicious_confidence_100% (W)" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.update", + "data_type": "string", + "example_values": [ + "20181023" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.result", + "data_type": "string", + "example_values": [ + "malicious.94715f" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.update", + "data_type": "string", + "example_values": [ + "20190109" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.version", + "data_type": "string", + "example_values": [ + "1.2.27" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.result", + "data_type": "string", + "example_values": [ + "Unsafe" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cylance.version", + "data_type": "string", + "example_values": [ + "2.3.1.101" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cyren.version", + "data_type": "string", + "example_values": [ + "6.2.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.result", + "data_type": "string", + "example_values": [ + "Trojan.DownLoader20.25948" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.version", + "data_type": "string", + "example_values": [ + "7.0.34.11020" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.version", + "data_type": "string", + "example_values": [ + "18744" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B (B)" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.version", + "data_type": "string", + "example_values": [ + "2018.4.0.1029" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.result", + "data_type": "string", + "example_values": [ + "malicious (high confidence)" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.update", + "data_type": "string", + "example_values": [ + "20181108" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.version", + "data_type": "string", + "example_values": [ + "3.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.F-Prot.version", + "data_type": "string", + "example_values": [ + "4.7.1.166" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.version", + "data_type": "string", + "example_values": [ + "11.0.19100.45" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Fortinet.version", + "data_type": "string", + "example_values": [ + "5.4.247.0" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.GData.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.version", + "data_type": "string", + "example_values": [ + "A:25.20275B:25.14197" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Virut" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Ikarus.version", + "data_type": "string", + "example_values": [ + "0.1.5.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.result", + "data_type": "string", + "example_values": [ + "heuristic" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.update", + "data_type": "string", + "example_values": [ + "20181128" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.version", + "data_type": "string", + "example_values": [ + "6.3.6.26157" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.version", + "data_type": "string", + "example_values": [ + "16.0.100" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Kaspersky.version", + "data_type": "string", + "example_values": [ + "15.0.1.13" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b.5756" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.version", + "data_type": "string", + "example_values": [ + "2013.8.14.323" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.result", + "data_type": "string", + "example_values": [ + "malware (ai score=100)" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.version", + "data_type": "string", + "example_values": [ + "2018.9.12.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.result", + "data_type": "string", + "example_values": [ + "Trojan.Agent.QQ" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.version", + "data_type": "string", + "example_values": [ + "2.1.1.1115" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", + "data_type": "string", + "example_values": [ + "BehavesLike.Win32.Pate.hh" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", + "data_type": "string", + "example_values": [ + "v2017.3010" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.result", + "data_type": "string", + "example_values": [ + "W32/Pate.b" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.version", + "data_type": "string", + "example_values": [ + "6.0.6.653" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", + "data_type": "string", + "example_values": [ + "14.0.297.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.result", + "data_type": "string", + "example_values": [ + "Virus:Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.version", + "data_type": "string", + "example_values": [ + "1.1.15500.2" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.bgvo" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.version", + "data_type": "string", + "example_values": [ + "1.0.134.24576" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.result", + "data_type": "string", + "example_values": [ + "generic.ml" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Panda.version", + "data_type": "string", + "example_values": [ + "4.6.4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.H" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.version", + "data_type": "string", + "example_values": [ + "1.0.0.1120" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.result", + "data_type": "string", + "example_values": [ + "Virus.Parite!1.9B80 (CLOUD)" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Rising.version", + "data_type": "string", + "example_values": [ + "25.0.0.24" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", + "data_type": "string", + "example_values": [ + "20190116" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", + "data_type": "string", + "example_values": [ + "5.6.0.1032" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.result", + "data_type": "string", + "example_values": [ + "static engine - malicious" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.version", + "data_type": "string", + "example_values": [ + "1.0.21.268" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.result", + "data_type": "string", + "example_values": [ + "W32/Parite-B" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.version", + "data_type": "string", + "example_values": [ + "4.98.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.result", + "data_type": "string", + "example_values": [ + "Trojan.Gen.6" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Symantec.version", + "data_type": "string", + "example_values": [ + "1.8.0.0" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.result", + "data_type": "string", + "example_values": [ + "Virus/W32.Parite.C" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.version", + "data_type": "string", + "example_values": [ + "2019-01-21.02" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Dropper.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Tencent.version", + "data_type": "string", + "example_values": [ + "1.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.result", + "data_type": "string", + "example_values": [ + "W32/Pate.B" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.version", + "data_type": "string", + "example_values": [ + "6.8.0.5.3962" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.result", + "data_type": "string", + "example_values": [ + "Win32/Pinfi.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.TotalDefense.version", + "data_type": "string", + "example_values": [ + "37.1.62.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.result", + "data_type": "string", + "example_values": [ + "malicious.high.ml.score" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.update", + "data_type": "string", + "example_values": [ + "20190103" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.version", + "data_type": "string", + "example_values": [ + "3.0.34.707" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Trustlook.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.version", + "data_type": "string", + "example_values": [ + "3.35.1" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.VIPRE.version", + "data_type": "string", + "example_values": [ + "None" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.version", + "data_type": "string", + "example_values": [ + "2014.3.20.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Webroot.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.version", + "data_type": "string", + "example_values": [ + "1.0.0.403" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.update", + "data_type": "string", + "example_values": [ + "20190120" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Yandex.version", + "data_type": "string", + "example_values": [ + "5.5.1.3" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.result", + "data_type": "string", + "example_values": [ + "Virus.Parite.Win32.9" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.version", + "data_type": "string", + "example_values": [ + "2.0.0.3733" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.eGambit.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.version", + "data_type": "string", + "example_values": [ + "v4.3.5" + ] + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "type": "" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_2, name=\"file_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 55, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 40, + "line_start": 19, + "message": "Configuring now", + "name": "file reputation", + "notes": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 160, + "y": 100 + }, + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1981 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 5 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 5", + "description": "Only hunt files that are considered malware per the sandbox (malware == yes).", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 110, + "line_start": 92, + "name": "filter", + "notes": "Only hunt files that are considered malware per the sandbox (malware == yes).", + "number": 5, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "detonate_file_1:action_result.summary.malware", + "value": "yes" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1020, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_5", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2020 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 3", + "description": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 131, + "line_start": 113, + "name": "filter", + "notes": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", + "number": 3, + "order": 6, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", + "value": "artifact:*.cef.fileHash" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 500, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2022 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">=\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \"<\", 10],\n ],\n name=\"filter_2:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 2", + "description": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 165, + "line_start": 134, + "name": "filter", + "notes": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", + "number": 2, + "order": 7, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": "<", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 400, + "y": 100 + }, + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2023 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_9:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "Carbon Black Response", + "app_version": "1.2.80", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "Carbon Black", + "product_vendor": "Bit9", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_1\")\n\n return", + "callback_code": "", + "callback_start": 193, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Hunt for binaries with the malicious fileHash across endpoints.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 112, + "line_end": 193, + "line_start": 168, + "message": "Configuring now", + "name": "hunt file", + "notes": "Hunt for binaries with the malicious fileHash across endpoints.", + "number": 1, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 100 + }, + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2024 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 1", + "description": "Only process artifacts that have a CEF fileHash.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 37, + "line_end": 213, + "line_start": 196, + "name": "filter", + "notes": "Only process artifacts that have a CEF fileHash.", + "number": 1, + "order": 9, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 20, + "y": 100 + }, + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2025 + }, + { + "action": "detonate file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "file_name": "", + "force_analysis": "", + "private": "", + "vault_id": "filtered-data:filter_11:condition_1:artifact:*.cef.vaultId", + "vm": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "WildFire", + "app_version": "1.0.24", + "appid": "", + "config_type": "asset", + "fields": { + "file_name": "", + "vault_id": "filtered-data:filter_4:condition_1:artifact:*.cef.vaultId" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "wildfire", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.parameter.file_name", + "data_type": "string" + }, + { + "contains": [ + "pe file", + "pdf", + "flash", + "apk", + "jar", + "doc", + "xls", + "ppt" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.filetype", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_info.md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country", + "data_type": "string" + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.platform", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.software", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.summary.malware", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "WildFire", + "product_vendor": "Palo Alto Networks", + "type": "sandbox" + } + ], + "attrs": { + ".action": { + "text": "detonate file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'vault_id': filtered_artifacts_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_5, name=\"detonate_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Detonate the file(s) in the vault.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 135, + "line_end": 240, + "line_start": 216, + "message": "Configuring now", + "name": "detonate file", + "notes": "Detonate the file(s) in the vault.", + "number": 1, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 240 + }, + "previous_function": "", + "previous_name": "detonate_file_1", + "required_params": { + "vault_id": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2026 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "13fce689-6a47-484b-a70a-aa77e2e79cb1", + "router": { + "name": "metro" + }, + "source": { + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2037 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "eeca94e9-2c8b-4474-ad9f-39da792e28a3", + "router": { + "name": "metro" + }, + "source": { + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2040 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.vaultId\", \"!=\", \"\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 4", + "description": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 89, + "line_start": 71, + "name": "filter", + "notes": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", + "number": 4, + "order": 4, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 640, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2059 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_2\")\n\n return", + "callback_code": "", + "callback_start": 68, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Hunt for binaries with the malicious fileHash across endpoints.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 215, + "line_end": 68, + "line_start": 43, + "message": "Configuring now", + "name": "hunt file", + "notes": "Hunt for binaries with the malicious fileHash across endpoints.", + "number": 2, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1160, + "y": 240 + }, + "previous_function": "", + "previous_name": "hunt_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2065 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".format": { + "text": "format_for_emailer" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "text": "Configuring now" + }, + ".outPorts>.port-out-1": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out-1>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".title": { + "text": "format" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_for_emailer() called')\n \n template = \"\"\"Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\nContainer id: {5}\n\n[EOM]\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"hunt_file_1:action_result.parameter.hash\",\n \"hunt_file_1:action_result.data.*.process.results.*.hostname\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id\",\n \"hunt_file_2:action_result.data.*.process.results.*.hostname\",\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_for_emailer\")\n\n send_email_1(container=container)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "hunt file 1, hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "format_for_emailer", + "description": "Format all results for an email.", + "format": "format", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "inPorts": [ + "in" + ], + "join_code": "def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_for_emailer() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):\n \n # call connected block \"format_for_emailer\"\n format_for_emailer(container=container, handle=handle)\n \n return", + "join_optional": [], + "join_start": 314, + "line_end": 325, + "line_start": 272, + "message": "Configuring now", + "name": "format", + "notes": "Format all results for an email.", + "number": 2, + "order": 12, + "outPorts": [ + "out-1" + ], + "parameters": [ + { + "position": 0, + "type": "", + "value": "hunt_file_1:action_result.parameter.hash" + }, + { + "position": 1, + "type": "", + "value": "hunt_file_1:action_result.data.*.process.results.*.hostname" + }, + { + "position": 2, + "type": "", + "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5" + }, + { + "position": 3, + "type": "", + "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id" + }, + { + "position": 4, + "type": "", + "value": "hunt_file_2:action_result.data.*.process.results.*.hostname" + }, + { + "position": 5, + "type": "", + "value": "container:id" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1400, + "y": 100 + }, + "previous_function": "", + "previous_name": "format_for_emailer", + "show_number": true, + "size": { + "height": 100, + "width": 180 + }, + "state": "format", + "status": "", + "template": "Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\n\nContainer id: {5}\n\n[EOM]", + "title": "format", + "type": "coa.Format", + "warn": false, + "z": 2067 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "24b9331c-ecbd-454d-bdbd-926babd67934", + "router": { + "name": "metro" + }, + "source": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2068 + }, + { + "action": "send email", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "attachments": "", + "bcc": "", + "body": "format_for_emailer:formatted_data", + "cc": "", + "from": "automation@phantom.localhost", + "headers": "", + "subject": "Malware event confirmed", + "to": "recipient@phantom.localhost" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "SMTP", + "app_version": "1.2.29", + "appid": "", + "config_type": "asset", + "fields": { + "attachments": "", + "bcc": "", + "body": "format_for_emailer:formatted_data", + "cc": "", + "from": "automation@phantom.localhost", + "headers": "", + "subject": "Malware event confirmed", + "to": "recipient@phantom.localhost" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "smtp", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.attachments", + "data_type": "string", + "example_values": [ + "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.bcc", + "data_type": "string", + "example_values": [ + "test1@testdomain.com" + ] + }, + { + "data_path": "action_result.parameter.body", + "data_type": "string", + "example_values": [ + "Test body" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.cc", + "data_type": "string", + "example_values": [ + "test2@testdomain.com" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.from", + "data_type": "string", + "example_values": [ + "sender@testdomain.com" + ] + }, + { + "data_path": "action_result.parameter.headers", + "data_type": "string", + "example_values": [ + "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}" + ] + }, + { + "data_path": "action_result.parameter.subject", + "data_type": "string", + "example_values": [ + "Test" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.to", + "data_type": "string", + "example_values": [ + "receiver@testdomain.com" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Email sent" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "SMTP", + "product_vendor": "Generic", + "type": "email" + } + ], + "attrs": { + ".action": { + "text": "send email" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('send_email_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'send_email_1' call\n formatted_data_1 = phantom.get_format_data(name='format_for_emailer')\n\n parameters = []\n \n # build parameters list for 'send_email_1' call\n parameters.append({\n 'cc': \"\",\n 'to': \"recipient@phantom.localhost\",\n 'bcc': \"\",\n 'body': formatted_data_1,\n 'from': \"automation@phantom.localhost\",\n 'headers': \"\",\n 'subject': \"Malware event confirmed\",\n 'attachments': \"\",\n })\n\n phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], name=\"send_email_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "hunt file 1, hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Send the formatted string as an email.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 269, + "line_start": 243, + "message": "Configuring now", + "name": "send email", + "notes": "Send the formatted string as an email.", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1640, + "y": 100 + }, + "previous_function": "", + "previous_name": "send_email_1", + "required_params": { + "body": true, + "to": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": "", + "z": 2069 + } + ] + }, + "notes": "The playbook uses the following Apps: \n - Virus Total (file reputation) [asset name = virustotal]\n - Palo Alto Networks Wildfire (detonate file) [asset name = wildfire]\n - Carbon Black (hunt file) [asset name = carbonblack]\n - SMTP (send email) [asset name = smtp]\n\nBe sure to update asset naming to reflect the asset names configured in your environment." + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-19T21:50:52.204902+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [] +} \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.png b/playbooks/email_notification_for_malware.png new file mode 100644 index 0000000000000000000000000000000000000000..bc5bb024d64875f66189d543664c2a5e62bdd661 GIT binary patch literal 226528 zcmcG$1ymi|mIVp~C&2>=F2UX19fG?D2yVfhgS$Jyodgf=?iSqLJ-EX!?tT4U`u7;` zzrOwN8Fg}Y%69Fw=9+7+y(3}O)$8rb9da~1^* z?6rZZkdT~&kPv~Kt+kP{X?*{*L==Kn5<;#~;x*|V<_X83xai{8PDz=MN{lXlGs`e!1qV}Siq@cyU+3C4i4Z&~oRe^TvrMKlgH z>?t+N$kghVS!zl90*plrT0JrwIDh`>?U@#s{X%BCGIgIncS9tBV0@y_u0U}1w ztzb|rA)dS%yGZzsz#-(3A@Ye&QraVw@$t${W#G;2!y;jEzd3*38mfP>7vIJ+_3(2- z2gFt;63ncLzKeY}CrGU`BtGAW-MB_KEdF8j6-OTw z(Q5wG>k)D6chMcjsN~=v{tpl#SuT37a){(!U*ZQ=eJ#N5d;g9GFDV)cPe=<^pCA08 z1Sg3E_bdS(Pau2~e;JB?8e(?R;Ca#}lT@Wh9`WqQ1vE`CO4k>CW`>yEu#~lSX97Hg zjI45(b&Ew1{ru>aU#}lx$Eyw&pO7!+KXR3xl&KB8;m^d(m`0u$4Hm&|?^gAkkv|6x zv7@oQvZ`ad=xi6tG{!I7GTTtu8M$L~K{Wg&GF-~Y;F`%0bbC2&--@cUDo!CBS;=U5e-V@n>)00M&LYTN25~_xC^A@?nS)siT zg<950771)}1%23jpTure)0=+OW17axjYE8XWd*cZNxRJh#;4I~S$bD&*YsK!=9h=N zkv~5L-SqC4OJA@RXxA@d$q-VX5K=#hrng~2`p6-J_jox+y&iA>pk~aVHEK)$W(eY3 z;C&(3U^`Yho(1$m8*Moz4p{gqEIYU-^iDg;mp6+62L)){uXt8jc7>4r{C=W9>xZZj zUIkID2bV{G`T!9uf*NiA0ijoQXCBSLz1_5lNpOC6y#fPOOCLh>VCL)4nt*;Vk_DHCb3J z8-Fo;uZw&A<2vfP=sK@HLWS>5)T|Uy^hb%(Tml8|U|C9{_~_~AtEh-r+E`8r>weD9 zR6oc#Vp0VXVx;=xH@Lo@h%x2X|E#O}_%)^`t|oR` zuu;TKqF@4dH|yfHD~bn2bAo4#XXKMgViuP|Vgc1;T9IbSLZ+Mgbv>TQs7_=Kn?#v# znZiltvPiR)M@Wk=uWCjapIEELbNSPoN1ayz-hl#50$J^-zDv-?Z_=@1UgN$de(fKC z@TT^CIavS$WNh z_4Pl(kVdMvY4vcoHI2CQ4e7r#PBNKY*SqYbMRGG>T>LO8{8_>3$LQwQemBJgQ$N#| zJ@^UHiAJNkihhA(>S484^?Vex(xjo4AFaQK~kY%>9Dx(l)w<$N%={+VqT4BdV6|oTJoS| z`e@pNHG-9bHIMb);&@)ca;}D>rpQv$((SPLuxEbwM^WYdRJ#6X4dy~wHJ{~kPx~0* z@S0|zXkbAEX#{sKYAOm3J$*CFT z^@g!(14uo;XV|@24V>j7C5)=aZ80^@>HT}c$fW4z0GYN zjrW#FLXix3d3eKkAeRPbcDF5}TPJ3u=_af|w_;lmJ3_d@-G}kD^9_MYpHZHjz+1pYz+oVsUfUxKAuZzG*jH_s zjO`xf;6u+rp8D26fAdjqS8vz!Q6`)we2DrQ1(Q{i)$tQIOO|~km3stl8*uqMR9Ru&J4&E}J-n(ej3f^^{Tq|&6(*Pn+JC$V*~R8YNcU15 zJb1ssW^|QQ^G@TV!q8n3Oa*Pl+3a@3?kt0WYIrl6F+N$ic^J%T(~a_}6B-U$KIsE< z1Us#s)@5C9FkWyasw^2p3@O=>jB6TBLKF3^V~Ao1V;+k#9Sc)6>!q}Y^ZWqw)Q$Xx zaU@@cRRXPq^#FlkuF+xNZW=O!-mu@u$BdyLLkDQMWHK4fjxlq&J`!SN2h!WJyh$Q` zl7sVUm)`iJWoy?)=Rep!U&Ge_C6bF*DO`LYBR4i2nOMwRRIb-vN4CkU z)9i>ZPHgH69a%`dCgtM=8GC{RG}>DPZS_>v^uA>=>&~-w+YVe%;4-SJCx2vN`LzG_ z8_(IhTSTbrq(T!)MxVfI1WB?jwt@TZ_U@@}>w-KPF7~BQ4fc2b?`fGZMx7N<)z2P3 zy61l~I-ovKKQ~^=7*1|>Kx8CylR3~@s7Kgw90~neYtHN7`ShSGxg@2U(4rAllj)Mx z-Qj|O?}>IPt(|O@+;rGe>%C&7<3|@mZKiuz?Yy)uyVY@K_xAX0{9F74*o4&kk&VXh zCwGb4)Rwy2jTRHO>$ZDm2ULP8hZ?5kKR$1DDjTS>6dRS$>OPtcZ?YIuHB+&b<&`Rz zDl2!Zu#{A4*19hRUanuxeDC~zZArgU?%bIY-VvV2=5O_V#iF8K|NNdNhK8+H)Y7uh zrtsUM=%Px~(dpIXQ9-LQNVl=mLaaL?k}Ho(xe?W=dg^X!`j~a4xfroTaoXXif6>m= z`er%bwf3&$KIxwF%J*^LvGqCXvh(s41B?dJ52Wd5ljn^9p)jGXH{zXP0qLSPIo~Oo zzis?V>MR-d9uD-xx}6vyo)-HaiG{E280KoRR`Ik!((9)AnP!R1R+if$ZPE39^Cnhx zp{Ke!BZR|Yd#5i$Hhnvl*OPR2D7q5d7%9Ub!<_rXt!2$;)L*Fe=E1gbskV77d!;*H z>M8Lnm#7m?BaZEDSNtz3KHV*C9uUp3M(<_Z0h{&bWw|BvWp~%2)#*^(P|#5$&k5q1 z%&qogWBm2d$<)L4!vb%7+5Yb1uX{|q4?J~`a=(7f5qIYxr6J%?;H&ahxGLOFp6^AM z_LWMt%HA}eCm*WoI?drjgDjknFCKdNgr1vzGPM+(`#*?0>q_Z-ZCSh>xK}o}7CdR5 z@h`hyj%#J{Xgt8ZU)sAiJ;}I`zURM_yBxbUI4?+&b-F{izc+N}0IiaHwFhi(g8iD2 z0o&aJqo-{@?}Qvqv*t%0=5YY?e)eOz?f^f9%EWWr-{7o;@_H=i81h{#{}#F5p9OY# zhGnK9zv=8^R%i07N62|$<#`+eOo0guf9vtl1N;7-uY-%y5y30r+tZ_$b&Vq6Dn1Jsw2cuO~Oc88jKQX!-7GAV}U^d zEpXt=3y%HIwkS9`*sDMGLx6z=nu0<8;~W{__vI4>d|$5l^Y>Lu02mDLH&o#3oC)z? zXCv)rzWT2=#3FDEOh8dcLIU_zG_W-^w6Zg?wr~4(wFB&c`y#Gx2L^^g^6~|jQ26i* zxc`i)lA67m^hZtuYfDi!X*mKRYgrHZD|8Y?^EKX3A1_YpRKkp4(%KfsJQ_j@c z&_Yev)Do~6&<8IwJsUIk9~bj=)albPdopy7cew0JU87xoyH44IkxKy_z}lcSXK%61yJ_# z0k;DFApi3hXhRT%i>2=Jf`RdaNeBxlIfEajLDfx)Vg?|oEZ$OBb?4PJHa5Pcm{%Y_ zKGw+XUIIQPb#DXLOS_*qDnDAWrW_tOyQNt>*GZ7(SpS&&;MQU%*d>v4fk5aD2J7{= zZFM39kbZYoHiCr6VBmk(76nN#*&7T7LGZV2%LHIqEo`5%$p1!D@fSwgfkE>BZCjH7 zn4pJso1pyPB^> zhWzr3jXXI<_J8foy%FHzXU9k$BSZ)Sj>3L?sVhDLvd>+ZV(ERI@TFy|9dT zCXluBGHp`nC4W!bD}-M6x+`lzDu03bAR@p*FVILOA-p}?a3L;ULlArt@PfLpwbBVx zTk(l(oTDC()N+Q0ygP;v;z0f-20=Xws?YgW+kJ<;f4?ChsQO~y)eJ}ir8C+2U4-8h z3qdB_>JwXLB-q^xZ2yjun_zN<+`e>H-@8BhAcNFtc9n2CS-gm?X^j^p-gz&e zw~l$Ek{{~g!yiTbYi-2JwZ7H2w&zV&OYN5|`WL@K;=V*?nt^}x?{VQQ0|ZMtlQ6=+ z!0{hb4!9J7$N)1sk#L_EE~M)pBSV1DZE?>ZOdQcX6sh5Y%vPNfA{6v@C?Fqrc>*wR zx{T$CiLKk_DJDRzboh6?^onf%f_3|dx1#XBQPC;~z)!9t$TWW;av`a~4PoAv=kTAr z-2apG>UekMG*?A0iTArHq(*Armu|qNR{LXcma$%B)4v|15XOEH3?|JW;J+E^CKc=$ zfw!+e;eW&FM*ydI#KM0?yMccM3;^|u z{wL4N2-Q%%WcpFVHMs~ToeF8(`*JVXE( zc#NRYfc{^GFA(m(@F4~e2SBbubT4CE^?>+E;gXTu0_}I_ilqkQ-6rwE{G7B|g8qz_ zw-W`j`L_auOtQyX7h8jvjahi?&V5$cFBwK4@lSaCu&+Tn@fyFK0L-|O&|~x_ixu`y9UR2y zcjpPo>XkB_$VRp`7^{fg9kpgq?NIE+FGrS%_tWMT&Sd0=9;DwoTtx)fu0aUS@OQ}l zhiwR^7aJw@22}tya$kVVR6IMp5&G{Q3;=X)8}ygTmG5#HJJPxqzpR%VgxIW?5Lb!4 zj~{*hfK|EfPmz@0ZQvaaIPTQ~O1txa_$0rd)+7Z4ol7m=zzY<-Kqx@aF^&HZ$2sA@ zcy0H7_Br;g)pC>c$#Sbx>kq!f2NnN2ZO)o$@slM`(A6 zH_2z3`X;!5&Lw}5v~ui{?}-0J82@CB|Br?j(+jPtzdw8hpuyYg5AR(7WDtgL=IaFl zrd(Dc$$>cFofU>dldJopXXu~8WVesaa)dN6{3*vWDZ z21VUESw8?m$1mz&!Rau!;SCm79Fp1lWj*xCZ6lUtxh%o4U}BhEP=!7RdcEBat>IwW zC?WoPPay(!&-{k~bPXt={FHpDG~*&LdVW_y|CW)aA?F{isHTc_!i`4L#L&oOt7(IH zyaU>NIG8AG*1MFh3j*wq?!x(*XkSA@LJ)iZTI-yceq+9O8;YrvFSymlE^HnC&3q?< z(Ro4_jclyx7NJ=g(|;J?H}do5KH!-Eqmuo>Z$N(f2fulLqL`FTq@~&FPmawN4kvn_ z&f^wwh0iTa*X0{5i&~pVD~%;d4!K2_-kQm@GcpD~mR^ZI>wo8ByAxxlFIsE0L>eJ^ zU?%gt+_X=>RTmt?vH2~`4-U1@amw+N#t%EM*$M;sx^lfd124_mFxLKY` z?H7-Y*SwDGZI?Ns!5_Ir<8QL=^51RP**x7c+cXBF_F!5r@M3c7rq^;sptwsFK6@NK z%cC=}>DV?9{h}S&|A#9TTI|rR8+-8SLq& zO0*}euz(X{7VfW33N$XUW{)}pR#0FgGALSe{1br0=L7#zZpRb*+x)I-{tdt(nZaxF zWMV1f_vm>&?!RW=Id-IBY-6F%^Ev@~Lusgf^RBS8Y8W8C@7nr=cQ| zi3^f>@(3w?IFDR-6bZ&jmPDr$wO(n?b2wmY(554R*WmyK5Q&EIE1OL^ns(wLZ=6eH zs52U8L)@Or_q^WQdjvg?eVZ^gIjF&1ue6yX8=jk5%VfJf+m059K<$bYi^Sv0pD-R7 z>*$u+-=6xik_!0+1eY8+e;9X5e2X_ycO-zd?;;l1}*t!WBNd zII&nHiO%=UkM7GCJ3W&ZI|2De6}zCbs`tzy4{UZ|tCEGIg13gD+eLbPBnVr#hQ5`X z7EM~C#o8mr0v_muKdtWUh|Nf!&Knpi)Igi~2Bu>%c|F>;3(6~Zk`KR{w1y(P$3qjS zD>u6w1`=px+^+G@)QU?^RwU&zc+5!$NS`WAmXg%UJuh}8I9(5O^PHEyFTLKI=yQw* z)2{Z|JLAi4Zp|am-b$u%;pQ%l>yJ&2ke<@Z;;rQL*lrs5q4_mD66zVSWjWf@0hNvB zLd}U|Qe_2=2X5u%EkdH^NbJHu6m9s{;;d;~%VS`7DEUERa4;%KCMQdgiT0>&RqF8y zh+Kz#s{rWK?AFZR|60@OFbklyB5I1=TFPe~oM+3pufJgIWuGPA^{dJ+Q|#|?~}zj)diH0tXZDlFOqY=q(fblj>qjW6{==DA$Aw5y+`ySnnzVlCvoX!PxFMQowu){g{zhsPu}<`&ORmGwM^JTG&HJ>aqzGEBapR7(hndAtBj4IDBmwA+^R@10mG*) zRQOh$$G4xFKg4Ciqyga4qM#=0#vJTmC(0&o+%c;gEr`=AD$bO|e$I zvG+4~yN|Adr@6!*+0;7np_X(qgVTmPo<>p9cOb%mTVj8UyY>{QZX}baNj&a8hn62p zG=i&NpBMy^Up+sO1^(I{GZ=^>apOlM`+0%O>+am(dRoky-stq4S6qK)wxD*Z3)Ic` zbk-NpKtaX#QvUFzjv@SK8iM~PS*G9J_3=uge8(kI2r{7$YzRiidUtpc)Yj@MYxM!! zB<8tE8nJ{}C`Ps$IQTB*YOx6PHULFDz6j{8Zd+T{pjzT-;l8bdV z_AZUKE8{@%xH3L=HK!Gi8#ii}lK?^!k73V(RY{JRwMzBX=Jh=5S`hjb&f2u}Ef)Tv zIg!EuIs}J;2$$=LjmPb2QNr|)5j6;(j+R8~YZ8%2m^hhiS{CSJi4CJ-5%E0{WS(Ta zPYkI9b+uxx)k+05b`%#-R)q2T-KC!jS*{R9J>1L1v6#MVcz$3?YkZ8xYkD|53NR2u zlyFf9$U?#o9$9)6pTUE+;tE#g-LBK4J*u5!vvsHJRZltmdzW zx^{5nTZ}Hve!S*G&p^?4m)Z00OIx5P^(?1R`JS4l##at^sT{&PDg!c4fnhw9Nhi~ejm>Wp1Q&zpT%LKo_i08jVSWb&*HmtL7SVPh-d8xvUQ zRNsfc2+o$CNX4(!k0e#|TgFt@R0%e`&5`4azFDlWgFKeaz~gq#g*&}X@_Tci=2`pM z${wo?DooI$QIeLm#&U&bXG1c#?5mz0AHqXxb?zUUyH-r+86wTiY~>rmux{O~HP@TA zX%Edp(80bTJT7Nk>KK4Ra#`;VaCWYhJuE>Fy9kaS#yQG^O}yCW7}VK_X^meoMN2bY z7BEIpa$W&a4UE9+eg(`cg7!Zwvwc2*lT2nXS@SyV&v)7*;vBhM6rvEdDMHn^YK|^< z&^knzs-GC?w7Tm+n|+tdu}`fC20=3&js;PnEmT^J9L>5+6`PvhI*Tz=f|BW{8^?rIZ#I~#iaG>r-`)y__rah z4kwbsUzro`du3BUKEk|Vput{bBAi4z7Mnf4rQjkT)jV@S2;G*+VPEO3u~@By{n>L@ z>My18^DbPo%J%JGe7>Wl#faheDN|vfE*rn9Z~S38j0%rQn@YW0cWZqyI(48il`xE@ zSh63#b(LJXvp2KCWqKb*h2k&nIu*k)E&&S@L#0`d5l^n6hMiHtZGFyivtNxpnR7x= zU?3aM2z7a~6#sPHs@BzE<^dE+?}v4(;xOnm^F|%ju1&Fz>9=i$lUW58-DcU(7_c~P zi#y+iy=N&>&KKpI8r%Q&h|lYpi-1Wh-#Eg9+fqRJmT-SkxE^0FhH zo34Jv3pcUe6Qik_0Oe2$LBC&B1~WSQOrHt|rW3|;#Bw4mHRU4?)p2|JG7{Yci&v_R z`5HVo5>&)m&kO?WC(Dd6_l81Fn3UEVko~qGeZ6j)V$wBcetVz$qqAbSQ|X z`tg^Kysypqpc4yOXOJkWWu=2sq75(JCM0;KVeV8G z?^!co$ZSlvW(6-S_c@$ABtL5^4J3UCD`s>!(7ZF~G%s=87S1xYN-?p$zjRx8aG_N( zwJg|;Q-a;&cx2pyI%<5#UIyx4cLaulJ7})< zLJjt^z}iiU>AI{^R>me_-47DKpggr%d+zCq-koa)Co5ej6tLuqelldB zGqO(A47f1eWWN|e9h%jIyNtx)qNq#D-RXD_RWK{~pj%^avzF98czD%!YTbUnDEA_UG}u6~6o;Sp#1rYao;B@6%5I zPO{!XE~4xgsne#irND2Gik0cMW^I~|7g^;vesa$#oQu3)i+}i@$s6i^ zuL3aF>O?d-LTr- z3vPi>9_pUy^(?Z1+Au#he<%u(R*6Grxgh2B zrWpuKVqUz^oH7aO)R4K|`q~Kf9gT}fDB`@|on~WiW*vjY9lo)H`s)?TWho82j(jO4 zLrl0VPglZ85TV~){iAr{$?-dvk9LmDd4xrl`gi47LO)Nl7`Ehkt=)w{mZ#}*e5r+? z&*C4YA4;7>Gq;~rbI6s*n`!vZwp&*e7v|`uXdAaip*j^C;ZY2i+okY#cO*vtwEr8& zBzpHL^RI?PHO6Fbs?Yr~XRyj7@%<{na&r6>*?1K?Pe*b6uC$8Wx63D69X~g69)4*f zp9NjrAxvRChFQVwfKyJr-O*;Vd9tBgeui7}Fru4e3%QuV@sQQVNMcg3yxU>~&=ZL> zyMeryj^A;kH>AvnmSKl$yncpgxgh6ux{_qONkPywJPWz%EnNt@AHk*6_)$y|%a9YG z7;dH0Jo)#n*n<@40%AEozeOwnUqxZsE9<& zvrMt*`_emhR4#;eWk&PF-d+f&%C2?LV>nspRAPzRfn40Z3XxM_T0>YIg(or{)_@sD zX-_YaM>-S2$}p;(v3#SX%EkdO;Yle7l=9il_lTwoMpVjFiD=7&&0Te+`$-iuTyIu+ zhy3oi5v>-elR3OTMf0B1OC8RIM3zYgBH|~e7foK(mMbCcdOEyHXv$Xy0FBA`kK?hIqZ}K@>)kM6B9@Us73~Yl2V|E{qGtCv91s_S=W*b2M(B zOLVG3oNc0XJY{kDY!uin)k$%Txm7!D8$QO-6ULLP#My2Q3D~T=)8VwH<}A5gkBw+I zZbee`3>t{)MTH zCtfx#m(%;u6sz-F6?JEyktkYR5{VeK^bJfpZH&~b@tPwp-2D&FYcP~rKeyfUqzbM& zG<6`=w~rQTnVolG>!0>7sWb>iSmIL|6bvs03*~bZ#yX%VKrQa;I5M=UlZ&V`L$7SP zMa!D+T<<)W5$GZ-cSd3xZ!1;n6+|c%zx%m+cOZHJs+@2X%ELo;=C(JReFY?II-Z+9 z&r)PQY`IdQm}=*?d9~#BJl=50dNQivT}IWyWBs(qY;_acgjlT8DC1hldbO8kSvgA4 zYC%chnfkfLRG|Q4rZ<)u)J_CbHvP~kGq^1cuuXBty&m(rokb*juS&7T#x%0KtM*1u ziQnC!9AVxsSeik04qA~=^z6?PF$1=T$dXG;gJET$n|b*%M;aRQ$9!q~oe^zI&5|2? zyh9dl&~np{WNbF;@$Hg@O;?Jwp(3lJujtb5Mggz!B@Q9Gl5RNFYCclj5;KAdQaRir zZa5pwukqGLX;6XrwVxkWXRccXV&O%B7cu_ryz)PfMnEnrMdc5BokVeh785&$jzXd<28R z^cHGfY9MM!vbbLC?FXl{5=zNJeA^CR5D3nu}J)aX18li=<0Q^FYeUw zxI}Dyj()f2Tk)(+n*K*gyxqZQfojyrGDElFLMHJO#@7*jdkhZKwNF<{HuNF1DecO#S`e?6S-^8<$n(O*rnW zIJXS#&Q%&;Yz7}}FqB48_Ks-19qQ$Vb^zujwfgFKsq6qR75N^7TCkAHSRiUBu}pc;Bg0zxvMD$ zZ;#=!F zZM&4w)B1BvWZju)ZZcqfpWC{BhlV`siTE^mf3l=@S}q8g&`{}A@b(;@CM;2{Sz?g2 z>+Y>8k!=ZKXgu78sNDSIx6Rw0t2+1Pcxv4xnZxvlz|YJM9VVs=BN@Z+Q~U4>vME7I zESkA;p8HG9v5TK8JO)=d`y3u`IGs+4v?FghQ5Ch=B;(0REfnqge>{i4?pE)!$x9Cy z0(DznUn-lLACJqtg+_&IT9as3$lF-TI2sXUs`vu&Xp67Gu>~V?*o4zFWU>o@79oF0 zbgE@b;>5iVc_+*EJP}_8%Ej4@SM9G?+$M8I`A>P=w5@FV7HZ{tHSX+G4B>edO< zc$(AA+(x4A<8z(XZkG!zn5yaZ%3dGyA%Bg573@V`u%bKQp0D}=Rfx-DMU=*AFdtc_tO!LZeX$n$CfAvX(QWj)p3W zmr0k|`1^M8>P^2Q^Ho{@{3GdTwb|Agk+YdL;p!X0)@RC@2Z==~-VGze`6?qge*{dK zeLQF+Y|9<$Orz?7$!v9E^+X3Vl0g?!O{GUKwYzv33W9A^WDjVJEYE5bot><=f#yhj zV~u6eWAU(0SwViw3c@a`6bg07ar7$Wlo>44TjF|lGVKt*Iy};UPO#}*-x&!$b}+1>%36Gel-enClPdcNpX9f zWn$R7`}Jpr|AmmhA{cMaTBl#;z?^@ADm#QY<$#Ur<1xb4-epo9pUjBgooMtEDnkwL z;7|sSWy$U1$|u6fl?IzM=R#QnF>_#j!Nl+8gfcmJ^fr$_9;=$B=u8US5wVT#%Y_7; zB$9>Tqo}mzPtnshlZ5d+DJf01Vu#s0C+;?`VKs`ZmgIAvZmC516h~a#d547d=p%LN zG;%%nK>cNuLu{x^YPAe{(*P+3ZiF87Rb1BM;RRSRPzJqAJ}ZVniiVa zG4?+AQmwVuMsK9pfeKAxwkuPBlfP5dz?6A%%grQ$(1O!G5md1>78|p9KtxcY>0xvn z8keH!vzz%Xy(RTf_5iSMs@d|ecGg;DBAPZ|`*sH6K9F%L0aY%c)xTaxHc% zxbwdIl?je|JXE2O|Em4bfZ^FzV+GGu)l9Xq^;b4fmQ7;KFrRC&Mnlq#TL<;2)My1L zBC$i|@oBN%cKoax;X*zC;1c`kxm}iyk=Q9(J{M2ENX9b!aM$H!?72 zIYoWWJhJT(r@C-3^m~Vf5LtqX5N$qV{^<^4epdG3Lw|5H(>W5eQ84JH@LZ8NyjlJI z$>yWoTG)17+xPS-B#agg>#OZ%!%j{~N*ubvu9-*;pA<5QXO1m9yX6iMX2T9$bjHn@ z0xIo|hYhWfCaA4Q<%fC=W>7?0fsk_C=!9*2(Rk~+NTTxDW8J*^I@_eMN&^%Pv+JORWvx5jRg_a3}Y6we~1%GVc9{~iUQRo@i}3fMmhi^XtJFC5l?!@M&-*5%s#eBwUq%ci=2cp zF#cz+F#t;>@4-)CFY93psXDG^aXxMCdN=fSnrgRSE6Ou+`BLr%Iv%EEau<3%X9>4!?r>&D1_~dWfBETCvgss z^E}W6YBsc*E#SICF=y12p$|=e*)hS$pVqfVN(4}&p3K+#B8Mqsfa_R5z&Drhgf0|F zW6|MYv(L|z^Ps@I-Tzr%b@=7d zH$r&-pn(8{sc1Z4Nx5EJyk@T+{s=_jWslg=9Y_0gj8G>z9BZ}_XZHStQRgOr|- zhUk^Y;f;jZ%$y@q`}@U_{k-$sbKIvx)nXl8$VxYwK~A*#L5OuEG11W!u7U?VT0-Hm z0eP6(Mx$E@)6jtkaI;BsYM-)skeD4dgF#oOzg>RclS@iYru9mFpz78vw`HdpB0%cv zhDBQNJ6oAu8MAyrE%gtZ&q7=aN^7I zmL7j_q;HFW9>Ss8J!mAJ+&Lrj`}uSov2>}t)etWSnw~t3`(PueZq&8gYBJmqj_APQ zi~I3oiphk?@nUnN>oq>nppD$rH#Cb|OOaOU3$}c4j|Mmx)Ec)+-FbWTnKOhQqNkRl z1x^xB20xh7yLWzf>opoL|N=ZT`eP;!e@|Gk3e@esagUMUI#7^9;hiYE7gl#kzlj z;yA+N()$cgoiwA?TnA8V;*l_V1oG9JAPK#$4gApOP$Xx;QQ?)IE*S_`_$xjC-SpU& zH_JLJ9GoN(xRUOC^Qo_KnxDKYabqZZxmeTPWsi1dTd06~3Ghj(wzX-W*}`>=(8f~| z3bo&zQS@Rmq1X`%n*9Fl_dr&U<&z_>;6wlwf-sj81_V6giz z{YD#7z~PuQNhRYVtylye&-l}J9~qIy6cQcJTOg$#^z0tqwS*mXhoB?-{QRiFig2l3 zKH5)qgmv)xJ+F%Sf|jP3qF?IEAeZCof5t{}h41I9RtwrAT>Z&9F%4-2k18@}x~s4XI2zWezja z;Y{!MpdmiT2gvv$rKzgd2r*P~ROSt%NpsS$OU6TA4H7NUIVydRz zU39P|<1TCQmC7kKRW?gz1v3gQqWR+YIh{xvi=_oKELK7w9wV4n1GgevYv_3fjVtv* zA6X726PLZFSm_X8>E;hV^OI1CA?(8_()RL20R%KX5?WtyF2}cNd;gH^ez_liF)+M9 zdD`4`wm72GczfQ(XIm!;3VScs*@eU^4phDZpsWQ?`ZzB)nqW(Ix&8@q@AG@ z*|dhMFX|F=U*o7X1?CfNys98iHwJgl45?Hqipwkl6Ux*?4p^WiEIUXIojL@>*y-OaIHvL11<>j=P#^9-kr6fTOj_*Kfg)_nWN|9o?(;8+ z_RW}0Ydct#aZorD%G)DH>FUCIhM3E zdhaSN;Cv~xOj%)Gs~=#a98yT%UM%!oR6rmlE-RQcNCZwE<;tk_cy9cex}8 z1W|#aW~d_|wetlHU5*qkF9kgi<$Amav`CBvJ!DID7p;Mr&^!#kvI>j9zL}PynNr1& zO+L9R3-vAT*)fS}9G5Ebb*)I>m2zC#nT^ML5ip7x62nvTmL`|#-PN8|4lPVUkNnj} z3E-uEtDd9M+#ezT9U^0$xZcn{qIAcQ99;NQG4TF0b3D zy0_Gf_Ld?}w`L0T3w90XbK-QV4TW}aN#&7keX;`Se%t@P}*vz1CO`Dx}t&<4~RcOIMdp z`5DUS&ASGJlW!C5bjI|@VRZRl5X&2NU#o-SkQ-#te4J#655)2nk}bTg8;3k3%w=XF zA8ZTOWCI|xOxsV!KBN>~^UB|@)$GK^yzdw<3}D@Xepxwf9j-F9do#5~$^|`3h=VEo z8dFfKHi*&j2ZtX$+CH|(T`XH`7DLK%63fAfOS@oU2E72pe1mD4ke^$Azt6pn2TUIf z8B>GNx}CuXmr7UZ?$8X+W?Wrn3W0}OqDkY?gu^x24DPpk2Me|&vnw?oY&Pi528{46 z93jo>90okg+q?&pXRdH{?pvIvUo6m6uofJ|{H%&|Ff$JBcRba-GKfSN;mL@YQ%FcO zb_y?3wcsv?g|B-Y!#9|Uaxj}J+0#YNR3zveK?Gf=6WT!=mq+EkKEP_bnL3br1s`ui z6DEdJYOozjeDv}x4={)%OOHbP`Ud2btT5inVEq6&jJMJ4iAJPe(f}TT zLxGycywxzeyJ)P$_F!O5X@k_g^!iI;axZr3M+ zi3)VOE!n8uA*g)CNhG`hhc4Gok1%mm#*X^dk$1V62Hzjf3X=tEKgVOs`$E5Dfc3>r0-MR`H6=|dnfrCxkzKpt zF`qNRPUb*So@;+;jrwG>!#(1iSd-UCJX0Wg-9huv*)0BRf;EcJpdX_(*Z}yW60`Iqp)7~Q4?cjs6pGw_;`vyvuxi^*YIfc=w zxq$9#EQ54MzIXM;=mKxZ*sF=olxkHpT?u9kHhJ79Fd7Y05T_JzijL9O+8jT)%$J*n z-n5fYPJL5Xe2U5(I8Zn4PYtFF=4EFoR8{37{eKvH�#QuUqu7q9R>Iq=_gfASeh( z7irQvh?Iyl>77u6Qbj4!MM~%$LT>>g(!10EfzVq51SBC4NI3g>|L?u`+%NArV=ywp z2Vk)G&RT2EHRt@DDfE>$A6irR-D9!gh{}CBC0(esMfhUmTl_PwVjF{BnjdCHZQ=3U*Pttw)KoXa|9-m&* zccY|WHYuN#u=(~!mFFbSexc1__P^?0T2D>uQ=pfcmpkSBbJ`tN3h1M2iSzu%lz1qt z&R(y~+(#X!G(>+A+g%OcTf2aOSsT&vHhjDpUe~#-P7$3D}tEkFOsekzJRd&y}zJ-_q%_+)IFx zc~-dKBc|(M{3eKOCiQF&v$>h;cMmp14WOPgNy!FPA#UuWlc65Vl7pK*iOx7(X6#da{v9qDBA@?u~ z)?X_aA9g8hS)%N-sIiEsIGg8|wLK4lX)!CTPtxfrhXqjprzx^m{I>Uqp z6qqeOn8$I6)g$E+hsEl|te%}$h+TlUIvQqu97F%)=apL@xZ|UIipXYTVIb5^5 zK^hfBrBq*vsd~-yE0@@M<(r$ausb@;J#YPol-G9Q>{uz;R{cMnd?$NpAY5cTA{p2L z+{+2^Ie7WDsI&L$Zb%Grq?R{MwfAA5*>P=GhQW&CD1h_xFEO-N@~EZg?Ix&SBkZ~z z4@3Yv`Q)C!nJ>WRp4O$_x%0+sXI2nZi3;>H$8`d*cIVDWRm?;EZfJJt+%PEfx5-hl z7eLur9&d|m?$~xR3>0Zq1yL-hdvC4tP2~=yi7-+VB-kYbqb0p@+{h_Tk$CuAuey)y zv!K5(?Og|sey#H%r+xT&jAAd&c(JyBodKK6^tTGL=h$lcO1rUkp1lX?~bgv7r-qP5zVfg~D-1 zJ=V3CWjWBghdM5dq~?3B+IL6T8=~l*8QKFfCwf-TO z!K}+|e~$M@PYHCZrLBypGUr+w4z3ZChL7!?f`&v>28`4{^eiP|zoNRe+SAG}pB^&b zs6H}=sgWr23{dPK7HRVEJOI1#F2zD%FVQFFcW~`<*1SKCneeyIzm5h8%Yre!!2ej| z$NlwQ_r^ijOIhZLcsL=5UB*Z6+5>0tXaJL8Gp|;8UXV>0(QB8M2&Y11)LdKq*E|!Q zf(<&f)of&%^)T>*^cQOnoE8tPGUxik68$Y7r?Q+PFW-~)YT^?Fy~oYB==wU>wGA0d zy){VZ50;0g8ZW?oa*dukTXZ$CeKRjZmX?+Ft@AKclT?<;Mg{&ftP{YxcdF3r@3*|x z-_-eP%Gzz}lB-VxND+goQvNL#d9=WKlW40?7i^N!o4vry{u{oDjnmI2CPTQF4$3F})O zAsnyUigrFX*xepw&(ndj-!_v4t1!)`F?hn*Pi94vO;rznbNS{kfrSU{C~D@Zjin3Z z;$`ilEa{U1({)UJ9p{ZE0mKlf(V@AN2ZuP8)qn=Bw)E^uoNAOX@0rE2OYDm(L63WX zzlnceq1K9!*0M2a(NyGU7ck|*U~y!`1C>GKVtPocj$e$)S7N>48)eS!mAUn0jWBJzRa zm-oyI=0ZH2vJNj|?#WDB%Ce(u3pZ%~D*U0o zI(n*s@r7qqR;eiV zj+KGJcN5K5KUj?n*&6_+FP8kUyomGyD=MOHtFODwKa8}Bxd~}H&|OxcED2SCS5}`T zQFcEc*}!|OPM7s6;nCmP4vi=z%lOY{d6W)mx80cote3zj7)b-2*6~k}p-^ z>-o%>MtfxZOPw6R0dpSmlJmsVu?{p3x8f(?zl?A)PHEK9wK8n3XmrNEpifBFS)9Nk ze?fwZ-8-RMG4v^v?{kBYcXC|oNuQkWu0Ep3?~S8Q3)E7_MlO6Q9c*Yp3T7sXA%H*D z=$Umfr#*KqKpike1U&UeJbLsP!QI{qFuxmr{*iKfFCVy}AvX{NtmtzJ_>E5A7DFFM zeA{y#G3$wi3S4|%5x>Zp9{wq<`%qxquDbnsz5P^1seu4*t#PG=5T5qL=Fbd3p);yP zY+_?%x0Uux8+Io{+QZ3$8g_KFYN&2dco&&=GXJ1o`lSA$~Gng+&*0H0(WwBsN+|&eEG*`tPc?jnVC32hId7j!X zTxPzR>8wAgSo7~+8qRKLP zo?yATsj)cR@7*}Bl@{mVkI$j!N;Il+ft+6%dl*CM?I-$)lP@MCd&uM!_7}M&|qk$he#jhN0j)Le_ z+KF1@-@3`~id}ieg9Tk4`pwgENaxQ~JFjTQioq`LI|wRswL;Klwta5B%xR^S?^^VG zzeYMJASP3%sCNlA85LM8c9SZnUBsciR$C_fw1>tmH|+ZMA6Zx=PZ@L8PQlSo6!*{l zpWHtWzr9Gt|JLzo_?>HIHE?Wob*{-L+1w|zN3;7sVC<8o!RkYQAV3BNnbp8uDgqyhd? zOgW?zstFKlx3liVasHKzgvti-LBje=OXCmNENX!@qvNa^3I-a3@)P$K@`fb-Zh-^p z_9}H2VH-ghJj;aRCzV9TWPnqnFgyz1|31uNMTiRivBo@!@$Wv3M&2{D@T1;vCVz9Q zUlgx&oKKPi8&AKaAeDC za7!K~zF~O_bN<|xjfV9k67qJg1>O9qmXnnL1^L7#JgC@}Qgpn=4>Z2dKR>ym&#z*l zKDhnAf~o(*n%RQfz=NoGC*=|;8zE8MSA_`|Sj0}bE&&=2+>`vgfe{VAh{}}?ja3$yW9T~E2 zWOw>lJ8Ac*#vs$)L;l;HB(a(QWMWR~mhtL)uHaa! zY;OG@d8eYSOaPRbMLN5Q*p2SG?GTQlMlv*fi$LdmWnrYiXejH&%Qa+&W4Gn?`mo;4 z`1#p};{&UJjv@;IizeSEEp7)1+xyhlBCmhj80BgUN@c{bvb)}8ecSH)Ir;_+eEHXf z#N*oTsNU{|Q6qamA&?}hZY$OM$jByh9Z;0Zv_bycz@-Y9rVH9HT{WSVpPeXi1l?u0 z-4;)Oj9?t=l=z-*sJF}NT*5Wk_+aBO5NKnEccft@VI%=BId4+=^nFn63ERe-g8{*m zaO8T~T*l~@(wZnn><*EZuD)f&DB|XpQnRORDpEOCcC;ZYqbKIxgNww1M6r4s{;8U8 zZk2PU)gK$!66ZG7U3Xh%VoY}@;{MgV)_|K=2%_>2GPV!D z`LA@fXd3Y%vDqw337^%_5ro~`*PYJ`zXP>Q_JtSHmw8r6;CNi@hQ7!r$(rArCk|y^A)jttRTKDI?mBhwHR0=rPVee{LKlKIgoau5V@i|r6<8{MBX7F| zqkk7X_%Zunwela-5lyDvCmLCLFSfT~q)MH6$XS#cZH!NSL7m+*QcOqQenkGyN>lGPYJ6N!kR{VGN&5dRMI)4E0Ud2n?e3f z!`BCuxt3gEO#3LcmlX1oU|)<`zu1x1YiWemmn|?cO8)s31l6dV{xalY5pJO!@3z-*ifR;j9-BU@ZsWfk4`SFO=h^pblZec#`v{yGK;Rh`4j6tk!9V(|R?K@eif32UlL$UGe9VVm|0Uo-fH`9>uaV-|g*10cMeL zwi|bQ?TpYr?53E3MXX*sqJra3(CXEl**J3T1702+v81* zg&c*}j;{ni;9?Y2-;w^5dChI5c!O#RkX`@B?ph0)dDX@9X0ioTKhuJc@*NrT_ zDRdacc{?SL@Xrv6`~0o~cUQ0$#wKf?KGPKU!q#Eiw97Ogvz@l9}{ZJ@%$a zO}f}7W?on5b@Sg^yV1wPaV8q5Weq}t>FxJ)W0)(+We@{)3yyhsBA^z1SbH4qmvC!? z2qH=DRkF^q$c&fzT>OA8b%hEnkTdpB%`pj&)JwgAB>l1CWrY$SO&GJN0K|@=6`WX$ zz1O(D9zbSO=i2i_8}mThD3CL^?nI@1ZOI z)B9iG>yLBVr7CLZ5hd4deuxen9;-G99E#eldV3e9SI?JhKfe_}9ucL4SN_}pe@zC& zw>lGd5T&;4DdOkNkCj6FO*8VSj`Yrs5BkzF^Blf}!q0?^1TZrNQp1^uSGEA($KL^~ zp%T6^Xowm~5f5X!6stANuwn8NmLR(VJ{Vu$2JEX2sb+lXP)t4M>$S%7ncWH3o!MqX ztEYP&x6(nv?;a_O-(|3WBtbjfK5piV4+W;<7sFAPt zNc|5WTQBh;NARU5iTxT7`$A32G6Q;`_f7FDjsPZJU7Im{K2?|H`;j<`XlR@q6|vwR)oqN?ypK{l#9xysVEKXEzg}#S5oe zyWwjNzdzZixUtF(0(Z3o)?;V>n*i%1?snMUs!>p zD!nZZUi!ljhkAB{(CpsM!66-JASt=D8?f?YvYaRaBRzhkK@Z~Sm2UR@Lwuko!^s)+ zq58Nk&9h$M(d1_Kdz?VV-{RkFIh4Q2WeyWAEI?cMSAX;9uxJn$>|>x?{Z7V@_Q!Ps z^KhoJ`(D0B~K!>o@8&*ef`4jpB=STkEztBF3pQbk0@Qj<7Lp^#ZJg5T4YwJL5ilEf+HL zjH`>7?d(4q&K)wG5tgj&GhGFq$}OR6BB;M5Jiy0IUO5 z_?B!9{o-QK->9#2UK!uoWnqW&|MH%;fXT@(@|cv{wt1d+W{*f*pLaIBa}+7pp;Zj~ zLBLKV{uFb`7pq^VUUq*9|KdNYu7$BQGLeHrsKE6Tg~!Y7d& z$aAh1JKoED%_3UlyV0+G$+9jJnFr1Ky=v01o(j-(iJ{@O9Oqcp<3c|`t4dnXLdL{W z<4E^N?D; zPW3h&q=rD{0OrbEPpV;QG^GE-u)!1kujfx5>nWl%FX3?f(hU*E{wj>O!bv?}Fu)8t zmD`cZr)wtJs>>D~d)1)*oy*(W1V9s@>+(0$CYMvM#N31BZa8W0#_BH5O3ziqHO+KM zQS!cmFi9|aw@1ikV9kfagFw7kstWF1ReOco+YCPyMfcv~H;*03lHrY9E9De*vB1db zpM}2qZT$ofmw5*^F6N{^JhJ`(i0@Bi<8fGnnwHelHgA5+d`>3c#<&7Z8vrm({3Dof znbfKCr4s2C57~fuXLSC5Av$sUzmwaO@Wp?cD}@>zM=eSXiM(m9gkIjmKi@FT=KO^i zDz+(N+bI!<5f}tMacO)?9?r6@3b?>umG{MfMse}cf3=V#rmpP&scro4QOrOTFn~0^ zeT^Q2nd}hum$|u`;DSmSKwwJ!j^V6Y#k<;+xBpZoFz#~5xhD)5mFL#f7r0(0NIaua z!B+mqLaxyOo7?y##x~PqqPJpyXS?<-G!bYv!&u{QugtgY0S0a|4-B$fc)61<>vu6( z&`?kLj-7mknze;Uz{^jYTRuSi*U9d25ewak3*tEE^SD9RS~D0ZjPi4Xd%uO{*e zD*RjO9}-Qv031Lo{O#1tLIn-%k|xvZ?0~4apuriE_&E`S#wF2 zyQ-Xu8kqsWl%Jd7M=iM>V}1Xj593noa7}GQIS{X4hQMENzQt^3RW+9?rs;5EqVe

9KHZhu{C4Bry@E_sgtR z<2Hlpj9DPYA<*)7Sk7`Nsjs1luI+Kq=El@t5jWD1gu_%r?Y~~l|1x*-C#Rm!q&Fli zy0?!-KxhMHc17Ob-JNes<%wqHa$0n5ILC@P#M)3{luijAUbuC?=t zp4MmDegnYXj^ZbF#^V=P?&QeEA>OUuz@vmT*9|5Q#F#MJclm!5RX?|rKNoRd%-8-G zmi%~b_0eSKj8|jpj|WPl7zpHQNqFEV>_?j{pljgyqspt>;hs3;YjrWg^)y1Of02s) zi{#CluY=k(3UT{=rUvu3F)DHN2}ehbnWySUh&V+# zGkVx4r&lkR)sL|Yo4Cx;8|BDZjD{W|pG>twX3e9EV(&5+@pVGg?5?8xyRu)7DU7o& z-@hLqj;LiW#qhbz&-sjI@>3cR@h4`3MrEONrY}9FGGs)zN)q<3{wWJW$l6Z2xv##* zwJGDaM})#i*O?w>cbNxK zz!k6`$7y6g(1j>AOB$lYrXpCP;vG{* zRJqb+bK&hwkCdmVcL=AOqgnFd)VJ%XpXDsVrU8}!u+sxOB(?|i^A)H@L*0q>9Txo( z-?0aEHYgubi7t~#j~q~#!WJ6r+oC_E1LA?FZj7i4H8M*;3WW_l4LRF$b3heHwD|5_ zX%4Skv}qpE9h~J!NURyOj=Zt+w!`Fu{A@NQDC*LcAY$gzKAO~EAaRiV{77in1+*9e zY+Tr>t3p3B1V`t@uOMpky)Ft+CZ(R}%>Bb3!0$347fzaoGKSYKI52V*+Kn}q<%eu- zWxoC~WhrGW3zK;C=4Z%DNq3z${yDNJ!*`GF@Mg)nhXE0Xn587k(J)j7;QP>Yvt7Gss|U2F>|at6k5`AV#_ zfrQmmO?MJ^fS89j#F56b`w?(ch-@zg5H-Km=$z9n(|?|b&@{F0yM_V>xZMIY@kQGAROBA2|1Nvs z*7w+fKSNa!z!{QCTMNO(L%7Mx`a5q^*twg=o7Wk&=ptx$o?`iOAiMX@?QmL41wYT_ zVuR#LuTx;XZ(7vuk$}awOz2ciLiEw4tA%m7WUHffMC1qdo zZx!Sq5utQ`#)+fE9K6Q$2IPQuUoM471ruw09zf*`RF9tOD^B~dUw`4Z6sK`YFVRt< z(23_o6W||OnRfQjHWk zp04s5dp$dfUFLszSqeD0wHVfMWYwC;TYVM$nyZH6Y&^wOK4^hgCM}QGJ0vs$FIo=k zO_}=s^;0`a**e>zNIT;!1(~=;bV(_W6OF6nst{_wZ*b~zawF}TJ+8l?k5DLF4EyXw zQ)n7`&%5Qse@un_?*|=3;0ZbZP!oB2S|o>WilE`-4t5>%6}fr)fpRIE?Sj?oK-kiOTfqJc6r}T5~&I+P) zvab*pt}BAic*TxW%TIR2i7zIs&Ld9;ymu>UHIZ5N=fuu|KZmV%C&9ct-n@tmDeV_; z(}%KU7G!;cKLmRXlw?B^C$y5?^HjoU^Ukd&P|6qM9Ea{@BZg@S&0Tm$m+Kdx3{B9w1o2>xXmpDx-UiQCi53@W0$r#>L+A zsvbs%B8qZS*lZbZ4j=1bjo@c$-R@nilQ`m^P!DoF^7u4yi!Ou|_4T>j#b*BR1EYxM zfQL@(7cSGk`saUo=`;CkaD^b61k3qA1M_KZt_|)b2xdyD!UFd2uJn1x3`JHC;bPqH zQ>59VJo(G}80I&xAt&|FE+z`FXG z=EI5p(119d^r%EoDiujq06QH{)w}_bRi~9$dw)*WTNGb-rL(A-zc*%1mE0oA(_ZKW zT-{I7mP3OSTEVx+^{oW04OV}L(>=cc=3tKD%L{*+O$#rndFw2Cb5sSL`beCHM5q5g zYAJ))y~N%OM%|l-5XmfQN1d9*K3$f=X9dxY2*SHFtn1Lsxj{Mi-O0F}n>h!Fd#Z?b z7N~vQM2NZ|!br@e2B%T(R|qa_-2m6*%X`vf^xiAfxcl^Uw-FYISfSc>JFK8MT@ft? zRe!jGaK6KDq%o-{7iw>Mw!fOT5<)U;BX*5-g7(>sD94FrsDqTZUKIRCd9v!N1p^t( zHSaE26^3?jM)g41a-r`5@vIfosQ@WAxM4P8ZP15h4 z;b1YWWTAI1Y1Y8gPv_jKb6N!5Z5woVLlhzoQ;<^Q)g7u7-+jf`E>{Uel&f6Y;Vf^O z$h0{ZV_@eEs3*zX2Cig>}JBCO#*V z`k`co+nM{{k#tz((?T!<=PAbbJnjZ7WjlMLiz$|<-Pgk6$yW>u{xl}n)ntjEF)oNi z!rjZcY7U`-jozu(nRriYH;b|%F6>|dq;Fx7NHMgOC@ND~j*hFp#J}4&K(i2lezf3< z<%={L-m1oT=X9>MQ;|sPk3gfufS1#}WKPbwO$E|3>~ zh=42i)KWs*shkFLJ#z(&f8V@z|GU^{0|-SErB%!Ie=4c3?lWK3yFH0C2VWSzLXAi` zd}qG1IA)@-$;6A`I^Xj*oy_w@2Aa>1gwqafHn1=8KifrqiYALMX7P#pkie7PTZ+sM zG?l#z-Q)w_tOVYyuk0@-)|sFFz*6P8VBL$N1Dsp6)J%0iQX+q}Xz)E!{+BqwBJfA* zsr@W=P%KV;jgFZX2KKNznSyt^J_v;iii~AL+*muXZhI|_jjh5St~%oHbk6%P#Puhq zg7^+MguYV?IpQ(vK}DCI=9W( zm9$K^4tQZ!~pa4znq#JB%_wOIat!)S{bZ*ee zZjbFQdRPudkNUAoc_*$f!oDxzel48)>By$b@HV~qIDdsis8u{occIZ7t%x^ROY(4B zJpAoL?V)onjH5lEJM)Y@b~V~d;?JUpC|Z0EA;q-82N7EfHWrZ`IH!2KMHHjt$kLl< zFVB}8)2-(>g8}&mCYut_#y7xq%A9C!ag}nM#d5C9{;v9m2BDCd@WIox5f^VnMh?PQ zk0RCwxgB9G#`<1-j|)b=2CtgGYK84HOsIVVbAH! z=L!T%5fwj17FoKH++|mqbZjQt`ww0By>Yp-DuvKmKhRyffYWDEPVd(IYk|t>+(5X9 zaREHpOuTKk@8}?Zj)3P%VuW|CT0%(9FefI`{o+%R1?>J3>!=RVSmDT9MsD|V2MtL{ zK2>7>*MLic94-|k_#MW)TMr%-yBS9E{w%a9xZlX|Zibbsm~*l(&HX=vEH_ShzV1Y# zW(SUAL?4ug@a^PE}p9{P)EJnSx* zova8B?Gt2wE>vm$yS{vod2p5a$X`k0rb(P=C7j}$nw)O_^tj3k`PoVuf7u%NFEf$W{SpJ;H>wJ=(qhRa6i;zyZ zMRVm%7BMr5XE5|_ZFfec`1squ!x!at3Q@ttU2z*|(7=hf*BC2Yk+q%dkY!M;BcI^6 zFz=maq;p>KIZn0NV_k7`ww`~rGBy76x%YtexiSY%D;QLXts?%c2Zk=}ocU8S=N@+P zZmH1%lNEZ**!3(YQ}E-b(|-BUu<*47!bx={%{W=zMhAgKNDYDqQ`HkiOcgo&XAYr8 zfty!eep9VV{8Gj8AnS$WTo*OCeTOP1t_=BXB6DD2XKzEpKd;$;{$^&^l zYqGey+#+*qTQLpTV)$ee%3ah74lhUghLS>|><^hiGXscry+xSUW8=#5kEc^P3k3Ey zN3_)}+e()qg^Es#;B?PwCkhP3po;6o7k`E#W1(ECHEqt6o!JIv< zlDb*J&pl;@ymZiSBC(Yz*vjT{Xr1S#7K^M$Ie7Ef1ae1Bj`f91TlGA|k@tMjA#?ky zqh!SIGr?jxFy*(7?;=Pyn$w@DY5~33)0d+g>i^dl5j|?KfWz!AWVp+(3Ft!OSS1we zE`@=NVe$N^-Q68tj}3d*SfZ5fpFsUMc);m8PmyR!J8^L}4&=2hnkM<_&+qT&vQJgm zO%|Xk!Nr5*pwq}K<4QBt9zXV%TUc1=UT+;y_B+uoaOadgXfobopr2;FW|}$Nf+-W0 zi5v^vSax7D(Tt!FSu)q?aIL59NRz1-CUw41w+OP_?6~@VcmR6CuFWfgIWqQpyj583e@NkjqNFUD;dIk}YWbk#W~U`IeULzjoY-#4RIp80OA&Eyk?@;nf@Jet4JN@jBygW6u#X%a)WLX9{OjMbcDgWrxUil|d@DW|( zf{K^9{d+!xwj!>59Aeq7{E zy1tpn7*k@OJrS0ec^+6l#8-?XA3lOg>-1x9-nY6W6kKJ<5$x#M)8nyh*G`9lTMSHU z;S}Ze>aXX}|IuVeopu~#m!VH6<(`7qhF9C8sW#nLzukG7!W?mvdbo_s*WAwf&3Wyp zojP_(~sDaxb zt;_QZKj`ow`}YFDoejYlwQV)B5>I6^D1uVRz#ywdBr< z&iS1g?MY2_KI}1pe~xx*lA0|Yd~4}dwyUu(IX@OGv_OB89&W#LfZ>ig3F%d&P=reEs$en@>z~+e-*HwD0OzY0R5o-H1Dg6y3~(ii`s^BD(c4F zr95nbK@l+S&`RVg7qj6UbErT5Fi{wm+`-GzaQdu`QGEFzO=y>e7QD;On54}>%&O06 z(*M^M>mWrLp_JueZ-M$wscoYbDAOA(5|%p0yR%EvgjVGpFokL3nI{@bd4JBIzNuU6 zHDFh11==f)(|Bi>eTHNeBIU!u@alf>jr_ldu9REvVGRE>)AQ<|&&QYbSSFEA1yB6j zInibmGSR~z<{o6<=u%VlRc1_ki6?W~-)U5uEh~B8nM9t6zEJ)PLzf*qPQzPVzH`Ap z#_XAZd7~El*q#DMJYXgdUNStu8JrZHIW1tIZma_mKc>_*793UATaV29 zjsJnWsKdred<-gnAfvX~7e(JxB7LSLa zW7sgfKUdpoLqy5KQp%L$KH*&;JH92e;M*M%Y^+NaHi&>P?Ag)J)RL$9D) zqQ;9)DQbWijz6BA%lfB8oaP&`V$Rkl@f-=J+I3jt&`7fZ_#Kd|^7>WgN#tfV1XnKu zK{!<}3R0aDmBz4g3rmvd<8Epi6LISvkmfGH3 z517j}$?Vk(yZVPyRC5gB^k7Ve#>mvn_Ud4GuXiEtknZazgZa;n;QSt98YnWe#Y%I+rct<^4Ht^eaB;+ujSAB0OqaF-8(k9mt%XC%xb~2)AWE` zcbp35o(GQ27-06?h}dv;pJwrhLw1BVc#12U9(@zq>^CRM(%0u*YBX!%(2v(wL$+^p z@2(|hL!`wzq|)Kp5Tijq*W2SZeW1U~jmzTihK1zG<*~TmD(6Z4V55DU4q^!VWhsI8 z=;}(|Q>g+wC5gY;(fg$ExXM&qFbehL9dJ26qONJ3qOdQr{TAicMxQQcQq2eGN;J2q z9-mGgWd`J1AGG0QTC!lqdr4R*>V9xQecy7%s#^alIurNJrfcM^=IQ~#Z|SK9WxmyP zj&|-of7{6Q`R|50pv|(NH|~D*0m^p&%*9p)_=FCTEh9~p-fL81-~jtu zQrgac!G%^k*1b7s?sbcN{G_W*|53=RgDWe$JpxClY@h42Gz!hSyFJ}zHwmAj0$@ux za5V?JF694+n`26ZsJ^T?=%+|; z0|=@|(hO-tEB%Z+>7FwccPL3x`$2Evk%(Q;UZ!+3B;ji|p}5YcK=Flp_>q+ zcjj)8kMF9)C;lk9K193u@`aEpk>-s-NvmQ_eo=f%17Ou#H3 z?Vy4j@Cxx*3_6ORt(8px9?=LRcA%5AQlF$eHC5F1QD&_X{Xjw|C0s4YE*s<&6q214!B1I3O#TyATDg+Yy461z+Ok6&|VnHGJ5L1Pe(2P6QHKl zQ&BBcyeI5gTby4)6o5%u-<$0K=%LUDi&R2Q#oj}5`P*l6?!9x1!ARY!m+AXdE|#2~ zrN_~xn=Ac~Wc|Mdp7G8bZymY6h416!4w9q~CMTW~)nSdYbq5;At&=td7hB$?>yp%ZpRWnbjZ679r&I{+KgjekCCPDpQa->mf=1*UN7h2(=2$nf; z8&6*WYa9L;z6QQ6I`8~^_n;Q@XEA{+{N5D4PEZ4m%#QW5?_rPjJ%SmGdT z^{fF|>W!+3eV6+b1;Yi6AA?xfmFJ1?xhRcg=sa_u}jbE znlb(-WTN+&5pH4TNV1tUpiZ6xK5px+-vr|%L2e()s7I1nQH_VVGY*zNAOuBwn|Q1b zRIH_a%A{%zeSn*P`2nr?BHtqHm`lGI(#EtNrE*G|aK+9Jo(3Kn7W(CC-o-8qQaB!we7SE!2#jiW2NK}8nSV4mgg`0eaCQk?60UWF8J0O z;Hp&euH?rV{!~z+5p>MH#chhfo{#!)d zwP9Qlq$CtDKm4y?I%fm~wjfY9UF~of9 zVejqUp5Hm|KHoW9zweyudjBCNo^`Lg*Imo7H1ztdw@=5k#UCZ*8n7O`mHRv? z&Gx>@V0aW-Qe!(%1!5KxoslYSN_#!l(G3&a!cZtIcXiWn zrt4eTSg$)hspmo{ilU5MKpd81#{aSM`5?dfqt|`MW@Jt+EPPlT(^VY{Dre*GSTr{y zt~GHwx|k}yXx0|D=yIFViUl8I)RbylvE!5Umg0lEJ!U>Tk7zMvgVt?hn`Q|_>iRP=D!|9)~o_)JkPE{wAWUXA&usAYFjz$Q~df3tBJA{+b-Pnp; z_p({$Q`%?747ameEr8J%DH$V{0zMoO`q+QbP%lGR)z_L2tSSfC|y;P@y4Gbny=mb z^x*9r*!hwES4iB;o>tc>{yx9`{z#Aq(s!vsH*m!AoLqb$eDhA}wcNWGk`;q?C889& znA97>rIl;6yDsyZer(y_zyvtobQn- zZiyf9zQqzY-(KT3Ki+@tuk$~Cc-&zk54+9F*OHKZ!7P=}R;OBmM!EEk>ARoVd{brB zzAjXvC9#~&>mHnPyiUMwaFXzi(@Sv7#+Y)Vs{{u?<_){|zuv(|?KGsn@)dv}G8chnMK zFvpGWR^f_sEzL-Ss`W3LAQ_RR{Kz(ySd`P)u?H@`E^Y4gi^q^2+i0T-kX6awp+yhE z^)>Rldc?=%+RDf43i>qcNY;9)cy`@$;sduoeW2jTOitY78M#xyM~u-bw@=%xa1VAl zLAcc?kJ>37oK>jt5hx-y2*~cE$_Ov6<*{3OiB%uS0LAQhFWkBDBGBnlA<}gwS08m2?KL5- zJ&mM5pq$=*psW!~+uMw#mC}ejMxJ>o=rm6_gT_8Ju5L5|iynE#+8ynL>TLnnX6_*< zsC2|>O%>G@*~lv6SOvo4#rJLz*D0pyr^r9MsFGp%I17INn)cp|?Y3!;qIM0-Zl#un z@RXNctPUYftP%N&sE5bO$R`*&D*3fzM_7;hs-?&nA%;F@!{7OniOn6~d7<;u1ipyX z+pX@r-@4jOThw?iRi1upH8+cbmEb(vz~GvX{021__wXb3I|d} z+-DS$%RHv1)VF2+{RPztRmC>P6X9!9AJ>fWFe?jE+p9Z%NJ-j+cFPWmT0(b2wULx> z?%8}##&_weZe$}Fr%J?qH-% zOz+EPE-gB(N}-=-mo5SnFC_m$a@?QUqvE;1*?C2x?Azd2qtnnGbqFqHgI_J|6}|#N77%VsEcihLg6zG}l9BY9Ca}VmbFag-!vucu-yLBv)oT@b z8?HkTfD_$(uGhcn({ZV!xBUp#?oq*7V58U4?D_UeC>hZTG7vyZgLkHXm0`C{14*9qVdjtlaUW zEmr^n0#xycDNw~rp@p_E48B*ej)!p7qb|(kJ{Ve1k+E;ILuX5l(K^qWI)C#N@jPk+ zIKK;t#X_RR9N5Y%^t+# zV|3KB>8D^`CjD~u&TD*ol|ohpw|bZNBJ6gR%SZRT_I>^> zmir3lcf*O*`Pp#z)myG*y82rAswgKzhI6oM%vYB*-kaCzeSP$(Azrv;NHwFp>E#7} z$KCbFW4o1RQhB=h=Mt}4L<~FGp$jU5QL-^y`^`1nd>YEy=>CyS@15I;N8Xd6_ydk5 zoxRjf-u8YjB!1}vKV3@S_Idj|WCCnmMw>$wvP$UVs^NVI#ovNXr0zVim(5BWi}iAd z-O0Wh?Oj;G!*K0Av412=CQ9M4O@phbZB!&!Kd#c1VLJS5_v3NgYF^Vm*L!nwy&t(5=rA*pWpPX0*h@-ONMaeMpizY32cw!V(W&zDb) z7>x)y8BZ=Vy}Dl=pJ#*HJI9wgp^#WFWY$qZI)ZX7jvt?0Zxk2K)LO-Oq7_FfCkvQE zLpXQZBi(TJ9B*|nlr<6*t?l?^-AZ=7{kb0P@-EzcZkT?n3-r}6?CAQ2Fgnm+VqR#Z zV^h~_%&C6s-J8ko&l!!&C*Mpi86ZcDFBCD2=lM2&X4j$y%-49&TWu=J-jQ`}xtVx= z=G&P7eTi`fZ#=4Qr45=AA8b=zxkxo1VA{$)nV>FG{Q8pQ zcd{c5RNZ~#r`JO{YAZiW4Y7z2XSlp9Q;a%pm^>~ts6Tcu9dWfjnfgFkRD7iqwzNy% zG!?pbVOWa3FVf$=Q>33NQ!yDfQzXyoECajBAZ9;jKBZN zylYT60{`gVJ+=wXwaa4^My>UZ0KFb~f-BnsXnGcpr+=B>ofJ8WT*FX|d7;MM39TN7 z^^RH=l;88kuJ(NnUfo{cxq~)HqN=YYWVmE@-R3)C2JGdwMY>gv{loYvcXj9-F|=B8;Hwud5~(_)iH@Q9x(%e4(HnIWhAq5k?%MEg>vzi11hg%uk*8VY zqSy0kb{f&wnZ7!uI_%Gnj(nu!x4t6mvMBFH*CU)E0DJS&dZ6O2spr-^>yZln#DEx{ z(zHbP1n0pl_*wY3x_o416@tO3##h{{uhzfx+vSYp%Y+vmJ#n!?5svCV!~IfWUHq(K zfsIvQb?LI9g6K;@ISqFK{+3)OP@9My9ZrFZWU20GX%{SW)KLABGs?V9yCNA(D_veV zWjrt3#Y=#7Xn9p&)2C0U-X9V_arcP#E^}COg37+&eD@-o_+Gbm;bnY#*(WL0eO3mO zl)14bjc%?ZR#D_tEoNdgT$g?)hlvg-p%VESFOXgd*E0_bv?U?%G7P z!DeHtfb$pX(cZm<9cje58=gmDE>Alig_%SgSeFV{l$be#zs$UBL~tWyz(5 z$Cc=Nr3<5#l2-Z>lQsFetOCQHL7vyl&=o!{6)RA7-w2r`i@EgpQHR0R5&?PohvoP) zeJh|a`i+ulbF`)*onR2|)@Z3JFxk8h`zgOtMb;XKIk600Fr?*`zc9aP-VHmwP=>Bv zty{yLu~e<4|C(fjSsEWCHGh;0iiTw^h9{qo=j?Cw*yOMKPP<3+lUaJ+-iwr=$Ny-R z+LHV=Cu?^sg*ElIAIZxQIS)7b~p*4#~ zBig|=*QU6(?U!yLN>%rr3dba}bwRQIaB*Wpg6NXtep2VgE%uB5F%-Q0{P>tgd#(U*`$P%1p|LlFTJM?J1G5%`U5pgdctXrmFx~(SBd`4RYKh1@sphAWfcEn0~=XrXD z-1h2}NmD1d-6Ph4&u?wb=RFva+=p^2gCiqTjhiB%;sZVcLseul0}`fSdBMw3B^$XK zhnjp73X`!Ma6Q8gN*k`**jJp_&aL>8#3wb~7SF(6b-~JO@BuidC`S1k*nOs@#u-n` zf9-HLpuJv<00loLYcX8BT_^&<(F+Pa>H9LQGWz+f;|lRNc97%TJ4=;MDHM*i1uF?^ z&-dnWWy7~wSdchN-Cjn=WBFV>`WuPnU`TJNjhyS)DQz*_lXQf%oatFm8Ckv;A{?oG z-TGyM&{EaD2dzKl$|Zr(zKhOGEJ_Y*H`m8}Rq2v1^1s!Lg=(0S;Tz>+!XC2Z&!ZWi zh~*KbPORDGoj*(W*P-Rrf+q&Jch+BTe~oW=PRpmb^d6OTtEy~)7Lex7Q6DV9iaOVD z!(^T>`!LCQ5j>(v6YqpCY*SMciapgQyOp9Zp~M+y@QLQBy4%Zpql2t2XC?=2SqqJk zyyuzqJkpjJdlg3b#6jwL?zFl$@EY6M=-^5YvN4#8pk$|<`NPcE@ME*=zbN2gRCXnJ zt0{atiGDp5(G{DkTh@HdNwG0fV27>DLxrr}M4nL5WPP%KjC2<}q=kn$Y0 zmmTmx63v^nho+sB4mjYSIde0MF-dSxklEhbAhp?SNY?QCd=4D;XMwsCVtDdqXL7x} zg~w)M#HQLnC4LUKC8k}r6q*`i!i2BFr3_rUDUe!}vn+uMJ0aQ1GU<9pS(7oRY)S{V zA%?}@+Km^rD*a2d<)=FivZtIAlA&RzJ_Q9Zx{r>?NrqgYa&IF71x;bx0QYkdrowZl z9`%W*S$S9!0xbXgsJbaO$Is!p-FuQED!y0M&pp5jj3xmPheV1GA4yc=RSLXP0MNqz7VpE>qu)J>tE>IVwE6R5`5?AitjO@F)u zp7f_Bet`GKYto@lD#_VJbd5M5I)4WnJtaWOEv^j9ti6fnrur)-26zWJ0G%qI?D(`1 zju&_R3GLo`lweKnlp>kGTIo+~WhYe&HzuKdQwq*#vD6{a6`ahU+g7KDE#XFop97&Zo>czf?=KLR}SJw(;b z!BgGsNept#VdUPo8M>7Sd50iCSABoo>+Z7UyU;%t7@z^0btce;DD=mE{>Q)Ubw7Xx z3Q+vA0l3#&3#|FD>7zhm3fxoii=UV+3D6!2UZugn&`dJ@%IR*icOPi}@pyarC+#(Y zk}ZLMaQ`1~{{6og6`=C6>oy^+Pz@n5X_%_)3r=ewdk@av5@%F`){NvK74`#*rW*dr zN!Y~!V7GoNITXVZ0C|Tyl>YLU_U}iLVipY~($2X#WB@nPiAMy}7PNn$783j4REa3% zBg2mEBMB4+oPRp-G7jN+?zi4x;`kqN`O|K_^*{xr_|&Rxfg2zOV>(#z#r4NDMDq=w zKFSkKzC9wor#EFb0kPQV$zRuWF`(MO|3NyS;lVB)N^{Qrcf10)sUXHYoz^&wf;xI7+nZJ zoS8X*-asLcnk}wUxULtHY$9(F59byo*ghiyhva`<*L4R!P&0>RCu!w1HJb)|_@@_V zj^cMR7MS(j7`QnhIZzIlxvk5bnM`?xj~P&7TM8g*-z~Ra^@nEhULXaC+VRhUG~mx{ z_z(ZJHx#SK?q~{$HAizu-G^-&l5ZUGzRifNy{H2jy*muH2 z`TMZD={d)}7l_Qo5Hs@wg_xn(Q{;0fXX1G?sbmvqW4AcPl-Ve1ZbHt}@A{z`(hv43 z8vhsi;rH)C8s$C_Ww*eiE07}J)&~2A!!i9XKlbQ-2YPzu*)<3+fBxD(`L8iRCER&k z>oh=HV?7>z^y+d@ecm5dBUKM5R5n%XL9uc2D;M>p4LYzWp`>DP8Vbs|HuEM z(?6utDZaPYtQls>Zz&5p2~Aq(4JX@Sy-hK#@y3;BdfS7&_uloa{Fm(KH^loP_b$OY?%i&V8IqEX;hZ8x_rKFG zwH@UgDzhv4t=l?4=G?b(E z&qp)=TDx9(0gjxc)2QZqhiH)|L27RAypKuAp?P*k@CZOa9bW6HFUbD0C>M^hH22G)kfmw2~Ifk2+IlE)L1M7YM=LJt!oih5waV_8Ri-IzY zzS;VZILBY})j!5&$_EnjU$7sK2d{aF!Bz=6KkWPPz!coH81khpb_5Mdm2A~P0Zq)U zp+7>6|M+2l4agNrJSRo-E79bcDvTj4tBk$5`piM6+nyyPA;D_DGkTPT5B4Ii)2N=~nqt+dHQByld`uThtMlP797(EJ zWRcG4#tC~u%*wjJh`H>A71`$}^FLN~@(YOXIm#5#9|~)GY$%UUA3 z_f#wSW*-MBsBr>P8dp0e-b z!@w_)6q090YS%s*m{%>6038M8T@C}kAQH-SlF>D(pEUT4fjEeNij#dlBnx%r5*~g# zmB*`Kb{}wpEYDe$7%VAx$YY#sKHl=v)fqMJ~|F8R7UG4U$MVF>z zx*JawlrWKMgjo)Q96b%mvsjV{&7h*TFps4w{lL>-wcHoJ&CM8u5l5zfOsdUH9c<}W zla<5As5Un>9|m-QE#t)$3EOc!nclas%X{~SgvD(bFKsnVymS>#^{2NbYicDK0EV|O0z&#xiLi2+qR&sk-j6@53{j1dKL@3NZsq!SU2;5hkIMuDH6s?jb z+jPdzlgXEmB8E)RQ_8JuPb*ZA{uZp#jc>bsMC7$Cyr1LE)YM6%*S#wI*8pQAY{>RJ zX01%}neM^F#HY5hPfi zz7Ck2!fMhILl#X)e*TKf@MEdj@(}YEhQj!n%CBzsuP+XjwWP%wu&bua6UQgDv4Wid zwcn=6w=={J8g^-#*mIPWVLOZd{C}&*{%@4@AK#@`_NL*`kjBjSw7wa7XB3bC$IkJ3 zY*;&pY9?H_h|u#~`LvXUJIj?>W7)%=rBhPc;`>bX^vZ(J3}(s`&E# zQ;(qxNwAo^5veCQa9sqg?{6t}wn3-h6D8e93mIfxBzgGUrs3C;caaMWr`uqftm^470 zmzLpRbVaX2yU0xYCKi?7^68A>Lg*Nnu(tZ)7{%5Evs6fw^Wxz4L|2AV>~w4V&V(0s zow#*EsnMGOA44V4YLWkO<1)tKOez=yz~n`9DKi=C{E_x>Y|U!97^u24>CU|O>dgxn zqPja%lZ_U41bMxX|k z`i`GC%P8Wp0p_U`TQE;Fgl;yl%D-TYHE_==Hvf7%T_Jv2X=f_dFx9f>?Y^txe&gKu z_CRZV6JlxUB!dUvG~)KgaDGXZ;Wk61GCB$>pSL2fQ3=Lxp#fHggn7mQI$$(8^mr&pTS!FHrBW!MZ6Q~ z;R3pU$I^iDf$IyCbdVpjcLztV7mpM@SV{%5k}DbUF}Y#;iy|IPh6tOeyt3g-Hry6d z$4+%C70{Op!1S%#lSGKQ6R`sW3`5laZ{uC?EXK3H&jR=-qHl2_8+=|^M~l%aH*+b+ zU4Ta-5f^5wzPxBqV6dYEF0JMU5@erN&;TiAppf@0gk6@R;ComZ^e9qd?apybODqo$ zXe*&0*qLdKX9b9kENTU3p!K0CjeMpN(PTU4_HJ4Jlrc=_?y=*qH; zgyBqY>b;B!AIdu51;yEG(Tg1P=zyj1;`s2?QybuN*6_d`&4}*?=u3YSm9!nP@G?eN+j=g) zBUoTxBxKP2kk<+S5B$fnVz3<;z%;L&jaP}~-~8!}8^f4h&Da_PS4;)z?zE}a9K{vO zh5)Kc^W1fFW%DH9x-|pc#MORlP2OC`SlN)22e}^MxX^#?y3!+KFeKc5Dq6F-(4=Me z{ytDvX~67*s-JWgK!p@|%UXMQQke_!1;yruhUf8&?KSK6ohSv9FdY}X{Er5K3$84s zY0t|`CVrVVyH2d@xE+XV`b`E-#OEo20cMLPt+=-9BBR7vmWFfgFvo^yM`c9KDov_R zaNGqwZS5lLneDYur$Upp%L7Y(7zd;K2y3VR1~MoazlVQ*e$IaSrJ3nqxq7ySOwU_& zi7t*MLqSf2&bxd`F1YR#Wkh5HDiL93FIa$Dga9%?~chL zQK_W=&?573^96nWRw<>ZW<8b_%uPm0)MRK#!#tZNlhWRLrJ*)Q=uJAsy%uXHpRg0k zWT}`KuT2LRnslWX2*{RsJBk#-O0SD<_2W55Z}^6C-Pg2${RjTTufLd~k*fpG99?V$ z{G1B9KzZF(jRj-?0Vc+JM6cJ#|7ZGayug>&y1OkJ4!k*zZU;MWpRIE&du_UclTcY|RzU4P6Lr4gQbM z)hL+lyu4=Q4~_+#)}VREa0%A;0qH-(96++8NiwCRTVly#SG6K(9^NC`AS>Ty= z6`!cNl(AX>Orz!%2eSMxmwTfYT(wb7C7>`|E~|5J<&&vE6C%f8@zJ);q7XVA{jICs zRJJw}3~}$;hGzyOIx5$I@RQ1GV`4UqocHZz9(~-nR*Trp7j(yVjIt;Gb2;`mY3dq) zliwUavOSlPyem8~iW&2YrBBl)-*<4Xvx{?FWN4l*|m+u4{R2$a7A)o$EJNKHSwofIZhHx; zx2eL(t=dFrtJ83Fj5kXwAhv})zo3PSp?@=5V58>4DJZ4 z#j9K>44TzlOnlImAPBLAhdl@qupD1XoZ1sr5Z{|g@=(ls|DD96Vs)D#(eEZFi2Kzs0k--GfQx zwy!N0G42?D#k>7RX~dU@Efowq#Vg;RhV-J4%YftaOG6y=PQ6~BIy?6Ij`(4amRIZk z_m9sy)8x)<5;cS}@MI)9$BE=l0GHdL<+W7Y4I6gabr*kdL~pM1BQ*g{WA@*lu?iK9 zw1coh^TI$8f?#eDq31sw6(RDR%>=wgBFmRqZ^J$cg!UL zfj%y|&(apY-78BVtx%;>tHnJ~yVjXxs3dA%voPdl$2MH5fQ7B5R>8K7h;^h5bvXwN z=7dN=3!7Zr-XDRGf8#HvGg}R?eJ0SI7xhXaK(Z=&KU&iuoRp`kLqv$IxeOde_pvA* zmn4hHIIFyH?_-1&LAN&gjqJM=1j@U0gu*+F^!YhH z$+nvlCk9OY;A^X^3m-fZg`A);(MhQr_dgsdU#dV|oPK#3nmMo!CQ@DQ$<~YobH-&L z%j41oIhU%6f}fHMs$Aa*^SJSs@})QAmb_ zlr*@-jg$)P!kxAgvD(BswN#0Y0cXmJc+0P^{W!G>?gtPO-XtA%N9C?|NKgny%It93 zgb9s;96+ch``H#2VON8}H4bpc2@#W*%{xE{6el>Nb6afq9!8wusowpqCz&q41Ml(jOYbnORs_8}vaW!e;dg zU%Pa&sMoMt(|I-sZlRyxZlUhRc{Hh%FU+G%76+ZCLSn4*9qB0#QeO;*5kO^>zz4EH zG2pd1k_Mu{ye7@m+tcxOsVOOp%2J@=cc+;t;QU3>)0|=LFq~d*zF~49Hu{D%y`7&B zx=ZG|7UflvR3TS`EESe=OnSBbm#AkC1@>lP17PjoV3JI29TE%z2dL! zdhU^Dpe%|83?-`UEP#*E*+m*=C~gioxSIm|9?Iu&C`JJEIVs}-4MjN5cp_THIgFO) zSgF!I3#9F=M|6Vw>N8Q@=Lwi`W~Js-3emuXm!GqYlMUzIy0chG4Rx0A9gZk~R9QN4 z6yS~10mg(`E3!FLa;WI&XqLo{L5a7T`5NEJ9US_azi2ziawC>khV;Pj>=ihycKFezG z%q`7oPPR9sG|kHFkYw|Sw>(w9L-Mh-Z;HWuivZEfc+)|+!Jks&K1HHkeBZfK0^3IXB$oN)7^}gGV44FP=zHxpH9VYr|G`sU zodM+^*vpeg4#OAw%?5Tt{a}fM3#5l+6M@6RxDND$#MsmGhv9tvrf|iC2%4$8^VMWD zd1%3*X8L)|5G&?d7YGDtf6!~*{%`!H6W*SzLWs%kYmC8?(aJ`@RcAqr2n`fGKw1w} z$&iqcd>Le8PZKrO@?5?~`a(_+@!#_6_OvR}A6!oPp=~Cwy`^ZaT(``cyUf#;KU)-o zr^X)bfvHBekvc%00fN^D=?`h@f#6|`l>P9+MHGz zxlx#Hx55DuRBVHo*B7Yj_4L(P`~ClxUr$>yoD(Ywb+b!V>YHb{b+KiWc?K+Wy)&`8 zq5|faETipW^AW|u+z-{*oLbiJ_n3r8?8nV#+ z{+U{S64&-NY9T`<%1k*KOPzcNZnU+PMcrPX(O+kGf&mu&-EE6ncPseYM25;OisXl+ zHP<|M)dFX}sak&%@DELvUAg5M$hG@r>Fz?>!iv4Jo*1t9yL1j~(+Zyu9%+xCV_&=j_5Pgq zxu?J!=Kqdg#2HFGZ+jL3?M5nCD7S}GdNQumR4J5N*EV?g6JpvuuC_D0YfJ8)9+RW* z&es!^d#jPnuC1-Uu))Q7rGP{CzE{luSM;!nFl@^kI702Mp0;IoV~lJxdlRU|VS(|q z(~eyx@bkMkRQggtuUVxAI~&V2W_UMc>xB~M-`8e!i$%GQ;%9L=hEcg0=^AHj+H-q9 zN$!n+RN3pXH@SvMt%TbCDs2pW7eu#S5PV5Xfc?MyRlCXtE<5!+8}(~F^EmT;zaVGZ zPBqKEEY?e&Tr*w6XD&M^G zFGU9!Z$ibMU8lRDX&8-KN4;c~oLkRZj69&QsMfX0GOT$85wx(daM)%*9yWGJ?XwQU-DT&Vw7etQONyD ze}(!Do6$=_)2-n(xnuD-t?NAQC)5AMxPZzf;I7;)us*1FPmyNi$PT=2F{r0gHl(kk zjngh?wkkkSQ)x5pEfOqMwQ7u;dl@9j?`?a$gqisZC!fUUl}S-VVta=kTetnaS-< z4y~$k;x(Gb8E@FtNOHE}{|I7>O%qRc=P~maIlNDga#LtI2_|Il667FY`9=G=Rgb+4 zc*~kgfAZeEJ4m`4^VmvqP_myk8Qv^O_-{03LRF$+dfsGot1Nalw)O(ey?Ct3X*&F1 z>a4d~-gi$1p=9rDb{dF(n$_>Gr3Xh;nyQ!gdM82!ybmZl#xCbNUOM(GR840(!r)!g zTxlaq9en0ZSi_QorsX|l zaCA|6FSI^1nq58Hf0Hp&5J0KihQ|lr)2_y0Bkl7DDy109@f4+NY<5IaO@=m>KCkuV zMmm*S8GkNLHhF{jxZ$*oN-dBuZdp?x zzBuy~qkmWOcV_cmCcQqG_3XTJH?c~-c>OZNiGzCvqar^f2c2#_lPn+AN+%GbO4iTy zE8F}=kT8RzUaHGAA^R?O#*pj1PmoZP&9^gJMefm_YXipGrIY#4qZn~FziU~HJ+`}a zu%0YifkplC?ddfNldnGDMtQt!=xZ;*=@#ZN6vHe5@vTBiYS{i;nwFfhm@i>9IRfAE zN|J8O34rmu3UQ_V3PKEzUUcWF>b_OWlGPfc2y}Zz)t~F+A-K8~DWPe{4hFpt;orMI zy>2)ujA9Z!L1gSBCd0I+hcZPcysT;Z4m;gAuioNC0ZJAv3soc23vokqsP z*-d{mp}eBWRL!q;oEwxVbg=Z_IC~&@l+@lVLAa<**5@R$PML&1<3q)JqS855KaO8% zPP8AAQ{|KRH*&@pBgg2uvNiKEi2~x^HMsWQ(@(Vt5aHd}x_K2k5hda=D4pj)aK^>9 z=@;@quPg&4d~ECvh$-Mx62(HWM{7tUde_-j`_QB&UT}jizJpF>y@g}7xMDmhCt_4X z_e1X#Qng$Ii3&`WbYW4ENxeS?GA5PH*_ydw3UmVaNNhI+c-$4uqh97pNGw^JY|mR~ zk@@aiGX#8l<<3h156SZ0;6!F+4eyBCSSyYEsFz)VaF;gSSULv*g}58w?n>d#{gIai zaCz?2KV<7R%cEf#GwH7B$^i;K{j$11#NyyW4V&~9+tie!@XXVFEZ#F)HtB# z3dEacpZW-tqLWS%(}-s8%yE-LJ@fUDS&PXXA!DWObkVq!gO*-C=j;tCaPDk~EGzF^ zy`EV!nGdUnOLsFs*gkV~QF-K1M&hCuk74PZQ99w*dh@l4C#C&?`H1JYW3kD}a4NIz z8XYlyERFD<%+*D;h4SClg2hly{jT-Iw(#Q?2US8uwjC?KgN#9>-`ez3G-Kv9z+aR{ zyytuC9pi7pC%$&eL%G06JnP;{)Ww$ z56n|xka_DSEw=7bEJg&7C(Fk%*6<|6V-pJlQb`jACvKzeUc1ZGH6<5&shfdyF8YBl zq;G#Ah|{Kc(U($94ukKM%O|fI{SxZ`7P2o*AX=BKr&Q_>p-{`)IAEP#x(*wHpZwtT z&F$v~8U>E5JCsE80p%=N!gxecWn#|G3KpH#nq{nOJmC|uUA)nh{fL_Vu+6ax^tfiuXJCKE??ETe3A_8`kX%Uzh`qgy zRU9Ek37_)xS0DFj$vcy!x31P>(%W@&jmlNnRx9+SJA|Sv%Kk#PqT(?l9+xgd_^o@> ztx4Y$`FzCAf*Z9vT|yEIs+ntl)cRAxy}2_mQJ)p!1_{Ca5W9;_Cjm6u#MXoF?>UcI z*_Gk(r7MP`Yq0%^rhg1DgLt;_lJ_3@eyro*=8?@XQ^g(iw|$w=IskA+%9V@QGv9S*Y4#b|O<;q0?fZ*}?R;q3s_~>b4E%>Z?%B+#0geNm>|R+Fz-{{@ku@pnR-d#0m64qYp1s-HVM9o zGFpa$4*B{vfoAK;2C0;1muFdXXgrLM3)pz<@dBL zjc4A2VHP zG%8k^>PYF_13d)dOuz{sLD60>Fb)RT%Y|yk^c49k78+iX~>= zzU{7NrTXPew8}wc^Cd7f3-*9lgD6a_;x@L8iK^G-($a6!{%6=8FTCvHBB=UQi2kdyTKj=r8JkU~2-Nw2=5Wa%Aa{%rH`0DRZeH~zKL+t2Q^+Z29B&SY z;qX%oJ+bKTF1hz3sJY6l@}3niO-Ucf#rL$qCBIZY*jg(#%b%uzHi0Rn$tUiXdILbI zi9x-uX4BJq5-G$l#Tt;Ck-p?2ow=BGHkfRyj?=KkuOj&!iec8!$X$FQ_6ZuMuripy z3=Mr~=2SLd^2+#r07*R~*vpCBJM>^gJ}2H+@jY}-%Dy}pVQ5iJqT9YoGABI#GsMfp z0Aj=Vdqx1_bg$>Kgi1h z-ql;YYXe|^4}EFqM)!%|6&$3lB6z?Dw$rV_#DDfY0PAv@2=s#q^2chyL@tJe(v-`9 zEp7q2*IH2>U>skA@d}d{;V+QlFbjh^zRI04>F|i2D%=l9+3!nk`eKM68G4{RMskrd zDy+KxXSGTc3N2Gi!w+_UpLF4DcQTV9ocCIPbh`7;;=~4tlNJ!C(WODY^nFhLLWiH} zrmh@&33MRFyfOd)N&)~MSo6;VUu+I)L;fwU|5T6BoXIO7@&Hz42-Xsl%rgL1FxnM< zRyX%yuON6ogXTbfet2Tgz*~k8=hrdd!Jg30?U*fpYHMi%+>(4t?qCcpAT~}AqT*i= zkc!Asdd&Ocfdz*~|B74F%mW5~08|@8Z%noph8(a3&J~SptB3 zbMTqY4=}-}#OwjTur`F}LTUy~W`*s}9Q|to$}-LZ0tOu*r2}HP+`E~e_~|Jafd_w~ zoByy|1ib&ZNU1$N>ps2RnR1W0GD26tE*u6oq+B3T6$Yx7F$HoU2d}FA6u4Kp2;gDK zu?7SE*)t)c3*7o^&?Ff-0cg*E3q%@h0>!o(X$=<(%8Auly#49rc%w#~ADWxm< z^H>}2PU2K>!&>S}TcPn>;VBNCY>kk~si{~kMQBVXr6a_rcCY#|%$W>Bzpy}XxB`xB z;P_+@9X7z9njbZ0UO?OP73&8%r&lK-_&Dvr_ohbh7JyI6D+4HZxy01;yd3zz-zq2{ zNI_{WirWChK^fipA?NO&I*L!7k(N@%fqOQ?t@5hWVmP(gz3i|`&!W%Ynq|w1j$~GX zZNBzg=_zC3mO6k~4T9L_PBTO}-N{M8D@GfEa}mQUveRPi3oudup&9aW{IsXlfor zV7$scVne#cch>gTIwbC(>+etumTk7=*90ZCUWX{C1$OLhL(2{vzrqjYQktl-+ZYN}0qukiV|2FrAN)2`?EZ0pEPzCf(~o27{!aB3|E zjHdH54(=1BGG~stB`eySmZ{zmj=D?X=C-XdGe=?4xZHQQ;T*&|1(29pwcNA&T~;80 zxe_eK?u(_pao)lY?bH#r|4CENs>(L?)g3a_%p|oRmC}4~*LzQkkXR?^5o+KON@=$4 zrHSCW)XgrXXuuU8U5|+55DrXE&9pRr^YsE;*z8U*9sPhgK?ZUoyv0btvW{!Yf?zQ- zh%twcEI@OUiG0M;{nzPr4>ax+Q`me;^=Jp}^6atdqkFRxJsEbQTa8D)DuLTX#TcJM zyxDL0QgcS0Y)+W#?oTI$D+q5jLX2JIw$R)|k=<*(DNK9&p`vVto*0{)yKGQ1G-&r% zhK04>P6K;@bilz6#=Ce~C*}4B*bA^_KLGc5P}cDkXF!}VW7 zx{oD$UAy>n3|xh}Sw3I*OGqDWC)(?-p$oDw+_7ytjuFshi=}log_ao0?eTi0 zJ9fwC3%V48zYpedXDe;*&mmM(ab7NSshnC{mBY>r$c^`FMm237EoovQbZEbOwt$GHEqkFiah%ASc{JfAC72K3Omt>K`POrBn1#z4G+ z-zTL|JX!GiR8sg+NA#RTjjmmoqQ}w$ySF%Ir9gur+4Zcf}0CV_TPyc z22tv5Z#hBzYGhUyJhCClQ*yO0zpM{oJO1WcSvI(w%qD$zvsUU8x*`tAgpztANj4Qj zhm}TYa4n*==mcydOj=@F#+mY)`o`dB&eHk}gGf~=`qP|x#`@VvSi{XaS- ze(~7jdT1ukNC_%vutzP3-a-e41Fa1GusA7gqC7UFDPu^@I~ALCEmUS__NE<`;%8l7 zyNV@C!TUI`;GLe>1lJwOo;-Cq+tR$EV!J*`+8dd6`Yi*DL1%DW^-|9x?5cN|9_q5# zAiynS&WL19|KMNVi=G|{klMi;@zlKsd;JTUE>$Q7mw(-=G)TCzovf^Rb&6xyf_|WH z-psKjxNmT+)OLjZjDdUbYzAMH8Z2XY8w6N=^&GVs%p!oZaU~51mP#Fgc}d`@?tGQB zKt04_bYVUQIaKiA7~7RAVd~j|*w5}eNtRt79g;tkOMTbhSjk9=L?gD?UOS<8+gl5z z8pt=Q0vJ4G_XVajpUqTS&J|8|Zhjt;)hkU!>yL!bfx!t~$gf!aS5vmFcWZDZ=!G%4 z*ybW%gHrU|9knE45QWeJ0$FFA0}w|e4gMssv?iwk3T~N14cG{Wg##PW#S#WCkl(x< zbD;%P14a<$lDD#uvFao`*de!t%C^8bghGkwrT@d&dq6d{b#0>-q=+;TQIIAAA_6KZ zorqLHnkc;}RYZvN8j7Ga1?eKaC`gqqC5eiH6zLFpL^>gamH>eycg1sj-*dkE-|xR; zWGH0s&0c%1+2?%besSeRAn`Lz-&!8C#u?NQxp_Z2 z**bT0nlJelH4|D-jlR8Q>*w;FzrCYl!~C{UMSF7A0zO4p$2-=!sWIM1IEddm2w%oA zh#Z)jUmkLvt*MUY70!_ww7`;Rv8Tv`Qj*_C)^RKPr99u!T-PQtE2hbbO_^9-jM`V< zSWDwxxpK><>v@V3OlmJ5PU26UVx^}JfX}JBJ&!8Md$yH%66D_hk#%Jqp) zHt@q@Av5UX{vdzTi5?AoIR38oSWr-i`3VeHQq%o2g85bfrd+t@MEER;#FxsVL{vQv zf9Khew$Sl0zNH{^=(AZwylv}fX4y&<7ShZj+)JnGtw=hv`{b9*`$t}8QcMHydR~=O z>_OxUAoDK;j6_yx5i!mhOU~s;HHWSYaXy6fu>Zpw_t10AQj{vWrUn+-EKm;lr?TFy@!_%;;as{3jh#+}D;j5liY6XBqt|Xcc>d)@f zqdkPN&R+gMB!=}L4s90A=tb3@0*OslYUp$&D;~#H5f99iJ7%y~#z{X%+HLEGiG|zZ6MTusU_mzYKAPFeZJjj{AHkw~IXmru$xd*}w3 zA7q_HCk)nWgiIXZb@Rl5aILUwUFvkjEWEtAVEN+P2J^Tsd>5X z#&kCCRWO|h{U{5g2} zATEV_cE>iZDhAIrmh+AbKUaSs#1qu!L5Ay1&Cuq zTWE(4mEm;zeIOF%BZKcY2z0jP^;2utoe5{0&owhz~z!&&a;o=qIsR<@CK_DhLg;qBD1fUxDYiYgy*^?c5m+@{v4nis8 ziH_?kbAdk`Q;d)vC&9J^;<{T{ubq$y=vL^%ND{xWIG$3nNowBG>SMgtJblw~4?r&J z`DB)wzpJ7!9xY`Xn8784G7RR_7E(wjn_dsWW4~DHEg!$!BUyxFQeFNsW~{k)Og4)JA2r`iW#H^f2*TilD|MP||(+uUhZOYZj zw^3Ig4feV`mqZZNU6FeS1IG3&*)hCPKBktY)^Fw%O4SQ(kKi+LcPxkHFIv`FxFWFS zkvWL!(xm|7`e`4iTAa_LFJfuhgUUQQt48)~YU zI$?={nmaoXqsDe4=LwwObV8tKQ1yISfldS{)ut0x)rU*1M5PLK;*mkt{C=2d z^z9{yR}Tc088NAYR&(EUVO<;lr`|Q%x&2#e`oSUiCtm=@!v64!)6&YcN_%;yZ3C79 zpl|_MSy@8Trh3vxqpKHB=;>P<$9d`8k~fMwZE!*rwU_Ka`Q6W?Kq+!P{}!|%cY9N! z@h16$oP(cy$}W7m%iIOmBAD$*7CMce_iZxaTiqF6oOUg&&@NvQ^O*1UF&<)m0!1i& z%^HqS=jHbLaf=a%+aJ(VfFd^O9o{3>@#hT59;X{HW^Y(X5=L1B$0)Aue_V()pZgxn zGk<$5n@G4m`5et!5<4aRUaKVr9u#5(ldh=qJ8$pmy9c{Y#}xM3{}p2LfDdmFvPz)zP^umepn9^lqKa9j3CX^?>##^ zl?GDI`Ed#stIONLQ)(-8H+X|L(p(Qf@_OI+Qm}n@fF~T_y+z1NwdVpg6i#|GeMlk_ zc^sO_gIe1JduhG*O9?-6comko_~s#G03ki)0NEM|uom{0h2>NQrG6ctNc&qlnpxAo zm3-c>jEm2Jk>9$aO`zEp3!yEI7H79Ln>&{qL1ol^%oJ`1P(gC1rHc44O>%v}ODsgg zIk0@Cq;RiZI@CkH2aap2wyj;G?rPcGnP)-x&95BVPm3p!gLI#uZdqm!U(5d0tycDZ zLGOJSamd+Dn?(D&IGliV&3yb}>P#gV!hn|6eZ8A#s0Hha{llbou`B|l?{&v+nq)() z<6Vv`CNn4j6QM!38YffkeAO~)U`lrgTER!GTq62%%?7&^I#8r&Am@L z-7jo=YOG4rkF!RT!NeS;678rR7V87c5RxO0wP{1cN8;_ zAA#J@Fyz>Km%Z(f>upnR1%Km}duPR^iP223^5$BQGE6b09fw$QRhL{@I-=zGadF>c zcFRz&PDG?x{+3ms-)qBjI$XGmg4R5b^(xG2%>Z22F@14-Kvw~O(MJ}iSt{p09tJ=X zvFjfgl0aXvQCZ{Qd-ERh_7W|obr(1tc9@hO`+J@NhaJCcJ6-4*N(cmzE5lO2&#>de zlJDVL>i7MQ4YrlWvM4zm^blS6=YLMGy0h;Bpae_s?b)$c^@5`S7TXEnv9ASY&cBof zyZ9zyb@_+%bFKX6Oe=7u{T;)N)vxV@kM$na9!y${%{-kpNAQq9XzAVB)rjRwTSL;b zbGa3xGei}>)sZ?Ku>fLnuAtp;MuV$qDQmODqL1Z|ai_f>ZqQD{9>h=A>VYhtxzGUI zhr$I(lk;QGr#>&eE^}}$b#}#LhH7K9hcE zjo|C~ft)77mjW-vK;#}$iXC)(D%-MowyIv7k?Q7+BTrkf^zZhK$5^E}fq2N`6ZfEX zwSR51qJPoD;Dn7+J3-PVsj~w?J+Rpvl{io1ETuV(_ogMW@;roi4c?FD%yLhH_b#0z zks~tDdl$A}Z9Qnsw+#ORht2mv?VB z)n9S?@~|&rd2#JmXUp6WDu!=%0GpIJ+o)tbVm}q2MmQD(az{500ZdZr*0vOh6ur29 zIs55fBK2->AG8fxtFRKUH>|9@sq$>MF|B^|7W5ufXN}ai2ZsN<;rmKUVa|t7N4aW~ z>UanV^Wx@BbhV%tFzuQpnzpf*955kX#4k97#vPl-ShV3(z(&Pn3sMV_ab0& zQazj7H5uU7;^>z#=IyHiYnKBQadD>A3m^69hSHt6a!|??H_CdU^+;w3Ui{HJ0VDb; z$s%OiD$i^~Xxv!(xaUQurKb0;CW{oz7`FKH=USn^Tf#f!f;a37TXo(7d%WVz*G)$KHpff2ZpL%a zNi#?9XS+a^p`9elHFmST|A)Q#HKVx`{A&jHtLs}^{2JwJ8(M9FR-IaTM~| zOSfLRiD?6o#H8~jNrk;|&xfdC(W(kB`^AQ46`I1AEG&;kJx9beF$X36iD_;O8Hhk z5YGC`(b$P3YnPyA8(DNS9xA@bLE=;FcveCF!@bLZQq_ik%frMqSl-fph-H~bX_|x&Z|?C0YgNQl)S#ls06AzD?nILy_LFIO!7R8H4fA*nCSnLR$VYiN zx04Z(9-s(uGKE+(3hPOt!8c_G70=F|P&_8gbql$Wk^0an7!5os4tS(uW@@TrqHypz zqUqQJ;Qda}H7&M0+2YkL6^IWwH)W49ll1jM&{Z^$Po~LX>t8FA^dOWwO1mp1kr!O5 zh=W0!lPrYh1O!T(I5m{qjK=9woN!^qdWxG0m2SF z23;6Y3`xR86==?;T33;4&hxJz_-W?OZBbHX3|AasLpDmW`a&bsB99JRzmmV^Y6JJX zI_^KPBxede@}WbjNDrpqSle@6N$Gr+>5lKEK=t)?<@K(k<$6pQoFfM3fWa+*m$I4# zJK}C?q6b{3`ZkVX=(a)5Z!#cOX6CI^1=R{cEl`b_paX1zbGex_zn^0eCH>L3#Apby z^bQXPUano)(C%&@d3(9QH(TFNy}sNXdoOi#)3GN_B-P3*^XinJNS}1+(odL2Du{9| z7dKnR8Fq6H6A~jz3nS!sGBdy7X-CqbaQ1Z?oxta0p*Qj1zG zU7TB}B0@W{^$v6|y=&$4aNM=wBm2nIi(bO^UtXgMTqpBH>IgCw_4`eoZtkD`6tNp1 zwlM;+O^}bN<2fT9xH8N!bFn9Z_Yf=m%m95-Ay5r4*e}bl=Py@+vt37COLCVnF3+7F zl>D)+cER#}oGEJky^&6Eu$2h+#^zfql6sYSx_9^%Y_UVW6j#HE$`9mfd-E&~86(B{ zzj>yfuD~?n;P~f5ZWr68-doxBIy0>wo9Z4}I=U?4uJb;K3_!}Co+h;l4o zV%)&AqFM&}Xw&=RrhE`|!4a;z+4>>1v|DhLEoRxPSWk)4ar6@ex3|_}BH%mu+S>67 z($8zzgr#VlOna^HxPQjxyrie_TacQLwkqsbMxV@whH#TNJP2EVWybtRXQucnmtQY} zaJKHW2EXPXxqtBgPwqj;^|>Wz*z2w8&1bcb=Dw4Bw%M7)mS2Ge3xKQg_N}f(ED=Y7 zvn99!DYK+?0{Lj!T&x^oQ6P!%0t?~&xa}>w!bdl5$QQU3HG!tAN9K@;cy3jdsG(vb zuNHjc2SR`xra1=dd~*sTGDax`@9*|DvF5w!=U!ipb=<;qC9ITub8KD z5CoRSxmIWF?m%$5s4*UHnvt5Y=$7Sarq^Ciys64Eg|VK(s!6ti(pr)(zos(DF4#Ir zx4^gT!=MO2yD{Bf(#f7Tc8Vi&pRp|7qFLOOkwvzO z@6_~y@y7*n1eVjp=@Q&>{8uVb);wLx2SK{@T6HzvH+5)FYugmPASXkzL7yTg?7`o$ z6!p;!`L=9#BjDM@yt4eJ42PZ#3GSZl^72_9zHdw1mi;~m9}1Y9d}HZ|7APrqZmann z=>sM|?w=+f8ST}V>!2$x=6P>YDNo$|`grDOCq_~jxLlQgTrP%sJ>>_XgY{3<#m7Bg z&5OrS`r!Yy_CdYTyXU2lHO*g$`@2`N&C`A+M&}@k{p9b-bJlmgu|cm;%V?`MQ{C;W zU3XsWSZ;05w$vKdKHs$FBjnw!nxcKjIk4J@6Y%?b^alp$Q{&p8w*623oABpL_@&;q zj1isYapJEMXlagr-(_E@=P38a?ljY~vs()-(`@XxYZ9!KJGd{D1ZJCd?50|{Ji98G zt;;1wldY*wnNvReRtJ;9cFnRb@R=uM;cP(G_UkjL{$7}loy!$tbKGSjQCUwm(%3K< zRbca(d`$fIjy)v`wO@j09uhi&uP#kzBzj|uhmm@Cz6Nu~I+F(^rY}gn7&A$Bgr1=v zulnBAhc(q#ou}@Y)m#X&oqsbVWTrQ>J?~golxpK8$a-`FC%;|0N#Op$WgklAK@z>?4+?w&8`}W$A=)B5_%$)UK{ZB z7KM2~9q#U(ay}JhVc75DTkiuRtTH+!*8~Acr82d=%$z2?44N0kHx+BYdb=l5x~QVM z)^OYlWg%f13sK)9Cj0b$+6UDwQKW9>YNj}dTpB;1y{;ksj4k{@$Tz&iHjZK*)9{yj zEzeW$l^g8b=7Ql$txK=VW_HXDet(f15C!7w$a@;N+6z<#xQK!F&D|Dcr3nR^eV2Tt z{^I`~4AZU@e1~li3NqUkpz68mCB%fmFy8#d(=4C>7ry4dLX##B4QejYxVSKBr23h_ zu<#}dOip8>@kd2*3~ozcUN|3EJA;vn*}TIHTy-Y#ppDT~P;btQIAq~&Z!Q0kvc=9a zT7p!1RGRT*#lUqD&0QM2J}UAS)^wfV&Z0<2YL<4YQXsFvswf2M11!87#m53%3JjUH z6LS#SpXm>YvPB+Su88+RpOG-Hdwi=MVdHXj6wO&l;4D$Nh^NNVNOsAUds~-M5;8Jy zx1iaUNc+x>HLl4lYklOs&dG^A!6_I4WXN|nFu3E58o%J#?yaMo9c9w^t}gbAE<6Z2kuOx8@&A?aT*sBl!FyHUzj*ZwZ%C0wJq*!B(jrKS^Xf^%%Z zCpT7QU%3*#ILc}dc_39?&H<{BmH|Dd4-p72eN-2L&jM3 zWfoU76NEv%DoW&xGt^Sv4A)l~rnpMepE=14>Jp1gN<6OQp2`00X4gRbeZ=id){`YjI(GwalG{O#(^VRN0%{7-te7xdy@Q+|Jlez zq+Y%2BoO5K`Uk>++3z+yJp(~Q{{^la=rS*P%t2!{9)3?`_!bG@DfX9P-XA~me@zoD zP5}1Tt9d$KZ-z?FP)09;4h_%j5(zJPPK>{Z7v}V)Tv9b`pitVx`p$2kJr$3*(Tz3T z3Q@tX!TmN*%FfM7cymkzVqE-|(>N!VedSXuJxJo-uh8N(>ch|xe&R`gzTkL@!h;-{--4Iy+a{7jowmfXy>))SSH|Zh&+>tYGoB#| zo)k;(c%^e5pQOT8);GIXC4Tt0IK(04-KrEoxDP7Lf<`=@?xY{1blLPY%KShTA&_0- zG5^dW{5z-c_is*BJ=7pCQ}C2Moa3Y0OeVJ7*P1mC7E&Ymidnl%N!KwGHO?!EWr6Bj zqmL;BbT>!pEaB5cXq6n1pJozSqKT7>huShdpL@X{dVHB9sVYnEbnj00<07nG^BCnL0SlNCnBfd{XEH*EALDned(#sp}N5FWYYbC~= zPLM|w|_vUIewq1sG#NDYj;_+#`DyV#PIRICy zp!C!9G^P7%Bu*H&4syk|lY;A0dVM)$VT?dK^d+w=#1vr2L=FgdOe(Xl2Z z=>L5$l6_v<=n9Gz6))|AP3@$ay%3IfgWVUShPv+9iJT83V3I_Y1IF& zg?Ct`e5{E>r~r3oCpO901YLin>p%S^SM;eY3~OriF6wR<_3v!-4qx^`k%XS(^TSAE zxsQHUOA4!vkNb6<7>wI~b7!*A%MSScD~(_v*VyXCB~RvoZd*`p^u+K?R(6@sOW3_! zG_Vj|Q zp+^20^W<%tZJ*YXPcwaT(p+YVih$3WS*9S((tFn|!4?}JK# z+ zIih8KF>aHK18MU<^X7VSbs`LX9g=;|4D=0sYi7WzyoFNZ-q8AIRJn zE5{h6Qhxs@M4{9zOD=e`ZfecrTj-|7Sdc@;`4Ge66hw(P932;HP`n#!B%kp_?Nsqi znCR>3i`n2+%_q<6=%bs}s6(7WyQoc%vM%lM)Rv9%0|Kzryt{(oc5g5hI*m-#iX}Q(Ip6fXoZ`Pd&AavOj(r6kC%|9E)3> zDBFu-UUpu-aDYpF!uVr&3jdS*K{9sHCiZRu0%srY`8>CxD_nWTiA3aE3= zVWl->65W^67TVuTSop~OPC-?O1z&Z`APwsC1j7bR{6Jfq=O8bTG@h~AWX>$u7t?~T zda#XprS$>%uf?{vu+x)ZG)%ZMs8gRZ6Akn_S72RtU9i;pI%N1i?V7i#(G`Zw3|V1q zz^w+YmgCL(7At44y4u~`w>{IOnljIh#gEB<9X~kUq-ofhv!@+}u#0t^s*%iF2n zL}OBbX!h#lj@LyGHWG&Wred9);NjFe;1^(c(?lXPhWO_VSZAK zrh<`ZY0M4UC<RO|TiNmXDro`%d0H%;x_aqPsr6+{ z{@l0J2(_dg7fG9g!k}<@8#L~9e&vizmQn;sCXG_)M+o7oE88lSl+06Hq~gH}V`&@f z_G8PK=Ol!W7Xt7iOw(%yODe#tS)nE^0{K?TgD4^ze10FxFLZC$D}HAA|Ll7KU6ul* z*&3+_q*<9Nj`+K@_#xC@!Ln-eLU+34Sf!b~O{&*g)1v*+=SX75W`7{cVbwK1jA(Z0 z@2-^zd(VPx4w&H7>OA(mg}y#3TljYQ&M2pKr>ppzPC=HbnQroWq3D&}89l6YN#=NU z)A%kJ68gg(VB$V@E@_ss27+V+uH|5zDNln&TqeJ@DT_gG_b+&9x;JPev%xuzZgBLI zGGb=4BL{=5Gcsbcz3Qe`;122e}?I+QcX|A-n#ch z^i+kDS%uKjH6eK2-C+Tc#9I~1a@Hc!a>5d0e0*)UWc*g2rNXPvJ|(JH!&(~EQ#cLE z*`*x1Q;?@4-qGx z{4O6>;)bex3Kg;K?R>Bc+xXxv(JJ(T?RkvKiW8DKFv=p>yzy~ElchQ<{TpgGPc1$E z-z9s{mMS?s8I0`S*ioT)IR=6h-Ia9`OIgrO@fC#py|UD(#T-;f`Eo$DqE&x7toB3a zdfRswX=_Kxg{|#%D~KDfXA$%u`RAncB%sWJ@3xH@4%>#&%)^qVRkwxVie_6=wN|)> ztzwL-^{?q;pi=ePBJgtq+n#5~mXv=0BPVHE+yOLBcYrthAYX(WG*KJ~Bi1?(CAj5B z#B65P?cjt6DwbP8-Jj{Ol7-pBLnI|&6=B0MpAa#7yzPTaQfE_!IPI2N;=Lltu|s}9 zZ;K*tCs!bLbz=mdbBGy7A)3Xg^}a|TA56dGx3xS^!}&G7M+;>&10$UNE3-D`<%Nj@_9Z9aN!LmY$Rpu#f z%hlW2@u0Qtl|YMis=RB{tyo1OeYQ}v(kqR0d!e_>f@`A^4k31-~2qR z?y@D))7%8wi~o&)?FD5`NQ2HT6G%hWW2Qgdy!xR)+P(JtNoo~hb0F<|N`GOOsSlNu zz%i_MwTQ3hnvh}&aIscFJIRbJzH8G?$JO;~E=~`c4RoxPRo& z-+d9FWw~o+UCG3)>m$RJwNXyna$B=cCl)u&C5?h}!Nk@M(*?`NkOKxNX%`Aeyn0xl z_|<&uD=1upftlV}+&e`pl>u}-$>)|(Ra2ZJog}#3`>ho( zYAT_(mtrTjRk2;~B?E6ek|(+Jwb22@qn{UP55k;XXW{zCa)=l&BrINGCA2R4a23bo8|BdvbisdC2d2}Ml^u1jE; zz{=p;BA#QCMHQQ*=P%Q*w=;-jr>$+5yLMLeRCNcJQiA6~Nb;B>Tn>x8Qth4}Ai*pWk^iCj`;#u!YydC4Um4+>@kql_4S`;l`cMyv;6WA>|W?p65< zK{?;^>tv<0oGZxYa`-}g?^dR1uA`xEt(bmw%5T=-xyq2I1dW$o^>Dnd7-&Tz-+-o(GGb10|BP+mNk~ zK5R}1XQ@4%M{H6s;fx%_$;_bTc7pj37);GxIV*=LbCP87`w^5Ms2X~WO^k*T7sirA z-kx--sPo5j$zn^b*wQ~DdXnAyk#TX0`(@IYt@$yPI7NF%vN^PCiAj!Uf6D6Jru^!Z z6=-hRYOP+hw;Adi=WQ%Yp#3XXb{=d|SpV_q3OWJOV2!{7(%{Fcdw;jK7kxbRo_V?C zahaK{8Y+od(Jq47o;soSGBh?diZ9SEf(V@?*IlxdJpBL$)u$j?lrHcE?Wg%xJV=^< zlQ4`0bscI-!Ru~K;<)K>7(+fCe6=7mLnn-V5M@umHrHFA7mkjWsclBy+v56RhiM!V zjAJOS>IO3<_#x!0YD80(Gi!*?Q#CMn)>Wr3=eNyX&>k-& zT_3+uHSNtN6%dJqXJdcT1y6 z2RbzFG<^~kQj@lGsL~yj1VUv#6lpE`LLd<+Co zgp07Bwp%$+yIbBS5Pv@9?BQ+)akG^RK))q{jLZl$>y}q$t<-2%z={O5p<6q3{lMbg zfND|~&H3Uh8K@iWzgVxkKpXRUrH}VjyU#>pnd-u5qVvh__O%=m&YA$-E z)RmdHZzPL>k=PvXiVdlV^${RLEx~8+CgmUo?)dZNTQ=1Vo6j)Xbx-i@vB-DY6AKY* zrCyyUtGbAYg(;ley zF53Qdz>7-e7db%}bBo+bjEf)gbtB(&o;zgE{#x4kdEjpQ*D9CrTCq~#uWnscd_dZg zar|Y~0SFXl>uCZxtydcBh`dN`-c3>iyk@#(Vtj;tsc=DozcicIk?_aKOOw>+RVJAf z_dNjKf^H&0`Xv1H#o@*zDr9O7AiI#wv!jy#i~y1%sI>A|m{QUperQ8TliIc~T`Pe6 ztfa%d+Z1ml;d!e=5kR*|I`QaIgEdQ*szz-Z>-RFs%D&!8~l%NK!y7xh*R-J!}UG) zQajQnb>ka0IW=*e72@lx>To%es~;dB`|W2x5_vo|pPJYC@3Vu%z;A@|fkTx*E43Xz zs<#V?m9ZN0nGjRpc=s;%_|D@E`Kl*VEBZsSr;~+>vO|6?Eo^~N70Vse`By&p3jsf_ zl^At^KBBU97ly}CYGREc&r6)aY^ZCG248_OE$>k|xjGxk9D~`;M+m1`BQ-)^1u1B? zTR;B*ur^Y#7-gW!Nz)NLXE7TaYS~YIfX$_+q2e)n&Ch?t3l>-_xu}>R11Cns{@!Z4 z*c<^@l|^rDy)(M(8G=@ z-Xpe9*;(thF>PmkO58IcYm;b?#EZ{E!~uSJNj_LW+;XG-wm-(pjx|#Bh9*SVK#LOy z!JVlWJQJEY9nUerD^}JMCh@4YV02JL7+5jUWyIBJLTzPNP1| z4e&5@H4lnT{!=mvRQWBHNlACJUQ*$`2LaxY?*pxSje?@=dBy;b;DSl{(KanYxVN~ z69RnRMd#6QsnBE(vda=SijEP2KzhJziO?!~-!Nh@38AkP2z_jNowL!4VYzM8u5i2A z1xhBFZFy9;SA)DM+2+`VU%Lvd1h z93Nyx0F#0WM+ptehb|n{B3@vim>CXlR}k0QCiDll+sqzhX@<}oN43J-y zOKagjg>T$KBQdE}h+veS_Cjo4kT&W-h2Eiathd1;=?qW;d=~7de543$<--vE~%9m~4eS!n&Pbt|#b);5zgS&_0jDgzUA5p$3Ub z_`~^GW@l5uji1U@+ybjCrLNNX2bZyg7O}N*%U&x954)A>l=x?rH0+Y7Pr85Z#x2N)N6A$|_lJx<=2G&4JmTlQz_yzm1}iDcO@T`a3c+xrwO`Yc z{yYWPTJT|gNPQNwmzR;?H?mep9s)UhY*X#`vA@m$|NdkIREH@iJ0%=os4=4Q3vym` znJ$Q@iiUcX3b=|g_^e(ww+JULn^j0b_fz3H6{ne9rRH;dLSb*qqK+Bbp z?%V>t*VnX6A(t>eQXAeC;j|lXrvnbH1^b2`dt?#pC%S}joYT83irF)Cxg<$l=kE_$ z6Wj?hd~{P4EIg9BaGSErJ^wlU*AG*G-qdAiP%k2Ylg6bOYFGgi7}<77GQ0|bu!G}0 zwfU0J6L`Fv%|#qwhr*%?Orpnb={PGpXUSJ_S+_%NaXdp_yn^u|^5AhN*&b!Ki7wH3 z!wrX7R)|t^+b8fZg*&#W1eT%_xPg$Fnwfy`xE}f>yef!)@c5?Y9}4!~0ZXVq;b)af zqsc!4?!{8aW$#Co$bWn+s2m&392XBbD8vz55YXDmXKVQX5_Mvr4|a-uM%dDUQFFYK zgUz6?4(9smhT-3ju&H8T%_*$D@f2);WX_RY(WI@g{HLNAIt@iGgQL+zb$vT7Dv|CB z-7v_`4sWG7za%Yu{PiB-@an18&i`RhG?hdFt<8r3`(pS3n|cjOX#>Xpvk(9M8#L5w z03<{WHe*tER||+pv_ge8*qs;D-3cnYGsvep{C@v!J+RM;iNj}Z-hzC5lwB3{WJp9?<%hYqU( zX>u-hNl6CMjsgqWd-DM|Q25_R61ZUiS;Lsg=>keV64M-uEsKnduKP=EhvX@#!7Q`+ zqKS={E+=qO_u`Z@s7dZcKFE|APlcUoB?}SZaV2`0QPWn0qoK3 zZ~y*3TiXm2Fgn0nA(6Vis!`~HPRd^=u?JwiD}Kn|H!T81S{1V-Rw~wM#O|1{- zbGY6agg#5|J_{7m&I_v^>ONeMc@f0iXGxIg-7j67)VfMWIeD3guvG+wqA)}97S%ofKIezE9 zx94qcgI4F}!RVUek`it@K?Q{~Y;0`a)7^(UIyy3VuAIxrLkOHYEXSrrJZK4Pl+rV` zmM+eT(KLW87AGA!d+_)}Ww0UUtcYxjHwlRByWw%w%BJYHkTiuqHsZ!7uv)%L_rARV z`?n(t=oe(A+{OFn@LwuCBo`2ZJ32862xN^rRpC(%|K^!jLV(}b_`o-$LW$-d3~DfF zyJ=6%%a>l+A>W=>ZMX|rd3u6ZJ*pVoyEoVCmKc(Z=`M8`T$mQ)GrvCo1 zXd=*zu>CiNgDf1(e%n%Ak&)H>0VNFI8Uz|QMl9lmW19~6puHH6|C-^pr~+?Uprmhd zrCcKYu2sQi~EOib8~l`e#j{hXOWNFYPeH% z;55OFd)_XuT$<|YPVOFg<~xJ+seJrRPiu!l-n{xeQ)%R6+hi-d9wdgNWcXvuJl+j( zQ$AxfJKz)!h% zZnk#X#wL%$EqLRtu`;i7a~I5(*?)UER3$>njr7CkLPVyec9x{b*i;=%guLG65j}yH zfu~Fq{v}csvTCFx!!AvZJdm*}33}0lFtoPi1W%Ty4M@S%9J?S81tjUcSKF zxHoUOGEU?tJxm2?d|D)QqLk^1XL=qYSLX1A%RmV3Sw6Q{~Vl^ZR-<#VVSR6;VH(!T%>B)szl4T zeCUhMwP&wcd3fyQt>>q4di#t>5~A z`t6%`*2EU$=vUTv%%am>;oNPpJjOQK0^~VP@=G#o@BDG{9ICsHXFz!S>FXasMX!G- zA#)B4RMe0cAI3S?L((bCa^5TV8U2ZA3zc@eTH}bu+-Tw*GM}OJuSoxkY8jMyF^YteWbL6aX24~a16E~`EVxB8EP`TGaf?=*R1 zOgB{BgOBkIvcJdb)a8|0R?;UYi@5Af{N}Oay?Xb%!rSSYzzgF|EF4;^vcE~aO}Kb> z9>;Mqc4)gdo6GjPNa*+Lifp5<{6qrg*}xr)Nbp2+koeJ!rH5A?E!WJbY^id8EwZ{7 zp%Q(Ezk2j3GzELp%jtUYQNm{n!_x{!n7$;0w|S}G-81a1)v$iC!sjCP;J5uRM%VK^ z{LCb}q-|;~(H1*z)A^36!`sAHM$U6FlE7ma-jc#!fIlTm0T-*W@0_s%0c)Z%tTfN2mbB0KTtluo;VnVZB9fH$DGq{ z3*SyxVDLfv#axN6JF!#vBjZ`s70TMe`DMdF=-RY*-2gCiT`f+AkJ$1x@wqpPS(F0= za6V^7^t*jhjPH$9u(7v@c%HC9zS^@lTds0+D>{oW+4Dz*(Pc)<_LvJ1q^E*d_+Uh} zFvI+_g6lIr*9>=BpQdwz&M>jNhy*0Em70-m!BQ})evOA zYLw(yuDniu_GQ#ZA-|X`cKIC}jZIVRO&g?BBvzLB!FuL5Sl`p6v6q@&2&P!^73{Hbx|p9Lv<&$$a_&8{uTt(*uq) zd2+{Y+E6-KQ65iE4VJ}iY}+Kr^1w=vRh9z)i=Ng{-OclIXNM;JZuS^lq>(Yyx`XKc zzO+a`JW%wfv{hA{-BBmX`A5Yi9Jxr3RM!r(m-U`~H@yb(y$sc0ewBiwvLEN4n{!*B z*bS@|D;?ujUvJN!`8GXSW6w?A|Jkyfd(zVIcj$F^WFn9JiP4!Y+vYPA_iVHPW_fyu zt=-%JX{ek>#FI@DA$>47R+>;;v%9XHWo5;1+!4W37~WuY9gZOe%G zlE>~#Xh>bFC?rdeb*t`oY&q-SF&pEz^vOf)ulsG6r6zl1?e;L5)Y$ojZO+9aqlv)_ReYC{Jxn_J)Qt#1_JFgyFPh@7 z?#RVEUzUme=-5sHp^?7Ol@g$>4k~|2E`qwqYea9~k1t})EMcsJw{;H%8I@E{cB|cO z`y8pc7}|Tj&-n7QqBT8>Ab#bYOLtM z*M7$iCQ7LfFUrnxqwj|%cV-x)zi?UyJ9pMg=OGk!M+^Dd(gY*&&5mhaqWWoDX6|8m zh=)OSc1LJBYR&Hq^7*N}%zfR=fwvb9+9!CZYG{1E7*wzT-xipn^j7O01)3G;v8c#M z`at40lrR2egGuumqpF(vuWCuopUJ4Qup>qKzzXQ?lPH%Qwi==rgZq*?4g59={EJ<9 z=<^UCK7Hfc%==u0@t7s;pXeI0uiN*?_hZofT=c`K`c*Hq_>Ks{xMI(g1D*IL`exE9 ziT0WNe17qLmPSuZs1iv}rJfi5xNwfIM`f&AT*h7I@SHspUET+^jR7WEu0EITeZD(# zKKPO|Syp#cbUUpp1&D+r0YvtPM|w5k)hPV8@_E2r8+`6#I6c z(XtV*iX#{1Xh8cK3S31mbhTyiRADn>`x9)g$=o0InWRLbYcr)OWJUyW79Mh6(-gvA z9F=zNPfXu?E9XbZ>BT2g`NO9zlRUVn>|4QpF8_C?g!z!a8cg=Uxv%^eIQ-1r0q2*96=#Se`eM*w<3`Rt-A*`UX3{{XCLvc2&Ge#{f+zb7mtS^e~7f4i|HIF5hV0LI$^-IG#uI zy-$;{Djy<=++`LsDmS7DGEOem803Qx0{2N!mh(2G!8BCf$B#66N<`_5;HmTW0Ua-# zxh!r1{{A`8qX3m3u5&s5ocZ*Nc*kR58BuQFbrCxQVJzdZ&eDf&4W?EF;iGQPUPSWE znKC&#qf(;ATiGKYjaz^J$Rdd7Ima30%yp&8K=A)z?5(4s+`F*hqbP`ol$3Or0)li& zqm%aUQcMK>YUDAyMN_W>FozjgkbceLeF!0@j=bYzzp7;IZU2FbeEuDL2?%$4U zU;Enoe*FB%jK4!IA~+mxxaK`YgKJ^pEQa=|CY_9I_u{(9!7;@WYqShQ{1*dl3DFWF zYu*uN*C4in2nG5(>wWYZ#39M%vfbqs?N+b#yJEUEYG8Un-L5hlIAAI3sPYKTcc}fs z%FIAClo%}U>>V8F7(I}vMbkNGDDgt#mZ~gd#+5&DgTZXZpS4%(+qG2qjLB^R?D@DF zr{(YDoTCL+B4K2cq$ZO!m1G8#F+t*zY7=$}%6socB!-zF+W0l;HWOQ?pMbCTq=Cv< zeMs854?lqAOeV=(L|00QJ5!YI>YI3YU-ld*p@Xnl zm?_WW<^mLdE-;4ePQTqx9w05%{<>^Wj8cDVTHD++GRf~1Z8`kw=JP{eiJB6_} z^PesxnW)Iaw@a-ZMqRCCWi+a6;9!1@d;%&vgm9(gwM z3jXsUmAZ^plG+`49$3n^?024hR5YYPfneVv88HVa8FBoXanp=-*TfXuSkZRGZwQ~^ zh(#844f}PU#QPb|5`C0T_XLps0nFfz&e>M;Uf1w4)47LpF1nULK%RYk3dPL1EaD`Q zm3wop^M0@Y^7VLW=~yJy>`Hz&jZ}+xGx040F?#uvr1OQK-@jtH#%UX?sX@LAsZPU% zW_XmsX(2myF!h(&Zl%=G5~7avEBjbwR;no#Pp@-{Pi;O%@cSSk4AkD6hjL#|8$U8{ z2L%M&7nlmzrLk?tezs!b^aOV4;}LtkKBzjHwKHOI>3jDa0T)AhTRnaj!HCM4eNa_6 z|B*idqh>6Hed~Nr;IHy!xr40=(=kj{RR;<ZR| zkHFCfWj1oftDORSAUh}V;_!-Qd{sGJp|(aod3Km)yAK++cnGJ}Gat@9J8-n8Xj71F$8VH|pHW_S5@l!TTk^R{H@g$Y==%pyo4m z6aw`TBeA{75R!MA2u{~{zgC>A^<3^VYYp&Wu63k@HzEVSkdDP@DXw)NF7olTPhKe$ zgtK;b{EezPexxwrIQ%k%WHQd(vi;+Nbxey9d0Yo!EKz$MF$eECVz+-cTo=qq1>bw> za_yK<`)!@29R7T%rfHA%qQR#@k`~}M6y#qXVxMf!;f)wqXuDWEnRnYC#ch^N<10)k z1kv8TLUShdU`&4TZjzB7pWcqU5uaXSt6K+EL$A=J9C@O0E3kQ~fYNudG-~-gB9$2Y z*0VB*H)^qArk10-Y6^iQx^COfoSGTc5D@whhmc@Ixs`z1Czdml*Og|NE1I)lmNwKaGn2nvJ9c6N0bBEH4~ z8gwn^o!J@JY=pr%GYLQtrq z=k2qX0a{X>%KX$=XLiRk2dY7p*M6>M5}VAaDVR#U3JB?-%#T8)LoTr_-9b){6^FwZ z=f>~_u}B7Y^4U?K+Y%ojirQs&TuL&4}nq5M`7T(n~f@dAOBOD}&}Qlc(s z@_OcrFzfZLTEN9iSNkLi+4nxHHtx4a+qdrA3wdebtT9jAf^`%{exdsU1P*NDL&sn; zsVp`qtSM?e7$k(_rX$b$oKaeZ@Nf!g;jHw8aCwf-X6St;3bo++n+nMGu_`@zt*23R zDT(SuF3?lC8X zbfZLGSj3qYyZAaNKL9%JLDio(Tv7^#t9ucS5h30^-F&yE;fqbL61> z{S@Tm^WWE7+W`KR$Q}}xnfdMTB{?b}`lLA4U?w*Qooe9Jc+xi|dB`0A_I{1i@-b(6 z2yt;Ca(eA6e31K=q*vNbw(qX$l)pup>0T_5+-^PENBhhNBlH{AAR~^;w2@pH5u<+X z;yWz`xmm5Q63UyrLZpUXN|5KOCS35?x>FYr z_K^12n1%6f8Hllni{Gl?`s(W78p$7-ZBs0I4Gb$usj$zx=NA;n&B9PMi(LSU|25)e z2UXlqVP$*TIleWuxHkp%1JJ#z+HT_klB323ZqaC~Xk#vm>N|SnjoQ*1*U)UW=C4&q zNI@d^tMf9Wr!mDmb>+VZrldwd{k-E6$XYv}Zd?3$*T)LFf3gk2= zZ3u}DC#|@$q>-+n9b#utMG8tyx7*s|wOW=jhrOLr9rI9*?az<0IHWH^&-W8l(uLoRu3AjDaN)A0H?YEs8|^Zwo>%yA zDlDniVi50k=;0>$1*~d)nJ?cBWt7PRvVcc#Gn_+o{Z@ ze`vaL?urhiUdM!g6-;oYXy)aAGN{w<=Vv6p7JZjX|bG{{%{ z@SYF8jU7W`!sk=}{5@-~oiK;bQUOIYo+ZE+ErN?a8=g3X8;t8uTp=Kd*f>hf8kw7M+pZ5KCcNf+QfC=MhDA5fYg&BXX-IVXRZ~aJ`*vWPX@a7Q zOLc|5nx6Fvx6$Vb%%Ly6vkEeCW#MPjtksTWKbo0$SfO1GvO%< z*qe^}@|Y%mNALNm<1=h8)0KV!B<$^YX@O|S0qpWG77mU$Vav0DU>yE611;O_n;Y7K-gqI zLU_4xArz7QJw5LlHI+%r$vL^-)OCvsc8LkoF-(_Th|l91O66ZO{^>SE^@`B#C+aWP zy_Z&Llz^8cQc1HP*DNhw9=fjauz#O|bEzKZ|Aed7pn-|vB18aDACdUIp0Z}SXs?n_$x zHfMHqF)#b!Y#+Sys861z4?v-iHJ-19yFu>&&hMP#XUMLLjaiJ0(@O+T?QG4jp900c zmBO5Xd>RzKKMIJGj=Mw;-7M{U5Uta$XMsiFx{If)MczFV-5st2;Fg2pHIMXSdS}}* z*#8;*QESIe`yT3XX0Q0FCqA`YzoPaGOPXKHERh@+1Ha8=1C6`+hXtW~LfQ&oeiZ`VbNIGKGX|CC~v+LBVd})f$@`$=LeT}6E_4=glNJL=E0)hVA z_Rv3{>vUTg$RNZ{n&RQNNASMnhgBkF6_u;DSS3)H8KKZNsonYJ=KRiT5uj}3_0+Gu z|7GN*Yxg!r5hRv%dx~g@ttw+AVlKtqtBi3jzFf@7VaZFH9UsJLEj>}5kCc&n~X{8 z%3ZngI*@5}wdpLk*7I7i>2m<+(_WLdzRtHss}k2<J*~aS< z;3u#vACD9>8=uvpEK;yztUlq4w$wB!)YcQh+4#=$wv<%+$VL~KAR}p;-V-&H`}X;L zg3mq_$3|5GcBDI~n&V@1w(2IK>>YTG$zM+O%QzdrUU9LU8KO^FO;Co9BF3Zqd9@`N ztVJUOGuW@>VxTay3RuRBWHp>CIq^kP3mj;r=dp5ik~}jHifQwag0mSj4%S-|*K38r zF)zBqt&IWGY7GfOqnYncHzr*WsN3leTf_6rxRq}9dk6KLpZ`{(a_vLoZ%;$tOoJH$ zP&TuMQ8ivabm*vm<2pJ-uGH{$w72kA2aTvyrN{m_^)DbMUVj&5EkdJ0ilHL#JJ-`3$p*nb;Q$<`; zIX(Ztu)lGd@5QB3rUMp0*mXzRv>3v#o-WrhQ)m9E6Ps&byl!#1x6?6f5DQFNI^^Vh$_2U2CX&?8>ha&XVy|RAG z5WMBoW(`1PPV{dYi1e!_Cd284O_NfcpAW^cZZ{frwxbE>MWI^^GLW!Mc~8TA?L2nz zRS(SPW`d32s<^xZz+Ll51(cPdXNy92a+6X>(=`4CqP(|fYO2IRUgf7?Ismt@Vzc!$pHuJrn3`MYqr)*nV z&s0gy6zAv5y)3WBt6;xI`sdjZ`oDd0xlYv4)sZ*zi3REd7jOP`X2r$6VLM%S_x$?w zpvGCpG5bp%7|4bxQ3ZYXO}RfN^d#28x$KU&tMlx50_jERDZhL%>Z|@yT^%~0$uapi zaQs*)7x}#<(?={N z-OoEZy04V-R-!+fKc=uWDRR!P{M8I^35=k-Gmmax2I6t0s#u&I3cG3USs@AJ{3XW| zBjPcfhB|to{yHX~tdR)hngw(9MM#utTX_G0V@klIGgE)&c4?!Q_PiG8y!N?>@|5R` zG4mKHTm5#XF13I`zMTN`s%}?U%x9QV6%ad>7=}$zh9nUtsGhIoMR-ZC16e5_QU&>y z!RSBLMHE)R^fh+GwH$KOiZvxYJMse>^)FVG0TRoiP<$LXg@uG*5PD zZg3`SUuI-~Xifh6)^aKQeDbJi(4tdN=sUvk_BYO?|0%0Z6NjSMw+rj%tB(bCXX_1| zD>%(Zk)?yAgOaK0rE0M*<+i^8ash^;@#o7^6QaMoFR-8Bn&W;A48ynHH=i}>|C;oA z<(Zb;mBl0L^S-QRf3|O8rs>uje|_|?Tjs@h0~k|zj=~5I@-fCT2#X}WR8*eq)IqZu zFdUUXAGkn(c7UO{P*)$n-A*^J#E^zc%6YC;!}hDygEUu!y;7rhLUEcLHqt??i{1s1 zTjQK=r-ftz!k$X7{7n(Zb|;+hv_I-HG+Z_JITMFL=3Lsj`kQf0-W`SMb7qMc8_$s5 z+mnU84O&)+JLoM8YH2o)Fi$#+FPewSFLtdO5#u0Bl($~ot+|Q zUQI*?)S~vg73|AH>R5KCa^@$!_R%_WA};(@YU#f2RGf+5wVp5WX+Mq>e(bI`u`P<{ z0gGaDVI}gQ8AqK3Y$BrV69dRhWYkh+bd%!F&E}mOZNQC7O5;(%!QYny!K@O5VI*Ab zyw}x{+h4>qZLL-yE#_<)kSivA=v5yRTxZOnf^z6`Be1KNUP}hm_VhTqa+%9@4QKsB zKu1lIOEYrjwHU#fv=qbe!I{{-h;X-$Dr1HqMo2l=W6mQy=b`6_(sCJMdpY`=_&0o7ehcF(_us~fc({GdQ*U1t3s zD9}%qi5jQGS=>#X#x7S|kkPHP-RW?KpfTCGapBOfds>Xrwn&v-I2P8CE`*qq;pk^^7PC=$;lF^tROa;y{AT!*~By*OaRAiq?>QCiz?p&p3Z=M|T>KF8S|t;WMYmo0xi zUdz&skN$jazYiclc%iuNxAWR@QJ$ePy-2MB}SN3_4a(YfIWW`L0`go~a{%M#^z+ z#L?ULUZgdyjeSP8`+nPvqVT6D(dXFM$1?F?Z?>T!kG-dB-8rqT4ODN&C459_fTS`) zveuWJxHLHTo&%{l*g#${e{9|T*se)@L+AnJFdoy_uSrjQ>c*X(N+po-I#{l3_FXmF zHHT-2HE=KlhPSvk=u^HK2g4lsGA=iKcO#KJSp^lhQK}TijU5XqF+FS%L2;eRUt)}@ z?y74s2Jms#v=?7XNfEcw=GZdZ?DW#Lx#UaEazKnq&KwyrbvbXFNtfo8Ca{X^(AHRA zkdtpU0xZ7EXuf9lSRmI-pumG+@x_F>w=X5~`SpVlg&j>1YO7_7GDdW+2h*Vg;mxdE zyd?$z1?8(%_m_nCxw1c0PjpR9cG`FA!t8LSo94OT`;N$wHjvfllQ&oM4d-2XBSiSb z6xnwsXdebib<@JfakvA+;1~`fq%BxdQ?<7J)nRMXv%bsIi0k@bg6Sa25QJq&6Y-gs zUOoOZ{ga3GSr-ue^a5#6;1bIY)AjCv(i7Ce=|GXCPd)QZL(^OVFmUjqf@-H~^p0l0|f>EJ~6fc24|%T22aUB6_+YmruN`=K*t z3n=qH5#!y^ie`7hADynnM?Ja3P}$XA)Mh68Ul}tiHqgzSX!B&)WjRaz#2E{J8*5)V zDT-Db{Bw~F^hI#^VV{0xQlE+v-E#iK3j#m&6KM0%2$J07vkFWJNUg5p3Jrw9D3tz= zY=r2@M*R882!PSY%Sz*#{ksumcK4&CuN%*>A*@QuU7fR@;0Kt%g>oL9RaREePN{Wh zCYnF%wcaSv4~&N67#aJGcZJ2RA4je)FT$E}2dyZFCICjmjaZeMLSU-`6MFS|jpOiy zcW5r1dF&E+M0uPj&ENf@kdr*~vGKVle>LMIP=GjgFmdfuY2->%rp9T?nZVWj}B6{|^42ThT3&J8vraXa#!kxr)L`z=Rv3gUYb z6eu}B^R20VtJEZ)K5#b8FP56Mk~%8ov0dbYFd04hH~p+LFRF}d9R0|h5?H^_A4CAts$yw_!LGtA`)+8wH>@|6 z7Qk-<_H6aavFyCK_0!r98X`xQ?Lv<;ndt-feFk%pBZE^70V@aaBOF@ zlgCwAc7CeF<|~NXkkHvje30=?}Xes<6J7bABqmH z@ykR-f7I1NVV+d-Z9dm?u5{09njd$z>LBfPZByeVHW>ywH+38DIV9*gM3MuoAgzm) z+du(sA1ycLCkjw66FFIo*L(&!9TFBt&oe_2M=8q0kvfGrrIVT>BU+TgN0cLmyCrwx z1D$2$HZNFZ?@LK_2CD+-;VuNoO(QvF2kt^g^FIX34|Kb+Fhn(?@=8fSQDtz~-+O3z z#5SAoWD5LVC_>o%*?n{{+GH`T$^-kj^YOrvzDQu)q8`%)ZvWZHPbKU53QXj=jk^CZ z@>3?kOihao+^5|W9JjQs$X)+XAn}Xlo*JXh!!VLC7yE|H1fQsI42!du&!2UugTMwV z77VKOfCXgV|&*vhk#uCU6dZ-e19^ z{x|G+al4CP7>LrE&Mdp~fZioTlS?goM+<1=GtT|+FIZ>5oQ%Y-p5RNm9#j+_HM;Q- z+K*j#!bwhl@DWcRt68q}+h_ilvRWaFm=JwQb0F|z>cS!|`{+Nm= z3))mlGp-I9HCC;Ei89=B{A2*!j7VyumZ_rn;BEU9^m~AKDZ7`=c+Nd`In*6P8>4%zvpC_|Cy5key!CjCs4IFGvO?wM@;H> z5hiwa5{6I8=8j#eX@ZdqGe`$UE}Es49SW*5Y^%rY#s*GoTO3dyn}|(r4@$^DKfcYN zx=O#$=aADv&BcxoZ=^{I*>XhQ!S3gUV8y{vN7DV`BKRy5Bz`A(BSO06qd%<~cClm} zJ;hooLaHg5z!sLTGD&*u*Joquz`0Gj_xs+A;z=ZT{yHu9WJWNMsr9gt^UOoC-YsmF z8dO#nbF^1UF)alD6V||kar#F;%o%H)_!MHVE-$Mj^n^orIytWWA+c5e5 zd`TXlD)+-I=d^#)WIqj*8V56D*7v;~91=<4m>ukY9c^c$*!XfhyIrovEkdbZpKjXK zRleu+@QYbSm^v1oyt#QE*?s!kLDGYrpfNV%=tBFbxj`l*Dc$khjy^bA{@*ZkJL3Zo zS#=D}+I;4g+=5$aGBvWdw5(6ipTdO@Xst$MXe6);iy zul)jl6yIFu{y=gW&Aj%5EBE+Be+i&AKXg<^|F=&BK+KRpjAi%0f2SB-9M=W_&OdP} zLUbmbJ)3o%jvO}^o?O-s)6yUZovnS%E5)G5zJU%Z=DQwedXL$s7J<9M!Ar!isIMm?|(9d4LD2_dVCGLQ;kdf>^PUFB6{;Vn+%Ha8HKr9|6>{K zEd@@m^WE=Ug$Z>E{YdFZ859hKxtM{xf^v)`X84jI&-Ovf{JGYQT$}m!GB4peU+JU< zB}|9y0f{^zK}^i@I#nn}-Cy0xsG^D(wknlzfe>wrz$_YiCddZV=S{2luCH4h-ytos z1!y6Levc`GZ+trqR@nY3H&Ra0LIhZk{hy@xEA7JwP&`O>hqF9$e?dCLOB8GttgGRY z??7H!C9^ygtj$R{UX#9qSyvIvUlkp>{9|U*Li=d|WM?;v+&E`DvmP#P;rXmF|FkG%=>v`$yAm7@>G!pTb#M7sh z|ITb0KDuQm3pqtZ1fu?-F7S4=!sNnk!V6UoSs*$VITQX0%*(7i@p)wH3pRU57V+N! zidG9P(kK*tjDvjXUm~B2J(M2=pa3-8x3k#EiZ-o9@>|)mC}?^nt=HjvhAI6AV=v$x zvQ_ty{pD`wu1u^oJFLzv#veVkx@Twcf}ya78h?a&2Ka!rmG;bhIEiBMh>86!*ohAE z`tOV+o_xbV%)`{hir(2YbLlh-SkV{&xuNV?D0*N>eSGS4=}TTI4iSTgS(${PEy1p|K;!wxWRzf0(x9S|V#t!WfqR@G9ZNxCY&U7IWm9 z8Pu>xG~gZ#LHgq$0H5HdD%hA-8M@J@okBEiSRDRVsL?IrfLin?Iml*N3S96>YFVXa zA&iStzxwsd#(omTtI&}=`~IeS)HSkvHM_-wfL=PZ6Gk4ya~399k^n8(&Ivnd5?NIm zzjj#T3Jwc%N;OxkP4_z651MgX*x=9PY5S>}DUbNr+^~%4m9v0S>72>#rhES6L3Qwp z8q<3fO6`XCBR&Y&Y;@ST(dT>a2GfXvk$RjXspk1G@cgF7s zs5uv&)@up7Y_T)zTOg3{XS&Ps^8TWTI+gWlb0^ib_Exx&@w^lK$pXZ;kIY1X#RzO% zh1<#=@CkvhQeM2;DA^SFRmE&pn#WC}9mH#&Q-F70c<78)><{3=i+*;aqH})%K-HF- zCwMkvC#Ml7w5dKseEiG=5HCC{M;~_fS21pv+>x5y**VuM)H!C&Tx#Rzf01YNhXC?d zAhU_T`0;f6yg7>m7&E#&%V06iDuHr;&LjX_2iVogtFSk_F!X9Wb(ievHfi#^a;DLV zC-Ny+b1vyjbc_%-%1&*^5gJ8;NS-ykOJJC%?EMU$cuWLPH7*dkGIM&QW@H=#?)1fk zW@DVr%y2q+LrWGS16b3LOvcw1{L{c3n#Y_nsMmCxsoMdl=!QGv)ez5i6Dj=J09p>`)J_Rq3D$}6_Rv4PWQeP?oW8ZXhO;W*exwxB+6wD6e3A&f_DytGWl z5Ypko*<-OE0$s8t*fXo%D+)#=biM_F2Og&+rbc8YaLUMfB%@8r#Kdc=r|Kl(6BK5k zhP!e~B}m3FMDEW`w>?Ems7=QZ{Z43N*7gj#Cz`eD;%r6ZZL{%dyzZYFv*Oej5$2(N z8$aZp?pU&XVegB*<-)gT223Hp!5F*AT7e(9WKeN_QTDA_3WR?OWWbF6c}ZhmCin_J z)Hpk%RlebOsO|sQ*|0otq!JA#9Gp~TV0b4vj_z@Tq2{SJb@U%L2YrAyx@9bMR(!f{ zsTA%3_ouw`RwHbaM_1ieFXPx!#8@*9hOJ(#S-n8YwoRdlrPRv@3J6MD9l_)+j2(+LMiQbNxx3~12mXeF;Xh=RN83Cfo02sW>;Z6DlAGq6NYkO zYVZX=ex+E%@1)ox2PBg>>i!DP$`1w21_Bkfe##Eqetf?&DHl@ear?gVd_XD}U{(~p z+Hf)a)1bG_A+Fd``*;$^;@C13{2@0@SU;3iUD*s0PZI&?@i zaWkZijFtose)gy6WkK6SzwV`_$A0Wld>ed1iJC945Rta#fPx@%LYQ}UruKt>%{otom)uBa((%ff;Z(-M?W$QW{-Ko|h%F;=DZhfbL{f z5Y1#2Tm%ygrLU>|naf#~^b7|kp@A5Zg-%-V{9o$fLJ|J^h2ekGD*u=aA@`^6c7g2< zSxrG$Ar=`xC;9vX#UEP`zx^o;@m0jZ;#v&BIjA+QK8lwbhUM|1?Itr}^^gIx;vepa z(gNiN7nc~_HWi*Dz7{BgZ#LI( z)njG2M&C;)i}=+D0l6TKskvQz#3OAu`!+`f?9sYZ&hrh0v`Pct-@TeKX=L7&&17ub zQ};ee1pPQGYRd^{y-v!HC4?|-%ge|t95rMn|pxj3ZXzGa48Y%6-7&9LO< zm)J%hNX(!Ag^5S*$3o-v2%zn7BOSVZv71i%tU?Xlr}k(%dk|Ls{7}79 zD`}K}GUWXJ(Ke`1oRF=b@~r(5i} z#N7|{FRLuS>JwZ%>3WEbp+L)e@3+*rs*pGh>4U?TNJUAI(UUv>&~P_oT$Sv=L#3JDu3c`B!LROTI^$8o<=DWQ3hK+n2kc9BL4*$9 zap*wt1g7AHzjd$uBY$+SJ4yH>Z_TkNrUn|QS6Gz315eWY1oqY5pp~=75<>2|kx>79 zt|k1327>FUhv2M;k7s`TE6k!QFB8IZ%WH-6{Da?bFA(RbO+M1=*=reyRoBJ!3x=Du z03}0DfCURlWW6}(^T!*c3F{MujE0bEpB1VDWGxjo!m_o&;E10Pp{nl2XJy48Ym@cj zxyBR6_rp4L?UQdqw53#`(wmabfn*>B^KnPl!8C@Ta;F_k6Eo`3oUs#S`5QK=q)rFS z(my1A_19M>rdM)lA&SaFUymQLZi|?$?DlLPl4hG_-l}OAdVi?)%{9q||1}#0+x1Dm zT*7QDE8>W&%MPvEz&Pl-#r z;(K8liC#|uq!k*3F=pSx(leJy6g>pM?(%*xoh+4=4B64>)N%bE4GweKqMKt69GT_@ z_oNjR!EXR|e?f%nCm zucgsS20r{p$H&jCf3blIT#ZCAt8YmLcLo*tjEp6?3cT`SRS0e>C(%6&-?L84HBX~wwp+9V*oe#}! z&}b+{_TBY?Q>$fvUuB8ZFCTp&WN3U~%QIbZ&lL^0C za`(H!s-Cj*6Gapf<8MtF=(cdQ;ZHg?SQW)FWs2m(wfbcTA2hg4@#h@C!`{h9nU7k| zeq#W^=N_epC@y>hRty5`dsrvB$sHyyHW{c5WaVVpKAIZK4L?bXY@24iag6P*Q1_|#a zBqS_fQ`f0_95R{R5pg>)*K^u)soRKhqvhbOl+3tT&bk%(VJ0ShbM3=pVDHAaKH$MS zM8HpNx!zj>G$p$$X-N4afFv)u1F4od6zk5OGo>kPOsPKWOl%V9lPs~c_SfsJaSHfK z25I+|^;^r^G&dA;IoRJ5taHPQTz}paWkGo6KGt(q5@WIT^qwrFIj89G(*p?#3{?@T zn2||sT#hF%0Z4o2qB>n>PCEcw63&QO@5iPji1^YVgW85Z*iH5NWJYde{SQ+8_LBTDYsECNp$#je8BjiU6 z@#EDAD1MX%6ejWP-mQIq#3YA&*mc zg{?c$Hd-3}h5bAkjVX3%_Fs%-aHXUPF#qF1fBVv+*X=|Dah&!c;i;v-`^Qm6D|S0& zFE2R=KErbRZO*TV0cDT7X9^+Qn*ZI0CZPY7WqY6um$wJrIYK zJD%z=aU8UW;HioovRZb0#{@ySbhWjUkxzI&+1_qE|0*p$HCt`PQqt`B4VbnRH)2tF zw58%tAjYy-1TZjj9)mn&Lugj|Cl8(w#}#3CUK|fDh0y&({jJ^)yr;lcwnafJU!6}b z%V1N}Ku6k!m90&Wy-|dMZEXhx^aQ||eo|JXr|GCOfhjNgbG{BT#>GrDxbN>|)Fn5r zC^pnr6L#qaBtY)^O?$diMuqmepeoq8TN!qZFTB&@Td6XM-!q8FU18OmBFYM7rC6$QY(P6Zcxyb_i zgG6AN)Ugtf8@dHUERKKL-q!B$EBdt7N&>{M{P5KKx*_Eqf|zkd3dWjZyx&D!u+`>r zgYnv=LZkeAncxe?*`&y9)lIH@c;zs|*pQwYC&Wjw9$tk>x5)*_MTE!lMK)h%1P|P> z_ND}&&Mwye=(bR z#-?|w5)V0>bi0WuI=OtGtuw`%b=x%T|GfK?nuO%rWrP$6{wa`x(U9yGI2eHim%xkf zE03;{S;&(mKzc4W?#8%TI2CCr z@KrqH-j0EC64y!C8-YS48~YtG5-e7lILy zcOb;CgOdV`7Mr0hMVoV_cI9UnK<_l;E!yx2EP)ZM!IB|+!e4G^#`P|R0f9>Y%9Vk2 z>G4K!9$X7J(yXC~9sHP|niQ+XjU~QCn=FM36tM$ao4Tm@y|gMST>=6o<`>ISw=sd; zFr{Z10)M^dW|0I*Bw5v(_P+<3E_Hiit53YLOmQZ{HQiXYy%;yGj^?k5kRv|hU_Ls> z%0rq1HU5G(@9(}bWeCGR%~t-pY1k*VF|5!1Meb$0xi&mGPvW3`h+=K#a9?@KKm`PU z_PFIfFk+V4`3sM!x>up_@uzM4LUWV*VUIq8+|$cS!Q&DqGtYscm*c{t$MNKJE(1WY~%kLF`3@LYQUR+D+Z@};^cms<+Mn9tj#ryd-XR(9d@ zbU83~E6TqGQ)>@fQ{vF=-(_Rw z63qc*Mi31jixG*X& z+J7wXqai&oe0lI{STk9M`Bd^C)d%g|6zIWbJnNZqtlr+57@zm)ckgOnqb5 zo+MNA_6%>YtL|5pz@!c=%u60>t+40?2Xx%Y*_-jNsuJs~%#{ZA2wmg=PhDvsi@D>B zCd^9NdRrH2F?V3%3}`;&|Mz+>@sa&sU13idxYUO=Rh38| zz^>`KA~Qb#g=p8iDADoNHn4ZENz>J&UYZ~%KoSGVCnUx^?0kFIZp!&nYqZ}8^y;IB z*^0^1mEnt(vIl=Y*k)Ob^ZNd?`N1*F`std3(m1t7f_%P0>y0Aq3VbZQ{p!8iN!(CG zq!p}wfk+4@EdBEPH8$W>W{; z(sj0Xq1_-Qx9it~Sq)$xgUv*Zdn;fx{>@)T>)HTvc;P-`_5}I!cOjXDf=EgUgrU>8 zB%kOsFq%t-p%Onbrzq1<_@gU<&?Z?0=@+_5EQDMiB2orovmiEu=Jq~+%5~^A5F{s6 zN-Nr_`a>wUlJv&pfORNJgXP}P9oEdeP&R)1`d%-qOw8$N2qIp-c6l*q#UD4hSkzMn zA_jbQLoH|Blg9Q~ZHErKz{_`X5BHZaKwt=4Y)nk#NcNyc<(BIYQY>2np@>Drb*$-VEMzPMGTKq+H_+)2L24Z&?vNz#nfMS4(;7;8U0_K*tG3yI}RafS` zx|W49$a=!VZ^l(PL(<*D&G-BdD_}8u`V3>E-yQ2;g5XTlYliP$!s!`Nj!q9o**`%= z8S8Cd7v9sF8zi8vPA?35XaxUBu+Q5{_AidVg&wI#ry4&12Hpi0jf?^(c_W|n83X#= z7#H0%Kf15Q>@#upaq+56u%3h>aCiK?7!4WGDXXpcfZpuFU+#U3#lJgT{@5>>!uJ_u zHOiu~%za6-=f@z=t|f4@nt_{@ud;IGpF<~50Gu<>rWYqX-GH6nTFvrzg8L9fNg#q# zFRL=zf#AtoT1Pn4!Y!}#J?@jkyOaC*#X)Y0adD_U9lwTa{V{+{Vqjt&G(amu|a%=7qG9QJ=)2#53}| zG;)n}Tn+sx|GulGhmZCypyISWHGl{t;~qlii9Sn*ucLHQoNY2~@=ZO(6|D`EB}WYrj*{+?=&51eDRO zoD@tg=E=_MQLJD2ILueiL{WO^Qa9 zLBdq*w&0m9`FL9e(6DqxWdgGB;+XsE2{PmJkl1GZb*;_DPhwx` z)`VKBrT1k2WQ!Nk1i&g5FZRts^V!Hc94dKDz11!}qeaI5Yzv@mYt5fkPK%gC@YvtoLCXL_#w&eNM?;-4iIQlIDkBjK1_a-Q^od-M|MDT;0*ORXpRB zGaMs0GV<+c+>r0;(P<)>RzN_0#`Q#E=1V;U`7p_49(OY#C3J7D#(2pM&JMy0`N-w_ z+viIKDoEE(GlSuW*G4gBZ{5y^wcg_*OzfR$pgD*^m>vBg5uN^d#ZyC%ioi_+xT*~Q z4f}pE-7-6voGj4^rD;Kq{!(ltJQX88nHcDF7NZa=DH9)h-JVtoq__tpr=?BXj~Q!i z!YFK0A_mhN4ad47pfn?Ruil!#sb+%Y8+%~#71yD=SkGUa9QO{0hG%M)b{(xLf^^iN z5e3%$Fun?4#~7Fa*&rh)w;Wnn($xv&8i`@hc3&Jihw3BG`gn_er1CFMfhXA}G7Y;Ggn#xM7>snV%?Wn9ih+p+Vo|0PstdmTw znzNaaczMS38ImQJDIvFYaN1>6%DN%6lg+r&@1w#nNESladN$=^6)$c8NPr)fZoKs6 z48pFv7l#@*LGWBxsF=XB4@jQ8-Yz?|sMuFiZqkl7E}VbU7pB@1asDm<_6@Nk z_4ZG(97!y)je+PKT&{@qHG^u1`E7qwWkQb1+mWH3k$U|vhfPFe7OwmIUUiDSs~uH| zwz)4KRtfiUI|!lt+R065u6!entZfcTGsU~ZCk~)h7C#t?23*2g&Rt3qEpb+sSZHVg zdQ~ElorcoDHpbfI+)n^@k@*+9JUTu0@p;_s>-D9xe>{!+wJe0;F2v?)Pkw1kbeiOL z$x%>Ky~;RgTTH#msOEbt;yIff`$uf=vG}OCH6{TCS@GA!Sy$$*19l zGOPvMm#dU~Y$jo(Zxmauf7X<`NkdrISz)r_h?!wAU$6*+!kMxNOkyT4~gM$XzGHa^ScpeyWe^i9l`f6 z?V3;z+uA!f>P9N0?w$MAU36jM!Kr-p^K&Co~y8 zzYom>A)DN~Nv`iUBKPW?L*E1>E@kBGZGVC1gmJa@mo_g&FO@fm>It73_aMeN@vc!0 zYo`kOcR0 zZH-$EZ?%!~Nv3!~-FwV{-mK9YjwHBA&tceAE-H+lza7>*43J~YI@tUF2z$?HINSAoI7)&PHHa<|y+zb0 zgJ?kzEutqxkKW775D}edk!T}>7^3$sQ6oBo=soJ_qYN|izdg@>_TIn!et4IASw2{6 z*4)>1w&OU?^OWhxRt!+ho~VLtWyw(#rp4c3)=&IaT=L_>*FrDp*iR5P`E%_-KKXhm zZ2V$r@6m^CWKe&KXo_~l=GB#j1X$2<-pC{Wm9o2zWwRJJpR5Cce4`Vg8tXaP@MooV znz_SWEVWpI`H9GrSaROR#u0J_@;B@Dj}lYDD%DJ2^G|p!K>Az5;(3Y&MuS$e;H)wB zS1d9BbfW<1ZT1p_6W|czacO4Eo3zwNiw^%zJpcZq<^IBYvx$Sc2pv$=_jaK{^;H1A zX{u|46@QYqR6|(?k9Eh8VvUks9NzKAJ{XDXA&NL**H5igBapa1^VrqhFOaC~}oYkJ1_*L%DkBe6F`PMRr_)gR_& zV^`#HHqkj;T%)a+sLxR!p!iUHcpyHgHQ;BBkPs-OS2+Fa)45kSil#q#V{iFwM?!f* zuZV%TMsep#&~`O8$V-{~FgA7fq2YTl)1Eb>ECEZ%Vdkg0)u;LS_UAl3KW>6BM>oRv zS1U`5EFnD-RFM*j&Di>?we?BdmQp;=Lz`uwnRf323ah4(ht8H6GaS7_es16IoS5gE zjvY)HHb6@`? zU_;uVb-q2=+T=%?mtbQq+a&705}sSgYxOw|m$~M^Xlr{W-S2M(@~=CIj{3LVuoqo7 zxpZ5A8Y5a*1q;16oc|CSfjALxR*hqmkK5`v@z4L{Rpxz|V;S{fPvG z>&evMF37{va|3?(exwe@mAtw8>!dW*!Y|9>Vi$_AE1mPW5`sh`*@IM6RJ`!b(0n|2 z-+#yl*M{|(2SclvuW*Weh{vwd!+L%|AGi0FU~Q+BPP%<5pFAfVzKyPw2W1}k3aHyB z+rnG)6)i&zzpa@YB_qeX;vcX&OG>CQQskxLr6xdDR zkm1G5s^jJob#V@!Wn0}=jg(C*pH*-2b<^p*=kYQH1Ho!>Dnhem{cTjes+^A{Mr^N* zg@Mb99j9Iu3fhtsr&kC$RQ$)4d3jy9x3la2d#7!#IBR7{eXisF?vY)#439N z>L-N4LShn~YUIOR@g&0u*sW?UvNMOpP7=EPmkR7w)^aGYu#1^WJDnlK0;4CZf4bU8mcU5LJ=J@1 z=i8pjkPyrnc3Eo@!e6t~gk`BE!0bn>TW*bwV3w>MSHesxF@;!g9xh&A& zBg1VVH@HCW5T(HEm=FBzFOAf0@M!+TRP%4sR^S>CJ(x7JRyUmN5;Q?z-_M79;>%9~ zik|zM>6#c8-rD<```ZE*fAS&}OZ4JydDt9m_r*vCd2p>dTiU;8npV6*tnk-E4LAX0 zyupwpykK?>R5-f^S>{SYFGz6iDF1nn7z{lhD>96R+&Pg0<57|i1!d3aeJPj2WQIJ# zd7Otk{IgX03J|XOEbsvIrUw@-2v0;I_c(>mkXke=_A9Utyr)$VL|2*1VE24@qyT)d zZ7$yV)HT&oJY%YMmwh_#Qg6V}SDEb~nl?#`&aAR?aHznL>CW@ke227!<%Jto^a3_gzHg7qQg#27w4m>{5FYKreyy{l)r73we3Vq@97&&b z8an#TeGv=7AJH&K7#}5F&oofF#)IqDyH{)Njhf38s@t<#@^TbqqK|H|V~fQp?DSXO z6Mj+gwhkLJ-3`L7ST7xpA#_9Elgk-tKWn4%f1B*oNzBsKsR0$T4&vY1CFMOR`k{0m zR@!p$xG&=3mW_?!7k=eN=E0ABy`nmD>aH!2ptnp~Nco_3O2a}k<6lY3(2J0Yhn4mn z-V^#Kta7W6(pJpFOkP{4%UDBfhI1B)!xJhnM`;6wkvGL7SH=||T_o%gZjG;;4%eKX zD1v_cjM&X>%^bIj?yY@}n(}ywWb2O2V*y%-XXYVe(}LAvi=#5caL&zL4EoU&dJEc= zB$BFUbsL>?cipL{=vfYJb)8SmvEe@NPPCP~CKBI^@*ToQ`qBrvF8nYC;kRj)e!Rq> z<&Ec({3QH#0w=X*T>aYaJG&pmDK@(N_V0#g#>>+STMF(n%&htJsj-b@SlW&9=4Ywq z!$40ofN{iaM1!*UnMw?}yAE3C%{>7@&63Qo)$44Ty0&P0{<%;UG^xsNo%N0v`hBP{ zk^{Q!>4uKX$y>~o8@hKUF;mGZmSsQn@CoI2u#IV&`~hgW&-;rw_{J2 zyd~g>YPC*fP^PwduOx8($JW;is~eLyGxufla#_;Pe(q(rLHpR~(Z;`pKM-*x-#)Zk z2pl__v97?G0Nq>46H80?mL?S?ODvTdeW#L8;*&gS0{GpQ*5Q}}eYpRVQENq{aBP>^ zh^vlTN0YJaq1~_Y&kEwNEDfHNn?F&N<+ra7w(ocgc|>=-N-Y2wxKG`>ES>B__l@LJ z=#6O1@a-eyN|^GEc%@*N15Dm-Lhms}b>rVTi>?cP!5AqUqyVepSq3N{>HzV{?KzGor4)6w_J~!A@Gz+-tNR zDmTSvVyu(?^`9nVEED%NQ=syP2G9IR_7iuyVchD*^Pfn7IP=rG75~wt75yh0E1miK za|_dX&KtMDl`karM~D-&8#lbArSb)tBu56_fbdTXf2`J78?g9$$D@o$Fh;)73#Bn1 z$0B^#PDFZ#iR_V?_ZxDGiS^Wk1Vz9Lr4Z2tVS4Uhx|@AH4Zw?gFm4@A*5V*k+L#yS zJ3+vwalc-s$L)ShlDCD;%T+ys*6}+NmdEaQ=qUFHLx4~$^Hp9u5E9>iMa5!)ZcEI- z!N11O2Pd5OypTc4`)8#nnJymT_gsiuKAt%1bG-Wbg+OLXnp!n~MN#YXpBSqLMbhQ941GBH9Q`d_*x*Jki`8(2VMUI6odg%?tE0d5ij3EQ|Jo?G zH7J*4r?u9=KnC72dR(N(EodD&Zd~lpULkFe?9NUcdWAIk9;Kiz{`;>|hu+f_hL;Vu zpS-z3K>1%!JhlDI5pl!W0F*c{juSg5AEb7){F|;yZp!in(sc+yR&3Jp4upOA+JIu- z?dOxishy>VaSrzSQ5A^N%ujYzsclUk{;)!iUO89d9(n&M)w8#3g|OVBqtPfca5b~= z+b{%LfnPoD5T;C0tr}_<*M%)t^!+X{=NF-R65>Ab-M{n9fAI%FfbTB#Z40#sze75K z1XKX?_e7jJ%e1b$dpT=-=W&>(kp{#5N2XE^y7p?DA4{uxX@5fQu>~!FfKTlKf0Fi* zPJqyOEZfjqX1lJXP`rEUH^mTYk38QUv8Ir}bNkQA4NzC@MtDpf9aTtc{b|PUi5z%w^n1v-Bis z=I8x2O!3j)luv94hbhsMl_v6q!nDjY$$LEFy7DG(Tc}>3x-`GC8 z%S3epqZXE3+E2;XiG8dwjiWK-w@@#hu1d=3KIq{{K%Y@yo)?GO#nzSZrTBw0RhN2clBI z15A~CXfCmR9piauyE*;Mw7_jHyZPB?S$9HnNvpb;9KeBf^0du1dR=dvZ-qfaO6okM z_WRs2*qq(_^)>PV_3#6siK#DIL@K#(J{&i!{nMrH&?Hc>Kuoy8^B6_wFN zpI~J9DCVmcR^^&QY^^N25{%W{VY;SxN(i$yy$eG^RPl2a9{gL?k$*IcP1-XmH!wt6@A zRQZ#X{gXm64a$Mx-92rH>zJ-X$;Jz{LS%NhyZ+AxphvS)P!~3zQ|1S#KIuodKZ`yd zV7X&pb1KfULaYw>;XBGd0U!j`u(-k!Es^~laWeO%o7Ep-AbplO^p>-C^}fY(6)-Bz z{$#2&5@UO^PBme!qXVL?^G%;+D{0zv3^RLf@MB7cx`A%&ijE22nwsE zrp|Qi&E(fDTzycI(~-H#1r%6O;m{;+?=L}I$<2Xa;cl)W;?ZtMUg zy0D5ClDC^Ie$CTcayFlZ9|xZG?ow?0-A0fPVuQdb;w^36H7M zvqxT44<>$0mPgYNGN2oEtI3V@Ql78rX@m*5)6&90@>OMT?yG=59uZYQ7Qe`M-uy$e zK9uHe;ASs6Rx%NsR%5T^Jmnn~RkV8_YwA^5%`lI&7i2iDxbw7#=b^EjP=m_EibfrC~h^K8_4TA zy=zmUO6)|;NDj#?tZ98pHMvLFw+zQYE&L+in?v%L$4(P(4BklRhWw~}bto~ZFxI3V zTIL?ZR822~nyw<1xe_t{;slu#KWggw9@dZ9{<1do(|3-W)!`gT5R&j(To*dh0b4C{ z?ecWox?JuneEit5qmFmeY3(@}vOiXfY}B#D47S3)0MMNXPa%yiexm*c;#H2S!FbFG z46;v)-jWXnVPD69B7(>LWIVgP8a#e;Dmo0e%y^$Pd!00&jJ`cP+<5C5ZlAtSMwrD; zS%9$QQC*lhovb(bR5?p?rv6^}HFAeNE3*{NS3H=LtRb!`Cqt42GaeC6UiJ6{%bbYI z;W)1>P(=kSP1aZY`Rv@GHJ&eRLdnXs;=68Cy}~lK+E({@r6wMAeitP<-p#Runm#RX zR(+d1unk5grV-=+TTtE$Ln)^4#p zjiwVK)hanSXX2Ru;yEA#12G)lm2<;4=Ph}33%Dp*v37BqkqG3YjJuXijKdMGVbn{( z!J?N@H>p6WTJ+cN8~=hT{st_TlosO7S@WdfI$1RxdLt798-MI3i4+*8l9$*w4{z?t zCY{G@jII~<_H*ylA2%?qN9JdJiDi-;>H!C;zXnnonw#$OIc|Ulah+`lyUfajt~*q& z9z1Opn4!OYJ2~p)ByfiV*In6n_~!6=DzLVls`o-RT8?eH&R*{VaWbFR%?cU1vtpn5 z=;5GSC6|-ODWCu?&~F_7+C8D{`%yX;WnqI}dnlK!ex>${JFKE4Q|71Q%{GO7xq#WJZ(q@SLRAn~5lL7TG%zkudO?I2stR zOYYWA4K|J*b!z=cx4gjDB`KjyGAS90E?TU# zBy4PL^#)5a9nO!P1I#L&S|@$LYDK{ci8K)g$oblJxv68#mB9gZi<<$*`XhY0m9ONV zbxL=0OCgC?H5OV(0rA@PmU^`-aF8-sv-$?Sh4X2|O0dFx06h)SvXU6$&+S-RK>p^u zPRu91txoIYon2L=nw*%WqNW+OZjS@;-F{1QW8|#S=%e(F*Vrr6-`aHVMPqCeaaCl? z9Y2l3-zgZxIeN8(6vCt)KT)O41&U89hs1>2aqr56m&)JV=LC20w^Sb0*zNFFdHQTn zz11|-cvGg8-E);q-}X>c>sYku%3&P>KU)VwXik(IgmtnpNv5rYzh)+XGg+kjJJq<0 z1@J0bj7Sle@d=|+eCWf64?AvpJ9VzR!L!1RD=Hoq*nAs*9aR5X1-Yi=(7ijCM}wLv zS7J4HVs75RP#qoWEVpMQ*dy0PyfE3K8?&`)BY@O}@pitzXN%}Q;p{Xq2MyFzZGP8M zWsv_}!l>0vr;*qM>xMJvsYt3xQI=`3O)HKK?N+T4xQ?7_j+mh z(l(AUv*c?b;E{p?X!p1KJU|p~okZsQ()iK)*abVg{VQ65P-v)6Ux3L?M)zC;xsGf9 z$yOrhLK=uz^U~yY9y~I0OHTx<0^{^s+#2btQ8G~;;kp(;ypwSb--|+&R(Jk(9!$LA zd{J67;3z>Jh5#JYUE+JR=vrJ5H_CF~|EKOg?f>x{3hZ;l1ND0zn`6-ItQbNOqLcMn z%dc8Ym1yV4GQDE#1IGuypB{)+@pdXAFDFv3-xo=8uIu5C+1{FPRq*^He4Tm@2n+Kq zU}U`#leHJvoCfWG?7n=nA%M8tW0*5_M6+Z1=(J%ANvBgqpN*7D%9u`#m7S;lep ztDs@AiQ$e#xs?jSw!;SajA8oc}44*@VIKEYkGfBKrZXLLBv#{PR-}?!Tt!nVD=gm?2r5z zhhXceZY}a<3+n%~<+e_2-X-Sb?)QwflB`>AbOfR0B=Xs6y2c>iW%m1hza{pQnG*^P z9Ubmva6-KEWdh^!l;Uqp>)s}t+1V}Uvkl>%n8B1LBgDAb4844Qm1BP!v%H(-I|SRc zTN3q;|Mm{F|9FRBeIP|Sxjuzy7yNL<^5CRR=mVN4@1=^AhJkMDQ}y|0y1jPD>_TUu z+#)(9#AB4U-U9%$%Co|R(K%0z`vPxjexLJFe2SPc6H9LB5UBX6 zozWuL-we6dCFPP_*-$0@MTCV)Slm$4SlFj-xR{wj=+&#qMqlCmpWRI_XwlW=tN#=s zJ6kn~LE%l@S%<#Y4;6Y{lQc>~t&eWPoIu&q6kn*TCxdm!hbgiJ9g#7p(bkUm1@8FM z4{dSG1LZ_WM}9u36fOD&xeHuSehv`nac2FZptg>^0{Ap;{=tDrzD?7Fqv|OGkX%y5 zl$o-j3Hg^O@5TtV)!#D~JR8`RqF0RS zL@sP6ywY=B&%aHgYq^!5lUP`-99{#y#50}tC`jNFpk|-}lm`R2f^gGJWzbUb^BqXvHf&XK=J2K=sm;;b_k7mKClM2}(xAD@x1mbUy5hZNy z;#z5^l`}5@gR-{hHDU8OeipDbt81e&+HU;QP6S5J4{sS)b=W@7W83~6MYnd)EA(|z z)NcKU_PN_<_0NmSVAKpoz4yg1X4-h8(y;3bB{MgnwhC6x(*mB^3Zl<9;Kn)dOKxh$ zzHiZ7<)0w$Df(AY5Z_P4jNbz2rq>1+nW=4Ugp88MfdLl@;SnU+B0}2pA}{J)-UW8U z(M+q6B`>rkO}8U331;U?yZFTsYjN_Ebmwt|#n4?7GGKI&3u1)FUp*fnD8ShvUEOT%4@r*8(7ztRKqerozs+eBR<$}sN@N60c}LpWK~#3 zpd0$63VZC>@-bNrFi@0L$Ty@C9kw+{{Q>ZY zdW#|Q5uDhz_UXsIKYZygFIe#U3l@x8&f?Wi-6~+#*-vT>O>4WpBky1kz00YQxfvPE zHq7J#Tb*&^>pwYOvB?E&$IB<>{8?MuAR@Xns?@t(sagQD(i=N5e98tT4Xn}4=^ok$ z9mw^aXI0mc#o0e&PI+qC9N?V>3XEeWNMj;^!X%9bq-tGICQC<$2l4p8ClbF@HIWl{ z3T?kHA3DaCb*08=Gr6Am0TJ&8aYh8@(PWatbn@y`wrq-UPUDLK^nrfR<8G1-N)y} zUdokT?8<}$lsqcmBN3KmzH-j^Rkq|tZ;OKES495+2Y<6)3PEIE8*|}84OYs}?)@QC z#0TEp4A9m6^Mb*wd1#s-~+pQ8bJHt6@-aiHaCn}*Y z$9?fV1bY`p5BKFa!R7ns%q^ zleA^>TKNiZ$^@NK($drSdP}NcpJ4uFcllUU(a|Iy4cEPnuwZlD))o7^sMA%&sn&zu zx?IW6+G!Tm4B~f=2n`*rnryFOavOk3EXJ6U4T2W;D*W`Uz+u!@k9rN1n==;}ehJnJ zGCE-8P%YMF9@s|O<$Z$m(*^Nk%qTf_#j{0L$|C3kZ+6crv zpeV(x9O9|u?QYZ3jl3h1A6-(pu@N83bQCzqUmBkq6La$|!j&he=&b_rO@_NWK?lWzuLNio?Q>=B!RuaoG;zL?`37u6wef636#YTi} z1;4~4ZJ_wQ1knoJKd-Vru7q=U4nK^GdHJ72^pZaac|r3;Qzu_$H!!Af3{e0J80|uf zVTz3q*$WXZg0GBzLo6An^jX6|32O2OE>Q9zMy4G z%=??tf;=o=EUQ{ffm$nD=NH_W-%0PokagJkz~hUh)o-1<#la>LPPc`kHYENwrLZkn z=VwyxO&OG{U0yNrHZ$Rp#`ib`R4R}V1yHAalr*ldB3VLAYVjbNt5(eeReP}0?wA3D8-Tbl_~zrh6moq)3jLaQE8JFj%XPY0lY6S(I-K>* zU&z&N1TEzgkINHpaz3=5a2?d2I}TIV7Oa^pomBxg0Zm z3t715B&VynHu&Z0q3yy*|F|I)H(7aalYSNT zHS}BS7jU#%B#vFh{i&cf>KegM3_+nSP#Q*JJ{--SUiDx5G&W_fI;PWLL3(c9IWM*p z&wy+10w5%LJX*}$7aLn;)~6~95E?mzm4LbEf9+4M>}|yyM0bexnVJLBR%Y(}WU2Fa zm?|rQtW(J2VyW@EWg-ph7cDN!FoPE_6a>@W@A{=1=3N)Gtk(7kcATsFGVti%_ToiJXH*0P zCO;l!A_7X%yD!y|I_mkMPOUjuP5G}J=i_0_1eX8Sk^BwLG(FDNj0brQuW}r%+-83C zIA@qB!|`iL zI>X+QGq-OG&%tpi?WKS*1!f)Z%xZFbzhRO<2^aUq<EuP9CQ9ZQO1=3Nc9H7J!-ta#FhE9+xqh?FNl5Vwy5_Z zGAuFs%)S|(_`{ddP4#;e0@muu%kpBMfyE4;RGIX$G=eNyQ=Rsta~gq(oOlMLA|Vh` z0OSQ~CJ_r}1;s1y7Le@wx72S*;UK;cQ{p~=CkQp&_{lo_y>?ad*AKQGm&KDlcYxH7 zx|iXW%yW5x1}|pJbV#Ey#{GlvU$N)+tT z_A4^GfRdhReWj&Y0|oN^VO3~U3NnXmsE7rQKb4c6i6;73$Blhx9(NNw@Ih3Ii2@z^ z;sx(k=YTV`If>P8@6{tBaN~HtmL+pomIe*_1U0QD*YWeCET8B4!9}$2s7-sxha3x! z8~{ibzUqJMpA`o3TKv2S$#`Jw@jwG*B1?z%cNm59uCA^+q_3`37&;Ybq!fMy{4nLO z1pk+Wtl8h|5OMwcZOx<&tHQNZl5Gz|Ypgm(fsG@}cUK#ZmtvW?bT%eT$LYxSYAPOA6ngB85Rsp$DCno^#{%UZ?R6?oSxB88iuj60@pZP6mHc5N?m3lPeb>HyXIA zK2KXD#q)2I>n6)Ja#l4i9{Bq7?v4>+I!q5hyz<|Q7)1K?B-7K=4SzbZaL-WnO>vk=*X7|9e8O{_foMyEa(tRfh-P;*JBCha1Q_UuUu-UWs4j$PY+9#E_H1G z{{X3Qk9=Y4a3R6Rbv1VY9Cb>h7-9khI`oSO5<+&$r@;4-H*tH`6mPESKMl#xh}B2b zJ>d3J3j)mgzj$)WJ?4;at{42(E)%*s6Ua#Up%qxy=6sTKUQhs?p@X-Op-TXtjo7+& zL5kBTSy)oR@o=Yf)V^i>mrNNVu;o###Pc~eELEn+xf($Y#VXX>pSdW(RRHngjTy80IztL(m~BBEa$;ndE06g#3_;O?qU zjp=N>%%XEixnh}b=va$TJbACu}jkp_UGDl2rrS;<<*vGY2RnVTFR4dPo)ubWE?Jb3x| zA9(fCWcB=;#ug5M&+H+42jEW&WpA;Q$+gxZtIk>KXMre+_lYYn%=;nZWOmQS$wCoU z?G^@KRQcZ`cKLR4<^3w6F=hlEUZtl-bVPSIQ)BATE@wIhj1QDDBTZN+fdOH)b#c|8 zjpW2+WR$K9#Mql@ajqUmX55+^*s8Bt(y*`HtbMa}V<2${tSwkznEz@7Np_bxWd<_X z&Z&d*eI0oRD|Pok@IIEh#n=8MVNnuW{Q75@QL;f{MhfLwySK783$Kx0y*5+xc0Kt` z#sCN9RbVt4^UsGRN~#wv3eA*e^gXVKJncbRd+R_}M6 zg%AJ$Ur(DVKUtu@Tbf-GHSbdN>pTA%RRu&nb&fmL3^MDi=nXf*D{^{oN@_E*MxJg9 z+{Y#YhoLS!@y)g6+e%ZfYO+DGg{Z@?G5%K3T#mDnVjj=rN1IoGpWxa}g@EVniHE}S zI2R4CYccEoPn_nTrBoU>CVnzhsiAcXOa^N8>mF^Z z$6l%&Q=@Xw1k1;OCcud#%+!IYDrp=j(l)VGzJ|F98HIf7QO^Yu%r? zP&h8Gv+Gk?Sy>hbrTO^cwS+@nE{Pja)_=jZvclud*haOpI#bYN{cT3%_YzTbR4^sF zK+o2Of%9bV6~^P~OJ%h&5GfG>KXHdvthBcbh~prJcbPY^UxUB#o;D#hWd%swdHDTQ z)z*DGo+SY~divo)8%>90jCfVx+DGC(Z!0_XCm3Xtp^Q64Pcnm`kkD7TM&A*D`r(mW zduC~uN1F88~MbU@vT7zXLtlYIBE5Gbt$a@ zJT0*~lgAH~5Sm%hqi%_(xSeT^jmU1cTT_-zemUeU(t1F5;eN!ZzrVj&05VVvV4bOj z!`5?j2t^y*rPvxhR(~P4-~DO%)S~^*EPw;)tfV9kwT3^|(DQyHuQe33Jm^gv4Wk&0K2_^pIsTe>3N_aN9Jj(lVhm)XKTJZ(TwljXu5|(z=0PD zWVzJ;VRzt97G^X{zA(a3Z&R1r?lB(D@yErx9;0cR$PFJ-v%3poe4;q;Y2FnD;Yx(Z}jU zVE#vtIJ}`*LniKIAk5QOB-o`M_axKR2TNnOzZp@l{3IHwGLFI2Te;CrZpGp-~cc2Ya3gS+wy(q*tDQgAY*W#_h>DX zQI%9W?lcs0vhjr^Qe6Pye@J(5zGL2KkD3xkmVg5bpBFdG9B*)2uSfBR_xj`xNid1< z5McL4l^Npg)-&atKCYV@JUPK(T`~KpB2p^YC0aN+xPBBu)V9NSttxkvfAkIhfmvQb~l=R=dMr9YfQf!BByIH^KIAaz}5rCrxtj!lc#dy&*%>& zl7eb`?l-)cV0ReTj`bM26md^@z{=DKe7@w5O!1Vqc-+xS$7tG@U6gdz zUsOap9QQGJm;z$OzA56I$@u{dQ-|MuR@O6Qzzh17pZCjao5mY^E)0qYO#5&pka#Nd zcS^u93u0GH>1cjnz(-hRVjkh(DGmO46?2w408_g0r+=i? z`YQ3gyMQguX7>ICLNYS+EC$sI1MA*YuIbL-<58~E0;)#m*JQ0kudyAxR!=aI`X3Wk z?vKN9rJnRZ-&aKoOBwm3jgOQxzhH!P+K7Rt3;>1d**v}Fmm9(@%53+QZ~PWssXO0k ziH6{MO!8H}3HzLK&eG%0-%s5j$YR1)g)xmty!rWctCT^A=~^`^4I%HaGWmCJMgHj_0-MW=uoaf4}UH-lgy3kN; zz3ThIwW&v!z6|K|lAq&TXg*XLKe6~MrA2igoWD}W_D>0@aE~UU8sMk-fue39TYI$c zlg#J+mtmi~uNf{mtAvFeo$ns5Umw2f12jiefZ;Zks?7IOpG@EF*cKDpNZs&oQ$u}{ zeeh~`$GocaE9|*4nAM=#Kk1rc_p`q!@9WZKVZyedBrkr`>H>b`7a-nhy{SNY?f=wr zY?M!EMs_n#=v~dm|e<; zJHo9ik9mn5-Ook=a3aZLZ-x2G+va_#w0DEpSnZ98={vclPSlbV#QvMXEf^n>!=^Wf zOJuTDVWUlUCoTcYXrtA4Y)+DIJ|-oU$qu%`+^IxQM{L^TbdrCZTX>GGBEML3TZ@f) z$Kj8EN_M=~?z~h(5XIK*1PtqJlxIWqo4~bC4$&O%N8w@JBuWdYCIrUQ+<$D$Km^?Ek?Ud+_P!wG-A?5ca4mL7}# zV!i{eQzeS9%C)}yOR+@QT9y`|h$snvgle}L=eqNE9f*#3*{M&=z8P33#mvc-1_yB~ z^gY*!2jSjjeE9W=z2z(ZcwS6_`smL2-NTjVNnBbV z!1mA!e`@dBL?q3;J6nUY=v*I-hmFVS&J(^J*Gca`0-85)rB^7?Sj+bo0|d%oICcKj z*Fm2aNqYT+UA~gQAx)Z+?t`ven~lb>%pv6fBof|FQqhuD%k~)c1T$PBpKzcUfFwp8 zMAjfmwar()$ZCki&(-^nvQ<6ldpLN@)I~_(i!Uup^QH2j*Uz@f+o?TkfM?TEe#wy` z-?l%^YjeXc!Z>Myq}husFxZ;O|6}c3^ZB#>wCaxaPs^be*9wl8;})ASM|rmW+LRn_ zuJFmqPM+Uz(S{l~DGKTD!aINZ)1A^N1Y7nii>#TJ(~4opyl)xxKr@3~Pim6wei;k# zg|-6c=5#Ztv7c~5mnM#j?I*@@970;nzoAx%Qx2sV$@xkOTFBwbCRf1{u!$3R^K4R_ zBFGR*&3aIvLF}978@c3ZH_Y*_4u8j$u-;VR$`)&4k^1JmO8fKQwZ8EgpSOW>nu=NQ zz`VG|Zc>hB@IcQkH`wo*gaAM%40A4gMC_)VhpFD!7=H2&PYl~Lt14c|Ng&0OffnoS zO@F9yP~m8T+B}DA-o~rmyWl>3w+45<$`-49I;gxn`n-=4I))A*qm}CRwA0Edw}di+ z4(V#R7}=~p<_K;w#XH+H10^Q1))i{f9ANmuVdj^J6-)RzyZ7#JQk~_nvdFZM&d@9G zMdQHpTX)zoRJ4&e&BNT&L2PM}5Fn6-XUh1zh%M<}CIe}MRt==@+m^!~SvM4mZIMv% z3)}|=3ESR~bfKsnsHClRo-8tW7IvMMI5er??VV?#=US+_>Td=aFPtNCDN;wpJp8*W zS~EwztmN&8o45ed5Zh}^c6FCFPNxb`rN#v90znSFIi53S^^9=`9{@D93I0ABE%v?n zmHRe9Q2eqlW$V){1IGpCF-YM9Ve@m*hYu0a+u<`GxO6fUWJBob0659_Qp3=04x3f~ zQk}!)8Nj}2`i&!EH71x|1^WUw=a11-dk+qaVlXg|dD;_8{m820OH-2>pMca-L!Zs_ zK9_tFcngF7oA_h}DP8Dc*PBAU>cR`~>e`APE+J?*!stU;t8nAZSzL1f<}# zC4iS6)={yBI{X2p|^I=fq}j{#bs z0@x`r&${uVqBe+H1(?;-7{X^*QWW7XYrmT%cQl#L#x@@;PWgn8P*oR-Zvl%P_YQj< ztq<3&$PVvXCOj5j9&J#v+nn^xhMY3cbm{sWGyXdtEuwJ)+I)aR%X&H_VAPYv8iBDD zCz{St{LZtvw)SUK64okwe#qT>SZS>bp#o`T-EFp75>!c zK3Ln?_BpNNOi}%5vk@Ifk4rug{BAsSH!?uJ+VpYcULc?gtwpwXha=dsZq&S0sGxd4 zgXXuh)ot&(xG?*CygkX81v`VJMW1h!Ur!`G(dYMOsc50qn2WMD8d*cy?H?YJ39jsd zC$u4ux#%@JrE;#`-PsQ|rr#EFx~~3@cZq+*7J>QmhLZ47Nbo4M&~R8P+7NyjxS{cA=a1tauC>Ms)^RH(BKj8 zg??j7=QeKjqYj|bb|Jgl!UCLgD?6Sv7Q4wIeUEEi^W&ObHyrZ5PGP*nG@j4kXLd%0 zQgYy_o0$r@c9ckWeqivrJBktjJY6TNLJB7koDfS|ULCU!2Vt*o>*&s-=2KZLm?bAi zh>Yi5Zbe!KH70`ctKfI`zCK4uA3)O5Q#p3?_iv+r-P2{g!)JOOzV7~A(q;XS56THA%DAfUFg5w@G=`PJaEh=?Aaw+U8eE5+@`2nQX(Rpe=oR@Ys z2DrU?2!H|rPKx;-i=ZCv{bg1GcqNFjIPqcvC2)Xh2XRAnrOW)A-I$Y|7f2l~%^Zys zQC_*`w=099;I+#FIE{Tzg4ae&}dtE=z*R*G#VBEm&wtbE0U#u>YuU?#%s5uk!e zuAssXES1+`&nwdNUq7XI4Q{Nyf4rah1e2jrG8l9?v6HW&5+olBd+{lzRamCFlMJ|+ zKBVd0VF=fOYj@c{JiT;g2L%OIJ}8Z3E*xl8-Xl5+SY!~tH1=U_1+r-Sh|4s9eXG$p z9q#!iKM@4W-16Kz^nCTWRt+$iH?6*V<(djCZ2#+z=F12&MTlhO$UxsCSs;I=q8^dK7AgAP)Y z0<-)bwkNC+3Qu2V3Jea$sbG_n4<5gLl5?=CZ?niMC`31O9q}Tl%i3K=4nl)Ae!4zX z&&~3?Hk@t{MjLRuNza>ILMpD^(la=itdqzff z%1n|y&p`{>JM$DmS=m{KQVAh@J4MJm8OJyr?$=wN>ht;D-|N0V_wSGUy3W<5Gv4pl zb3dNr^?F_KHX^(e zhO?@(zDSa*W=Yrl-($*8!B7|P|9HB5dVi5vu8%L7KUYt!={e}z#XANnt)JG1C6c1R z6hv?^cz*ita8YjEw9Y1t76tL5tBq(=>|aETo+gQAxxv6a?u81b4*0#HQd3p)OLpd^ zufonlS4MJ;@6J|i*##jsZ%miH!)?ugW7tSCe6#vovk~d!mIZh4A1ZH-*_$;6+Q{~N z9k+x0lS8Sg=?5!PU1QL2YcyE{qb-virwqOw18DfpmG{D+PiI8d_mo;QOn&F&=(o)a6SUM#zzQ#@SY@&o_zO1h(bMey;6V7QJ)M@fnpXW zlcdB_Cp-x9m{HR|_$Jzw&`kR&RW1cHLx$_ z=jFBaup5%C$lMKk5+@gxER>}c;O&y4U%Zqr&G~j5>?A}pl!ONwe#A}kSOOmKoDj+< z%0{JVkvM_I-48lI9)hoIJD;{3vDcxXb%Y%rMI`^HAKxquzA$LY!U^T21*BjHj z3f^)B^M!azM20`u!DLrkGEVaP@?2JLPNtk!gB5|@a=zL-O>HuTelFf{9yesxCoq&_ zZ)_x8W^O%N;UQCORd$hIC%Ug{h({z+NC}(-Yirl^iljw#2>ir{!A&U(%rxyq(8L3h znuU0R3ot41O45L+Jq1vfVA5<0aC%V0bRZIv3;t0!4*842*PaIW7}jy>1xSN`KzrUN z`KWVA|I`P;x0Wb^3tU6bQYym(8Yt+Xj|>5&h2OW?PJ*Adlf3{lvOh?`PxraGjCdQ_ z7i#7|KYSg8iQlOJ<;|lu2@}~~YPW`SrIv@QQ;mgA`&Jrno(Q;j+cOjJ2t0a+Hgg6!C!8N<9_7{>Y$M_BZ~}e_MmCESB!Lki#J=OD7y(wVTk9) zHDHJ(ystfwD8G2_d4L}ap^UW3wgD*!023dZI&Sr5j3{KVhp%lUxaUC%i#sHvQ{YmK z`sC`w{}8Su2hblzsW9B8FUzGrDzK_{P8lAQNNqp{et8-arM~VHPvsjJpyqq&LtI1gu>nNmD2cr-)d*Bzzvb_RuEblc39x zRsP3|Sxa>V1y@SO+-|opo};s5`?(XYody7+F5(AjAmS_frph=|&CJaln-ThcgHx5t zw2^i1J-;JYpj#4nv3YAnKif`L~mRlxjdqYqCVwKj*4@K&c7MsQ>ST_`$sY^qLtB*xvcf zCSkT8XluKaXY6cu>V-rBnG%=J(c4qJfIk#i0i##G;W%$0dM`S$yi3dVR}cus&P*xc z+mrVMZ^dF;L>|w8hliKtX1<=gSA;=~DE0av-LkWeWFxYZ`PYa6VUXfXE6S~Qk(r|L zA`f#h@;5UMVG~3gvlMVPdeQExf`I?yTz~@j2g!fVu)c=ORj!T#yS%D&8}hPOfUrxm zr(-T2njcizZ)O4<+0Dr?d=Z&n!1S#mnPuLCQQBuw&8ToF7glc45%g@Qd~y8IN(`n4 z+ygpz$&BVSfSbgZ>m6N25_J}b_(eO@&&IGV1sA!t^PD{b3{Fu>swM3&d?vtmjLHCV-@>rT2GWgO01v)IPf?c z_V$p-SWWQDAmE^Y+8R6;vC2low%$_g)zi_*K^+bKSj7KCG>V)_n&OhV?)ca%lD8iU zz;^+$1}cxMz!ZVf8(J3BIRR_gl+C5ll27KJRmjUx@k!|+6xfN}^uX55grcA~b}cWe zVCSZI_YRlBp4V37`Q`lpe8}StOs4>R5Rhi42TQ&W@!{2#zzlX+ z8_sFUbSK+}tzcSX;$9dn4NdO@H}vOH(L5rTm?2u=omgYmA%JrDVu#c$+^qZ~Eorbq z5pe7=;%*rL8UeC@y|T3+1<3lB3IMXcZ>46j8&df3rWz1!5|KzX4+mXCyYLL@*X{RN zKU4mt*BM|tv91tBgEeH^d)mm2#^-^=mP^cw<~PnRt3!vKpJ`o>C_32oDAf>#RlY-P z&wAioW`&-mPp>h=BP?EVjcb5mYKu75%K)vqv4cWy^bhKdenc$xs)51xtWabguTf!Y z^4r{1bWf$mv`))SN&*eo*+e&TNQB24ACL2zsE{zojO{k_5iG56Ze|rkPw#yCM}lv+F>1Zuk7q=9rBe zQ@&uyW16>1)ISxVIQ)45y3&tsDyU&;q$(4D2xp!s0W+W6M>=U^qxpC4f9TJH)B5dY zTqbea&v=pC^-#SBTA)9_TkbT`9`hm^|D}mL$K5XV`(ql>jduYm{h_&~v}DGt5b;XE z!witnP6Ab+yMA5#7Ey!XB2s?a;)0}OK^B@}torkZrKKp*D!hm-HTzX+}9vof!SKQI=U7$JP6#B$=w7s|DfcZvuWTu(7 zb1^@I^cMTd=}#RXpgDHr-R7%j(LDq75fl?%NWVAepCfW&3;H2#{b2is;b699Ly?uX z5(obMx`V#HzKvoAW&(mq>_%1m8wWA4nwVoM z^hY5!5dt>laK2V)?kL~4#=sve47zexbj9yGcf)vw%&VRB*zTaNs;zYu9z4^b8(Ku) ztRmEa8Rxn&{!t!?>*uu?{6ILndmk`EqG0ODAI$+Ap^$-;r|e%V4}9|-@R|--fIz=-9k#ltD2Y3GM|z%q?Be8qhWTtdf1wvFP?u?fRVnD0Sufu9Pt(>yxPGD7v`YJcF@i=NSN1g0 z<1bACfL#<=beje4qYQ8%VvrO#b?E=O5BP>2unn_*VDqE528 z%#xK@SH$tL>0z$*SwWK)mW9jxHHL4dSQb3q-V;1~+|-&Hv%bFWxbi8yUDnA>%Ao7n z{k3c(L&Jh`l8_b1$upYMODQy;E=QRt!_{%y1Fs>dL1*Zu4LJdTzF?+W^4>d}FN>I> z6}l1mpKEC?S?+5dn#eXE*#8h3vCw`=9anPwz2YBO!yE=c0W&?=?gOMA4G8y%B$xT^ zSt0%ea{>0&n4J8VgohS%&zG?+`Yeja@;Vqj!#XGTB1!6g3}tXR0L&NC!aEYc6u(@>;kVvBgq*?fzjOv*`F*x3gL9H_67o3HYZo0ZFvxp0i^(XW z1lZwMb<0lv^q266{DN+>lXbqgC$tMq_)ls|K-OOwxN0$4;T&+~$tH0;O7*Qd5yiyH%mvrETx%CZx z9-e0=`*=xEdS~Oj20$T^sP3UOf0}VTAj*&kGWalZz=EEyVL89G9{NL}0TQnoBhYQD zuv3s0@B)K3^4y~Y{aL1&2Zlfywjs|Dl$gMq1nO~8mUiGIz}>W;F;T2jGuGjR20HO- z(NX3@m7W8e4?I}!3$h+FZ8F1}dETf&85$a@SL8>ZPG?$HdLJScO5QuQQ(?RJDy~d8 z54f<_Gd{h@Ple?OSrwqz8V4138NmI9D5r_QYBT_9M^MpJlawzQnI4Rq@2d)!)%1}; zNAOkJzOlg9r}M>bOyow~{GF@>D>wlPv_#)P?E#9rU?(Sv`qs~S=x;pGa2dSYSPn9@ ze-jcLfR8dSD00oHH1lxq;r*2npf>6Kp0ndiW5=@W*x{1IRAl|d%|uNN044h$K_FioAg7!-X@kdFs2 zl7GhTixABJQ!xZpN=FvKe^|3GNa5fCc7*>fSt||0WvC`&7cV(#^DnH&ry3>IZAz<@ z=mA8xcXA6BZBpg018=(P_DVn=C@kc;*Fi~zj@m*vhYGvo^JrYmXOO+UyF>ig%?T3l zjoqiQRAS*)@z|RJP{8`Ex!iLbfGx*2%%(upC=hkgDesdh!lP@7f)-LQ&sSD-4Vacd z=Yk;)PW?BX4o(B)h%^1F%28m8x{Oud&P#35CLKLH4^Vs@ z)jNPYe<4+h^MHW3)s{)T;fbZW@j;_2=*g{FzS8gZ7x1HAiA=)o-PWeX{p=gm1D`u-v9 z3sfRnDSICW0&hIP==g8EuHVl7Nlz4*R}X`1-oFd78|4Mvc#lPKM^+X5UW3Jdk|n^w z7$*yj)#OKTIZ@HNnxeTEV(_@DX)?}c{UeuqW26n}KeK`romFJH05SL)1pW!xmEAHG zitONp+53|d_21t+FotXHv&^dzvyuNTo=}2BfJs=1{xGv*2Nx;$+hHw0aEJA}E` zsDD%T;$JB2jk*Y>qELFN0~!rv)T~m_dX9)KO&t&M?ZB1TE(|NO%-3tswhBVLD<@?E z=^_D95m;RDCU(yfi!hI^*`=N*b#Wyv^Ehy8|MqGJy85I8AClFe>*u z0Z>;3>ad(7{qI)G0?K#H{04t%&}C5Buu)=%%v~n+mJF4IUYfe_>-wQnaLl2^~ z)E5+={zaNX1`-$&n>cVGh@%W(|LEU2${V5#40H2>f`D07j%I3Vys4X;@bXAwLY~e! zwOXlAiv{?YwfX$NpJDY{dX`~T};3pueE>M8;S)Nd|K@p7nsSWKA8T-AW(;8^( zt$WnhAQuY8#}2oYoB$#)4}QQc%oR%tM1X%{LYG1D$GZ4|O+!q8z@S1Z_-;x#Ddle{ z0R7S22i_gy18wMkQ@vDzO54|R!B3z-5DM=7_JKM%Fkl~oQ}yp21S9PLn}lDmN`|Wd zRS~$SBnCuE+bavI z&RMMjxb`oKI#i(CL;jW($Y77u=N&_k>;hHD2`L$p2uxXlnXV0a86s$r;%671nKXNd3CVe0BQuzU`*08%U!Z zBtbJWX8p~f15nlk2ShNf;OL#qSVv%~5ZUo*_u(C^UsUvA$xS|&mKn}(((u|}!CnyO z5f_MZCuhk1IeVk@{{4G9VIPk1y z0!DM(4%%BVTBV)JZ3f6wrqxvo4?t(hJd6^wJP3#q|2~?tFNj3C1xeiVbUzSTVOqx8 zs>h_*!RzBun|m3Yqe1Q-?(fj~NCx!H@rJpT0)E zoWK7c&Ff!796$7_uY_jrzwY1~1=a2pkVSaGl@A3u%yRtb_3V)~`!RMBn!;hGB20O+pxjlKJi&pq6Hd!Q`DsLJX}PTqa&Vq2tp_ zrKogq+NRR>%77tnY32)EYwkN+Nl&(fyj*w~7VPmn@apm!b|o;~m15Zyb_CK(V=~b9 zP7%v0N_z%lFtx9nn2x4{ft*6GcN(%a+rIjPHGK1;-TVlI{IiE(HfXf1 zyE|ZY?{XhdiJWDnD*zxW^^ZL$n}sI9(NFl0xubd*;9A1Y_z0 zvjrBo{QVUBO@`Edf^}$a=Ae21=thePlYx!Rv&_rN0(Y{}O{~OrAM#bk$SJUF4<8f5%R^KB#s^!l>BlzTi3U;;c`ZGS$7?uJV1*WOW7= zDV(W32xFBdyYCEUa!LiyB$%|`498+R$_kJyg0WSLgE_}(M7X);Vksg{w;J{P$jD{Z zZ$3-#-|Sg@H`tl(GTT+l5+(2G1j0uFd=v-vd0^V_BY0-AZue& zEP_&V1>3`c9sP3EPP4WBtP~;py|dlj;1`+WLab~#lXUapOiV&;I54im$%RBN_Mei4 z%{>N3oT%Ttqq}#kP6-}u4L3$g1#-9Z$!QW<3Hvo=Q)6rYDuB2 zhU!?smW0n3E)SMkX@~}$cip!n_7;Hs?i3YxZI>?_xJ?jR?mz+L; z$(>x=G8hDc=()Zq_e<2v*K=eu>A7r+=Z5AMbiYMae@d52GUhjZ3V+WmN zqU3c*dx~BU-`I+!jMGdnv8V6Bo%X((8^lEIoL9uUqU?U=}MbB*`mRO^4@fU<31_Ox#8){rcDRV($Z9 z-l<)aJ^S$}6~7nG+IP8osXwu8q(d_)mwBc@_D(=5$#or^j=Jvg=v*Y1&K|ry=-XKu z+T*4$Jy{r&8={6XmF@8pt+b~%17RrLQ4clwuue6k+$a|8*1iR+=kblLJN)(cbwOn-g+-$x$ZQox)kURekf&lhlE zKc~4aGhgdR>%juCaTHOC^S!a^a zhYdCffjK!%O+OaJTrxK~BN16M3;t&`5#7H0W$JpZf^r4srAJmjGIpgB5qV>VRbhea zFFrYGYCcY6d2Mw<4;g)yDXAR63f$%yH+}?0U2lYFif2(KX+z4S0Jcz0jQkFmQ)>VC zF9N~t>!B=U2N*g;1kX0<`Mu(kg^_%p+Ak@wEBivNX9@#DKyB~u#ne5xcR4QWI^#2R zGgqSe51$`ovy`|~flA>-K_tlk@;3beIT&s|QFMr+*?*0jlK#&e;;(_xcT@VZ$zUo= zrM*8=Z;?Fng#$VS_tk;aiC-oFnvD60A_t+7m(G&z?`XO&j6(94yO>nL*3?R??JzRJ zOQb~<)Hy<#Fg1AzkD&dZA#Ch=`W5|vu+WW7E^nOzSr*Y%u2-&GchZEh4x=>zYJ1f8 z&jf?g*=j77EpEfb_LRON^DO}9)lPAcAEsfpoC`-!k#2`5fDB)q0}i{Za^Y_!^Egl@ z*ZbD1G6^um4Gl0J2uq%Ctp)%2^I{$$Q#S9{^UR{aQa3(`gMs|>8WkAj+udAwj%nIv zPR?(w%~p7tc{d2$^#~{_KoRX;Ftt9@mj(^y3Qh3~lHciHn$|~4fHN(3lAF_Lw7w6` zCj_SNt5cDK+_-UYSuZ!53;VQ)*N9;$%2I*(N%QDHhtpTrJ{}<WoOa@O^4zH8 zK-rUsW4uzu`Q_Dmd82|vMV=Xh4L0HaX7@myv3q(H*9jl0otO_kXXLt=7ggzszN2vD z2%0+VA(RSk4X`_jg4Dz*g7G|9@7)lPMA1H-iWTOfH~~mQe2Spq`ukaQP?AQ>M}8cX zsvZD=bJ;v&>-ec-KmR3zN?eUo5B^16*j6G549ey_($RhTQry|Ve@86ay%j!u*V#KJ zW;Jm{XR zRd6<%AlVOMYHqwsNydGeFZ#3~`8oYF>cPxj^I~<`8cZ7L-p>p33WeL)yV7*?`!tp{ zMHA|7nWTkZDs)Q7(@oEvf9G_8T5YPA_jR!96^b*wv>~J+5yx5GLkh=RmkxGT_GQsu zWt%XvsPzeSS6xQyqyrL;m=nabO&*{pDY%ota?18^(v_dDYzejO9+qG@_|c)B(ujp zEQ-lR$2aj#FFd2bwhk=L+OQCWM3ONtIGlX4;K6bDIdYNjn>}=^!@DwjfUBjl%^sr& zZkA*TE`aG;iN%opUJmo;aw2fdZ=;zq-nN1J6nLLG65R4!ru#Q=IKi}Bk0zYhMwTB5rkAN1ljwzEylUeW=-upw(V$oUg11`v=3~+pCM6NtgRsq485hl|{;*16hZJC2 zOlHpwumUMSqQqRlGo#;h0d9tA0oDn=(3JWgtzCy1+;qE7ZcX!`n-zIbH&Zy%yJG_8 zG8prhe*AdVfY>ln6O$IdE3)Q)T;ZuHSd2tR`cnpqUNp2Io!IIgZ@;OwpjbAw&HP?_Uaf09O;CuSiW&7e62%dJJ*tq|eH6pxW0h zD1IbhjRgIj?_MEi7#4EPk`&~c47B9b{VsCPpx)wQK(u!HreLbyS9;-P$^Tem>?vSg zw_h6od%w63Bp%b`(?tzQ@Go<&JPSUz#ZZG01tCr7eNr}1d{)h;_xs~ANWfSAV#Jxt zKxF4u#%aI>nqRX#E#Gg@Dvjmq)I?@x(!BU6zxR2hLPSJ*s_58DCDgf!f}Dyz`;IZ! zM!R>}Iptri8RM=VNOeKP=g9?l z)2;0JNb*Ru=j#DWhUfKPI~j6bR50Fp@3W=I4OB>IR4yhNE5jN6(XsV>Ty;;{hfKNM z>dMpuFWo21moGa+WuQ437%+h{9gg)c^lZO-=GRuXXg?VE`fbr0kHfT~@MF#k(|@?9 z@N|dl499|xmtL}|hhWKk%6VCj5A%Axs3?2gQIZ_I=2ic^RM$BlR7#cJQvWq%JVGyp zN5I^x;$(xLlK1kk#kGonJl&+7by{}RLEL^zuPZ{Gf;$c9M2~Cm?%%|u@KhLh-L~x{ z#eVD8zNz6HONnr}Os3>hTfHX@o{g&_W7YBrd-fJbj*wQKIl@Pl{KLV4~+t-&sI?>!5yfhym+#`PGk%BR>qzYE8#=pBSC?Yw!6JpZ* zLO!Jil=0Wu*Un$Z#F9~Ssa9`qm)%^$^_bW$&Yp6|^()x=K~9kD49kKumnr70v)$~& zilb!>Hp+O*u^P#2>+8=lL@Os~JL|Ot>$XMIlup(+>TbC8du}oeH<_o^w)D#1_gN>L0{+oDJJ2;#dwHsk*7vM|{0g1mB%vQP)gVuS0&zAG;UVLZa1| zpQ{)cq5Y*!SMZh7#OQ+Px5o8>CWJzXsXN@V20!W3WQR-IFDh}aB_(tMo<}c&9Sbq? zSG;|C4wC%q6d-wc-*VSw7q~xs7O%}a58G~0OHiceD_#}Z+KZ{5dEuqk?gM2EXSpW|euS zwy@CLJ8j!C)A4DT=OT$bH*$B6cCoJNF>WjHYYfHaVs@*F69@r%37lTw9>oA=G!0C0 zcOM1L=BWnR_jcr*PP*WUvzC0AG~t#aM=>ML)Pol1zE`F?{rtyy^E-=N!7lz`PkH*} z`$A3ZuBXxllr<>0g+o}C;d~F(Y-DgR<360Q2=ADXKP7E-os;(Sfib%V?~=0v`q};6 zc#GtK5sr=_NzsUv$1wFR5}<*T3g zv%tdd*y68!<4&Xj3Q+XXz;%)cu~>uRo=EVwwY42K8I-7QjEp32d(g%^aXO+hCTzbu z?-Ks*pxDcMh$|fdz9O+2ggxtX(FzeGSVj*2IU4eZGq4VQ!dB?czUe^w3|#Yx2I4a4yFOUie-e zFjxIHt=6VvU6)CJT!UVG_;xbcy`UGaH5NVf3WNLKS$3$Y`*rUr=mT4eVC{xO!ReQ3 z#F7J&Z0XZ2`)lA={B*Rhxi);_p>8b*_f55J3QByWPzZEM=zy*hoJ&qzm|WbzW6Zy_ z=^#Nc?liPCB)%(Pdnf=5g1bR%*hB z>qUI{Rw91Fo@3IoaQ(r4_J@(s(}>1o9;kk zIf6pOn1B{5jF5WjWwBCo>BgV1?@TIbo5*g(1^poDKG|NVhOoDNPU*KifN-$up=84( zFkkT|1luXR2j?Z19xr*8FIOCC-F%%@T=HPh!TwyQ%zRLje<#sVaA*kml4F0;c;&QF z!m%>vivbyn-~q}qKen4CP@L#Job`v7R`*{SEj3}fF*KG^QEytW4Ra^5fEAwnYT$K; zNbreYS>VRdem&c~Og3s~mVxp7OZ8p*pm!q@W~jLBu~F41N7uSL(yGsMawaG@)zs9U z>qviFu6aa%B*=F7Tg+prAy^De9Iu^TpG32fak)0EAxVbs}GmXd6aiNtYuPFW+#fHS3u7;yrWeX#IDZSl+MQ^`0TrFnX~;kGRxeg(esP*`FfG zTs+el=A?H6om`3wO3UFH@2khr7xAH|+vemCRBXZNNyo7L5Qea8+}%p;@mOO7Guyuw8%D znjvz6RwyBr_S4zMJFSB{A@NPF552NHeMUKGu;QcvAhLbLd6mzVZva;2x5lSEW_$Gm zT^gJ2y03FyoEi+OV?N^Qyx8GMn|yPskD?k}bN70BDChEvC&F-?PEz$#0G-d=N3ij;aKFHz0{Gr{=Q?*<{l?g7R*G1rW zY8o&zv72s<+50b_V=nFGvo7Z2l?sG}fr`KT`1)@O0bsTYz(OO7+?xG9TSH6Y+569q z?grAWWIp-Ku$ZW_bb3_;RT`22EL9r_M_5tZtqka_)~EIj95q+%`&G%AKEdhe5bR(v z^}=`bjE!hlb^_z#llQqLZMsV9g+3ES0@u>7bV^eXc>p$NNo}r`AtzDB8@V* zRxk-P&Uf6-j< zkim&bF+7-+bCUCG!$pzH-l~toCK0|+2gIrL&P_T|`gWI(eQU%tcB*fyHgC1#HizRj z_*k2gh3impST*Ogr}t3mD!nG*O{{Z1hTj6&)@o`}nHyw`~ zcch=q0GUdSB+0)>8jvr0CC}pukD`}gU08(2VdqWarw^qQ*Xh>lIh13PH>!%IKjic_O3c50thtjmP7Thn zssASW%p(V!IeN4lWx!0M0W4V^Hx7o~9lgO)I`yW_CY1IY^R#Xz!E6Dens_HoGW;QBW zI35vI;Og%&x)G#0=<4iDOM{gemHA|>f^SDX-o@QqKTSW(fj*ckwcYbHJpDIItU5rBc@%V=All7RPqTYd~FPi~wYxWIVf z<@pG=*5=VQKkZ0*lis0ABbYM`TB8kLg~zlVoYyxLID(S!6E`))A6}JIzuZ4$f6esZ zMP#Px}d zV5C%d<&AjfknXEum?`aWTNN&EEb~@Fd41N#F$af{o)p7gKkClIb&K@DVy~<> z_?Y?}0|)AfvVkCDy)AL<%8<;D*ZCNg+JkOPacyxs&Ig}zz)3d<;|cl^;4|>ejUa>{ zDl%!L)UC6=!oiu6pAR(!X`^b&_Y2}Sjd~>vP;84$Z1d)+L56e%Z&4$X_fQqZ>Nx)* z=mR=8Ydg4F?@;mMy;%qFh`N-Z{Woy46J&qF;8S*@wKLeN?v@g6DiXa!TgLoo|Mu7S z^EPm=j10tJ>fS>Q9=QBZ$A!`*IIrTdGHw}TutE!2l_J;)CzQErO8fzL(JZ=m7_ed1wZ=q=E)A@ zNyCcIgTP@ctH7IVr>~xpUG9UKRczVtvN%WO+ohmnNhV?0pOWX~7CnziOJ2lJsZ?L|@^M}_5Uu;+IoxxPrh zx_F*KJp?S_IK_+XyM!IdldQapF)uwad*`HrZWm@FR6a2!Y!bZ1 zS3iCQ+rU7~J1Ze+Yw}`jt2VI}Fof)&pB^!_MSC zydYccgs)AY`cPXPCo)M!ci-5jY>Si{TlJ~jNJ7iRq((r{4Hxk8A@$O*!o@~*&E6pq zZxP*7UF+$4`W=S2muqp@gvYp`?H!?Z0jBMzmqafXo8eZPWkr}{F9GINh8z6$gpem# zJFLq3SY@N?VLZ{fm}uJL5!CKmIk_y0L)1d+-xCgauloBFzM&SP4tsQxw2~fNW38zd zj6u^aUP!S>HVC*vCz$4w>Ug_Q2SJGH>~nciP`WcW=+keSX|>*~t-%3rtkE?nMl;LQ zxF+A^v>Fu}K=j#iEppLdy%dW{Q0q^v6AI^^$QC@lmze?3%^XqM7>Fg$*@35NA5zWv zrMTQDLhNa=Inu-BUzS$-dvPu7-T^^le&_pn<{5MQoU`v$x-`1gVAXMEHK!P3j<0or zMz6ycx9GSH*T&_`s3$AinR;YLV^EHgsekab|D3f@4SJKQ6JJySs~)(?wh(iHr-^mZ zWV2AIDGe80ZV;=5oztbIp zkPl?vcow)a_w~` z+vhkSen2G_bJ!1-)LYe)o`sa#UN_X0;X>!5D*!K$9F_}E)%;gxrLYNrNP=+JWdN35 zyo=kwl1*uAJ0klxqrSW4lq2L;Mf^Ld)~8d#QdV=`N|9Cy9?H#J8SjC97Uf(eWkXe; z98QJxD!MW9GF`;-b|IsNb!m@EvzSVh(*R=3mJM1^)kNXYI5+Q7K;LbErl>jD76RJt zW{87J6_H(qfdtAP_yjvdKqbRp9xWt~>+@1Jf?h-3<>Sg5v0|B*33?sM;kXrYaRKBk z5fN4sxAJARla46`6m+VbLU^1_o3cV$n?IyQ<{lZf@rok}c@5~Aj?cCbrIvJEI9a<+ zZ7rgNsxD`pmkF4Ca2%KRtQ=wVxn?&>30F$FZqzcQqtaEHA>xh*NT=NF9NaVPazZ7a z*~!No2#p-{&1J&(|5jn;CJB)Rip$NA^6AT$^CJyk%U-{~$}?vfH}g3J-entQlcW}o z^Dnm4c|S-^Q)Jiiexz>qO?Ga854^*8g5T0|q72u$7K`m$BEf-ks+foPYZ>*?__rh7 z8NfZvhSeVVBOd}H5y-Mmx(;R|ia&1VnF{;le1Gs5;OK;R%WP#cRg<(BXenj=<7N%K3w5e%F0v(qlnxDCn*Brm<3Tl8NnMLq$q@+);8{#o zG8$gvlJldk85_Whf{i=!PC;m*iO_Y59{^KrQGGoJWYR1HxQVuT!}xn)>X`u7qs%v> z{m(J5kJZ8>G9(dVFCAa*Tv8Y{zQDCT;(hXwm*%L583t5H%boCM0TGX?Q?{%)E|8Y+ ztXzMVT=iyJ+G87F!ub~;ZDqu&uBUZB#S(jc!q2Cyr0~eenX!u%!?#)d-t7%1+6Pw` zCkPNh`JWmkYZE^aV*O?ie}!PfJCi{ZMfCAKoFCpsj_UzJ=SEV?F%4F%s zo$60NevG-JtphbxRc|fc9cl%$_P^`n_cwZ1f`WoF|Hwj=P!hEi2Z&udb?$ zaH6qrAQyYGx)Fg_xNs%!E!@x_)HcSqW&#S|Q(z0Zhuh+Se4}60()?KjkS{YN-&=#( zC>eRKuD3MRSnnHe+3}hyi1bFdP?+xc6EWiV9ga*YcDFAzd>}bk9b48Z$5BXueK)@*WDyFEDJ(YvR1Ge04w4!L#XV^4|FXVUL||(7crd*%&z*@$dL*CGas1SnoYnW*2gpL{awtm zQOkxE%i&i`1?Z}aeT>QY@}*Sz5HLjs5Aamo(lTZI zZquH_S|bKgh&y*u)>!{l0vos=y^TkqHW|OUf8qEm9NR2o&dqYvr0$kcuL%!&CEaC4 zc_wh?;|TZ<<;HRx+u{(g^XIGw>q56R$Bemi2t2P^7)EAvaY%y)GtFk>xv#wlHX!vG|%N$y@2mwJED z7n#$?EDb#NqtV;1KuxACN<}SlJP0a2~J&W-T2LV4xD5; z3f}d)@Lla8zKA$QdM3FTqu@ z?hLTr*OQezzvg6a#pM6R_9mLq=x!DRIB)7I`=-q(TB6KV`;8k& zWrD^JjuQZMM+!P|OoXBQzd^!hZm5{-QeoLCSAcgSp(mMW#Wb9{RPAT=Y;ug!v19&H z(S&hi%}gV9bRByq;Ui8|@QFagSs@R5nTg6fF5d;#!4BXfz~+F_izzP3J#*>*#D))j zj{e_$t~SwR#oi@9^h;|-=W?2j3BBvxjcm*H9uvF9{U(Y*pC(G}n_hY36yaCVhA|_5 z;~w{EP!fc5+`ON6pL>V+HgS^9ZiB?D&Qj#ZF_`Tb#o!%R>m=*O>MZ}7mFmzo+^C+d z$><1hv(zWOSvQhb{QJoLJ#JwCT%3Z=~Vc)k8n z5`+O+v|XD6otB7O53BFmbZs`hOMUXHdh&xx?Ni_LazZ&hH_HMxmoCA@xC({dlp=G} z+Q>n()E$Vq<3KZl0$X3l)e%1c-NUzY3~pbkSm62#xCS zU5pB_*o~stU$$x01MN^Q9G)`y)}qVa7~6L%L^h(k|Ak1<{=KJKx4K-%aN1bO@4I@4-5>8xPN0IG(%o6fW7NZZv< zOX-ODcdI#w{7iBkx_3pyo~j+idZp_EV;|dIm+#Lsnn;B#t69si)>pfdH`rOlqb@NQ z+|(tZn9e0Zt%~o=4jq)6C5E)}9`|;Kpdj1rJ4q)((A(c9M0{3gN&*Is-Fp{y;)T^B z&4$q^435*;K?iNAxi5IW9=}@rfZ?~=5rpKiUID!pf_t_;omv4ml#500^wL;twB}9J zSGVzno*upIPzb+)m`|jf41LsvvrD~RD{jy6Wc{U|sa(#f<9&3*;2{QUt&)5VuNT)( zZ=!5rsH*kA=@n; zhoIre3L>40OAIaHqEg*b5@BxHo91s0#x583_}+jIW^y97o`g@I(yYQhUtgy56asdN z$S1O#mOmKLLs(SH)xVdrD_#G9t?Q^b9l{Twii2X3H1G_@z-rOFuJLof^0cQsWMVl5 zn4z*{E?L)5i;VMpIiquy%K{x=zCE^RD!O3VcuGfbk`}-+A#Vc)eH*E- zqHH)l$5)r~9^EO#i`2c0(lOQ9cU<)8z#_^~oiPhzq}xjUHSEK)poRw18y!FK_i#85=3DeWi0SEDn;Y}J&gA>_J`>ny)`l`< zpGh-Q>{E7ASF%qMnL(orJ7|II{aVcD4>hA1e?k6b8%uN7%t_*gg_mMqvPWGXc{It5 zPixpDhz<=VOxCC=RJ_;g#|W3zH{H77JDq#5KH-`gPNgfYav$Y7)qnXssTeehLFsP+ znV>XansHEz?C*T`Ar%OCCPx~4zE+8>za0tbW)#=T-BmhuE$fCc&3eg|S-}KbG#!DQ z=Vp@FPki2VpE^hA z1QDLjjTJu{qBSd!XpMV*z@N!LE!#V5&1E0+jC zqiB-sY~v?{_jTmbV!)e#(XDH{Fi&?C%k!MYwk8T?SQm-xeKNMCq4e>$^@DLA9>nXr zxS{*_7RTmJERMNbBf+s4-3j(Eiflx`E9w8ycM2>xFWyqAF$2ES?g92@zZJ5CTdhI6 z9L)p`O;iC#>Fk%dT0jamhOMfY2qkrqOW$kIn3c83 z!i-hA0Kp~KN&)I>uZUH%J9mFX-k$t%ZJ6WK+yFwR9}zG-CxaWM9I1j=U>a|g>TQj+ zY(1LIMHVm_URnqQkx+k&jfoHpgP}OyoQ2YnTCjj_ySL|mvnTe#VMewW*z-Px*!xE< zleP)N;uzM#(E+K6H4!rX+MhD}7-M2xW6*_^&l#n6z2Yv;_90p#ST;si-X+;&utwDN z7D1i&#>3)fdlHtaEV0^Ka7CVin=5)vo=w{G^JH~J{)pw4(`{_Ct$AWcD_t^gvrs^d zhQ|~;b{uzm#`(Stn#;4yA%kpMVlIkpRLhocy4w064-~GpNIWI{y-eJG98J&tQOqU2bq9-J5 zx#;fd-8nC|le6s8>rZzo-npx>zs7uJcdc>20dP?Y#Mzmk=YEfII0=`m^UkR*A1t!t1@C%&|AJCKf{x}A6JeZkiP&{5?X0*- zvnjbUD9319>J~&Y>|uI)0?oK0oB%r9>M^Dn{QQ@EusSs|I_*;+cADaq@jHzs?Uqfu zyNW6O8BKF1e6)fNZ00OJZ|QUr(r7-Qy`O(elDN6CRk2FZcWgg6#4;ZdZ)Sz5cQ? zg|MqBoGH5*17m^D7oxT2;L}TGh58Zu3&z2p8$8 z9|^m1QN&y5YD3V2rHLW%DDhQ3#>dEf-@zi$-0rE%It+W^|pUh4O z{}7&?9v#4rx75J$lVG!vrXE)}!J|fI=Bv|7cp3vPVV0zxW1UU%cW2R7{^|bo`~i&L zsgXN3q<2iaCudqL;WIPyEkRqTDR1ljQNQ^o)BAeTI}g|*ZeAkoH@`kw=`>F)6kxe} z@qe-QpL5>(em?V! zzN*`~)p&sH7p!c`$OvwAl&DPWDt>43{#mn!X^i*6`I;B%2seaLnTt&>yg6jt^*C)3 zR!;4!4cBtWQiQqm>BQ^$zP8OS`NN{FUR-`4dt8RDFhV{;k93ByupaU6tR(x|oUD6& zu(p1?NUH>bl!-55+VcCWgvp7=d9)s=xt^WAxG~r4#o}c&7jHMgjU%lB;ZCfde}TH# zk!hmi(=1vJpL4%inc^PrY%=V)x>(nAwih#x$#W*T*ws11N;^Sd`6Ekb~=kRQq0uw zBEr%8`mbR&wPW~?kKS_`nD?5GnUO_$s+L(X`rBz_(yT^iE&e#G*S4b*cRN$x=*&Hj zDz1^GHI?_VG~Dzu<)3e8CYDuK@CBjtyTLZKI^11l_~?M77{*_VtR8o@M`=< z_vRGLIyC)f^0-B;v=S_|W-PSk+CSzEa=LUM6Ue%2r7Qve>oMA+lwk0b`-pp`i9#`w zQo*gS1-j)EHH z`K-dj_fP5T$Wocs+!O!^+nAFtmIy+%*F^vmq1*XAkD@~rWIwW>} z182y`O(pUN)4PO~5+qn|P<`KBdE46|pN3>ZSqb=@EJhzAsqXbtaB%B=XI`5!9Eq-U zsf?g+veJLS$ePEtyKz}J51dOS@CsU8qRTs!KdIwj;=P*U8T>A4!$dXtrep#gUm2IF zHYc0#7C%DBN}I1H;}$KH>56d)4I#GlS&e9&-aoc%SceZfeus5kL1`7BV0EB{I~LJh zWIr~`s146nrAQ;MMKA70UVOS3qgASoh|m&0k7!Ko+Xt%`j^2-Ua6@{nCFg57V|~L8 z412tIx5(B`3HLOCd5Y5hD69^Xd(z7pLzq%*}Pv}3bS=-vh za$XzVjfS@w$7_l9{jFH85ffwCC?_;gjD2B)kD#}{y6t@dy}*<;3cX79yUx@DE~a&KK3Bo=cwHfz%An z6H~M}7+1I8V&u}FZlw+LyYJFjM`)ZI40Aju%lvQ$&kM609i!sJx_M#zdY+mGyq)wr z)x}h(6wlewf*Ja_ocF43L3Zw>ePQCF^qUdm$FhCrk&!8yz2$`d^xk5Bl*mRlrqJ{&wpC_CQQ9Qa z;G4>k2J6e+T}TesO&lWGdXQ<0jl;lTr4OJ9*gxwTYyNDwhfut`NY0`l5OJ09M`_0D z-B^vhV^-PNM#eziU`0OdZTVo-qLj+DIKS%#bAhkt$ula|Yitv4Py_Z&IN=YpU=tAC zougi%&ibP=@dkf?I(LyXlLWZB(iX!Xo_fKr#0c$X-(#@;g8cyLn)lcA(}F8CGXY*`79+URVS~Tk_A#C| zc;yw>vV~OanOKnz!%s>IsPozWF>^zbw0qSAuC`|Ey%Y&^c;PkAvWXPibpQFpgW1gf z_Sl0G-gZtga7qL<%Tcp08t7L0S&p=xb^|XteL;kmua-Gq{h+5d^8q_kSb;hwxSFS) zgrlW!Kc0KwG9cTeIf|e^UlrF7x1Mw=0j5kJC(Pb8T$}1NSlfV%GMgvS8wki^^XUUN zG2%fBE-&_X@3KQ8){^V=P)d`fodY(cv0NKEwa})z%vFV_O*a041OD3ITHJRZXejR6 zZ?btBcjJ8Cn^e~1hCPZVhtA4SA`)DVwQW!g+0h2Cu)Y)n_Z)2;-*$_Z1YW z+s0y*w7}8%h(cPAjOcWi!9fCMF!CNldkq;V9eu1`ievEzr*|Y}qlGrw?zqa%yRz}9 z`7knG3ImJdvM~0kzaSSjja#94ChB;^fFIH0SdQz#2fuLJ-XU=J9zs02^3gExvqg|c zB=^Az8VKXzCX=!5-X`#_q6THDcbia)g|n@P>*&askc9!tY-?NwpgF> z2ezsh;t?5bEyWPPAd1Nhl(&PH`oZkMM#VVA4Fryn)HbU<^ls;{)7~0bbf^0LN}SRh zwZB~?noI?AHq}<~GmlAdB;$m}`T?Jjow#_4dnf6!rt0o(V_Mqi)a+)J?I&g9t#9dk z{A5%n24M8f_^|P@(}T5IrxR5}vNkvlR2;Csh(^3t%x&@bs5<&H<0Exh8>Z9zlFEJ% zc_Zppf5S^^0ADMyXMHz&W$O5`O6o^EANGkPum0T7z)T&#Mnkmt++}>$)yl5;Lr$0F zJeu}YmJDY(<~d9lX-!SUyb-%1+M=WF_v-b1oAEBEXNfa3n>qE#aAO($msDOlf@;Oo zTR<2M>fznWET_87XX1g5@Nzyp3A^ZOSe7;8cu2hQ{U9Z+Ni)avpJ@Nd>bUh?DM&!b zpayP|*GeW~+eO*Oi6)+=2g=301z&$WmRz6Od>rMZ(pla!c}r;y=UiCU2ZDe?xyacq zW06btgS0|>>e4@>DHWwyxEavUYdxOW7Y3Zz{M&-8>qwdj-r9b;kS5TG6;UR9(*zi6 zWx7v11^cHLpsnR;n1GI(LdpzJ#R2b0lZwD%Td`i#VmA#Vw1X>Ir6>=*vy`N<+k5qs z%K7eMM|b>(j$m$u2mHP+=Q(tP*0-ra(jJdehV*{VtX>N+` zu}E~`xraxed8I$ufSZ>J8{hN*>ERO~t30{>wG)f|A1%lPgcclGiE{TIoVv|i{aNq= z`XRxq!)WjOoK#u2_8ekyUy8^C1h_7c2$0B1AIR8^3i~uZ4&%#YnEcF>s1NtkcX(SR_b0uRDEpXFf!u7 zEwWYfvAz9nn7Jv2QWF6MqOY_dh^5IpQk}nMGq&v37S{$o5GApo>AW(%!%$svkCNFK zTiF`2ewM*~#B`$LCVIl%1TB^ze%FirH>ieHfCXGDR+m0EEq(4aKTfVPoPyB`sGjb9 zNABsANkAzhAqWfoYX)C|J*^L|Ql_sl-cr5iGw4R@3GvEwuhSstwLqSjIC1?qf7Rc& zv^l=gJ)H7l%a%5QjTT|bpF`&@*2n#UlVYo2+YxE0c3Mdr)@l=K1YFEQuBqZEqhL9KRV;;ETiUV<(`L8sZaE7=%*=wA z5wJ6aKB>n_`D|p~%`MkKblP%CNgK@`*jTg;oG4>h#&9W9qO_;woHG4#iwv~pI(WdQ zlKp`vmre;{S`H{|txE5^u;Lh!Y~)y#w*Bk3SX%)+xS9Go3oDuFgXQJh{uEwfhK))} z+J3)zOr8bD=L3yE?!V>s%77*I`E5erf1ijvCbT;Z8&VA>;903+;G?6Q`yXF;X?M#O zXn*51%5;=xsWe!!7wmO9_1Kjg)W%#*)ic+XoY$?x%ht*5+_#EFMR0c-Olp!p^7DhO zIl)>PLu6S1EdlFnpcb8+4Ci1utpi2aLYXf)>SO_d%*5o4R#N{=8(ih z!GDTtwzm;uqm4OtgG+O^w1v6EBnqWrcM<-I04NRuk8^$=etz5TLsH^*>pmD0k?R=nh5tWgQ;eNW z8t?q(|AHGxj}Pz_zTieFAqqkc=J)@NGGk*q;!J5B?%eq%i?3gjGT8ktj`x0|+5r15 zw>Br-&2Y^FlUMuOqf^Tr(a8Wu3A${790KtJv=7XKDa8x-gIYPzzIs0%SJS(O&^q)C zlOEoiXJISHX(d^s*tfCJcq4$(LKGtlQ-^l#6?n3M=2y zpo^wk7#(6ZUB-UWoFvot1(E{~fzSD8Wpz}eR?2KM{W6g_9tEi_CqNu7xEV(9vy=sz zzL$3Na_5n@baCCSb)4ZreNoIx2t?@K1zc?TyGO0F={?KFV+A{?+tH|_3Le-Bu!+AO zmq&xQ;$uL=O1TOHlcx3Jvr4}R*18L<@wAuGDfG=pb8@Dh;%~f!PDcIXYns{# zDeq8vpx>iEa(Uhs@R1|IndGFUUiWyR;G-s**}vU}5hu${gS3=Vf;)>miZYlO%$1_< z_dzAbE4A}zvE0?UKGIwCLdIn!cLr|6rCM75_oe00ES$nAvhkF;kF~a)S!ZChfn%R{ zEGP%kTkd|H0z@04g)6s5)3el6x>eIb{?RBxwnlOPV$c#s$BoQ-5VU0Oim}L=P5D~k zi#Q5gombXDG_-qnOFavaDr^#t*0evxW6p}X&))0f?WG?=+CYi0eiz6iwmJzbRzBQy~^UA$k92a?C?T){v_zXImqqO+L$lQaLa`#olWl!aj4W zw!8n%NcW-R$qn+?EIA%lij4Lb_YZ}cxpvO~1{5K>>Xp=J&T7nUE%|*RV>=Ab)rI@8 z-3pP}>hYnW>D*d@YkwW?CC1HC3hZznzk>^4=G?;qZ!d~1w$=W!p#ihWI7?kUT71H- z4>Abr#zk|mi2T-EEpOGB;}&PnUo5?R3X%Zb&+@t?ND0$W<`tzX;Z;MxL_G86a=)1C z<5@O5ub&(wV5+?<|C5dzX2GOrs0Z=UA{_S6$D_CzByXD86$3!fL9DFv6Imtx4f_4V`8|UqsNxVA6(v$%w4(YdSIfW;LUtZilOT2eM)Bg zSr5WxgE+7h=?abkZ>_SAdF(-#Px6O@JvNB|&dgCaH(OHoBJ1z+$tx<**ius!QYYHa zVvcZw18uxr)gH-x0Xxdpu5y{E9HjaF^D5(gvR!3gXWA}IC9NQr+7e^_Y zPwjU@UOY#)!oq~be5(97*uaJAOGsg7-{t)hgE?OZOTJ}geFgkC4OtbqiGZ1qg(D}+ z=uuRKza^Ix5%d#nS)isF7=EewzpohhEiSC5!)|*6=QbgPZL)-%;xb6gwlnwdh@qk+ zEmH^MXYNXQUK_P_G_nn}Q~{`>Zs?OIHn}tci$e@JDi0VT<^o`ZGu%x%OAgA&_AXm0 z3U__=XcDOToJ&*<)9mK>3)jrVR^%VK29DjPX4X(7X49XpYxC~uT8x5wzbSI9lOBu4 z-l;Y##woA*H_c+I-gTL>DGlO`GvC|7LN=iZly}TA+C3@zY~R+d=|N16J;kRORvtkt z6@t8@h@#|7n~5G*Ty70V>iE1B#2{a&8KV!}rT4b(uea7ERi+5s6Viw=@Vwo6HCvbG z=rc)R64O~CQ+s6{`tC)E`AR9|n3)=t+8Jgv6=aUOw(JQ?^_`1-By_GvEM$k`%lVq3 z$u;4h9MdpIuj82pC@F=-DqovvL3VdnXIHRmK_;MhuXyF{?{NQ#s~Z2vfwFjSiz{Iv zySmTw&4p_zK0>)SjbhTbGY<8gBUnHGcIK~#|MH;{xGcoVNaOFqktJT;h`OG@cpvM1 z@;i_}{YnY_$zmo8h91i;Aqr%biJItBMwguVFUa}w{7+jaYzKPJ*h#nX_Gg{*RUCG= z$U(kbew5|%pBI!=q1NttXgXcy?iM?oEkQj~He1A7&X*6E2GTRX*azq~<4fBc{g-0ToIs> zZFY9|SNCG+IbuRUK*vZ=^(z!7V6zDhlC(K}Sh!xMLC3^HzF)xuJ-iX}?cZitjW37U zzXOoYkuEKxvh3#xHLQ@!8s}Ea+ZyjZfw8xQGumJ&Vp@vb|7ov-V6W#QR(&h>ngem6 zW03-Lm=Xh^qadri}-g0$&>&m zpxW96F8jGs@P={ss^@17m?1W8WAAD<-XgPa_@_NI#KD7x*sT|qJqSz*LTH<2lTla> zN+BDl8yv43+n!C7d6Q{eoFd`-QK0NUa9lUwxLEs|yU{=L0g!%Ez;P3W1D5K`StOzA zMG*fZ(}h;a@wSDx+QZQRNX-}mLj?@M4t8H@vfPCcZPax_WiHV(6(E19+V z)i$(B+vA7%ewpNkN=RRlpua4xK{Y4W-E^I>1cp*AXLEs{?%?hIg%!!iUmdNdiH;#A zFvbp>L-o?6`+R&h^qxYS!P-qW&cihW#zl6w3kesb<99^;G6%R~ufj=WYYu}mEHxiS z%br$ZT+AeUc##ucgxnRbdKU5T&-SJ4ykdjZ6HtL@tz5iEk#9DSmR;>XVn>(x?E&p> zM5rz!JW&K(0&h(odAEy3c^>DD3NL&1nxj4o zs4j$*+Fgbw$&_zW|lbn%O3o25Xsql|SL#?r~Z2m!-j#g%fY6 zGz-g16b#{o?Fr$LE<0G^Ih#`8M5h+mU^sI<;?iq5t7rZ_IpgUVWDY{1j#E8CKjdrY z$%xM61A*ai^$7Uv0rxjyGjI0QXHz1|htw!T+lD)R>P==6eXiY}u~i%vr<_+TJ^3FR zS$_GrwRlh}XDHQ$H)rT|)^e)<7YFaBrDB!oAF9=oLeKNry!!jT?uSg{q9oDh=wFv4 zex((Rh@TWzUyhUC8sO5Zr;q1R;zkgtacKv%6pKSWq& za0OkzSD)YOfh*~nZDYWfz_`qc*>&J}CEnhqsicEEDj z+K3d*WwslHJ8OaKCzl`x(zrivk#L{wY&Dh8k>cnx4deCfs$K4Be&HSH6R}{iQTH} zNA!SL%4i+1=baZ`QsG=3*|)NtSDx+be@Jlfc&6Lr*Cg{->#gkv5Jctm2Co$S@pwuq z?0~|ZS%#4)%CMFcsbo{=G626|66}&t2>A=%zKtu^w2VXk0_sMs)^hx$`70S3_%-4q zaTVDf0!2AmOw-46RfQ)*^=VzB{Qr`|+ z5CuV&ncDqr@e<*#?A7M!fai+((lU_G-caIhevj{E+)$MT{BrkwNh<~TPy_%>84ydRmA#~|VOb9BR=__Jes*U-$>1ebdX?L@D zkbfM6|GiE>o)3Ctf3KL~gw_S>yM@wye2xvzNQF$5Z#+4bNQjy8(O zy&q(6x12Y=Q@9#XHSsTY%aY}5{AD-+|KzjDnk>hzk{HB4>fEpg;tM0uSDd^?m(&02 zQNV|LtYqm`-);DLA081Z zUQ5FRgWt+-OJ5bF0D6{;p2DjD4g)N(wQU zeShnUD453xvW_0_UXrREeUqQm*_xXO{@@h zjz=ICCi1UbbxZvR)LW|o?6_TYb%rvC-)##dHw>JA_Ic#}pP!#OR?U$j;5$10AC$io zr2NgZg3qs%4?6%r=lbPvtzwbpgk;xi!Jjlp^eMCq`*3pQny>$vfC|j~1Usk-_XC{% zmfHb-IwB<Ey`UGfifwR70E8U|@ka4T#5I+s04|E!Pbfo-)gQqRxkM?=j z(E6qsfp995@R@;Qz^et9N~O!VBJfX;M&3_WkokdC0OAvB*nqr)p%Fn75{6i`@Kyur zM_EpjrT>^Euw)|!j%6G) z@tST9rZemevJFE1eUgWon(IU5YeN?FPTGu&AA_0*%lM%N(hunb3E>3KK<{r4t!Lr z%fpQVT7K=uP}|0ayRd<)8f7z`+*~vT`+@*1EoWk*lVa|+|68sQKj=J^E1aZ{n#`*{5CYEtbcE05I*>-`@k z-`8h=)HI*k?Yvn`6Y;KD{B);@vqdfzyNR&9;os9rmnjtmr68(U-s& zByRMKM$M)uSkX~m;$w*<@P6IxbwBa0zxo>m(N)kG3@?^~a;bXTUGpj%JyP%Tp;>(Y zccu5QtG8JH4ty?E!}Wtd_$!c=DtJ`2Gn+{$Xl6(T8^XOlgteOZm6d+iPPWV(149Q& zHxdYnEoQy2LVj-&+OuP{l|J7{bbI@$)#KZy&|dzkP-X0Ok2a~jiK|z>qA5+phS@WuyRxgZ+X&3pq|MBGvnG#p4-WuXUh#r1C(q1ly zyJ^I@Xq4xi-%>l%GS_T*2f{ZGq385_3HV~V3#f~8NivWE@zMMxj;7z$-IqNH008na zsv$ga0}D;_$*V1!#D&TnCSpjpv>57MK7+L%AAadh_}>2sfg&htk;})w?fe-Of0=DZ z88*#lg<&+dn!DN5#u^-$IXw7NzWKr~1w~aE*o9D+h4Xc;u|xVW<}?_DUikKS)S!s9KA+q7%&{}7JKg=LU!{{VAOyTI)AWRJp2mU(g!eE z(lEd5%UuAJXgI=)(TS<%5PR)zvLf3322H`=RmO~w)wrsF5x3ZoUu_O%h_NSwEtVQl zzwwp79+XY0(Ulfnu3o;bQF8Y$uA~uL!OW4X{Qh5{GaPim%68w_DZT=o?SPq$?N8BQ z$gP5^DL^l$95$~@b{Z5;x>OyQ+!!m99KtJeL9t=ZyIgL zcedN$T2I+@x7OG+rf;YF>~^pfj;xc{ z&{SXnW(kBX!%oj*Wnl_M9_PylTC&moZx6Gu8l5xynAG1&TD|$4Gl#+v&umW)mo482opU6gkeD}QAE4Tna0Rm4uQ@&cjHp=*rkdlP|$ASqw;>as?a(`eqH zm7OU5LZFi1__0RPWjO;Xi9p@bFAvT+ZpO?F2v5MA-Q+$#q=TI#v;wtjt0dtnFb64E!mwd)AK%40vOXsS;BdNrr4?jRO6X<-*ZA7m&Yjt@)K&VOlb|#Ub;lEXHvKgOM#5lx9xb0bqVHhr`pcv( zUi5Bnh`N9*=*y$LAq_<}+RQ7Yq=bf^kJM`AH|~?6k;d0@ztz&Gk39Hf)r{24Kx14h z&`c@a&Kx2_?PS|mQJKbn_QbS~jN86)2**Ix_q2D3!M&Dn!O2S694RORp#wTa6CSat zhVh4o%1u7A(HlnJK5SkqHGAQ196(dR!JM+0HHz~ClvEd5rtC)ipw}UmfCKO62`}2_ z3>tSIy8P;Im$qpwjkS#mdqHUwwKLG}F5nXDb^fll9Vy3M11W||^N!lt=0 z)m3rQ8*4J4H%*m}b^F8i$e{4F8I8EGeAyNZL>ZGLu>6eg-U^=gn8GqX><^#*Mu zIZ`Al#WhlE>Ww&GqH6NAxp30$@VPXf^tr<}#cy=}tb2XGy{F^smibke=;^nZf?#Z< zSA`m+dx9Fog#iV5U!&6TT$kpGUeI4Gk^vXYbKf&LHg=j*c+!;a-gUSx6}&Jf`MwEC zwNLOld`FM9slV@>!fu6$?$ng^oI+B>KkhyTxKa_#Apud*jfVe8Id-{mOW3Pw&a}+y z*lb$@&aP47kZaEXZpaFKXricYvJtjZ5;zQ1Th@zaA7AS};pq2B@41JalAs3@>nExa zSEOI;ybk9+n6t7+tz|Eebg{g9DJyc$)_PDb)ufaWQZ9Nj$Elhs1%?bTf*k!we&f6} z(knqVH_&+@2pX3C9D2O5^wzH2!SrIz4vFDw_mnUo3r6b9G>IF*da4-}Ofd?4x*xQb zTEGQs@A5`#9>*Pv)WY?Y&)gm~&nRv{sjeeLKRDL)2aC>ppL`tkfqu$XKg8-gLOY8t zfsACr9=0e6;}~&zO;~G+Ml8=YpEaivvVp#v%y`&aTvi2*q%V#y;-!ja%Ac@9hGgS8 zGcu@$wX*xg$UG-tc};xZ3o_${wEFXVci$wHJ9Vv01X=F^;BpzA(^>JAR3dO_C9{l} zwS78&zt8GrKIBro>Ik|oDB@bjz1}`_`S_;!3`PVg4idfU;1N1-aLalAPg(t)`3+s@QXHbXxYe;8qdHN=qDqK?R%s2GB2Lzo5Aaf zwAO|Ybb5L=N*+>$Udz2DJSgM0Kw4f<#ZpO(6Mxv_%ha@e%V}IWd<$N?dF@K`p&$yIj43E8c!(`jt2#YyR%?CbKke zV!of;RDufR4v9A90rqK&zK1}lU7}xnDed2}waW^<)28D^P%_XiVnT)D95|TvdYryu zO-6CFXvBO(J+Id~!o1$w2_9WD^v-;YGkod+ekw14v3kBAlcpjq4vr;NPzCZAt%@`O z?Yq;$Sf-^B+EN#|^Gf-UW$)H|># z9y!AM(waknw8gl|UZw$P({DKkSluC|{Yb})-;YkdvPu#RlYipznr;5AI=G5NBG?(? zSbx;I@rC?Zu}*j_7?k7yGbLCiK^Oz9w`+OkuT&&d5r4{VYqU~DLbF#3Zy=+=qDeL@zKVe&1Vep? z&cQ6Jzjyn&ED?n>&FVC)b4y3_zKgPnRl%myR4EI5eESnvsg1MILJPg|=q7VeCIKDp zU>bKMZ)frvP_#sb~NO zZDQj+jyEb)%xYxud%Z`wP$Zbb6|-uL2}zsrlIa@zz)ieSH%aW9f6_5(4;ipE!FJ%@ znID1jSA`7NP&D)Yd~j2mmfWwkO5Gqzo{2&Gls4TRi@vHOkg+$Brsr$ zy;hjC!{&c-H8nFVqD90jkJ9H_gQ>7}^DD}0AjJF&7!r*lv%r5627S1A8uqoVrCl7P=L>R9eI6Zb z1GoSaT_{#EY$jKWc`ON5u@29Un;+;ATbYV5QUj!S?Pxu>41udyG!6jVMl^H`CIsz0 zd5=T&GX|a50{4E!Ak?j3s8@d!jAyz)DIEBoLBf(xr)dTaY{qHq0)nUH$Lh8L4=dSC zpL@V8#yn#%;IK$J@MftGf~rX$s)KaFeL*^0t?0#0Zla6v+7%}Od7v_Y|BUP$%8H^H z&qZ*C7u;za)x7mUpPc*5y0x4;>hB@4_CPY}um&8&(qNxCm_*tM;-%P2k$0Wc0AY#y zFC&#egSG%I4Kkp`ES2l=eq%_6NXU-v^Ay=5Av;XhI1J8?*^cpH*xnztOe(TnVk>@o{N&MnZ7bzzmhRw!+ezA`dTyzcKPHm_BE*- zyLiOJshhd&XB<}qIL^MDB($QJ!g?b>ORYhW|J|qePq0#sf6}?Efu;%ffkg|Hd!uCAV=T;PBpe!jlgt+n-F?yxO9i)jD>G{=^`= zFJ-*PG|;AVdu zx|}Me#wr^}OEz@gte!u*%V;C$Q)|a%$ul1EBg~YI^1Upae9~mr2tLP(5{3yM=EUui z$Z`|g9Z!d+YG!U8f1?qLc^Nb*kj}ht9Li9{7=e3W=&Dr2eX-E#S7JRSih|&sWQ6qW z;z!3Vnx#NB0L<_S2EVZbO^E%jGy%-ZwUZhddZH4c9PO%FXgDm#3_+eJ7=>gwb!H^y znVJd|4$8^aLzhI99GL?etOe%J7eM6z`lSC_wKVRoB-UsXE(}c1_%==juuqgt1aJjard&FKS|eCgrp(VyB_L%{>_R}G03J`9U>Xrz-^JqNHi03Jj)vY(Y=y3# z+$=Yg^D#7ptF?J;2Zq>LxRF3WUMz<$XA4e1lm;h4mM#Obbf?$_PMd@53T+&gxDKBU zFBXcMjclI7wSlXlF8)^?qkH|Ki*rJGk#l{vL@6&)R{?_FQ*f!jOe#Xzckp)9v3>s| zldr|3J_1Us#q8$#nL2zU*(@u1nxwiL6+*_}YA&d3O@lEj&0gL-V?#wqw)(Ga6q_t@ zXvDj8^7)27ZZ``cMbQcOZWzLSUeQ6C)toYk&jdt(s=w(_3kc1 zRx+BInVnJ>b-X84hsN0M{NGfjrf#!>nyf(gyZf~v$a^5&Zlb^(X^d^HB@@8Bsn*Fb z{oCKoV_;M#P?$s?)l~@ElJ>MBzpw`1mXY!GxZ&7AN1FHTt1*!Ig1Q!B9pbmFMhhjPyXOf5Qd9uCi!koLTFZZ-@5wu$ zgp~*sS|Q_2WCPS=y$%n#RuGeJ7~jz*aQLzZkLj^9{B6t$35n+wJ4Z8p6*5PW?t4aP z-W&gYWq4^2Ac#ZYzMQIS5^yy2ZWTLpKLGt7QT1f)i+6?fR^HO{>!##6Eyn=r1fJ7f z!^-uLPYe(>^>)c~_h71yS!>NJy(B{yWoo~6kB=zQ#$_cNAG%&8!%c0Y0GbB8fL#^v z(|QwG4xhzMzHeh|0Zd6RVQKI zmLAUjNusy5Nw_;fcR>1X?>d}@J)Ac~eQ$4^p-lIlLj`q3!+2~WB4-{8^q;1^2}M(9^C+`s79z>a5tmF%Y2ST-j`XNX4$6A zLf(jHj@B^_$N9AClr}ZtzHZUH*Gim9Q-k1!y|cgOy=I9=46f&4QjY~sEezlOl#6wFnAcHB@>hby99 zoI`ysA*Z5oxpRq*TyBhWMUJ7#}w{8+QE`dlXD+gJ6Qj|MN)^}2e zd4I0UcYaYQxwCVTQI@W*w@cB^KyFsrDv5h>cs6~WSMjokQNE=;6*J+U(u`n;*w6zv zwL3qiCpVAJRCI45mds9)hyu)W)TUA^s3?>SjZb!>ruo{PhnTXi_z2QGbH381!(S4U zbcPc%7zVo^r8s9GH*btp?__+SE?UZ)SRp8>l>^MG0GuF`MC^CKL?1?wA3G*X_)c>6 zPr{34+Z}yGOs2~-8qS7pwO$9X9cU0(#D5c;U7WO*3(Bdh8lW?oDrvJr1aK41M01mb z2g4cTjU~@Hz~s?PBI8mjGMCmc)ymD(^=jWKkvTwr05^$3`7$`boUEo8LeG2VjW9+Y zJNp8-6;uZfr-4p%L~STvY#uV8`T1f6&T7=*csn-u3OV0-Zr0Zk(J@K&R-J#>CD^iq z1>9yEn_Vu~?^9hEa##t7#gB{wdHyS}E&3t?!jK3UPq=N^Iz;^}0_9xRsb59l9CX>% z{D7?y^#f&;3-kKrv;cS!FIHrY1b zdRk;8a^YebNj5sw9W@bxE6nyf~(~L2M(=456c8RtnR~mZ?aRt$pGA3?snn9R0@qytWJDKN9<8x1T zXHGEnH{qB=Yq4i_gtR9AoalRd;yjU3g-tD=j7N&out?njsf5J*uIdiKVE)WCv)Lsi zZX1JPjosSeTf1oW;*sPWaW21y zEIaU6k#ye=r|RoD4DMLeNX=89n@vH+l}{%bF~%QPPV2!D&0~t&yjgkFfc{{XH;8M_ z5>bgxYi$1biSFPz2jv;KUR_67U+FIj(Z4*fBVVi6 zXP7Y1W8ShKX*GvS5MZ=mN6K-!ku*`$yn-$wQPuGVHCD#{ti*A8yUpxKV|&m6c08Kc zPdqIF^YwnMz)|JSr!)7AEV;Q0?X{mqdZ*1Zjhr(kSyS{rP{65-SldvVz(=Pbn<}}pps)BmqSj%Y9ztC6|?Lu)r zO`%}w1Kw@U&%MvnoeHWZ59@DGyM+@iWjqtER0oFG3@m!LK0dZKd3vxYh%euH$kE}R z{b;n^IXH}fp6$nz*y_Pa%3M4Pz>9k&V&4L5M)|Iy@3mqVtQ5z3JfupaSZ4`Tj+HX~oF+&65B} z!}`6kH!h>mydX_uHOe5&BXX!~{-g{7-w}8X;^FDA=FS1K)3VTySE9_wTL#EyiP&i8t7O&)u_oFBdDXSJAAfd%XK-+yJ~X zKkiokUYRY*L!$d{?B2`5;W zP_>TF9STG$oa-Kycts}ae3a{oo}B1}pC}fOi!_9LPKf!GRC&_J8uH>trlr&T-oM{- zQDNB9URpYUTH)4VZ8le!e=%P%jX0s0SSGaV>GeX^J~lEIDb2TUUrk5)ep{7Q8?>*p z{GRX|+kU0*KeDesl;-%P)=c-ue}7)A^v4G9ZHS)L-w9=WJA~4T-fv;Muqu$GyZ-tm z`W5!gZ2G%_)7aj?Z4-$i`upuR9~83hvsMzA^0R89JtR*aPwe(RI4hkdQ9a+OQMsBn zGxI?_O+t2Vda>JjKvbi9QW9hOa#TH9q&iVGv`UbJuDdhp$^5jwN$N%#X9DHQ85X*z7+>yCt*d`me}p{x z!9Z1H9zfT*N1%3Ju}FE0vhT5w&Za+C9isIZW?_)DjmKc}8w}1TSZc$Jj{oL3LK=N; zpxbf#CuD%|9kta=8+%0K#hsrK%K!E6X4>cvy>WYP^w?J&Qnu&RynPXn!nRnUnp&uF zw8m$Z2pgGvDUrGXFCZbVdiGi#OKe;|w`{*xbREdSy7%2Uqkjx*z$B!Im5eghMh?gO zQL#tq1A11SqW77M#5?-jOpXhmrn=lUC6!utJmg|izn*Gcrnc2`2O-|r|uE_ z)L7^I43SSXoMqpOu}VZcakq5_Jrlxu@XpMz_hq6w3Rcl+ABSzUL@>^C<2AMLVzb4P zcl8T5ZUs+&6v^&1sx{^#E7R}PpFPfKn=S0f^{vw!;vUbIj^o^Kwr|xMa%LOP2RQct zywkxP{E_+a`z+gyt!?lboX;Qo_8o{MkM7Zz#U5qTaeVk(GMuqY{m5BXd1Mx6}(O@$iY8*|CG zSw{4*8YCJVBd8F)OrwL_Nu!ww5{k^<*K8U~71f6;(=&UE1jWVmDsoZ5dHsG06wx~; z6Bwnb%;dY=cVuhB(0DnE5*v)r0x95F{Z&uTW8ysC$w!`}_UVM4D`U9t@A6Z6l*Q4q zpYw`OZ@w(IY~PHx#g)O@XAhZ^#;4DnyZR{O`SXn;XhUI^DaorJPd-wAv}>B{M)Yh6 zJH9+NDkkQJn|<%=Qw5rnRvlS(_KUbWCWqA~d6k`h&Lg{g^5=}-KBB}NL4cOcb0s5d z>`h&({vT;y9Tw%gt}7wkjWmb|NGl=I`4c5XLTW%jlx`%3mJlfsQCd(y8l@zL76nP^ z8aifZ7-C@HyyMzyoxRs$owLtA|8T)D*Y~~OllT2R&-;E@wL!h!r$TioaSCKOI{Et( zaLEu-9|LWi(hf&6C$T@Aj337-f>?%jn9a|E;%GIQ&FR~opQR`~-tS<%zSku+*)26S zTD8Y8lroyf5md(n-nEka<+H*3ZB$~A!iHo)pMxDI(`YZvOxDS(I(AyKOxzZ%uF7aA z&)=OKbhk{fj%xkq;PrP+T~`b#r?S*lxRIJDt8~#9l#PHYBOGKSh#Dp(?#)g|d4!h% zWz9^!wSsP`r}MamSmL9yp08VxDfqv8@L5E)f0dtFdUu4Ek8f^IXW8NFG41v!gS*6b zi@(G`p)KjB#pwL}xo&zvH*kcLRo7L!T1^6!t@Js@2d?_&x$M(tYs7bUkAk+>li~%s zSHsZmp@C4JnLWEV$rq!ejsX~Ps|ppi7SFJoheM|cQr zEYJEV&o~07D?4oKYN#60$IY+9rz>S$>Y0hlvBD5GyrCG#V$pkN6aKP0XA||*D@10% zNTJYKc@Vg#4x1Gk40SF1F)qE6x@9e=#78V8Qz_YJyea0fYNX3tw|Fn_nz$jHf|`q^ zATRElX?1Tl#0dYEY;myLE6d<5Z8~H&33Cm`WuO6JOgXlt@S-q=LlXY#QW%=+_rv1r z7kZTr)~oW&nYp*8GpumoCDL|BM4}(J{7uD+x9aIv_I0psrPYxp$3f?E^spX2?aLwl z)%$a<^9efmHCYgZXXYNn%xvD@tHWphR>N(%fs@ zaQ4zG30gPix_eiv%8f#|`6X~R(+Y#uBJGBzgGM>uppAbBgL)-Bx|0K{SrkQv=x&DT z`Rv8&i=rZaPTWXpukvU)!<%@XjRzw@p+;Z$dmMfM=N&p@F@xm!#G`5_^Gyj{Imueq z%fA?a)*SUp<1b83oHY1ML-FB;%kmE{1QDd71(5UDHmZ>GWir|$m+!p5;lQ4V$v7+M zc~5P)57xbw3>Ds;NSajHe}1S)uxUH{L*KaRN&jkw%$D^?{a%C7Or%TzIikB}Jm~D_ zNmP8i&m)H(u(R^}=cD!9!#BP*+cVBJDg*BQRPmP+&&ZRe89Oo0Y>A#e6Y#&EQ&(>*cr0w>89e}v(z( zcFN%DPog+oT_T8aYZhLA;Au_>oOS9b51jQj8*Ef84@KXClL^$o9)?H3j1TC=eKyqH zAJ7nxuTwJLd<})JbepQ8_E^YIt_-Ch3z+?0|F$PUEma;y@3^AxOnO?GM5$&ymh`C}EqG_2DObh8hH@TLKi}wba9{{rC(cWRn&4|-R@3+WplziLtfpjdcAr@*02(|eAn;7*Ptm4Cv zNwMHX+8|N^x@Ex-)h76l3Kh{EC|FsJsAOBufgI@K8)K!g6I~iC50KejPL2X zxe?nKD@Zt`th^7nvBOs&VkF};Lgx7tu5DTmfNPJGcFPdUHHW<)A;%nnp`$bJ*2M2~ zWWSg5k$)KzW8Ss&qZ;mQ**yX;e>|=%v{)%3!V!}a5IsFE!vx*A{_2iTZS~ZK4~BTs z=ZXEojPka-x(_%&*e*T7E-T=nX&sL}^{yXLXzRf1V)!lL+wrHg2R~S=^h*$3N%lJb{9i zyf>S+gw5nPAEewLAw%pbt|Ql z32)xmXl8tKkgD@qEAFv2G={^oVPvsQd&@;pw^2`Y0q^@Jk`=TIlZ-FkUotX}w|?=$ z1hW(@uek6anwW+HbRhE0Gu}_1m^_ZJmQ4MDT25S2cwc8S zB7K${w(`Q0u3M601H=Hu+(XhCNZM#>Lz85m_~0nruWVQ)+s$%?vz-)$9D|~_5kt&P z&gzGy8Rn%GJw(V8mZ6$)$N9SF@-(!xmFRy6oOq)T8ZjcunjPE$q*-GeR(|`U$P$dp z#nqf0sCkoC@UM$-RVx-(&DIF1;4iaC+_Qx7kB+(GlC7n=^p(So^Ac;nTN0u^J#%+| zO|%Y)8b~plrTH$x&)*Ueo3=9-`r^k}?dK6wRj^EC82UUAArpW?+5bIr-t};qu4cn# z@07ft^(@MlHDg)1_hkKwsc1`KGoQ@j8V-ArPvNB{;?VOmyxL_nd^mNbh?kU#g~imN zE-(}Xvfl)hSArF$J@{_t`SkaN0@88g+@3cx<3N0Up8OEqi_Hp1{sNJ1^%z3_sl!NF zvsQ!T$NrJ=tR1J643;ge9qy9F#%SWlj~~C8`&=^}3w*At{46csw_&(K<;44)tOGde z**OxhiSE|u|G+)e1O{`Ms^i!nCk}h}dE8=KC=gouI-|W`95-qdEH~=5umz3Pkt$LP zzq7ye+tBFjvs5qm!kk7{@R>;oK!UU2v$JBS*D9-0FGFtq;w+^KWfJlbf^^^y0 zJM!4}ps0t+p7FP7h=*^L)<4AW1W1e8Ko*=whp1EjY>BsM-s(=mbg5=k$>rOF=ul&jNT-~>tD(! ze-=e_3;3u?Nry4yqBT-I0ZSyzS7PQSiYuzG62CXA{o;4AFi0GjDylX#%8t$1^vh#i z$Q5K8nghDaY>|2Pq;|j~2#_05T0m}oU8%(JjyxPiMfRQ`(O)TQgdT|%h{U3-Fd{Is zko-(2*VO7a1-fj-cOW8jJR$Fz{_xMmokc{;QiHa22!syceM=H5FopkAl5tVxe<`)HY;P{Y=M|D{Y8RO3`qd#S-~dtCH<$1 zo?wn2tnk}L7gfl&%(LQHE8L(;X%`h@(T{N5-Aip~ayyPf(`t8Jg@^Yaxd3n^4xm%~ zFK;R9GT$Jlh{u-5S&WyZb7I4r1ON?zun_)3PAGl1$_0But+ z{xVl@F#|EpcLK7?s4n-r5ANVcS`i4$s(=WXm4Hx(--Q%_#27pcRIrKwsr;Y3_8-4; z>w;&kle!JOQ|hKaIY`VxU8rHTU@lDE>Sen}5vZ_*E6xtKx(ZV!Z%#n1^5z>LQ*vI8 z)X61G6>1{(aCF3hR&XQ=+@hKUsS0Rh4*0@{G5cbP3uOb&tr9JO_X{;|=wG0-5F$np zOq>ZXf#vLxE)Rk*sGov7FaS6K@(B?HgoA|N8LIw~9avDsgajoAV*~JTMb)oRh>jBn zWL2~Y&kUr9X5Al4b(6^QvG>^40be<9ke0e|J(n(j1na#+aZ!~O*w@3^S03tf>wCf@ zh;qxBw6U~|Pq7}&U%~n^or)i{iiQ}NaEl{b5@4vw3@a$IMo(oV0a)bFN;SV?h$~ie z=_V4-Pg+lqv*W2%PXI#TWzIxe=_=frO!im9AsK1{cSpJO3SF$ba2QsY@Q5kAi~Nyl z5LYE4wmFLQyZuS|YTNi&l}DOnFU}z@8Fj5s#r(qv;^HxZIS60GzDj;9^9W@|b>UX3 zcmV`HKgE9eI#ns~^+<>A)EdYi%rfRMkMSyhq2hx9A3IN0EYoF!Vl^-`L;rHgiwrp! z_X8G#Jgua4xEO;NS~fqkn?KdM_VlD?|My{qHB#Lv9k1##6L*2rV-!Cbt#RXv)}lbN zwMYwp@nQ}?Cqs@~;7vq-%O!tjwiE#zAokaqs|W!E8}Yj4z?*rf#`~n)8(97-*79#V zb);S_J!6e*Z6!>>^>4LbJ)~I?mSLzz9M*p5{!ZiO+Bcn)&{vmVY5AW1H~zdy6Q3oI zr`@KuP>GuaiZwmJP6izMV8&}ce$f5#P?%KbsY86}Dn1bY?#Nq5Ie6JEEhaqoYKuLySIkLN%$kus(19{o4}d`?3oT>!r>k8}Tb zD%Ukh2HwtiPz!nR@J*JgfkAS<(`B#QNb6r(|BqM2EzOl9^uz9l0H9SMA5q zvkb{n3f02+y7Mo6R3R2THzUD#;lUF-tDaG<FC*q^E{eUaZ%JGhn}a~aG&(f@ZaFp)@=n%$E6Ov4Xf#r*~WKO>~#tg5Je+f%G+gl=^ekspZ?>TxV4|%>X z`hX>$%lw|TCfwA)r0LF>6;zPD@AUB6VJB}GdedAw87rG6+!i9l-r;9ALE{09APg%D zZKR=-Y_@5c{6w7S$1=U}q2T-z2Z=Vc;hjuhjM<4Oc=ca3aXyyE6RC0ree=2Xz=B%1HOXRr@ixDCBu*Rl>3L2qDC67T9(H`Z}|5Sj$q#q6D z+X}X4picta-32Bpx1xHd{p{=Y%^pTMnTjW*HIk~m(5PBtB_a>8j6ezb-r0kvO|ict zL)6>OsbWKSASviq^}+MM_gJcBEzhGL1;W%|a=E_UBV954LyeYLHT49RZ-fYqpZ36>(3;)e?&J(oo11QtrD97cw zTdeD%Aqpmm=)I+)L<8t!>xFhaugU9N7|)%4+A3@8BX0zjx1tT@GLN_JSH&Csmq(`l z^T=<@3w6?}*Pc#(;2D(l`RxsWKrHu1!cc&Mh8NzC_LWB72t${$v*u#sWC6CCb_%us zAIC{1VtiIW%X6q%7-PWelx#8HJ1x(cN6L~mw&9sxNy{Ey@WJJuWh`&j@1r?0*} zCaF7Q&&Gj%J5q5xK`}a+QK;rns-T4<6^-NYK^uh9`081}i!hzZgN*(PEuST=X%5ia zjow}*={gd?3tPZQ)f24z3!r(~`U=B7wW zsGzT?8I$27&r%g2-y9QGf7_>sO_xuy(os%k?gO_Qss(d6_-3&sfJW6CizZ0ze)j^p-c&T zv8d7_k@|9GwG&(~{1rOeA%5lxz{ucX$nklKISdu88YBQvaa(X71wP_OPo%EfWZ@Ic zQuOuGRvGdhlei$D6F+VyuhHA;!aX09Cg9RV>4sQdM)AB!s=t5Xim12%BGS-Q@sPTR zZGciQ4Na2k3CHySeaE>w(ID*qDjZu*VJ|9;Yv@$g_n+aVlZ1PzE8>TLclFq!lHhlqjpz0`O8`1%eyxq zUz&%U+-$M9kz0+EpP!mXm^FW66V^s?`mTa@NzLDNcUDq*o!*3*uvIG<6d|7JfO14< zvI7djS*K@xwURwl+HE61yD3jot8mD0x1*J^(ux9`O|pZxaChcihImAn%YdwW0roWlKh~H7F_UREDt`-$3lIYi~oItOBB3b%uhjOdk{S#0NeL59H|8hFaMlf6rPo&>@{G~a1&((KP%ALZ>-T9( zb=Y;OzEbRdE9AD;j;zAS8IKd2#``Ee^t|C%t$tm|IDRnQ;QG|@dr3+{We8SgE-FA~ z@OP#KLR4%iq2HlpY75Q_RPaEi_TPr>=LW0h$6^mQhAA!5$UgiFUeim5mEo?cuemQN8wRtbFR0>T!|VXoOFZ{HRxb1s zFMJT_Mdv0=`>R#>N*)}a9L$D||E}6eV2XOF?B1E!E9G}3a|H^i#$3=qZd9fWU(@a+Y3E*hAtACB*|v-&AgK% zs<>Yl<)L~dCnu*vCP%a3y?y*qIg-IG?ucQj)5BbnRhtX?&Du~-<5$`(yh%yB+A&k7 za4Tq0mF6re`Y*?5hPJb)ys#z0S+@D0$RlAir~t)v@nWB-mRb}%Unh@1ULwuyFDV?I z756>dp0}|$kF@?p&fR?C@M5}fw6~$jIU(z1)N}#asubgB?=zK6-PW9mDv2;Owf{ZW zPQdfB0e6V8SOd}rH2qU&4DDO#294-P0@Jm7!n^#h&mn}Kb;n4BPNdST0bZh zu(8`{PAyCEGfiJ&pwo1eeVESUtZZK<*xn}lczUS(yUgP)6FTSANb5;P&M9TI`wE|h zKP^F)+gp~%h_uSN{H=1!v-OCgU=GtK#&F6TF}o8bFhR*_ z+pktDy65jDj-hY1fAUhPJeu`;BSdlVl4d9304nYKl=SWaH1f5agYpx2+vl8$pHBVm zM+yVAeZvIxwytr~4K%T&P0D`tH=T~>bCew?Ux!Ssn_m~WQ~2j@89d7TAIqx0mRVuO z-gs+nK4+gdrBuqzGpEkzzvpYLn*7|s)mBfqi^56$=ZuS9-Il-C@H(MBXIF%GN`pWz zvC;6@OJPTwGMW?;?|qT17**DX%SD9+?Nc?7!U{5tKgQe4h!Yfs*5h`ivyEx_z>zmM zd)RmKg}B%HHAuj6Dkf_a?+-^oQ#{~fDr9gu)Na6YcIb-Wh`Fpp0i-P=7i-^$YqKu8 z3U}|U-nEeBFh9RdGICnv%(60gk?mu7gdVnxTRCU!bWwh!>cw5LkfsQWr0^NFc?dOBWr-oH*LhCG5OUNsOF2D1HgxP$)Rm(#N zcK7xYcDi*EpkHML!-yV&a0OyW zT^+mcupTdYJ$%ddS$I~rAOAsptP(QjEaqJ}A_2M)>npEu^K+My#EIlim6~aBDHmo_ z&d;jdcf|p@XUjR&NBx0m&}g#fdU2BsHgZpuh}=^sxiW*{tU#%1>+14VZnXNpF_19LcuW<2u6u)xGSyUPQlb`?S>74kFK+b8xt-cnm z-K)Jh%3rat1{!TG~f=wgGpG(5K^2f497RjnV<$RY{*QL!CFC76ZGcT6J zF@=r&y~GMD^1?!aurDXiFfLSFm}eFv8^^5FuM%JZ37wHyLVFMR`Z^@w@8aIOz?OX@ zE@@raWu*qUNS-t|hI3JrgjJu7vH6F!f?iiXsIK5AQeoO5c}X&F0_D zcSi3e4z1x*3jW5r!&XaF5>}A-*K|{|VF6L=I~!SCK0h}?oYJ-Qu!sjFhJVV%{}&C^ zl7779@vi-tMn_`HypQXa5y%(#l9Vb;&0{pShksXQVzQxjyfTr8%aS5P3x<48nz6!e5y*-j6bSx?Vo&ZXF|0r{q4W6oQJU%NbpoAsJa zP2OcRM?=+&O~KbNr4q&=n-lMqpm=-?Sg~$HvP+eq$Js?ZO$`yD!|_K=Zo(H1sR7@h zq6g4hl_hRC?_YHhjGM^q+IyVqhJM83u(8>KIevF|5L1;`L~D}(HhT)%R(|=?TG<@v z_<+R|cIME2^_G#;Qr?zKFiUX)tT_BiYqCqjTNl{DC)1PP*R1v=*aK!Q8g|je<;2KH z{U}8zjjT5Gd|QH^xFRR6TCX+;JB6EBKh7`vD`bRr(P|X(ssBhIL-1Yublu<7(9qt* zQUT^G;t6xUoRhOab`>jWdLZdJnVh=6T0vIWOzyLSD)dtG$`n;-r1P*EEFqq>RtL4H zjYjP?o3P$~V~3WP0x-AhSEd1Rid!e2fcpefEC(e@|w z->_8Ig&01DulQuUp742<7WP)WQif-(=OzLtEVa#z=mrk;lANVP(YVogMhMKUC(4g7*VGA*qw zpqi|<;gs@cd`S{-{~M1P_`qj|I4&sa`8MmwR^)UABbb7`pU$(G5|AG0Lb-o^rs`fe zs?11=x*8L0bjDsX>D?X&m*nKJCZ}M#$yYAIF*C6A{g!;KOc{N9G9Ku`QCg&9u|6P5 zPcEZ$*eBwOeKd|>bE2t9hofhgQJ|iFg-`)I#*?qrITO`uj^-5fNZKtg3JpzfHp(-7 zAkX?0DFkn0NGnJ~IP3mVn=GgHpBhVf@FOKm*TUr=>9@!L+rk-rLHh5K#Q$*|LDRHnMxk1N$nU?p0B1Y4M_NH(?R8-?{zzKs z1gEAgt0x~A5EG`;lJ}*Qt#KO6W4=s0^!}85Js%=Z_|sgYD8_#ksc_>)O@AR8XVW2gScN|v!g6CKIA-KC1thEZ1=vdSCeS1$kP5@_Wk;} zC>>4RYgtkDA$KO%r0J%+Z$$~hGfTX7by_#;8|P!kJ3G?8@_dpYK@<_35gf?gH+j|W z-8R%Aw?Cc5V`Au}yi!=~$dQHpcQnC;aglf78 z7Fel?LE6zLN7gt_Yu}mTv3PGrGfZ$?E#WF%SL7WR^?D`pI>uK?p}4eXyzdNddwu$_ z5!o(!rHFaR$fra&1aoAF*S}Opk0@-|_gWz!Ks6dyyu)fQ2=@sAN-&1Bd?EJi%z%?@ zc^R~%m7wGM4NcW&lmORaTynu?0xxne;`Po?dAXA%!<41^qie9TdhaK?a5?IHtTPbl zHiJOd_=QZ?ZePjZc;}KsTgSf!u0Ls=>I#b)4DG74J#m45=#@3BimldanlhN7O|{!j7`bS8YV$GMwng(k+2RYsrF%^FPAK z4X!IZieNLX;dWSIV3l?6mnkEL;8(bGG4+-h<&VBZIzA`%JArcrp_8 zUTI2`WUc5-{GRCJ#ix}UV}C6=X3S0CRdfBQB3HAmJRPU{?Km)Bzbd%Y>pQgMaGxd4u@g!RLgAK{rNReW1y5MuC+yNTS?3a3aD7W%IV%bk(|HWJE?>^6T9?){ z5$L5(t8iE`q#jh5w=zG|k=$b)sB@Bi#q1+9Qfv|3q~Kb1p1fm4EYU}uNH=KoEGbD} z40IF+a-2*zSoNsn$WGev4QtMP8P@h{J#s82&bx3<;5cCh&ko%Iot{$f=oQ*AX?wFDtC_Nr_ok zLoCzfgS3MtYA0d8nQno74!XB(pr!l5rZdp9p$Q~Tj&`* zAx$fE3H6BS=Avgj3&|5*i1W}ZPUou;`=2t%R;2DbMC=K}?w!b7_qoa=_~hnG#|_mp z$?welhdfdBhe`a>F#m66&@mq{B4|LC+Z?#};qb%KcI5CQ;J4{K>&Z{&$HID(A>0hS zm+%ecKkS%xY|CxMCF(E7 zJYmGAGFb)Cxa)Y?f%ThHT2a{oNP`3OL4aRlP%_cZHw-Ys`mPfPgPb}J5^S{wI5LVF z>HEV}7h*n`)f`y!8O|+SQeRh)0{eprMGS9Xq1|j&@VF9Yuz@2{E~q#td3Nezx1=Ky z!&1@W7Gv`Z)fi%r!#u*_(Ls09K~FXT;$4h8FiZ>0NRP;b5^`U=rp{_bJZ3FR7@6zW%s#ET=%UjoX1dm`K-jIl zA=|kRC#`{oL$!j+vgoSYLa^%e3Bl|WZ*hI=?m*mdMsM~}4;&=TvsMuFu$o$_B!8Kr zbTFK+5n`Dt&UH@W-eINw3{Z;ZU)q1EHMOV=G#Ww190#sz(75OHwN(`KmQT*7uMmlu ztD|f!;p3m7UP8l|T$UNtv#y|rIz+i#kT5ht*q?NruUeKi5%*+C6JxY0w3jN{goiVC;KugOou6!G2qLRBJMox}ng#p(;!nYv(1F(Xd01x1vT zXTfJHT$1XkmuG(V51ir2NOJ<5QYRNZb}fUSgSNFmc}^YXkEd&N9Qc#a;`E!8{y*4H`NpU~3Nn?vIgDED=5 z_bFj^t?LtI^lz|4WHc#3lbiJ|n~s?evzMaI_3idPl*wuUNBl1;{I+D>?V=v}oi6}@ zpT6<@(MOt^nx(%jq_@gE-XK>(4}#PKidqPezcCgM*~2?e9Po-w)Eb&f)#mr`ziyS) z=p3TRcjS!*Xe7`qLq>ud{N?aUxYtvU9a4m&{Jwb~HH8~ys(#n{v;b&bwI$Trn@}?0ZP7{99-$6a21=KYLmW%qbVN>9A4cv(Rswc{6-fK*^ z1L#t3-q*jjsiCkQcO~vRb?XZvgvQV9k|Xzn;Y+0xWft+b-@H90(nh9~#zi|Zu`z$h0}6z}-!gukIMm#*;7f%DH6o`y^t_*@jc!Ct zkcAMShB3v=V=i*LZXe0NsR$i>0Pu<-DAHONPAJ}s9b;?Oz;0ZjEcGWL44TDz7~qK8 zs}4T?J7xUezfy(b?*4w4f0itP@6adk@9Mx2ijx!>=^>cX{1{5a$o1m3RUa{ZSMe@= zs+)3-9)`2@WvHbdA{R2BCI4q=jcvoxE50!%v1hM3e%XdrfO> z2J(%+JpUkR3ME9z`fP-lZq`92VFS%wB8&@2+nCrV(eJ)I5i+p`Q~n9*uLTZdNFw{m z>&0*l28i#1F?XpaQZo{4D*n$&(jzI0J}W_6zT7@|veW5}ie0>wVWxtQ_E60&#@y#05_YK-8bgBNb8C?wD_e>J7tj7=g&5igV znrB|)pQ7&W?i>1zQWACZ;Y%0V=r-Z%9fSAUC8)_O-0W(hLLMZdM9W7>5|j<1k2ZC#7_nC z`mF~CJuUCeyQdi=1|9-nsTX>LEOelzPg_*_u_wblVG){X9P&`QkGM02qyo{cCe6)` zu<~a7YlVmaRTQ5oxgk5>K-!t37tkQB(LQ?#Z53}#v_1d|ll}-+Y9ZW{`4save$Kil z!$`eI6S`mR+1m5(D8BaYU&?{r(3Z5{hnU`9Wj2(_*G+!%Rw%~pWFT`M+KvTyqpTp z=mWFzNJ=Cvoi1XkmoA5Lx^BEt;3|1kbi3quH4*Pe7nnFxR%gZ!c(k%0@QN)6Yak^v z*~N9uLv9rrJzj}}R}zyU9O&M%l}A$ro^#pdYz4PO#m49(zDXg-*1u9-a^wycRIV+L zmU@y!g4Br4?PqRJ4!YtEXFK2FS7p5624Pay7h$?Z9D9X#=vh1khj8=ex{$Q1rASVn zFKKKl%JVBse}yPg?raQro2cGc8i0K7G4MoB`6ho*k(E zOPV!icg5v7z;MT+lu2OU$>C~K|7Q=oDfi#x3@*eTMV$`X9&+C#Nx}=Uk>|Zu#o<>L zmE>^Lg(X=)=8XVEZv=Y{E{qT%x^x9vx^3&VN`}kVoJLLK(UgM((>bw5l<6ci zKU_1e4Ea2aPJl@iQ2NUZI@b5IIar0g6JGA_8IP?JY*IY_`2{ijPIQq!ToCUN<|zRW zAP4P)(w?qtn7Y+?$eTA0$z=BKcp@guKU=@xAs&yDa3#tJc}m?ZM?c~NiH0M*qvXwYAq~GL;Q7UD#|3TKVi$xU`JE> zK|T6IE-6a}7^wu=tj4*IhU*s{nXD7l?jFyI&_LkL2VuW%?{pQ3Zgdz~evQu3mom@F zGFJV*#NTeK$_;&#e{M-|mk$2YnJku7a%OBtdphhRFSDAxwe( z)4nStqv^X!55pqUBP9B6vj~}1wdO&j<|nHhDqJAWPZz!((3QW#PK&BF2`O&Amc3D( zUrcc!(u59;3Pb9L9nC{UR2)bDL0u-Tk|FTfYlUQZq6} z78l>Uv)$=mp@;u^Q1+wsy6uA7flQm&ajKvL7ufz66Hd#G-P(=`gUiQ;!4){fz5v`$ zfvvR!P@Y&$K{$-vX5UgYfwq?IFLP&jkM= z?S1#;--fr|S{Y6%?fBhyC;yJ(hh^sy^F8v-+6@L)5rM)-?QWngcj-@#Dh^`1T*OY1 zEom11Z+PJUd7S*t7IeipDN%pyp{B9l@U&23 zb9fo8$uS~s%76O^Y5yH1dZ?7-~T0IxhO4Sc(RsS4^%iEE_J zsNdgl`JnHyHJQd+nm@uV>z`H~5c8E?G3M)8UaUVyKeo$S<~qDIF^L#Wr^M{(P3@f2 zzrjp3tQi%X)-yy>ur<%NF+0|p^(%AGWq90afS*6#5YO0 z$$wBOohzv%zImM!z&XAdr6iVWZFGF;jruLx7SrSEb@fs%GmcO+AEmR}Nc!H5nx>Y5 z1W<8+;G)rWUbT*r59;CvbZFW@qv|9ZMkH(WHoE_-w8ofrw#Kj9SLYI{1A0qufH}dJ zcc^X3Cp*Fv5n}+X1XS$GUghKSH}}7u!NVvwmKbD?j9HQ@^ySvv|3^=y?4r? z%AKi*{85|rG4P1X}^1N|qJvu+Lghg6Z# z9Qx3Ca5LV0}oz$ zBb<`m7XA$!?C`g~%S$8k(#Dd2p7BNvoq(!cmL;6zpxQm}8|ZcYl!aXV{N5vUnpaeG zbPMfyAYECLAr$8QK9L8Yj6UpKyj>qh*kD6eKq;Qxg-uHAE-mclKYO9?=!@HBM^`QB zu5L?ZmpO~V)Hpo9SykQkE8HTRtD{61y{xg#3RejjXXWd^u`D_}U-HH<+J6-*DAO~x&wdisjKd&l4pV})l{@`QET=StPS5?{c zjfk=L>!mJhkk^{b98kn6U#0*e@lm9Ynr|a|Ot_c2vm@+|qu9o{?R|_qowG~?paj!**>$&2z@ge4`+C4hCDDM#Cg?dAg=K*NP^R*yk(RHZ1jUAA)M_o=euIC? zZG;NsPs4KF0L)S(m&riY&fhHtX(8`kUDrm%&QMThhnLh;II8J1lsLs4;mxiM zwDzZ72=V$tGzr;2_+OUhyU2~P#X#(iIV#7ShVL&-BhB@}^_)szxEnKKl6Ar~sNJL` z1wwg>ORqeAsmDWus2ZD?8e5~}HZJ8_Z|d){D#WQBY--5WjQNuB}T0S3AZQnrGS3aZa$JIi8es~S9aPx;hU&6kWeg!eXn z>sh?hujeGo2d4=UUg;m*t86^Fd~?kw!};|lD;F;Qd^=|*QjeE?R*xSBJX8Kxu30)y z7ghY@n+{idsjJyEsp8FbWxs-Qq-R{zP&Vu&A&_T>Grr}zccrwKMSm8LswE_oB|uu^ z$AV|)EBX0^5_!pC>zk}-7(NP0yowaMt#gJ;>=Z!mj%Za^B17bV%zL~()-8%?jcGUK z%dK!+dvL>|k_trnu{t@@pYtv9ZQ3m1r>A!?rQk@MFFbu5mu1o`tmNJXeY>|-B$5B= zlhvTjip+NWp+azYI6jt*xO*H5d=1#$(YSv7hmoBT8XPOd5PY5Ht>Wt(B>@RN|a;SXw(@LFs; zA{Pl)JS&V;HtT2tNU832!B&hdlsY#W~#5(-qXkGiGVG!MP%1JhObX=&`U zVMeKh$!zqSLpYSGo#WtD2ny0dZkXqoMUE6_H)uC5`P6VJi1cmT%DH|12I;I=S<8?z z`qMsTrh?~t97}xJ+o0$S*=inse&Upv;JSvhJHERg-R1aKQbsrI8GlsO)D^Es0`Qe0 zXc*%kK2y6=DqFGr`!X8g(8dT6zv9y4#|ZLjYXT0ma*Y-E4ep;NO)Uy<{bZgp#316| zk2c{i=8Ne-?~1D0|FXY0TIx0v;y@FcUj@SglQQxHqQghRbnX|P?WL-a&%F%Jpc!NQ zpdM8Y3oxx-c*rCrT!`Pp5`CDdVfUVWB>p4S=HF^@y$Pu>r&ixF>!|EXg}4dRy6}A` z?&A1WW7Y9?BhObqmSVDDN8;erw&^2^U87UpbYk;^`y4}3JlSQXQw%Augh!z-YV#0j zIocUK0RMG97Yh&w7StvKoGcv%7L0Mo(xpU|BUvt^FyyO6($B)2)sT8RpK~qH z^QXECcLtgQglXJ#AC(s7(0ITDe|Fz~6+=kQ4vrH!CUbL}$04ul<*Ghu#vIO71j)^b z6$H(xrOcvgX4D;vkzd?zL4vASYtEbn1Ox?KtBLaZ&S$NsC(H?hf;vl%P9M&iz4b&4 zF_SU~tM4%gnc2}<)6*~2E{wpV%Lm0%zRYm{YI5ul;59x!YGQAx-|8`HMWf#@%FAIE z7oKknr=XIOt=6_jevLmJFEl6-|27rL@v9Rrs7^=F^kiBmp@rXPIs|j#hMqkWR--&y zu$uBZY!v>z7&YzOS-Fzgq9t;#$iUDe6x|=5`g`dJHf5H6%QNc1o3AcS(vGaFL$Ipu zVvw^SlY_P|SU)I6k-lRag3E2uq+d7Ym=`!R07(I44xe`8AZP42QtYcx^clhaaO%x9 zFW!l`_aEZ?){vzcVN63?lSM3sWyif6Rfrnoh=9xUl+ow*`4*(zg!<%c;<_1TMNNEL z!R{MVpR8p|);|QvzmyFOVw`y=W^N{R+jYgfN~L5MM^_5|oNck%Hs4vt^sm^E)X|w+ zFRKW>hSP;ROWb>or-C4=S@KY~1yqvTYWCht!4v4GVFmU;{F6h**;g%i_6#2BU=B?m zh%9E%!_O)soy;BZ{FNyyGQy(%s~f}Q7y*E*Io&CQ!0 z*g@z}B^47iv=fG_ju~%(h;l7=6p{=P^9~kC z^t;gb6vb3Xn$1+ym&*s!OJ)8vn)3}dwQqva(TzKOp`K)sOCu- z?ioWc0sx8-)%UKd(?9d-9#4MpYr{0LMoNn~!2Ys4h3X(^R)wNBRnP#)d~70G%a7I% zmPm(y?$ini^B^PTUerr(;6T3FkyrYSPI|+N=8YxAJ7ik*md>}XaZvUVWc8TqD)a-0 zAh8=TwQ$fArTw%}TO3U7(B`wRT7mt>{_&Z{XDEB#{=n^KoL|0&Z0j>sqzioan#WgO z>CTLOHgq0)7M75el^-{cW^rjv(oraSb$&t_kEj@eOJiN$eML*W0^7I zcjkHS_ul6|U-#bUd+)D5=9M|~`J8j!`*z-EZs%=mxGK0H!Sx{cZD$>g;*JjJzVvXt zwzT*W&ZV-DZ!otF%sA%cklyz1DztOaJ8yyjbLP2R{z1F{6l{?H6FXHD{XN^J4jW5}b zXdu=MPD3rd4{qii&D)jHr{Y&!65nm#N-pdcQY8#nxhkHw9wcMAq)^Y(dtT~nY$*KY zmoF;vd+^NYgNmo4AK;kMw$~j@}mES#79dkzYfX?sa93oWQtRG!|K9RbUGp;~cvvQu=iNHutS-mH`xt8v4M^jQ)V z<5J^*>ZnI=kKZes)$dWHCrpiJ>$@OHu!LmzC)u;=I9G8Uvgh@QJUPv(^3AFW>|fA+ zS?V$~;ONCg%9~G|y2OO@3c-<%6Vjlz{Uaj~9R28!#vH!RYNgYyNsDi)^cPRleP>yu zvg)JrWi}U@f>o%f+x&s=+rQHfGvh`)2lP`Ry zi}O$RQL)fk+G9$^@^&Hg8nMHc3io_#Gp~04qr;hnUsy79M5@M$SbU6*e*1$Z8Lh`( zeOSg~*=jhfrE>FTH3g5y&rVPRn3!2t$9@X8t9IwkTlSwd6t&$UZ;PANe-lyD+MaKV7<+ zT|${$xIBrO1&Wz5TP~xpt|Hjr9lBrI1p*-?!cUOlisxzr8P4$m!>GP0FYwvo*^!S}wUc>-Mp1-UIhZ3iQ&A zylwvdFkeyT(u2>{P@%2e$KRYQ9S7>qUCvCOjvls)_X&GpKPJ9EjhC4Mo#U$^prDI# z*_Rq{7B~KDr%VHg8?tr-rF;z}s>po|ynZge31p&~X>YB}eXn)#%+6xhoP&Te{?oke zNX(5zC(+D9kV`(PI;RiVejzhn% zdfaaVJg)bpAxR6KETAK*@Q3=R^7pSE(MzMA*Gq-pGro;@^?YGfMk5Q_{!;OV-+oa= zB23Am?P#H|$!h&5O)niZliZwwJou*GE8VjaTkF@TRwoZV?SSan0X;^oH>SC(@Iz(} zWCersw)+-@M^1~>PANxTIxfn157f~IkT~1l@Za8CgiPiZ^k#^vs)3w?Ugx~ul&rX_ zzK6Z03&uurt^ET4xH4Ow|AX$NuPg`4W+Nmz|{+=RMjEx zn~m)uAj7>Mx47!CHAuysCMtxq!3lTMUyBx}F|#ulKn|$9U9?>agQiR>z@C4*wCMBE zRYCnmGsYd=8UE1$l_o6h+bZESf(pn>GzU$&tvBtcT!)h?f0~*rHaje?*LO-j%G}K_ z$GM3IVz(|H<%z!*p!trFnaH0MY7KcQupePJ+bs^|^3UAg2mE>KY>}c*=vdQEw$m553TOST zHEZmk)DNB1aLcsaYfy)T-e(f^$`oTZ=zALGLc?)-2Zy!chei2=`u z{VnN0Gmu&F7Ip@@bD=zBNq<}ol7WB%RojfT+(%`+qrp6-FB@1G&)8=_O8ym?ju zIdz7&uN=@>$d#*>E(l8m*92qAqk~73>h{fMRl{++%FDMY=m*czwbM8naWju=V1GR^ zbhkT?;yZ;czLbSNJKgymvGw}t_UKC5AH4uLQBlIGSTVJR?eI++O$+E}xU1;rbM-p% zs@$VJGAgezLN|@ApeZ3f$?cv>mJljGSi zp60+{`!>b$FetEeZ@%NpUJ*;Jl&S#E5qxQhl~+&ni3_1v!uf^?>|@b4A~$1n76N(= zhT(-um1geMyBsxdulYRI?G1Um_BwSSeObEw=R}3OIg6B-OqPGgZ%uC0W&gQ$kT)3a z!Y{N8=8uPj#QMKwlH={N^*T!aR;X`RB zte6+i^5OOZ;yw8hRw>_PPL*uV%+Xd!3)NB69&+ya(_xJS^Vo{P`;DLqEbApJC~iwL z8IjymaqYPOMZg$v>e%I9;6`@k$}cTN5N_Gx>I6qS&{E22J--heL`}tlGQ`P}gGcxG zz0rf&l~s!4Usn@HF>hU_sFDiJe${zxwr7G`C7NxD`?^+~jfE!BPI6wVh%UB%kN`cmtj`I30B(QyFQ451P2wXs`=6$RN8rlJG%#^O z8O{^7dU7+*SKj)+%_PKMQ@-?Oe5&NGsimpFT{g}rRo@{^bj@j2nFY1@XZ=wnG%Hqa z^W|;}qYISputLkq&`eroU*B4JLOUuQI%3;@?U&n1$H>Cc2;U3GMl4^1(9mK|8r;`F z<7x&APM=%h;ZbRf@X*En(Hfl!(Zh6!0wl_`X)j!HYGNZhtKbu1U`iOuXU^(dvRgJn zdAEp*S)j;y!F5%xaiW=rc?5l9<1_nM+uOfzdBA@xRO~R&aV8#M}MAz=eT#R;CnonJ#mI|EML?MP^gWxKFE-@M6iS>ZQT<>L@^KIJ@a6t%h?A~ zmc@SFe(;@F#j~v%sF9xUaK9N>?>3L&bQUk%>fp`h70={IKNoL zge}%D=NonTLytm+LQi&|BZ;&EeB>>cIe)EJrqFxbV=Eu+*H>fzlb0n))Nv@!)8WDj zty0Q~li(eNlSiKRKK9C;qg}rijWmL`4_}5;zy8lmatx{eBWK0n_5l;Qz`QfOETF3_ zh7MPM?e0q1JK2A%sA#IGQqKT<+47$ldAtqzD^0$zfN+y3hGHE z(p_FXyQ_=5QZZQ^K`5U7^&WtyagL8Gv%U$YJ#%poo`7a*Su8z6x+_A;* zC)&LlcQ~Dtcp%q^b$)YmX8^&oD}wvDYJP~>X9!~0nz~wz-^(2_^)cbxem?!p4thnE z=~Lq^5pvAYimz9fp^+624PotM_58w~?G5A`eNg&QJSiWq5Ia0o?>iqQ$loIUvr)yf zXlW8%rOm8RaSahZ5SSh0J*pETDwPFMWbQrETU|=9>s8cr8qd?u?Al#>3-X}K`1hjT zrH6A!|6c~sHV-Nm`AgCW97mXKhtTBNyG#SI9Uc!^1FoH6WE=FyyGVBggdWBAKNt14 zOivVOqq$c=GdwIq9e6fjUd(F&J2ttpa@OM4*s{P8ROi-(XPr2kk-9>@LJd>x&vH1% zL8}tKjI(S~<{GSn$ki>O`E|}CiSNpIy>1yhxTHF4uML-1eaHeiGC3Gk7`w|6`TE>@ z3a*GxO2x`}Cz?q|`PX2*3h4(h~pXnkmd6I8~JKFW^ z@r{|cjqEbxiePrDli@6wA3rz$P3Zr_L;t;|2*xlx;xdcl%25t9SHV*9eyq9Yp5FJ? zC8p;3c3y%?9KWsR>QQZZU?ra)8Q(^my2)Dcn?b3j3S{xU4X!W~s08wvZ{>0iEv@4T7pZd#I?`QB?-d}1c3zY4q8KUJb| zK$|Q|K97!_)Gb^Qf3_ejwlg8OHo#lY|0>j+df6Yn&e;*|;+;EjwCFouK{NUJdGFv& z;VhSAbJS0!+_Wv(=UIl-oZ1uL&8U_kr8dS4I-z)QXh=g*8Sl+v zE^xGsM1Hi8^XjZ~U$l7|Zt;C$f)N6*?_HV%H6Ps2B?IXpZd$$ol_0EzQ+^4Clk@kk zgzkW6p}*zaiYBz?y(={7T89)MEo_!y!SJw?@9>?0)`Jok44S>LkjOOA1E{@|`Y7He zk;95pHvJRvDTw*Bo_dZG`uAVi_sXm{Z*H}xy>C8jT;x33kUQ8{chR(`;snC&MZm*A ztl1*!Qs_!j;bzy;q7irf%kYB#jbtk<)q8h>go5kkpFUnu(DL2RvbPQtI8C{AZizoV zOayb`#=RU|cy#BOa`CjTj!Zx78gtboUx;UZbXbtwfb^pKZ8C}#epzi?*c(vbii&`# zEdSP9o4%tr>GHu~=fZhhSk^nJdf9EWfuWI5c_4!Fefy;sOG8MYtrl0CdXIFnb08Pw zAwD_jMIXDswU$!^%Ip3yBHs6>eCBOg%@zO~)>@Yi4i9&EFDCLPNFm}}tujf3ukPR= zcoVHBgb>JnvfrAJm&}@Te!`3XJ6r9I{OQH6NG%2L!198)6v9@tqs{l}Z$tXGMQ@qa zRsEJ7+v2qc{-lS@0++M=pWxg^5gU-X@5vaL5qz74y8+`tqLU!!4o!Mi5?h6+;63y& zWP^sCg&eW9?_o|M@uTGG(oMEINgw)w3J@sFuwx6u18yP5t9EXo$HqBOJI|-)z7A6v}?^)5c?UTU3bw?|4z?WpnaW#!(2q< zJ^*gGFd=g088oS(TLLhvtaY>AH8LNA-KbP|MWIuVVbjKBpB8#gf=jnoNA;x;hc#uD zl^s>HNiI`^-!sGWOe(LJC_@Vu5?goUdAn>kBDlBuH52CRO6@d_jEt_4UoBVRnj<*? zwSEQr*{ePaY}_uAKh;m1B&AjQr;n5yCj+r92gTCIA}E>2jzzMsD8DdX=1PbEc8qaj z0UEo=4IB1GPZu5m`%;)zHR$+Tg7q36+V9foaY;Sw%>lfM9pv6B;d!RDmOeYbxn1hF z#7t`DMxCSF`x5w(hZuC8Q)Cdf685`kixZChz^>?Ltet#qXp?ehlG^iWOUdGWGv&|W z(7B_IdjCV!&d0Ob?4o?lkCvYwB%m($<^LuO*5@ocm>@TKvkTS*t@bDE<`$3e`YY!F zf>zirG*5h(zTNFTmi~6=leYd9Cfo+F)^rNI&GJMa7Mf&g$F7Z6nshBdjLf~G{fJ1IVMdyV(FupUOcRXLSlQI2zajHilU@;-&$&1*yj@)N_IQT+P0WvK_m_d# zTQ1wVW*Ip-8U*sVTsi7jpme-q@7EwzeBaH%%DXttjdUTD)ISNM~Mqc(Ywh$^R}a7uBs-H z2c0SA01x*6q)U)Hve+#ogqBIxueaLEoIV!Ksmy>6m)Fy_{u@5rx%Lh2f23(ryc6Gi zn%m-1I%j_v)$MXhAbBt0-5c+%2&TQrjY~4mQtnN?Ab6M9YR<4MwS{r;Q(g3J^tn(cqwJ=O z@~cpV@X!pIr-JzsEMQc`m3lP^r9E%dw~OOn5{hRIhN=ht7mWzMX1X<;5IkXX~T zGY$g(u!eoAR@t-?uld;udg*FUYBCv77`)Vk6GeEDwIDkQlVN#r^)|1bG}e4c^3WiA z-M21r!WF)=gh$6#wAj;;XVvSUb8R*UbXqELcsSu| zY2RlaQRHD{x15)DXK2CHHp2gt=!AD{dH%RE{;50q1sMl(pyHy0G^3o$)WMKP(`cz( zM=ysQyXm(pq_od8x%73BY2LMEChm*#{fC`jM(%FNPRjDODgToY`P-jdJ0zqSRn#kq zV+T7)f+^|ieLJFuJLB#8KE+BqMW7C6+T5}*558Or)(qZJ9kD-|CuWUT%Nz+vW4T`# zg(A$TzYUBKq3fryZ>u&~d$&C0wq)oMOTgod)vrorxv0$P$m8>N)+fi$P}OfVnyz$g z4CusjpE`ZEXvm`_S;B>6Wl0%tKcMpwN7$0SuDsn8Letf`c)wjp6nPbh6i%GDHgmkcG#BLsa_=khr-ef- zU(-OefjqP(+Xj^!^zLX;bnVjQ)`sd)QHA7Dc3xf-Cc(0J*>=~WYML(F;RKVbO?2ug2D7Resij8~K zzmkUAhWSO!JrAPY_QL(IESxrVUrdZQzdX7yCCHWurPxZ`ZcUgH@`4@Y-VgOckJ(x@ zr5i%#XTP*DcN(o@A9l(ra=lc75!ah?%0|r#DH%hoil<$4ZbSB=2JbFddSYsA8&cA&(;fz4zasej z2(ie%*z1p4zZwAdkdQQNB?PHiv=j4Ot#Vd|mKIa~1i1v9t=?+(7GJP4GOW1~FIrz_ zGPS+#Wg5WkTkkFXZI>)u!I})ahB2#j{wSR&)kJtwe>ANQ`KUSN7jIx_*fN|jTVS>q zXzqnEvq2%Co0!Mkg()y!UyT!;t1i8ED%u@uPn;bh$*3;I(D-jKA0R`R+oMK8Nnp?S z_U3b~2$7?_gc|HvWrs8pZ;_pq^`_9b?;JXkEL@)PNZw=Y`N4c4Oep9yO<18g6$b~$ z){eeTC$fI;7BDpR;(n=$q-JX~Y+ZnwchX5AYkua;Qu2gk|%NpD32LAj3^IWuHkLKl$%9Hz+{v=9f6nb`6>DG&9^9Yl+m+^~ZyF z@2@)d8QkYr=8IE;avV6?IhjQkH1^%ZPV%0N;kav3HC-cHAAH5QRfCka{Vtb6))7`H zVgAQ~e}|J@h01Y~B}I#jVma2nZQ$vjjhhnz&nRj6D2)8=%X!sOmUQoDov_BM%m-F- za^pddNGnMZ-s}iZH=2m3HmS#YkCtt=}%aE#iZp%C1CqVnt4TfOg`j2N~pYo5Q2<9~U2$?&$->1@Iv zS%4oY#qwgB;l*(`C`S?u7>BY@lc$;!XO~&bSbY6K;8(#eEYG6ebSTfnsc?5kVYs?7 zGy1md4fo#5XPN0J-kwm#M?7czsdfysD5Aiik_UP8@e;iBgmqxIl(itY8f{GS89N2g zovIWS>3H`x#3abJFc8~*33zPtd`h~=2_N~&T{mb_f__Bh3|6+iULRXSc0J3=hphJv zaOxOE!EauuhW**Wqu|no0X@-G*k^zJ7+XZ?4H*SPaOE}yU2rA3(ZIbCYrUL5SVP~h zgPHzBp$xrs5$$<4DTsxB=AEA6!w@g5q z8N=!`*fGan8yDdzuot+n&pa=ciU1jr=R&g19S7zcU@#;Np2d62;0cmRQVNFWJd_h> zR7e9>B1>{;t?|=d(tv07KEfq0XQ49{7jK;i5TK+T4A*n<8D=ghtS|LgX*aj3ZhK_5%Y#pdKKiKf(Rhah$n9MLS62&)H9M+@Kin{b(n8`PFDA5Q3TDhy;zZ3qwDR zGm13hF)1dfpJDLSNzz6U0K`=V;~K0x)IxT}udf;7fp|DysQ@xQEAFNrPLNDd&<^gk zMyCAJM~hKC5l{pGK%=R1PvI(=(*^!95Z;5^c^i=1=3{A zTKY@RC?lI*Tv9SdF$~pFYutv27L=gkQedMrCr{8SHShu`h$zR5T2~=&dM)O@BFL)8J(h zBC~G!8|6~2JfkewnwOF_6M&xXOF(BN-$z>Lr?F$m0HD46cdZq~!BL%Eb_^iY6yior z!*w~2*=WEuB8XH)@2MX%c#?DrKp}!WMl<2>P>50kn79+CudQ+$@+yc%<_zs%AKkki zz~TW{0V+yQ+{*)YeE!x8y>?7Ff8Iw3D1>PDx_(aWL;yWlgeaXv=5dnu4N)xL_TUda zZcu3&Xsy8hP*N4rjM4?IbxPVHuRgKyj}%LG3}56wfhV=Z@`%3u76Vrn9L{3q#WIbp zseNnY2oRzng>B=_;>0U{eFflj0iY_wb>Zr9(EdRWP?1kamppEeq8W(gW|Q>U-wqR=%i8@NwL*yT~z+4#)y%2-nc* zr#@!zBq=*-;{`r&w{(QE>gzj5!YLb6@??qKp7zr6vfGnX|6B^XeY?K+NrpEn#>ku; zQ&9GNH7aa(x53Ydw%^MoF=pi>un`>l2AqLc1Na^>{$<{`uE@e_@AnVY9N%37xvK)( zb_In$oxfZo2QZT1Dy9T<6%hpX!yYk0dW@lYB0vKC(4NchI5n%pAlf)1weOIvKdND(ZPXNCH%uDDrU__n$_ z#M|kGb@|~k(tkQY4;FGcorqUCAXvOSt%ZpzD+DX^YZIDe}C~_rfvnQ9;hbbRZU|b-o zO`5AxHvvI2f;F9?zIiM`+Ry@GKl%FSv4d)Nxqe#*f^=)N7XlsRx;rW7)jqap)ZU@5 z^YNSN>z3i8gFR#vlP3JFzsNiZcc7kwdx0KRuyCILR+RqSnlzN_RR=mnksBYiKCSwZ zxOP$-FXGzcz}jC2vXCev5mHXcd##%D;2P%g1%i|SwL!mRpA)HZ0R#SscP{I4p zpcZH5w`9nHI$Clx1)^{Yh>N|U*fgGFFrcOnRD}dC`u=h1h-+GacJA6YKubKOeKM#V zFFU&szooG8^wLs&Vt@^Pgx$+1De1gohOjA~I0`xPcnXgdqNIC~-BlcPi56t_3=PXC zToGQ-{+k2g6BTD< z2xlEi=v`fS7sg}CW;Nm_SSmBuJ7Bv6umj_Jk)q}Cv1qsqM4nFL1G;0`$BmZ4A+CXR zGdCyv^=55NO?rL4@DzvF#DVaVg^?YUFbsi5A_+^wnXS z)O`c5^?ntc&>1?X&`pjE#0KvKiTR`%(f}G>)-eq_K|%mi@AVfg6Dv90SDl~k@ndiXOyW31G*fXRG&X? zkXAs8tKB+qj@b}!{E}TV4~v!ST|Z1XVw-6ci_P8avlOMhv|$=IOMVah4*!eiR!2T3 zuB@fPAAM2g*#qPUMe9V&XgHDLxWcBN488@Vfcm}$lNs7UvgR+LXvWAB_t7o-Y zZ#;R^;h1$n+SJCpK9=fIs7NKX9ymb9*m`5SrhMu_tSen&W~q&(9dfZs+BPYclj83r zCPF({L|B6#yxUoUG|b?>Nh2@EA~9=XJ|Do*Jr%4nXUnewPH-jV9%s4w3D7kkXk2Y8 zwQ4@)Is{?R0u?hhHpM!+haML~5w{hNI-#u>-qWQ^SGmfoA$Eb<4UG-X@V*0 zBIm2D=_$bJ>4RG9C2^h3Q+tG4Q%9*f`}BkS>6~9bviH`|57O8n?>UmvQY3?A0o%~P zk+E!LMHDt0vYCM5Q1rWP>206(fz3bC;QsxV+6M%yqs#B%FC++~xn#gd1~XIu31SvV z6ej;&%g7+;9qAZV#jI8ME?;Jeg&@6X?3)du+w9XGtZ$_ zzK)+aee{W14H|ikow;k0pTZiyH-Wv*%24|@#M|R}nWmdS#^sdpiEv7UL2V zZZf$u=Zg1oamZ|v=aS)Y2diCAxgsZE!FBAQ`i!l!2%`_wsSlppgXX#Jzdpo!h+n?- zFdxw3YNIJ&KQ612Afj=2*zZg7mx>~Y^$nDa?1R$CvtBBz9g^kc^|oyw)$jcNoZo4;RHncF}?!B|@GIk*&}Ll)mZyUeu$c zZ>YlVw8#|LV>S(LSJz!Sh-`9Y_oLi; zR6x*c<1Szk@j(uEV=>giDP?ghj^h4O+k~;HdfP>6asR0-&D1O`B6wgCn-X_pM8_zT*l$=|+-&MGN5HRrgX1)-ppwb=_@@$#~&WwiW zHd>H8Aw!b6e-WimKlu%{7km>7#KXUw8hvdmi^0qhcyT(=@M+C|CF$TPn;DM zy}gU$Cqto__BdAt5Y+y*c}DSY8oxEy7&1d#&MtOL{+f+$Kau{m*O&;f44)A=#qv0P z9Z{LKP`&_H&Ve_J?*FT$oqq_DyD8HtFd%St3UXtU6&&+sD=RBakmf@}p2l);JKI6^ z%)eTkMtpPj_-tGFHDz1d=s12HW(C6a=#kmyggH5@gFKKR7MPVfU}j{y)V}BU*tZgw z8zFlctqP5ltP!0Zn7n-38d?~HZ3*59O=N{EaISPCGviVikCG#0llO7a%O4McMOAXT z3s|X2zep@eF$V`3d*q7QiZFAlgbRt@yYkg@osRlKpLVicj}#AvEZ~tq9bL{BcK#8% z;@BEKMZSLn_Ycn3OCx0{47Q{Y@RzFkh;?~Hk!@sPpyAQya2+Y{Xlap@G$b19(K>~H zagWo2<1b4hP?KxINc5}-#kATy*EkIk8IrIXw{ z!$8|lv&5A?7Qp;Qk2rHmh^dKTSPIOWG17O$cnz4@_0h}vN$_@b0lzv3 zT5f^=S|OmEb208v4r1icnph^(YMIsxVy1T=!*u`IM6AG?jJ2hKWa@J<&jj$}HG=(q>( zK-swxWpjb!l&AKT2++C90BZbvQd=fq&v3by10j|G2)}D1P6Iiu1l~@b&XaXq#fnlE zam_ikSyzwQ^9gXBI)z)@%LrIe>zQ&vodB*75QU0ej618JOSv49U700BLP2T*W{U6) zso^DN#Phz1ksJW$vajzwG3Okh1u!k%QFQS*z76Om4vy;v9tZCeBr+7F*R_;xLqftH zF_3Cprfnut8NG*Mrl1Cx@t)r*NJ|i-smpDG#uNc3hKIR-U(Pvy8z3=YmH7&&+~Fn? zd!u$*=by28f&>9VfP3{+S;x=)i-kguxbOWo2H`i!N)beur%5Bej9m)E-di&n18>g& z(ReEd*IuJMFm=nB5`SU{TeQtGvj?QcUIE`!)If&s7@#T*f+efhhuDME)1Rp91PL!a zg$i-zx3UQXARMnmOPreO_YKd@yCB-?vXglJBk%e=f^eR3zVb= zHDG01ATyBN)IJSMOf{Z&w7-j=hsf`ZatYFX0%)E-*vX z3RB-CXik!95L2l(gNYQ!5E_>X@ppsq5@g2=f}93Llo*lD1nRXFXxlAPqKMnB-lH-* ztqGu2gbf-4JoEw}4dh0%4(^>SC}gFiuwel~)5$l&L|fh*u+ZX{W~pQMl@6!^WLz1J zMK(p%W!-mR*U(tm_f1^WK}v#+*mxCeIOI@zwBEgzCVwG{VveW;yo4%<8iE)o|4eOb zO$RFEt}5JAz=KQ!I#z!1CQxC3>B3FJ`!60RU-SUvL_yr|c%iCAR(BRiHqim)o25Lw z)3!v(mi}79MCvtAVV-iKKqb?FE&9F$_kDqx$5=eIFVKUPa4!kufP7p400rm1$d|z5 z_J5MdgALlL8pjP%sNHFJPei&vDD9ZuI*Da4QM}-?-rd4cE~}?;+LHl^O$@akDW;rW zr+fy|v%Ko>VgNBd!SLq;pZ^Ff3kT8_$3+qwg#g^@pz1xx4boDCzD%$tQNgAzd0u&^ z)Jx+08pENA6&Bvw=kfnEDOb5@&M&3baGZ%?1|%#o>_jw47?`gTji(kOcyEP6kDIBJ zsEw+3<=2iiY*Ly@OyeGGzh;@k7)fdP`X-p>Qu6D363k2#@i=!5c$?f778b?OvHTP3 z6~k7Bdl|GRNdtvbUSX`psw^#i4_Zc02ioOypT71)eah?xN1KR6QBZaE%jt!m@0~XX zNcy(M=J5Ii$uD9~s(|pNq8flPDS^Q(IvjxU{~S%Hy&V9miaEwB+Qae-JE-~!BS6SZ z$j{}1u8AQp$kFVq$?4t-V-@=JHTlX<1z-Ap8XL5pAn7}ncE%xT>6sA(#?YkHq1s?4 z>kVo!t)xT)5kLy<>ivb!*B?wgga>obT%yq00MNI!!@P&o~M(q#b>hw zP`&=#gQFP1qowQr+m&aABB>Z124V&e5j>vgiHlZ!BqY{EjC`H?QUG3HLlmLw9Lx9r z&?N?du+=m8?a2WH0J{l=zBqmOr|kgB`v-fDXa@Y#rh?5If+=sYLvHaUO58ksjy0zL zb8i@Rc3w`&PU3-5@7Q95kD2I)ERUtIYhnW?__MS+Vs6HC|8qr^Q)DU%L41+3ltc^>61{B_0<5?1cM|Vm~&zernzM7m$g8mA!~4_lfdy~q{?a+J;{?BbELn!KE=ActM5&E zNU^MwD9^Ji?rm_(kD=eH{An>0tfT7QTPm$MX!GylAmcONaxmfvML0% z56wMDAsLu4JmFf)=b*<9Z0?I%VpDn2((DOR?iC&z{LJ#xJ$Kx0EE^#Y6l8D{+ioKz zI6k2m;b=KUSMcL?i9EqnAUNnBx`V2eKdF;|b|4AEwT${{j~N7ICj1YQgC|Evxj*T| z^MW$FViFvP59gMRz%c z@O}1HNAn%=l9G7-eo_BjS5&fYyty(%Yy7n(#_Kv_J$tsvZZ)u;cS>bE`jcyH{BfD_ zpKGufABUxF5Uag^fJ7ciW?nIOTVfJ>y6?I*vE^@a@(7UTr=z`qJ=zA7+ukl>j|*%o^JjTSqwMim11PGS@;P<{Z?vzifa<&a1*D@xj7@<9(5iA<5+E zap`L8fdZs+iG6qCprehml!VZoSdHn@ zz_6dXK?{P1x)V`foBzED9HMVd-#rL>_9`KWR4HXp8NVdn7m2`=FATad_!aw$ES3e4 zv(5WFI=MEu@b#jjk#IRevuv$SKwSCK_E?#)G~&|8f}@2#IDtkw1!rfRuiP$?I6w{V!I~17g*gh z3R1%*kyBgCkKbR9#ZT;NCsQrDtY;Nx!(BX`}(Nf1oN@yRR z+$LS)v9Rb*Q>PJnGd|>bqd7ly8F&E|O3?>lH!k&iq-%D&`I;q+XHLJMAXOm(&|RcT ze$f+I;$0sHfz^wVg_?e*ZeJ;MqThBVe*=1{Qo1e zJ#>ah+i|AOn;alEvUabo9UDgZ_n;3&KJc6t3&g*r+Kby|GJbCOj+GR$=_^Gl@tU%K7^+kFWiIEd!^cOdt@*2Ubn`Nh4osV5Sux4)jt zZ3!MOt?%|5?AH8bweZ?_;g(Ux3(y^^LiJ$bwMAF51!JLUCxQ3ON+vmaHoBu|x=g`+ z@vL#42(e@|@|rvSG4e0q4ben54(VqyW=Q^7IkOo!u_#tr2)nEv1l?w}<=ImEl4wkw^QXkup(As)4Rc|Vaxui^C)H#Y-S=EtL! zZupu}#6s^^?Z@j+u`T9otEkHHg2#snwj%4U#t{7tMa%dyGGE`!>g`PAhApe&;f;8A z>>%hj`{tz=FiGo6=i867NPaL0T**SEg^c2VuYgqk?iUv{$OyFkkI9yQHI_cRst>MT z(0|ibeP4a}^MhVsO_bl27fg^`R9Ry3?aaiRB0XQNz9DlGt1m11INBysx!30@?_2AK z(hpQNQNb>ZEZCbb&MUy z*~%r?TOiN}y-90?cF)jAH*=aMtmlT}@WFcdFj7|KDJdzwcYeudIc*8 zvOeAF=%k(#0sp0X^i0hbn&qwHSyTUea5YrAXf)^vc{uX+Az^O&ipNM6BDFBlr?qwE|0-i-1PO-h`hnbv%5K?} zz!Gl1=VAMvPTu>|0@YWc z)r{77zaZ?AhZe#7_A^0m{}?&}wSUXsCpYk$E2=N{&4%~DD?vhXMX}ZW!tJrPlzk9t zT8rB`z{eO#cL61)FRg)#0>%%JU>QcMzZ7?cDBKt0?Yg6DUMrTs*3OL5QK9U7GrE5$ z0A(SA^4K;WH5X8CUs#sBe=|2xf)|FHWWk-F)ReBxyP3ndy^Bk~5{f|Ta<(CvRH2%v6_ zPItH=vTz~Lb)vcfxqjv%(`egE@CNR1zpaDHtg_!{p=p^UW0KvvyAe@@q=zL zZwc+s3qnN;V$rabmCc8Zw_MLKYY0r=1a&Z(KIAhDik!X#zl{g0UjF-dcoembeCD&~ zI9f(H&`sx5uv!kdKBgq#7uc$`b+KpUwc;`59Rj%uTnxczAYpQ70Oyv)@G<~vW`pHvJ@gJY9=Pk zSkn6Kmdeg#+*=w&Sq5b%MRvEbL^299F}92u%b4*yj}~s`+pTWD*X#aKfAl(@XP)Od z=W{;ib3V)a^EsFIje;^Pn~VBDr2Dz2kpcNmXzk@M-M0Q#?#dAnU>0wSRFn)?XDzMh zcE`1H&PKMBNc&IO&0{cOw$Bg0msG5@*RE!Ss|4>>_4S9_9_U*t`)fI*8Vgcn1!Wst z=5Z(yMvD|k>8kh80=D+F7c z2&@tUJiR@~a;}tO7C(Pecf3@Trl&HBy5q``X6YCH(kM5zP<8rv!HE;L1ZdCt?Rd(Z0N{Qc2cm3d4B-7jfZdL#gTAbkL7FYd4)!IO+qs;4ji^ z8r894MTGfFqOH6_a!M!K+vmUhH1t0Sm~$;+g>c0K%h#mCABdgD`EGsy4R(qDY2J7y z)0k@L=*4%wk70_aHV#m|U2wy9R3XW$_Qq1))>VQY_ZmZN)#{=Zynn{Jkj^zWfts9~ zRSOLN14>Nz2=uz$wa8|emLwi!nO)IM{{TG@n89Qf=VUhMVJ$8hqw2a=Y1P<-RTbFQ z%9!Era9Z0mqdG-Mw=q;mbzO=gow4(hjYMLEc1+yv_pC*~)Un*mepJ{k^NzR^8jrqK z#X3B10UskP#GISg@h^_Kvx4DTNnReY{S^tehY3TGlx%{p`E6gP+iawt{2NVCJ5NzU z{t2fHwoe7t|pQA$T!}kSKQOo55eSX*Lf%6y4hs4D70?r}6eL zEKK)3ZPWC1II@I7ZEL}iJ$EWI_S|PJ2?fM4HGMVl3Iy(dPlvZSRNo--|LPzBVZ9QQ zw7JI;idBHQ8Bl?8_^gS;!>hVz3>YW-(o2<18~vP0=9?xPWhiey+BNccJb=xo+4O|B z9T=gjtDfQ4_wEx1+NRi}iJhV1GRx#@t^()9p$dyoji%-l#Y4c}soR+3#dp;>hw0}z zUevWyoxGg;V`~153{N7O${zaN+82!lpp5(+OJ#h;)7ckta zb?mG0M^jf+MgDi(xd?aK$VY5&(J2|=KvuB10wFAU^?@hD!!cTzbH@!Q?&zDuNKo|k z)0;#|3l@0zSEUe@FAT=^Q_SD~ENGWTEpr`Ry#z%)vF!F!VC5XrkLyMsBoHsG*| zE4bjJ*(bak@}Qag)ON6uqq zQ3AODbOj)GMA@qa){a!72aaBepxJ4YG{c(TyRF0>Biyfuk)^734C^! zZw(YOSQJ?bg$#I>ZurG4u%qK(Q_Vdj{~I|{bevrb+%&aI+^(hDq4ov<e~r^=7#=JSJwe zLc(Vc*q-g%+8QIrEfXKwc$I7*o^ zinr~cwY6kcG??V^?=V+0%zXoDM$|Y*EDsJlYYQY?QeJ2!H%IOmB$eb&nR1g#v$knn zSss;;3E3pi_#H8WRXXX<1Xh{goEAhFKXq%&cw)JSuv{9OS7@rYaoNgNA}TL`_?cgM zaUuVkxa0eP7qzd{de9Y4I@eXdw{oG(*n#*;Er|8ilzjbyo!LfamwzJw?7+2ir>}z9 z6f)5N)dWme!XoICl!f~!h(Z;XtC?&2F(x7&9h*bH`M+{NgWB9#a&A9M9mhUc0p#IoAe%0TG8 z>Q(XJHg@5~;AY7iJ`V`t@ktPI_Mf_Tz^TIN%Mm5$tWXOuKUA_rB&OJOn6#_LqR&JF z#@@)Fm^tuX?vvL#3vyO0th7&g#dF+Go0+N*Ujok}R%lgBP*ayX@m5Bz7W3pYecat% znie>XXBdT?oj?^NcnZ`Bav3=K(D*_=@Y);WwyeAFM#0BzOIgy;*0Q&DN&69$8}UXI z-5)h+=fG^sxt(n(q7sX*QkHpHR&%@{u3UcOJUPKEup-RRk`dgXFhd3)rhpj2f!N2) z<~z3q089=G8U1o*u38UBe%j&A@y2+GZOB$|YTARky#r+vJMf+!wa4O*=lXPCKb1hf zJh6+hQZ|X)*05g1)7t7JD2=7D(WmpwLdfCwN9YqC;inKF;J*1$Xj3?21?U+djiOp@ zOBJQd?Ezx3R0)8)4^CnnflVh$EM{ zBjVgq%pT(-1>wwuLf;+i)_q1$>g3krE^wKXbPkT;bpf#PZoo)}i6re}@oU&<5k+Djb<`$L@_aLIaGBpp4-HgD^w z9Dvie_$_Oa)WU=p7-HQ9Qie4|+9BIFme$^5ZTZxYQhPQj9kCgRiA#SvJ93$gU?c=% zyuTfh$8Fd%qn$TBvfxS)4MSy>tttF{amCks5kmcOazWXTJ-4L!H*aeJ%eC=}d2=XT zItU>8Kt>pmS`A62JG`ew8r1tur1(#;SEnqLOGWDk z-Gmn001yr6@@vy=J&{FDX5>>cb=PWsPP`2iLLnM!#WNu!+*}>($uqEsk1>>wyTc<$ z<-}ljU;aGZ)+%=#0wp~)iP2H~5?jmT&Ac3#Bt0vo{SuB=)#)vwfP3Dj`bq$#6-d|$ ziqc~{QEPV}nJRoK63b6R#KMfWrP%z(QB=po17OR#0jRYI=a0|kCWDs)HZ3yKWbT~X z-`PYeUIz(8Pph1}cU%2zlU|f}p91p~Bo5~6rCHZXXwK3AZmE|que)Ih)I%$EWm#r0vuk{my27tE+|MJ zu*UY&-D%uNb`1i4^b91P;C6H7+AKKDU*OTRKt-Sql35Xk6(7l!w;}N5acw47H1`a@ z7cUDoN)3owEV1RemXDiT)Z|3`)Nq#$G*iMCa&`U80y`(NhDV&IF8C3rVWMW1^F;0a zvKC8fYPC}wIg~X3bu#8AGR?wBsOV79@H1DNk$Okui_Svm^ zd%&vbWlgiy4lYVbM{;p^522!3t?pv;L6DyRbe&MU=v4JIR9@GIhrX-+QmWs1kWhKW zYw`_z&DCbd_LU!Qk1Z&}Z}|nd;5W2i1&6RyO|k;TKiu=-QA5X%QXUu<179sqNWbzV=NiV^LeS4O|B^>G5tRpYb}0trOG1gjYv< zM>aHbFlXp0(?b_vgW+vb-;f6T!h-7MAy|6))#SYwIV)xeI{0 z1X2fTZtw|3-67OO2Fzb7&7Oam)y*NZ+d|Zkd$_LSKY()pZp$_}!j)@23d^-?HytVy zQ>Fh#T>ETQETkolsSI_U<~u|$V{oj_teT#!hsv8?b-5!cIie2(?3O^;4dKbfLua7Ofe zXh|=N-oic^14BiQ^w})Sh_$c><0%dd1}7U;-Q8#8LJ~}7r!L+)J;Wiq1Fyp^Tqb@~ z-*e2~tFG<|KeR}a__u7`TG1LYb=^DJYS%sYOg=74@F$)+uv_`>t_tQRE@$W_d|W>P zl)fr6j$XfWq0ptXS9+cK`lYv57md7~hFH9jtzWU91T46`Y_Bj;N9)FWxE0d_{8Myg z;P75CRm`oCD>XM10P_@;x=VvfQ;PK~;&dKlZv!<7y^q8zjA`^ib2w)q>gGV3Q*%7w z<=lJRe*Z<+7Vs|zaK39J(ICC~3V@WWqyK>A%FZ}<=cjv-h5}@$$zI`%EH8o8|<=&YO#+idBwjc4hg}?`xizOpyB_f)b zH&-*udr6IriRzDUn)lu;{Sdo8DH#y(YW8syVK2+8@iiF60pd6|+wvd>x2cor|LBoB zzocBmV=c^55mTcvjXUd`-qIC7ocK&=n4!~Z7{4Gv27}wXls05wt)cX)^VW6i^9U{v zy$VY^Zu{s%axG~o%vAoO_t<(xT;$LRbAuEGG!z`fPB6okm6==xl?*bRS(YtD=unBH z?vdHn*5q$1ls=P-Ee8J!Azel_1Nu(&G$vd1kvp>uItvQ`0b`EmOQueogQ+?-@LOVi z2HQ89utp^dV$>Pwx$`Bld*4xR;jzgfki4scnRRZ5M_JvQ&2nXw$B^|$V!}=FWwa}#pIgLU-*EDcuIZEsck%NQLfxnD zUp``x+bVihunkjGwJU5K@P)@$~u7#3}gS!>FA@z!HZel=+wy0PHI(S z_Y(@fss?^ud#sB+5->LX3<(Acd<#8XN?4HFT1UWUJHovR9qb+3**Y)$Sl%=S;~*zN z0gqt$zI{cSXWvhy55FBx#*0eAl&EogKON8CT?`~snM@y+dN9WyrNJ@dV+_VO_fXO} zy+ve640@DZQp3t&!Cpzj^6{3`596E6f6U&EX1yw<1_UclkGhat=i!~tmTbq~=%rDG zTwz6lX=Bd^$1uj-rA3|elGo1Q|IHCXQv z8~+?02`q$|jsq4=nWq7~FpfA{R*cawnsJv6m^ z0DHKw{b7`=`1Bl2MX}y8=mkPGvwt_keB3506bl!EC6QC)dFJsh5|+{p`sp7uqAiN` z*qZp{ytV)AJy17-_2w<<6*}#0^P^v1G$lXi^+ja*$lX8a^@CoY3cDZj>+5!aAN2Y` zuTQmxf3aMhdXvBjlS6|;8zeyqnZZE+G{*w`?RRSD*DAK3*Q(yB>fi8Ansa+yh)^$H z2X0^JJKm4Xv{jD{32sINcUH76&>yA zo(%UgMyo0+dNLgFDp8`MeA|--*(3Gi)7ID5kz$U)_q`sUcs@$+2$|4NZbUL)U+Nwk zb5WRN_A`)K4l2#fUbYxBM!>4bZ(z7@n(!|gI6I!fj{SXDpz_0a5!Fu4&EQ0{pq|@1F%WeQim48PMK~NznZ_7L`kpvZA2QL75W4YiGcu-l ZNP9y0&&Cv9{0aOs_{DVB{T&BR{~zoDhcy5I literal 0 HcmV?d00001 diff --git a/playbooks/email_notification_for_malware.py b/playbooks/email_notification_for_malware.py new file mode 100644 index 0000000000..020befaecf --- /dev/null +++ b/playbooks/email_notification_for_malware.py @@ -0,0 +1,338 @@ +""" +This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'filter_1' block + filter_1(container=container) + + return + +""" +Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware. +""" +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('file_reputation_1() called') + + # collect data for 'file_reputation_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'hash': filtered_artifacts_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_2, name="file_reputation_1") + + return + +""" +Hunt for binaries with the malicious fileHash across endpoints. +""" +def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_2") + + return + +""" +Detonate file requires a Vault file, so only proceed if vaultId is not null. +""" +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", "!=", ""], + ], + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Only hunt files that are considered malware per the sandbox (malware == yes). +""" +def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_5() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["detonate_file_1:action_result.summary.malware", "==", "yes"], + ], + name="filter_5:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Match hashes with less than 10 positives to artifacts to identify filtered_artifacts. +""" +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", "==", "artifact:*.cef.fileHash"], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first. +""" +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">=", 10], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", "<", 10], + ], + name="filter_2:condition_2") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + return + +""" +Hunt for binaries with the malicious fileHash across endpoints. +""" +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_1") + + return + +""" +Only process artifacts that have a CEF fileHash. +""" +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.fileHash", "!=", ""], + ], + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Detonate the file(s) in the vault. +""" +def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('detonate_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'detonate_file_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'detonate_file_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'vault_id': filtered_artifacts_item_1[0], + 'file_name': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="detonate file", parameters=parameters, assets=['wildfire'], callback=filter_5, name="detonate_file_1") + + return + +""" +Send the formatted string as an email. +""" +def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('send_email_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'send_email_1' call + formatted_data_1 = phantom.get_format_data(name='format_for_emailer') + + parameters = [] + + # build parameters list for 'send_email_1' call + parameters.append({ + 'cc': "", + 'to': "recipient@phantom.localhost", + 'bcc': "", + 'body': formatted_data_1, + 'from': "automation@phantom.localhost", + 'headers': "", + 'subject': "Malware event confirmed", + 'attachments': "", + }) + + phantom.act(action="send email", parameters=parameters, assets=['smtp'], name="send_email_1") + + return + +""" +Format all results for an email. +""" +def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('format_for_emailer() called') + + template = """Malware in a security event has been confirmed using file reputation and/or file detonation services. + +Reputation Results: +Using file reputation services, the following file hashes have been identified as malware: +{0} + +EDR tool detects that the above file hashes are present on the following endpoints: +{1} + +Detonation Results: +Using sandboxing services, the following file hashes have been identified as malware: +{2} + +The Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows: +{3} + +EDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: +{4} + +Container id: {5} + +[EOM]""" + + # parameter list for template variable replacement + parameters = [ + "hunt_file_1:action_result.parameter.hash", + "hunt_file_1:action_result.data.*.process.results.*.hostname", + "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id", + "hunt_file_2:action_result.data.*.process.results.*.hostname", + "container:id", + ] + + phantom.format(container=container, template=template, parameters=parameters, name="format_for_emailer") + + send_email_1(container=container) + + return + +def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('join_format_for_emailer() called') + + # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed + if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']): + + # call connected block "format_for_emailer" + format_for_emailer(container=container, handle=handle) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml new file mode 100644 index 0000000000..8d7fdc35c3 --- /dev/null +++ b/playbooks/email_notification_for_malware.yml @@ -0,0 +1,22 @@ +name: Email Notification for Malware +id: fb3edc76-ff2b-48b0-5f6f-63da6483fd63 +version: 1 +date: '2021-01-19' +author: Philip Royer, Splunk +type: Response +description: This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. +playbook: email_notification_for_malware +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "VirusTotal" +- "WildFire" +- "CarbonBlack Response" +- "SMTP" +tags: + platform_tags: + - Response + playbook_fields: + - FileHash + product: + - Splunk SOAR \ No newline at end of file From 334fb25cd0c856eb674f2ad495daaeade5e92efa Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 5 Jan 2022 13:41:59 -0600 Subject: [PATCH 24/27] Added malware hunt and contain playbook --- playbooks/malware_hunt_and_contain.json | 11686 ++++++++++++++++++++++ playbooks/malware_hunt_and_contain.png | Bin 0 -> 384172 bytes playbooks/malware_hunt_and_contain.py | 456 + playbooks/malware_hunt_and_contain.yml | 22 + 4 files changed, 12164 insertions(+) create mode 100644 playbooks/malware_hunt_and_contain.json create mode 100644 playbooks/malware_hunt_and_contain.png create mode 100644 playbooks/malware_hunt_and_contain.py create mode 100644 playbooks/malware_hunt_and_contain.yml diff --git a/playbooks/malware_hunt_and_contain.json b/playbooks/malware_hunt_and_contain.json new file mode 100644 index 0000000000..ab2ede583c --- /dev/null +++ b/playbooks/malware_hunt_and_contain.json @@ -0,0 +1,11686 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "\"\"\"Malicous file detected on endpoint\"\"\"", + "description": "This playbook investigates and remediates malware infections on the endpoint.", + "hash": "d1af271dc2c9e67bf0393c4503368436c574f31a", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "5ad21936-f8c5-45e3-ab48-4aa74d2185b3", + "router": { + "name": "metro" + }, + "source": { + "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 14 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c168d4c9-945d-4742-a662-6e4abbc945da", + "router": { + "name": "metro" + }, + "source": { + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 651 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "3949529c-aff6-4401-90d8-a70c288b74d5", + "router": { + "name": "metro" + }, + "source": { + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1290 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9b55f239-b39d-4fe3-adda-f6168661b33a", + "router": { + "name": "metro" + }, + "source": { + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1558 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9c84c8ba-08f4-4cec-acfd-c4dbccbbc66e", + "router": { + "name": "metro" + }, + "source": { + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1694 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b415fd2a-3939-4c18-a92e-efa93d32b1c6", + "router": { + "name": "metro" + }, + "source": { + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1706 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "961848a5-5fd4-4e3b-8b7b-6ef40ea4d007", + "router": { + "name": "metro" + }, + "source": { + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1710 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1649dbd5-f0bf-43ec-951b-5ad008365d1d", + "router": { + "name": "metro" + }, + "source": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1718 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0db3fd7f-4779-44c3-8ea3-694bad0388d9", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1886 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "88f69577-f71a-4ee0-8386-9ab6bcd33e28", + "router": { + "name": "metro" + }, + "source": { + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1892 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "48627df2-9bc5-40fa-858e-426631c72ab9", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "91866693-2720-43a1-a437-f65f19382b9a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1903 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fbce023e-da26-4df2-829b-99d0a167cdd0", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1968 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "509e0e96-ee20-4dd7-8a04-e5a9b8f1db85", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1982 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f5d00299-537c-4bf8-b86b-a500fa1c2258", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1988 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ee268141-044c-48e5-b1ad-29803892a264", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1992 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0a60f02d-fb84-4d21-af04-0adc070f3ccf", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2050 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "562f6e73-5fb8-4722-b99b-7b2b91109a37", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2324 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "14967b49-8e3a-4a08-8c66-53f7e7b5b4b2", + "router": { + "name": "metro" + }, + "source": { + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2339 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d580f77a-9877-4c13-9a40-308797deca8d", + "router": { + "name": "metro" + }, + "source": { + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2544 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c2f5849d-4fa9-4a35-93df-7570b63d2304", + "router": { + "name": "metro" + }, + "source": { + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2557 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "block hash 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 44, + "line_start": 24, + "name": "filter", + "notes": "", + "number": 3, + "order": 2, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "5" + }, + { + "comparison": "<=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2590 + }, + { + "action": "shutdown system", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "message": "", + "wait_time": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "message": "", + "ph": "", + "wait_time": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.wait_time", + "data_type": "numeric" + }, + { + "data_path": "action_result.parameter.message", + "data_type": "string" + }, + { + "column_name": "Machine Ip Name", + "column_order": 0, + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "Total Objects", + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "column_name": "Total Objects Successful", + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "shutdown system" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('shutdown_system_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'shutdown_system_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'shutdown_system_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'ph': \"\",\n 'message': \"\",\n 'wait_time': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"shutdown system\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"shutdown_system_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 69, + "line_start": 44, + "message": "Configuring now", + "name": "shutdown system", + "notes": "", + "number": 1, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 760 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "shutdown_system_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2794 + }, + { + "action": "create ticket", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "description": "", + "fields": "", + "short_description": "Virus Detected" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "description": "", + "fields": "", + "short_description": "Virus Detected", + "table": "", + "vault_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "servicenow", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.short_description", + "data_type": "string" + }, + { + "contains": [ + "servicenow table" + ], + "data_path": "action_result.parameter.table", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.fields", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.description", + "data_type": "string" + }, + { + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.summary.created_ticket_id", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.escalation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.watch_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.follow_up", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.made_sla", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sla_due", + "data_type": "string" + }, + { + "column_name": "Number", + "column_order": 0, + "data_path": "action_result.data.*.number", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caller_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.notify", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_by", + "data_type": "string" + }, + { + "column_name": "Closed On", + "column_order": 6, + "data_path": "action_result.data.*.closed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.cmdb_ci", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.subcategory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.expected_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.knowledge", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.impact", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caused_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.problem_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.activity_due", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.state", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 4, + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.data.*.sys_id", + "data_type": "string" + }, + { + "column_name": "Opened On", + "column_order": 5, + "data_path": "action_result.data.*.opened_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.child_incidents", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes", + "data_type": "string" + }, + { + "column_name": "Short Description", + "column_order": 0, + "data_path": "action_result.data.*.short_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments_and_work_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.time_worked", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_reject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reassignment_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.due_date", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_class_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_plan", + "data_type": "string" + }, + { + "column_name": "Description", + "column_order": 1, + "data_path": "action_result.data.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.rfc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.company", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assigned_to", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.user_input", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.active", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent_incident", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.closed_by", + "data_type": "string" + }, + { + "column_name": "Severity", + "column_order": 2, + "data_path": "action_result.data.*.severity", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.incident_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reopen_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.contact_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_end", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.location", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_display", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assignment_group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_set", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.order", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.urgency", + "data_type": "string" + }, + { + "column_name": "Priority", + "column_order": 2, + "data_path": "action_result.data.*.priority", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hold_reason", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_tags", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.attachment_details.*.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_width", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.content_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_height", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_sys_id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.attachment_details.*.download_link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.average_image_color", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.additional_assignee_list", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_added", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "ticketing" + } + ], + "attrs": { + ".action": { + "text": "create ticket 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Utilities" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": false, + "connection_name": "logoff user, shutdown system, disable user, block hash 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username'))\n blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash'))\n loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username'))\n shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname'))\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n if len(loggedoff_users):\n description += \"{0} users were forced to logoff:\\n{1}\\n\\n\".format(len(loggedoff_users), \", \".join(loggedoff_users))\n if len(disabled_users):\n description += \"{0} user accounts were disabled:\\n{1}\\n\\n\".format(len(disabled_users), \", \".join(disabled_users))\n if len(shutdown_systems):\n description += \"{0} systems were shutdown:\\n{1}\\n\\n\".format(len(shutdown_systems), \", \".join(shutdown_systems))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_2\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_2' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 114, + "line_start": 69, + "message": "Configuring now", + "name": "create ticket", + "notes": "", + "number": 2, + "order": 4, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1220, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "create_ticket_2", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Utilities", + "type": "coa.Action", + "warn": false, + "z": 2825 + }, + { + "action": "logoff user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "username": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "username": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "column_name": "Total Objects", + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "column_name": "Total Objects Successful", + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "logoff user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('logoff_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'logoff_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'logoff_user_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'username': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"logoff user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"logoff_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 166, + "line_start": 143, + "message": "Configuring now", + "name": "logoff user", + "notes": "", + "number": 1, + "order": 6, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 620 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "logoff_user_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2827 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'file_reputation_1' block\n file_reputation_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 24, + "line_start": 16, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 80, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 2895 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "create ticket 2, create ticket 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 456, + "line_start": 443, + "name": "", + "notes": "", + "number": 0, + "order": 17, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1460, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 2901 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_1:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 201, + "line_start": 166, + "name": "filter", + "notes": "", + "number": 1, + "order": 7, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "5" + }, + { + "comparison": "<=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2941 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name=\"hunt_file_2\")\n\n return", + "callback_code": "def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('hunt_file_2_callback() called')\n \n disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return", + "callback_start": 226, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 236, + "line_start": 201, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 2, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2944 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_source": "", + "get_count": "", + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "offset": "", + "ph_0": "", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.parameter.file_source", + "data_type": "string", + "example_values": [ + "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG" + ] + }, + { + "data_path": "action_result.parameter.get_count", + "data_type": "numeric", + "example_values": [ + 1024 + ] + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.offset", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 27 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.file_details.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.file_details.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 511 + ] + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-02-12T10:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string", + "example_values": [ + "WIN10-TEST-EP|28", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.file_details.event_partition_id", + "data_type": "numeric", + "example_values": [ + 99742385111040, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.file_details.facet_id", + "data_type": "numeric", + "example_values": [ + 241095, + 0 + ] + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string", + "example_values": [ + "WMI Provider Host", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248 (WinBuild.160101.0800)", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric", + "example_values": [ + 2, + 6 + ] + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string", + "example_values": [ + "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n", + "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string", + "example_values": [ + "2018-03-25T06:49:27.776Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\windows\\system32\\wbem\\wmiprvse.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Windows Operating System" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.file_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 101 + ] + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.cb_url", + "data_type": "string", + "example_values": [ + "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string", + "example_values": [ + "pe file" + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG", + "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_3' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_3' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_3\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 263, + "line_start": 236, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 3, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 900 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_3", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2945 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_source": "", + "get_count": "", + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "offset": "", + "ph_0": "", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.parameter.file_source", + "data_type": "string", + "example_values": [ + "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG" + ] + }, + { + "data_path": "action_result.parameter.get_count", + "data_type": "numeric", + "example_values": [ + 1024 + ] + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.offset", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 27 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.file_details.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.file_details.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 511 + ] + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-02-12T10:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string", + "example_values": [ + "WIN10-TEST-EP|28", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.file_details.event_partition_id", + "data_type": "numeric", + "example_values": [ + 99742385111040, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.file_details.facet_id", + "data_type": "numeric", + "example_values": [ + 241095, + 0 + ] + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string", + "example_values": [ + "WMI Provider Host", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248 (WinBuild.160101.0800)", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric", + "example_values": [ + 2, + 6 + ] + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string", + "example_values": [ + "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n", + "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string", + "example_values": [ + "2018-03-25T06:49:27.776Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\windows\\system32\\wbem\\wmiprvse.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Windows Operating System" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.file_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 101 + ] + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.cb_url", + "data_type": "string", + "example_values": [ + "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string", + "example_values": [ + "pe file" + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG", + "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_2\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "91866693-2720-43a1-a437-f65f19382b9a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 290, + "line_start": 263, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 2, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 200 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_2", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2947 + }, + { + "action": "create ticket", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "description": "block_hash_2:action_result.message", + "fields": "block_hash_2:action_result.message", + "short_description": "block_hash_2:action_result.message" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "description": "block_hash_2:action_result.message", + "fields": "block_hash_2:action_result.message", + "short_description": "block_hash_2:action_result.message", + "table": "", + "vault_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "servicenow", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.short_description", + "data_type": "string" + }, + { + "contains": [ + "servicenow table" + ], + "data_path": "action_result.parameter.table", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.fields", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.description", + "data_type": "string" + }, + { + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.summary.created_ticket_id", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.escalation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.watch_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.follow_up", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.made_sla", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sla_due", + "data_type": "string" + }, + { + "column_name": "Number", + "column_order": 0, + "data_path": "action_result.data.*.number", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caller_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.notify", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_by", + "data_type": "string" + }, + { + "column_name": "Closed On", + "column_order": 6, + "data_path": "action_result.data.*.closed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.cmdb_ci", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.subcategory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.expected_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.knowledge", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.impact", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caused_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.problem_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.activity_due", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.state", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 4, + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.data.*.sys_id", + "data_type": "string" + }, + { + "column_name": "Opened On", + "column_order": 5, + "data_path": "action_result.data.*.opened_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.child_incidents", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes", + "data_type": "string" + }, + { + "column_name": "Short Description", + "column_order": 0, + "data_path": "action_result.data.*.short_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments_and_work_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.time_worked", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_reject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reassignment_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.due_date", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_class_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_plan", + "data_type": "string" + }, + { + "column_name": "Description", + "column_order": 1, + "data_path": "action_result.data.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.rfc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.company", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assigned_to", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.user_input", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.active", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent_incident", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.closed_by", + "data_type": "string" + }, + { + "column_name": "Severity", + "column_order": 2, + "data_path": "action_result.data.*.severity", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.incident_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reopen_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.contact_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_end", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.location", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_display", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assignment_group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_set", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.order", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.urgency", + "data_type": "string" + }, + { + "column_name": "Priority", + "column_order": 2, + "data_path": "action_result.data.*.priority", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hold_reason", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_tags", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.attachment_details.*.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_width", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.content_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_height", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_sys_id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.attachment_details.*.download_link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.average_image_color", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.additional_assignee_list", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_added", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "ticketing" + } + ], + "attrs": { + ".action": { + "text": "create ticket 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Utilities" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": false, + "connection_name": "block hash 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash'))\n detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_3\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_3' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 326, + "line_start": 290, + "message": "Configuring now", + "name": "create ticket", + "notes": "", + "number": 3, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1220, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "create_ticket_3", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Utilities", + "type": "coa.Action", + "warn": false, + "z": 2948 + }, + { + "action": "disable user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "username": "hunt_file_2:action_result.data.*.process.results.*.username" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "username": "hunt_file_2:action_result.data.*.process.results.*.username" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name", + "ldap distinguished name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string", + "example_values": [ + "test_user3" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "User state changed" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "directory service" + } + ], + "attrs": { + ".action": { + "text": "disable user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('disable_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'disable_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'disable_user_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'username': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"disable user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"disable_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 349, + "line_start": 326, + "message": "Configuring now", + "name": "disable user", + "notes": "", + "number": 1, + "order": 12, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 480 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "disable_user_1", + "required_params": { + "username": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2949 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "binary" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "binary" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"binary\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name=\"hunt_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 398, + "line_start": 373, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 1, + "order": 14, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2955 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "hunt_file_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "hunt_file_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_2' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=filter_3, name=\"block_hash_2\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 1", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 422, + "line_start": 398, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 2, + "order": 15, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_delay": false, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2956 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "file reputation", + "active": true, + "app_name": "VirusTotal", + "app_version": "1.2.40", + "appid": "", + "asset_name": "virustotal", + "config_type": "asset", + "count": 0, + "fields": { + "hash": "artifact:*.cef.fileHash" + }, + "has_app": true, + "id": 142, + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.ALYac.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ALYac.version", + "data_type": "string", + "example_values": [ + "1.1.1.5" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.update", + "data_type": "string", + "example_values": [ + "20180925" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.AVware.version", + "data_type": "string", + "example_values": [ + "1.6.0.52" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.result", + "data_type": "string", + "example_values": [ + "suspicious" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.update", + "data_type": "string", + "example_values": [ + "20190119" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Acronis.version", + "data_type": "string", + "example_values": [ + "1.0.1.37" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.version", + "data_type": "string", + "example_values": [ + "3.0.5.370" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.AegisLab.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.version", + "data_type": "string", + "example_values": [ + "4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.result", + "data_type": "string", + "example_values": [ + "Win32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.version", + "data_type": "string", + "example_values": [ + "3.14.1.22785" + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Alibaba.update", + "data_type": "string", + "example_values": [ + "20180921" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Alibaba.version", + "data_type": "string", + "example_values": [ + "0.1.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.result", + "data_type": "string", + "example_values": [ + "Virus/Win32.Parite.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Antiy-AVL.version", + "data_type": "string", + "example_values": [ + "3.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.version", + "data_type": "string", + "example_values": [ + "1.0.0.837" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.version", + "data_type": "string", + "example_values": [ + "190121-00" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.result", + "data_type": "string", + "example_values": [ + "W32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Avira.version", + "data_type": "string", + "example_values": [ + "8.3.3.8" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Babable.update", + "data_type": "string", + "example_values": [ + "20180918" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.version", + "data_type": "string", + "example_values": [ + "9107201" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.result", + "data_type": "string", + "example_values": [ + "Win32.Virus.Parite.d" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Baidu.version", + "data_type": "string", + "example_values": [ + "1.0.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.version", + "data_type": "string", + "example_values": [ + "7.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.result", + "data_type": "string", + "example_values": [ + "W32.Pinfi.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.version", + "data_type": "string", + "example_values": [ + "1.3.0.9899" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", + "data_type": "string", + "example_values": [ + "W32.Perite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", + "data_type": "string", + "example_values": [ + "14.00" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b!O" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.version", + "data_type": "string", + "example_values": [ + "1.1.0.977" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.result", + "data_type": "string", + "example_values": [ + "Heuristics.W32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ClamAV.version", + "data_type": "string", + "example_values": [ + "0.101.1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.result", + "data_type": "string", + "example_values": [ + "Malware@#1b1651nqd7ivb" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.version", + "data_type": "string", + "example_values": [ + "30310" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.result", + "data_type": "string", + "example_values": [ + "malicious_confidence_100% (W)" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.update", + "data_type": "string", + "example_values": [ + "20181023" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.result", + "data_type": "string", + "example_values": [ + "malicious.94715f" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.update", + "data_type": "string", + "example_values": [ + "20190109" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.version", + "data_type": "string", + "example_values": [ + "1.2.27" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.result", + "data_type": "string", + "example_values": [ + "Unsafe" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cylance.version", + "data_type": "string", + "example_values": [ + "2.3.1.101" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cyren.version", + "data_type": "string", + "example_values": [ + "6.2.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.result", + "data_type": "string", + "example_values": [ + "Trojan.DownLoader20.25948" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.version", + "data_type": "string", + "example_values": [ + "7.0.34.11020" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.version", + "data_type": "string", + "example_values": [ + "18744" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B (B)" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.version", + "data_type": "string", + "example_values": [ + "2018.4.0.1029" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.result", + "data_type": "string", + "example_values": [ + "malicious (high confidence)" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.update", + "data_type": "string", + "example_values": [ + "20181108" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.version", + "data_type": "string", + "example_values": [ + "3.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.F-Prot.version", + "data_type": "string", + "example_values": [ + "4.7.1.166" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.version", + "data_type": "string", + "example_values": [ + "11.0.19100.45" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Fortinet.version", + "data_type": "string", + "example_values": [ + "5.4.247.0" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.GData.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.version", + "data_type": "string", + "example_values": [ + "A:25.20275B:25.14197" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Virut" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Ikarus.version", + "data_type": "string", + "example_values": [ + "0.1.5.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.result", + "data_type": "string", + "example_values": [ + "heuristic" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.update", + "data_type": "string", + "example_values": [ + "20181128" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.version", + "data_type": "string", + "example_values": [ + "6.3.6.26157" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.version", + "data_type": "string", + "example_values": [ + "16.0.100" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Kaspersky.version", + "data_type": "string", + "example_values": [ + "15.0.1.13" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b.5756" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.version", + "data_type": "string", + "example_values": [ + "2013.8.14.323" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.result", + "data_type": "string", + "example_values": [ + "malware (ai score=100)" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.version", + "data_type": "string", + "example_values": [ + "2018.9.12.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.result", + "data_type": "string", + "example_values": [ + "Trojan.Agent.QQ" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.version", + "data_type": "string", + "example_values": [ + "2.1.1.1115" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", + "data_type": "string", + "example_values": [ + "BehavesLike.Win32.Pate.hh" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", + "data_type": "string", + "example_values": [ + "v2017.3010" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.result", + "data_type": "string", + "example_values": [ + "W32/Pate.b" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.version", + "data_type": "string", + "example_values": [ + "6.0.6.653" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", + "data_type": "string", + "example_values": [ + "14.0.297.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.result", + "data_type": "string", + "example_values": [ + "Virus:Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.version", + "data_type": "string", + "example_values": [ + "1.1.15500.2" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.bgvo" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.version", + "data_type": "string", + "example_values": [ + "1.0.134.24576" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.result", + "data_type": "string", + "example_values": [ + "generic.ml" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Panda.version", + "data_type": "string", + "example_values": [ + "4.6.4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.H" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.version", + "data_type": "string", + "example_values": [ + "1.0.0.1120" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.result", + "data_type": "string", + "example_values": [ + "Virus.Parite!1.9B80 (CLOUD)" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Rising.version", + "data_type": "string", + "example_values": [ + "25.0.0.24" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", + "data_type": "string", + "example_values": [ + "20190116" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", + "data_type": "string", + "example_values": [ + "5.6.0.1032" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.result", + "data_type": "string", + "example_values": [ + "static engine - malicious" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.version", + "data_type": "string", + "example_values": [ + "1.0.21.268" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.result", + "data_type": "string", + "example_values": [ + "W32/Parite-B" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.version", + "data_type": "string", + "example_values": [ + "4.98.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.result", + "data_type": "string", + "example_values": [ + "Trojan.Gen.6" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Symantec.version", + "data_type": "string", + "example_values": [ + "1.8.0.0" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.result", + "data_type": "string", + "example_values": [ + "Virus/W32.Parite.C" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.version", + "data_type": "string", + "example_values": [ + "2019-01-21.02" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Dropper.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Tencent.version", + "data_type": "string", + "example_values": [ + "1.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.result", + "data_type": "string", + "example_values": [ + "W32/Pate.B" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.version", + "data_type": "string", + "example_values": [ + "6.8.0.5.3962" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.result", + "data_type": "string", + "example_values": [ + "Win32/Pinfi.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.TotalDefense.version", + "data_type": "string", + "example_values": [ + "37.1.62.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.result", + "data_type": "string", + "example_values": [ + "malicious.high.ml.score" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.update", + "data_type": "string", + "example_values": [ + "20190103" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.version", + "data_type": "string", + "example_values": [ + "3.0.34.707" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Trustlook.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.version", + "data_type": "string", + "example_values": [ + "3.35.1" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.VIPRE.version", + "data_type": "string", + "example_values": [ + "None" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.version", + "data_type": "string", + "example_values": [ + "2014.3.20.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Webroot.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.version", + "data_type": "string", + "example_values": [ + "1.0.0.403" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.update", + "data_type": "string", + "example_values": [ + "20190120" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Yandex.version", + "data_type": "string", + "example_values": [ + "5.5.1.3" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.result", + "data_type": "string", + "example_values": [ + "Virus.Parite.Win32.9" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.version", + "data_type": "string", + "example_values": [ + "2.0.0.3733" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.eGambit.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.version", + "data_type": "string", + "example_values": [ + "v4.3.5" + ] + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "hash": { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_type": "string", + "default": null, + "description": "File hash to query", + "key": "hash", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "targets": "34", + "type": "" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_1, name=\"file_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 443, + "line_start": 422, + "message": "Configuring now", + "name": "file reputation", + "notes": "", + "number": 1, + "order": 16, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 220, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2957 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "hunt_file_2:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "hunt_file_2:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_3' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_3' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name=\"block_hash_3\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 373, + "line_start": 349, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 3, + "order": 13, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_3", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2958 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "logoff user, shutdown system, disable user, block hash 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "inPorts": [ + "in" + ], + "join_code": "def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_filter_2() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']):\n \n # call connected block \"filter_2\"\n filter_2(container=container, handle=handle)\n \n return", + "join_optional": [], + "join_start": 132, + "line_end": 143, + "line_start": 114, + "name": "filter", + "notes": "", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2959 + } + ] + }, + "notes": "" + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T21:31:52.515480+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [], + "misc": { + "apps_list": [ + "LDAP", + "ServiceNow", + "Carbon Black Response", + "VirusTotal" + ] + } +} \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.png b/playbooks/malware_hunt_and_contain.png new file mode 100644 index 0000000000000000000000000000000000000000..784fcde3abef0f88e31de330d771817d0b385036 GIT binary patch literal 384172 zcmeFYWmH_twl+)zNRSX9K!Q67)(P$s+})*dclS;pI6;Fu!QEYgL$KiP?%qh#@U84~ z&ffQXzRGghyOnpFj3UhzB9c zBf;7R_V<6i_=&^LI?dnvQ1lu_1mzKeICa7P(X ztB4{*dUi_BIy||uX^~RWK96h_jot8){gFWK>CKrog429PnhJfNKTl%>sY^Txl_J7L z80ib#pqr0DF=WIF>Kr0pw*?QL9vZ(q_Dx8IBbpv9UsnZQ-`p*b757^T^sQp~7k}bk zf1n?Fi0gQ~nSp^kV`kv)l*I*6?@Yc?GMGp}vae&|X4KWO3|f}_lGOO*lVbPJomXFZ zEg0qP^x+8D2CiiMJV*wPK@>TN_7$4mF5#5X$RD&BcAO+IK^okyQR0|U*_#Wb>CvzG zgB&-s!(D86!F(%f*2}qra;s)HwjmT1Lc(ASzh2pm&*s ztWh3ndpTihr{MeWsH%R8EDpvV`MDk;@vF-Z&rkga;_4^FZ{@~*??^Gk=b8wbRzXAJ zlq*j-`w+=jawpM-#R*oSLuK(maxjfn>NnmwS9zoxm*9^o7Q5eKR z+RqFG9^I7?CQuQb#i0-je%&BhLVQ2-Y+jYo^-JKhS*tFW-H&T&>Mb6ITN#B9=>NXTzKSg zyQ1&*(kO6{1DpMcO+EWXXS+~_DM|jO#k%VD@GZOh3*!@!p&FN0t|*dkM4#tyc=IYv zi%gpaiRg@i_P+BwG2Yb{btM$p1R<2`?5a9bs@CuVAKdTf#zK>ks6KhFq^(dKc0a*p)dRJ3M3%JrT*;71=}YNhMDvi{A(dRVTd0 zd0FA6*xrXpFXt+UfiSWBYRGbr%5g>O^ZOC+DTYs;oZ@rK%aDyK#w}h1e$7tn(%WLk zW;8JJiMN-DzrZ`t)Q;VyAHp({hn-mBV<|n<6g|q;Nx?_H~9zy?fB)yR!H+d7|Zbp5x%ZG<9OtQwB1f+hrST7pNGx!gm;B?N9g63 zFTXI63_{e&ph0wN!R1kUl#hc&u%etOQTs)*gRm0)=>=#bWBWXe=oCZmJ`sw_lA1=n z*uZrl+5LF`aq0VONujUus1uKf{3{h+;QLX3#~#&oqSf?e6pqhQF+*=ewib}f*dDda zNAV7T8X%0fCnT_L1yp=s#Emf4<4hn-_KP))RYzBiVC{t5qU3foR=9Ftny%0(H9nJDF+PuOBDF}XWIn@Fjjdw_^AD>!!8NXPY=0o{CI$ZZjz~?~0X2HyMEWbr0Q}i_a zXfz@;3N-%!RP?$xX)IoSKVH|OF$(=q|1mSn(Y?b$j?amI8g>>&8wSO%A-H@^fbU6= zhcCxo%Eo6=Y+xXbOdX-|L%WCPNAs{3|DeHZ(*(1bHT}y@Mhs6wrUl9gVIxJG%8`wv zeov)1^DpMDyC~zL<4q>@iJ`L`RputigR+Uv80`4O9NO=jy{oec3#+Xjr$PVNvo$)F{jQu zwKX+5CAnWRbvWhC7S8sLEr$(ebu_1FJzL9JTV$gDR?mUYT|nO7joDyx zWyurU61{y|9T1LlM4qt-_vkB}eVqdB1t zVk{6{J5{fnjqV(NCqbHhdg@n;RN$-8uF=5vvrhQTy*nhLmZURlHeXS|2ICz_YT)|jzHnUZ+GxNbv?Q09RDGAM2%P{2A=4+Kx zS8PJ;T#9TES)}BIk=BaL?fH-<`O-d?JFTh zvoEtH$Cn_|Cpj>edij}Tq-^!da{vzi{qR7LWk#5uBiF>Af`SLLCyBoj}H2(tNI0*EZ{k|Zik;2?}(Vx zG!ms*S@rgk3V6?6-@HJ~O2{{(W%3QYLY1W1Wd8~4ZttG#w$00t<>pw_YjnExf5XU( zJL0B@rEvzA_R7^W*{9#vI5%BPA4+U-e!)cJDZ8&d-+;R9G8~#zXUXU6bAJbxT$ECa zYt@Xb&2Z1`?r=vX@xi{7(MhyPY(D6z`@C$U`vnwDZvj52aa&xI+w3@V#5ux=#UY7% z7MB7WUT-QqzK!3aw+3%DS&ciaIqaV8(|uGu&@?ZvG}`P`F;rtMHYs5Q!!3q3SWW3# z=-A70N>xf#RJv7JORBW$ycPp5*Dj|EI}5L@-!GTDbtZr9_!`gdZ&SEzRncH@4r7RB zV6PLkw$8WDFIW&=P;EXug-#siwV6V|O`TR^-Qf}3Iov8uSgtjbx06#xY|AahFG`fA zoDcgK9L;U7mvTMoZcAVZFj}Y|{3pEaA@Z{G^2rBeO^iy6sRy%%^#GwTp-pu0&ai+q zQTy+O?^+7hPZByyhCUAk`rzM;4^vEu6-MBb=(vP=SglsvuT%AUY8f#s(m2TRSfws_ zz&5U9)aH9?YSKeEowv68(&f^&QuutRcLt-X9+_gK8>U ztY$5D=StnjCvl6q5;hS!+;qjB(D8#eb$B5RN1DBt-}c#Ujh5sWUoClg6s=5!fj)_mZJMRMk*@FIEflxg@+<+ z;(Rx%w69dEP42qoJn=vS>^e(=1hH~Ey147*7kX&^#oU^A?tdrp0G85CYF)Vb2~)AO z{dn9m?Oz64`qswk-Ly{xTim@eKTf}pfeGBoUyj}wp64aVx!$6}V8&jYkd?Qe+5@&W z5Kg9L5q5SF-ZQqJcRn3TwH0_d#OsXk`QZ!eRmY=K#0+AWy>+fS#82>Y&OyJ0@`8xH z{!E0+Gkgn8g$*}%i+Zz@9wE2+<%hAy2#U-IB%5%!HvtUB-@#4mg8C`0AgL)=Gw8&o zT*P}Cu})Pc1-TV#i1#9tuj*JcmoSl$L7)Z7&k&wI z!bd;^N{@hx?-9YDWzk1(5uW@}{}=%w&>Z3EKikLx_urpL;QHO?ANMEG0SL&zFD&44 z%Xs{+)@b1wPySVYMhZMb5L6P9kO1yVh7QKYHjZYtP6|0^KY)tocH$b22ne`TzpqCU zij*h7_%r6p>Q3r1(p-kN){Oc_wg$$GZq{}{YXk%yH!h%PZS15^>Sk?a+Hl!PX2qMKR^F?Ph&Upzh<&={O7WO1%iG*0exV65BhU#pexVsS}u8W zH)AVxVRLJMX22YL%uF9xc>d_{zdibE%71iKaWr-ivb6?!I`REQ^?!E$uMhv%j(^Ol z@zXN8*E#>oqkneg0sUV4f1$-c2>nMbKxsY{9?+k=#)onj^bK%@5eUtN<&=Rt zz-GTcPhSFGZ~t)z%1>;q7K3T45D)|qB!mT(-5wn*BG%(f-u9kOTjIHuB|M`YTO?g1 zGe98s6%6tX{-zhofQ!qPU!5I|qW&ejngzwT1W%zX{|-LVWQT4!lI9KN3-q=~KR$~} z#I3qeJH^z@|w!hiNfy7}}48Ar6k^f&B}|KSiow=jfuOq-|w z4{srY_$)ko$A7c>KVAsJBVUSzC(lSfAw2$%z63&0UJ^=-q7Imo{ij19Jbo%xkNlsn z;PWdSQjX{>ytwiIhpl)PZin$769M7zJ6ZudN)Zr!p8tPHN1)qF!d2q`lpg_RQdIu5 zA|9fvE{pn~vGi{?Cgteh{k@IZ2?D2B#)=1F97O+xJJ(RH7RuS~Khl5x_ZGP!2r!rX zNtWZ!XQYvHz%DDoZXI0yVzX7CszWCscorgXr!=H5fEdMACBBYTJ^zSY68X$@niYV|hpC?{stZQ3niw!^ib4N)(0E1yW z8oc{+_&*>0Ns7OCsILha?Chv!dk|BAR0I(q+W-HQ{14IohiL!9Y5#LP|B@L0Ed4{K z4cG8r{1Ot1pQ*D2?_4arub66J-8^o42nCBr^EYukDf7^>c+x$si0a6fPbOk$3 zJ`eAD^fRaG+`>+HMC*PDGFtufCzJ@hHAdH`pGPIo+feP45csFsiM04V#~jY4*I%0M zzbTQ<{@#}$EMOHIgTv|k=_w9p5+*;Phv1*bo>yFsj#Fm3=;3HPt}zg@Ee3VU^DWRB zKXWt}zzu;SyNqj!2YyiO8r&y-;@NFaDP+p_BZu521`|Q420EmGs-)^d1 zk4YRhqQsuHVB;*U&KQP&=w*kNJa;&TV{FYB4uvB3jF{*)@1-z5 zc31kez1-}+$Z7d+oe*(tfMW^id@1ZdrOf)Hrjm&fIcFzUdc)!|C&f~_9lGA)h~;xc zQ`mG#b3FszHf6f9q4{=A9$YW?@QBG`kmG@wq94a?wIOe_V`>{lz*}O62}y~Xz@545 z#^v0I6dIK9xjyCD{k8jZf^SvZ#pTXws}i+mmHd-Hz;B|yC!+g%#^;n=*&-;5mjap7 z*oM7+2Wq~M4Ci8dL9MNKk=(gC$UO2*R?Q{OIvs-9`cld9i$M5`@Ne&wG%Y6c$!^ZJ znbj?)OJfkz>7&yj_nbm*jV(+$k`iQ~m6P+MbmO5$=gMF6x|$4m$YK_$TH`4(_=hv6 zIS1Eg1NGY%za>OoiYm?WN7EGjT7nwI7YP~qu`zOtq+&$w+0P3PW-63gZ=g-}VsYYj zlx?PsS63}>Ui{d(y*VcWd4$y-LXQ>?mp&XpkJ`f67Hw8PBDPo`KQ#P0pFF?!K3=L% zmR9YKQj+D9ICJ056|$ah@wB}f@qDq@?8GhRF@5@K+v8~I(3<&c`qj!=o9CoWtIW#n zeyd``sD1c~xa#t#K$Rpm;k%L9! zTWFC=3ArgQBR!pJY4ng*EoF0?S1$=@D2XlV0e;V)$mVU*v2Wb#o6N68(M#+ZR&5T^ zSl~ODwfA~6Yq}|klcT%HrI@L$F$?P@skFGnPvqV9J~lN}5@o}y7|skNrggTMj;8*K z|MLx^T>LTQT2Qr2gT}C@g$m*Z`#Bg#;YY!c#2zE)x=e%~;*M~fU|FU}LS8a92 z%f%+=*rP?RKpQ!sx1bg-XxT^*2B6PL~t z;+y6l0#`OV8~Dc%A`CY42%h_maVBWVX}iXjW3zV?-7ZN`@Y0R>HoU@CCTKT%zuIC} z84ycOzg8c)K2$s=o-9=UR=D(lpY@ClU7lX2@namL7ACVare)LS&p4*}n$ORg4!iOipd1OGx@U0R@kivJ>nrAsLH?p*93Amv6jk7WBE@&HGZf%jl-Rf4-SWCfBzb zNVFx(wm#QZG|$Rwyw!9pG9)$ig%FSM%~_Y;=!>M&xp;0@$@Q(0yK=GO_g!7~-!~VM zSl6s&tCJ*>rMPeBtLQeWSHy!WabzNeo)DeR4V0nBG#xd7EGpDh+YwponLW2A^6eyJ z;#|{(MWZ5J8)7KogOx z_K5Xd*a?X^`qzu*+^QzGg;Vu;RO0j_B|py7q_lH0(DkY+$#WaJCAJP<3jAzyM}?w< z&rvIEHIMtdB*w|ZI~lRj!Uxk}6%&__Kj0%t6v>>I=1}j+Lc?=nTuas%%09Vd7CD8xzhL3ICNtp2CAlhdk-VY*50(xkV!GT60@W9ju$1lyWH-sCGfnA zI>n}$jX?XuieP&CA^bN`}RS=jQ z5hcaUms{ok2Y$|yX@%GP`t9Yx!H$8tO|5;^yEmZ|8`GI7`$Te4F%L_uTtAi}JYV!Xy*)=!f^ zvYXrc2)j|{A&OPgN~*_3tu)MxShu_n(@GS{3)C>D!miups~!`7pD|V>_mB`PZDrSG zL-XcQwBC-OAEpg!WQ*s+i60sMLLXo@HhD5nAowG_bK7cIuK?^LwaBT8O7=o^~p^ z`0LpT)1{iJi(PHk+P1-$Fama1InVki7G`^RUK@-e`nE>}#jbh%3ZeDjJN-!E!i>){ z`a?q3(kX?4BYN_Rr#-3|cZ3rL{Ajfl1Xx3t{wttdC}{ys$Wo;L%NG2<*s<<90JgG3 z$SHY?(M<78sECZ`vdeG@wHNgM+_vf5rVPB7oH>x|y0)Fn$LuWtGII>3*Jz}-xKu_B z-+6AcSgsn*cWdUpnxnR{1S1LK+Ftn*O%*Z#J04<*Az-s6+h?~zW9-Q!A9_6_czMQUh6>3 z(%gZ`>A47#*Cse<;a^lNBiB#M9e1>l-^l07c5T4h7$WHDC; zk;`MEDejzA)HZqd$|_BMtSgi8djqJKa1^hnoj4}?$LSU-w33sBu|~UNa>ju0s`R`X zaf#!fFvj=n-C--q#wwExLJ~C@f&X%A+~0%lO_aXDT=<1TwO48l$)HYubG)OnS1z+X zZ+yT)WRdg2lfKa=zKAjO*;lKxVW~sEZPik%caDTMZZv~@s&+>Gl{jhhD6@zD->c1y zF-s~PLa@6&FyG&ZmBkVV5|`E9Egc6Gs?a4_o{W&2oZO*y4jw;p)hvt{|A*nS4u~F2 zp6!F*8m1JnJ?g@}g5|gN$OpW;V95%?zcE^#Z8(1x_NACI8|-7x_F3dQ+b?UA7*#Yr z-0;KS>R#y!9pR_IOIem|h249;12=eRx5WqW(UoYW(k%O2r7Gt~Ux%)*+aw?wpqQBn z9m}BmccHNE{uD|lBFEGDrO9S9M|nxW9?{UU5{4tie|jsFPERrdCOrf-@o;bt@NMU> z1jV^NSAG0Wq1HecF;bmLU;mj7TS>XlZ>7k$^w6%_qRQJgC?yM69h={JhP3>X(A*8m zt8J&*+_YNFMRw_#}}%y6$J9G=o&M)`_~JF@AYG44{lv%pljzX7Ym;)SWc&& zSGfw&H!ha11gUC|S_jsY3q%KqPEZt^JL9yp)-q@|YcD<6rNI+u0{V|QrYnRzIiU%L zUl+UHDQyIj_)XJ>&7nv5jU8TNc-$6#Zuyw7af4cN~XJ~hbonhuFA zGP)hqs5Cppa;->MPtvwoZcSBwtEL))M@OxBZ#ghkQfV-0@rD`7F#8)8XtZ%>*U13< zj3r*?VS24LU7dGFIUj2dZ*S?8ehzs(yBn`pc=FC+YSyGM;H2Xx#2f`M+PSVRWz$)u zT#gntA+;2Hb`|lhjB2@IDb7=gmA$B}HZ%1Sd`awbTZ8Z)jJT{58+MCxHA5GmTHAP6 z(~%GB49y6}c>|2G*k{}Efyn%f=XmsCnstiZC|mfG7tw`{ZJTteNhr#w{LddWLgxgy zsJl?YQw~!tlS4sR45Lth4}SvINZ-6tUUFb=`B1uY#wYju%JZHu&w*^$LsM7v5(}IH z_15OZi_QrCzOH`TrmB{$uANl}ptXT#n|bG<_Vl znyNPQ(tVCV5>^;oycM)P6E$6~sas>X8iLRayqrQBzja29%l_d#v+1#B4H4G-#k#0#%)uhMhO3kNBvuDHe_dMXYe0MvB$5cnhVpgyTCAnBl z)*`7l$0?BW+kq0@7SZbEOx3k#mUAE}RH0(nK~=tw+tJw^q(q?;DGPqR^spl22(OVd zE6(*!zrQ}0n{9MXZUc;kZ4c0~?an2|A~lISyrlMcW_83-?80kur|kh=w#&UUj7l)= zlVd2_Y(wj_(?VQio+0MP+je(W^omZ0amoO5yhyExR*5={nGL6CDs0b`pu&zC(x=cK zHOrjm&aP1qq$FGYO-lXsN82&BLr~~U8cfhu5xr;!^s26bEcmzHw0NtDLsc9L`0yqp zK`)r=1z+oc27e-nb#$<-_sG3h(dvM{u}o6E|1}H)_%KY9k{2+ceh58zB?KnKWlza` zgoI8==)Qqz@}Nm%xFgjGH+*ixUP9^%cvbsj4d1~EBAsNKR2zCp1VPV`czt{EK;@ae zqnCx@KI+s{r#Unn4k2o%LPcL^aCtZPN41(0sJ$&Zt%mMK9I{xnRHm;+L-~PVo{AV!46j@8NJ*we& z_+&Wqi-rgZ7fM4`7kXPYZgCkaI8 z^bqacGqz?64I)#!&Igz6gWCjvg}ZCVm*AMq0Ns{Fi7iuJjW!{tPN@6H z5#{Vv*dn9QZ)sJ8_*+^{_Kw{Dy|gOE0;H92L_hTV`2EbB1Z1}Z4mvw>xU9(q>lClo zdfQa{!M{kvh`<86EpC~V50UeR(8HUr&x+1^EI|Xni98NcscBPRzJDSDV-I9S4+}f{ zh=9-Ztd_qyz6`oIE=MinPQx*9j8Shi>#)0ZIXx9A)jlqF1rysvnd29a*k6KSTo8oK z$@e|gvN!n2t(4Py$?i{I0a08RMK|g?nI80!v^YgP&Kb2C=hLy3bCZ(ghqJg=zL~~* z44yp1$M&%^E!Aomd~IQ-zf$6zbJ&eHpdUzNfol(&v*fQ(1A8r@&Ivb}gWq~<*e`1# zi(Z6|eYMi8(+uZ6QXe<*YIO8yQK~hV zO*S)ptccUuoA-5s+klT>-kHve!Hwo<=4mc=9(Pk6H+r~-{xGo~)n6Uy^@TF)!q;f!m&iMB7A6$<5)O^#kqb#wYaPd5{hpgxD1-9`0 z97Z9s=zc?>dD~s&aB^^77Qh%^h#j+NKYaM94D!W#(_h^OfJQ@Z)^C1fcp5MmYB3e3bXJ8E^(CMjf*Xm%fn3(|nD&N7~d#?MUt z`aXYg94ljMNrfd-wbwds(b(of#FhBUPIG{YYlK%;M@*@a#%&U3%tCW>y+_xZ9JjxC zC5Sp_z++N(%;MHKOSvH=w>XP2ezHBvXaQvNOyJ2!npEW<82sH_S1;nh#)|9hH~5ta zTmG^Ok&1SSE89lMVl3Sy;5(KYk}~VLW{o{o3)~uY|Fcb_wfa$ei0y7jQL~ZPe(1c2 zx4px$E&9UU$$Est-n%^E!-3TI4j1a@RQ<980BZZ@>Wk-r2Yvf?pV1OCRQt_uJbIQa z@?d-UfCCvC{C5EAGb8^`hw=|weF|fc6(W0Aa~KAjt@Gzy@ORJw|93q>CGYQ({?-Pi zZN_l?aZ}T^>~~DoTha}=T546rs$dQPBA1^0n(lL3mYD0^l_!&K-eaB4QzDw>oluQ2 zw8v^`)Y&7W3(1dZmVC{6$EVQvu$f*O#1Swq%dN6CoMdxbW}e*JgK~-#`aOZmuH+YlCm|Kd|kWok7b$$0ZsqNo_t^{+I_ZE~w_}7QDWb zd?_FI6FS__eiU4@&lf|@peZsq<@1$d>9vV83&MFYUed2U8j;Xfr{KaOkOHGxgQjqO zCz2R-8$4XwNzn2<%cSHi3r>DX)quY+N=rI`JH!quR;|m?eHgynpB?~=Ez`n?89aPT z4iP_moB6w0eA@=YkA4(Ks9A0Ix0V_e7BvSj%XH;@`QZhzMxsOZ*?e;;N9`k*8o6fZ zv}UzY!ShGE4Gg-C%03Tp*8=(0<_9K&7B$V<);=ATr8E}ZLX`rmQt%7Ii)}J3-v+K?>SZhuSX*I8it3T^1-nql(X)SkNKoD)FrM9{L zDCN|GOH;f`7;+W(A^kTr$lt%H_MU^u;y`$|6)pvtEsxT&*;{qiU0Sy1FvF?!S{J=+ z24CY0(Zj!=UMmT8;!4e$1J0W%$(?q2S=)_hbz@%|Z(BmNF#xCS3`2V-!9~tq=R@lAF+?)+$UkvB_ zqEe_kU~`rcpx;~2Tkkl{crIUMyZj&#(}ON@XgzLNdT_WLcQL-3h(lNbo1kSanl6rw zEmD&@%@X+?bHFq|am|&9xAa)j!!6S;$kKMww`BI2+)TYY@#V8?JK}w73F~fpAo0GF zVD>40pj`K{7eau#-JcOxUbbtJFxGg8NrALCkUn%AaqCR`v{%iK>J8;B#nUsysMkp1 zlu;Uv=3lrl`B8X`*l5<#W@&~H7x|q20)4(+Stv9P4Kj4Q_mAIbMJA~YvM+Mz#@5R`4&;St=Me* zN7DU5Jd~ELA=s;h(XwS3buL#nnJlyg#92$Vp7xBm$-A`%CcedMSl9m&2=Mm3_-w@g zVA9K3F88+)K~lP>W7ve|&bp}XoBrD}57oY=IIMxLLz6n2OHD`b$3x<1@lV~ch!RqnDUr1sXRZxvFfzPmyCgY>`ot)G&ncj&P{zEoZ zf`~d-XLL=%Ey^A<1E8SR3=OT5oN+b|gSzSNA}%J!sV3<6UDIqI6?UL;>_!lg5 z{Ni6f3GtIgSNx%VC~Sw!mp8eWx%hqPEgl1a83q@rju;PMrIRtnK(95E?ShOLj>s58#Hp+rpO5dOBc z(56QvtxPLW?nMa+k`aY=Ox~vQLOf{kC3W+xlq;gGXzKA2q05clHV5}2(G*u*uJmi} zpQ%PYhmC;5!9rY-d7DWUZt&E(BTmjpvlyX2|AVfZo|uyxY1Dh+VmPt$M${6hz!E-d z<3>g?kB+3!5zeWe)4A-P5~cT=oT4|rk8AgN_(gMVD42oD&C6c4chKdk#%UI%?EBF@ zzr&m7;q_#3!nEHe3RF6kV@IC=nW%k}lAeirb{o6f0Y8Nz(4cB#$k7-kBi{^k#k}gw z@oP*LZ_he0_-|uuNoK${JF}e+Jhts08@h_TR%ihU5pr z8&b<^q*HTst)=KVvIdHEDh9JZJ9}*p>nL6>aB=OiYjF*wuY7&V{cYbbh3{krI(Ndp z0c|>}AZbCahhx-p33ejIT26$N{|aobp^LkHZlqIcR#1tFVbm_W+&Gx(iV@A;TwP}~ zZcPD($l$wUaMkV#1@ooU59OL2vUo?1As6~tx35o>cNoWmcbyBtuPb&}YS3LS>M+t> za_G2RnN#lotj3Jw#5sv?1CLR0A(f#WrmD0(G~7gL@J1$kB+WjfI0Z>6Xr=n6lhN^Hl3I~0JKtj9Bwd^DVrk^1=V^=e7t#+I-A zN8YW145aR6pWpfy=vT#I@^gEXVlU&b+XDZ1cWQ!$p9|>Rp7r9 z6n)l@gOS9l=X#Bi}Ln-CDzy7DFm66C|0>VjXK1R5w{ZtBNV}* zzC+OV(N;dTUs(fY=^qcZ@=H>uLH0fw4@rrua6{P5Q*h%xAUgbKZx!$L#^Y%$Ax!8P z)f^8Wm4+zmrHe<7hunIby|ln=^U$$yh0xi1$95n2#+3}uqgUvfX5i8>99ppp=4yg5 zy+9-$-~IWOAPRe>80xLwsq_(QVBn3L;Jlr;TPi@QN3xA zd1*dV>39I};A25BRs4QZzuGnrdWvRw`%xDivQrUTrpTKWku!wkbp^jtY<0LSpM=Ll zkUN<&QS%J5TC*FZ3lwu9+KFR1*`;cS-B69mJ&xb;snwEMpBT@Uj^|S!eTftRMGH zU0-l_;Ze2gQl;ysYsV~M9Bb9l8ZZcGmmR}o#yAryij$F1dC`jS;! z8%o|GbdZsY9VInZb(zZRFpHc-#|3Xd9uL?UMkZ^XGaH| znBy!)Sr|S53|yahzd4+$c(~ArIk4lW?7|&YGIK`gK3K z67ewjgC9lvx|O#*w??Ct`@~dr<;)r)a`f2oP$He0OT!#^nD2V-c|S_HnR9I6lDA1& z#bWD=MTC$g)Vy@}aPIjqQ<2{uLMXxGUnjC99_TVuDJ#z#By3Wr59iXDynE;&AEt$A z_Jm3q5O+ZvU!Ou$qu&tDwmN?&+4==yGR2|8Ng8e|?PYb?wnl!ec*|^2SzXy>oocKm*mO)R3VFID)o#nf1uJ*A}w!e+dG2~u$)O* zX*!PRFi&!~gLcz(qeW(@*Xuug6{M)wE~*$nBIvFv68Xb8spTuh#>Ti(NE2lecSP{eKMtkowd*(8jtc-GS%x^N`|BcLuq_ql%5(7bM}kW6s# zLx}03JN|oa9&0<2nA4lXd5wa(28HRRL#ZUyop&X0N+ysPAf|rQI2HtmvE*P+`EEiE zhE^E~4hXl0tJW)gDO?ttu?R=^$Q?~&Vwh2It65CkrdzK12g+WACd7?mXg8q1z;MqL1zH`7tEoh%I(0lw7A-F zwOZVWA3-TX(2t+|m)D@~konu~1J-0CqU=L^^mmy$h8Zf@#*_$q+`;7zFWny_-TRI<#DKsz%gJ<-^Fiwx~uIBcH+W77QYgXW8R0uV%GOVG3 zy8OL`9R~5v5PnKJ4#o17-Abobo+i{pF7E)RWBZneS)x&+I#v16r){-#jZVxsAs1hf zH8uKbfmc)K()Njkzy2@*BEe@GWvK&V;V@ZR<$_gEOd4z+-coI_Nvkw9x*W-F&~`U# zZjLB+z+{fTzKDGq&Z}`Ht=Zeh^Bd!%`y(QO(>uub_ZZ*7%kuUpVQ5Kv=HvI_CW&LwvvwVuzufcM!FBQT{WObF5X& z{4%|&w*cfkxkm;^T41CQ{mK?&ZAYmd+yyAObN&Phk&qOI_6)z&^r;h6kg{VJrdR?B zA^t|WOejO~6|IvQe||25)<9B?l!}PEfp>S%mq#<@D7sp1U93x_t#P^(yu$vu}v47x#F8vl?pV zPsBi&aTRh1&MnoSG&49HL=t0puiOiB58mXuT708eX!QL2{F~~@yD1;6#56-c3h0Wp zIT393Ma`Lbjpn6r;M~EG{`UU+5`u2V>8rS8k>%#Y+Vrb~C@f>z1PN%5^L7)FXQwYs zaC1BF(rJLTS_Ih=r@yt@z?%jf%?<#|i~C1};okox+HO5=a9AGB>(LOx^DPK@(X7@d-dAEz%JV`uvT~b z9xj-*+>*VlB-dv4ZvBOyAU=DwkR2uCvLGn(Alwo9SqOu^hHa>kbvo zR$OcYH3~G#E}Kv+@yqev=bItEny=PQxo1GNoGem3EqdRDiuk33gpFYoK>lm)v|GJy z22Frys&NO0OY$rxVa4Xn!G|v@QvE;zqUce)un zaUnQAlK~oh-EC-Fq@~fSwTk6JPp)s`%>O-Cuv>3hu_yH!<<0L56C*!?%5+H8>Z=*5 zze^S%jih?a#*wAM>hds-Jb!czq?yMZx59L5z3&?a)6QGNye*qkaagOp3t56PK0lpb zNfSmJ@4%3xLQ3hR{;_(tx&=g;36Z^pEu zt?$*r6D6PnSvkiiAA+BXIn4uLID_U*2XtVe#j}ncYSkO&DU~~tfa7?j-;TM@ZL;9j zkYoFhu)h~}?`;EMKCPoo$E}f?m-x2>bN5H)m#Nc+Q+%J2*=*xHz9!x5oAd;!Dl}{l z&r6HMM}6;=1Q2-YY68nl_;fXiR`C?zEWd$o*(qIa4rWmqGPuZ(J9+^L-?H4D7I`yz zO+av<#o~2YVn1}tF5Z0X%uA!mC6)V~g;yW8UygTEE#~+lrM$^gvFfCsYltKw2TJ_) z>@F@(#V%fd^kZ2f31HK`rcBEzJ+Ae89yW7WzlxHY`zXeo8A`Kqz*G@nb0QdT-$~Yf z*m!PW4FUkArZONeNmtj?Te*1XdYpA4YZcd;^8<(CP|=I;DhgIgSL%;Qn!<=0w{yn> zT3NJRj+aQz$T{>!ST5bbIC}O9)ohWx@IUP3rKg{$(5qkC{4C1&BX^G zflccw*PCB$WxP*gY+g`r9L5vs?EDTeIm8y-4A3}k=pFxYc2c}5i`8#~Av-p9l#u(o ztm(d5Ak8jVwL55XVHpFkOBcL*t;g1rir_l6fHS1gU{UkH85Q*iewzUL;GzM?+KUqd zP?wWUytJ6}5pH>S4}*SU8q9OxmNnNZ%ZB|;dz4=b%^Hy>)6pBtzCZ9F*+1~0?S^vO zzjN~hNSP6>>^6p?zGpxD;AU#3n_r&scCUaI&DYwe0@_Lh=`e!Gifv&PiEqJJ^q+~s zM*|s)H!eK%90uS7twlQN^7R4GVOD16KkbI-tF6IUx~7BUqHj3uQDZrhKT|ZuMTEGh z22?M=FH7JJ)!=DVPz(8Ohh<%=R#kvBA^Ti$mG%7gQE|e0OUox;XwifT%q3UFzRPB( z3;TfrW68B_C)BfsDa4u|ei6fSbK&UI=FP1W2%H!6MzfX83Yx&a^`!@M)@1Bw0VY;# zKMuhp3$m(!dAF=n+SqYzwme*_ie=AS&-RwjEa#kcz`Xr*AEOT zZI}6&(*_|9B6h-Z9J)U`mk1fdm&`mmb0*n}b>3+%^;+AIQUSbG;;YyJ(+{6KKqpQ) zUYeQ3AsjUv12f)A^;iR`I440RCu_r~;WQNQ4eH*Yx$Rs8$K<(7G|d>tIVG-j4@a@# z)r={Ovso|EVp9|4=VC3`0B9n9N{aTVv}u?4CL8|9>xu9+ zxW^S%YUxk_esy+ATwGO&QG?`Iw!M&&q)guK6YWg$?(g^FmW@u4YB*H94By+M+>b}t zVx`BbKss?NLE^H{!vTO)LiAZil3J8#8{r%jaK<)9d(*2)z6Tr~2O1%YrFk7F?EbnJ zKuir$vGkbiY5h9qs)?QU`Yz~s+N|-Kb!QxX^?;>=4)(#^nm_1(i%Z(%x3eYOY$(^m zyPn3s4kWA#xICwX-LN+e`@#SIj{=Ddkw8=_K)5;v)^>jh+I6v(Q;J#(NaNjreuj6W z$2=XOVfLe7lXh_5E@d)3LT=X)^Gf42Ed2d%0bPh=Hd;MgmKg;68=~>M$^hPg1R_e` z_y~GzAn_Y|({$%t`s*FYs&rRfjnI{dd%bQ?#9%4q>FfhvVAhGI-8g|bbMHH?JPnaq=o-HJ*xOc z_>PUWK*44AA?0=S-pc8&DNJ!aVjC0*jn^Tr4dNey_7*9(#CgFlr|&O}zHTI~1j*z! z(D2#ZJ#A=k8fY=|6}j1qoUsTg<(ZhLIgxb8bv@Qr5j9;RFIAl5s~hp88JXb zKtMnmlVP@X%=#F#md+ynLpXXWY-1V&e7e6Mx@#&t92|1wTpMl1b zZv=w;CY2oeWqUT{qE98ly(r5kL0Ltzxs74RXuwkqc-IX^o$Gbpd=3o7Q*S-bTJ1dn z-ZcpwZO;DO$eM#@JXeW3uU=r_w8FFK33%~h zChx4}l@(c+R%@g!bLj({db8)_ya0KA%lco!$9uFt6Zj49pJ_zN4 za6>#We$ku}oJFkNe86i0cJpb=<*_x5#j#~JQIKZi$5*H0%jrxS$8OM&lY8pj(70xO zu277BKj&-jFJX)BM{rYhDz5S*a%GjAJcnOr0Tk88TFEl$S+u^edA7NqtNQKG>&B(x zF_+@hxu?Z+<|!~Hc929LSb3A&v>df+)m&IGNiQy~Wjm9WH8wkjIDK0jD$1Y?a|?RW zEEkysC3Tx*C}wp<&b^tC%Ucb5_U4$y*D;+k>C?~%afj&O3-rWNTZN{uaL%J=f#oA5 z(}(wN!ygVoANVNqfw(F9rr8T5^AnSj_o(erB+vj?mt)>Jt$Z&r$)NdBT_FCWx*&SK zw(1WXy1d%X%V~h>0^621wyKpn>e{(>Aq5s5fyB};h@MW(6we+;y1tFM|NNA!MTl>W ziUg~Q#E!!P7F7?Ts^4MQE$hYpWH{bD3Xf6;(sb}e^L7N#7K{eq!zH<~GhO|DC|5B`LT=PohuK4v+x>^^`6!X2S6n(Y4NS=>< zcseqvp3R?ul{N^Zoa7%=OuWmYE3)RY?JM$VdZ#K|#^Zsm(4Z$aU-gTQ2FxO)a72fzQhf=Y^bXf)?jgzus&=<=n zH(0W>WDLUKn2DcBN>h4#KweC&x1B}rx?h(4=J%5;SMyhT5;>mj44>GAj+rSp-__JA zvv`Z}f#(U|wyE!Lj@o$U6lE{&Z349cx6EuCM7pyGnhjEu1rSDhQ1mQx8cUoI1icj|fi2LqU(j}$Mxi>pSV6XV?z{->Ou3hwRQ0lvQ?q&>U&S6 z-Q?u{EXS;mO!iM0_QG#kh}$EhFDJ@}^5*Zl!l*iLXtY2$CHI`b*S?qiV$U#rpu~IP zbU*mPFS$1BkNH9ILJmgtmm>7(xLsrP!VA_jsQF^&8Z0)sa7pkpzKN_1)po}JBh7*L z;)#6_(M)`^wap3Rhj5Rc2!hAimW3kYExL|#SjqDUpZfwLpTGj?|OIw`6DP?#JJ ziNnNx=G1+(d$g&rAXEsC(D)!a^^Rrc`{mBNZ-gvxM+Jv0Z2Tg2y*rY|y>soLu06lY zsE`T-cCPv`KvVR(=FVy7IfO^k+YkL>(o+##*DQ@VTCWR;ZygR}T_&wjaDE=%ZKr6H za4$dUYYnBPPO8z0F4a+21HR3W`86r1QI8O?p5-yJKI=pyo@MO>TkJQ)=FzrvS)RJX zawuf(kzP1*j@W-FA*?)xVbH#t;z2xr$EQ34E!Gm1@~E?8bmHY8^(paswN$Ol3H9|G zrBb^8i=DtH_UYR67EkJ}#4oLPJ$$V}^`M|3Esb(?6-3y!orewFtIl)iT%GC?=zGdR z8ntqgfAq#R5bv5iZJBpNqmGzW3A* z`@Zgaj=~??_X>m{T-|-52vZ|ujkt2JQ&hGJ)MKPRuGDC=&%OK_WXhS>6eAf6M^l8o zAJm=NF<#oH>8Whmd9;NhMA0R9ycz948@GNA+t?_M*?X65v-a!W;@HN#D zjpSLb@epV23*bK{EHe+%}`DQDjpIT{^_vn3l zADq;@BaEElS@R!tM9XxWu??TjQ9Nj&JWdr!W`iCqUtV$s(qm`2KjbEhf$*gN7LOT+ z&UMxdedr?VX8nY0o8vX$%nen zhj7{6e4uB8_jzJ)4yp{VbkaY3q~*W)_3JzD+X7D}HMWUH{FQs<>2+qmDQD6?4+MqV z3ms(!{Wrh9dMA2pJ{C0nm?X}R_8FwNac*?n%mC40wFj#Ozwynp{dArOTS-dp6npU< zu?v1LSdS}ljD&W7V6kGZw^Hz-Vp9&KbKQZmhsS-uK7#6IJeyydRY;KWqH6zo7zfqJ z4SIB4k4rr%aRZB4gP|kaUfA4Km|K*x{Bp03>z+cWAh{a0F`5!}EgJ<|2kn!dy9?l5 z<@M7E@-OV)aUgyXc2ZMm9H?ZAr?MZd>+)QjyC&A&J#c7{-?E*}yXR@l932PQ+-^0<8H25j^<=iHW1n$-OPM`ysnCgG;1TI5 z>v!4g=`ukj%}&ZP1z+xzS_7Q~KebNYDvjGHz6H)}<(%B^mNhi`H2U8E+zI|me?6Zr zGomJNLSgCjk7R6L?@g6EXx-RHIdLvtl~v7BLuc7UzK+leyT0km)NdtZx7t2DrW{oP z&wJO=yL6GN$uD%NKW$0Y7EQZ2pK->Y5ONWNJT@N_eR+FCx-mXW0FvS`ym1&;Gi*L*>#D6G*K7#L`}vI9olr?EC&{GD)Saw&SmJo5R8 zQS1&S-MSR$e;Dn`_bIUGR-AJ?$^2@B%<7J`IkLexwk=pqMN+*W;K`u5Yl{z)2Yv1f zP*PfPg@z~mp(5`wyO!_lpt+AsuoW`A_#ve#+zOr>_x4oWbEU|s3q04%4&6g{3|tvG zE}gfPq1pdr1lk>|N;=bR;-!g91?eh?G%9k0eaf@OuN~frgMaQJam4p^sRdrWMB8oo zBd^lp+<({G&AMd}@;o=fTg_^ZUa6tpT&nf<=g<2zig%!#H)bzQ_OST~#x?)o$4l$>0 z2x09lMx5MD{UKq!yP#avv*pMBtX^np)JzJUouzIFWx571zO^%p_`=|}2 zNXnR;KI1-_y>FAzPi$oG+%c23#$KWN&^=p6TNB6|GNY^jZ7Kzr-Y%VezPOCBj>L{z zET8NL0WV9o#kGX^P6=bI%&@UTNuR=4QB_H_^kPM5`)oh;9*%P0y=jPzeLBYw89sTA zj~8KHc>gGa5VWAU$+h2v?1;kdUQKdP(Dx(9OiLqOr<&YwAc6RjQ%3a3n z-s18stL$Fmu)|;|>QFu+#;NLPe_91Az|h@+^>Ez_BBK*})s>ECt7>oAi(Oj#iB1<3!&yFAb7x$(6vCFtI1Nkw25W>CBY zHKy#z>h|0yhs4-ZgQj6l6>aX{yKF~*RwDMi*>gk2kxtO>T5q!SJP)}?2f5D^tp0Zc`Z&ia{%%wJh;=a1LW zASrtGYZhmH|KKA&h+Oz1hJ{J+Y-U((^0%v)jEY{L?z>$xEe<7;K!_ zBebtsERQ89&k4$|IvoC3jyvN4eW&M8gQYe#e|~EX157h{`SUzhyQvt~9TU~ptf1po z(WXA;2{0ztYZ)!?y`~x_abf6pa*kfvnKQ_-32a-xO=@_Y+|7Onwa_(wt*m`j($Mi;mXfkm6YU2aAMm}u0t zege&u*`^ayGr=mG)V(>fI+N#}4#vjG_gBXP`z?;hjHln7x>aB*i?FWPdZ1!YHm#jt zQqJkNP5{a+!$N8Te`!q*g8fZ2h{@7-HNS@bLJR>|f% z4xr$EMV9}gdPf!*0P^K(dU=ji-_aht{9d}pkdKN}l|OvFhXX(M<1l#I@o<-V`~GN; z6|_u49I>jd)rGtTYNllb`j<{|3*@4_`Bq#P8ItBjrccUdm3Y{oNGLm!IJa?_;Buh~BQ)JDA%P%VJmgMZTi( z#WOfVUFl^^#d5m-CT35%c`-TKtY=JYtVn!~@oM%NIxFdjc&^14>`R3srRHIK`TLOT z&WDSX7hn!Fn1kNfJH?6fSbu8z?q`Q#BSHuLb`H{R6+BgkZn6Q$P^97yn|5qDV=}78 zKu0oTaqVnog;Au`Y4Qpq+{m#N0q-A?K@xmqP`vZ42h0D^bNu_ji}35bhAY>4WyQlW z(sM8o%@0u?p~O-zj$O%2!i>&U3D>=$T(KK2&YIA^*WUDNsQUVv;)Tpll<5dhv6{5Y z&;xcRx5r?NQ1fA{$20tNfjJ(n1^h4p$YE*|(*?3qkJAh|%&MY!EnDuU>ZLw? z43id@?v9t#M72InbDw>q(Tnw&zVF9->m=E7i4r=0%yY03H27hUy^b!1Ht-#E!mwOp zS*Yv1CiKpWnbFoh>=&*vt4JSw>C4s>{t6537_8C-g#bai*5$q1qD9LKHXv4#WIcb< zk~@%9A*?jNtwe*PbSjl};MF5H%o=vj;m2vHjw+uT)u6}?@Tuzf3jSzYsx{9Mi1PEejm_?o1q zAhR4MJef{@+vFk_Wr$s2E3E8Ue3Wa;^HA#mgI^D@r^`UR z@x?Lqfb08l3~TWMD?>&~3XPbcHj0|Pv(yrWzv4nqGx?g00xZy}E z^nQ4JLD)y(_2JIfB$Y2B+E(i=M#G_?pl3XneJdunsr@gP>k5-B_&%0KZildWkCLQZ*ixfRp3 zLFn4WkfA=a(|eNpIcMB3O1amK^?6F7@v~tf>mWPAE=Ji>kFM*8tBHr2n^@D4lzg=p z4wu~X0Hr4)AY;9DD=sbkqGHN@&IONVr=yL{9@5T(`K69QpNE+mU&+nIrI9PK^F^KT z9|=@nDRdtd+l~eMki5>W{m?_E`oaWl1)j%~8q~S1Y4I90Oa0~9FD7nNKC4XU17!xMQy(UJJG?+D zE8E>rMOZe_nX#rd;ZlV{KcbBnYhCbVFVBl3Wbo}63zwsur(n<8lNB&7Ja8e!)iU!au#`0nQWoLEd*SuxByY~P$d?yUqeoOan@83ZgA-dr zWivL1SjZoU^I(`XQcaeNIuqRjmY%E9$uS+1)842QnE>p()ugr(gJt6B`z|4~EqB{`L0Jb!`F?MZtxCQ4?lUAm zwub)|-T=$}VSw$gBN+bJ05d-c!b(>_c&XRHok#Ubp0r|?W;_71R}Shwan}l`=W#IL~FD z1(h_N#Js3weIG&4XA>Y56E^4A#q;X$Eia2@Tgir<0utjDH*pvtlC7ETe_nK%a|`_> zkb1joiGR^_DLwJLZ~TJ>c8896+xCD#d%cZ+N6z+47LFt07I zBSO+x22=>2>e6EE#Lt=QL=r3#G=HxNbcmJ{;*M&YkQ0iz-vf=-t_e(FV5a*q;#5u) z%s^CI4YIrayE6XgPoL^ec1SHNxx)O|4gYu zOu4cM4C@{w4Uxjd6|e30Fqwc+tF>SNDfMb?pUv^iDVsqC8U@#Ey~6wVKhiQ(O-cyt z3{+Jnf`~=0M(%Vyc^#(j`oR0FJ;;UF8ym-;iRR?^F>Cm$5}2Zv z@F?%{ABWJCyzI>fKIMKJ|6E5d-Ui7+z8qPUoipcsCDVbQ9c-UXChLu-bU83wkmjio z>u)Q1>ETDGa97&U3;hvtX2iUTEV+YBV%$gR_hKa7W^&oRo59qfR>%38<1C-3fqb25 zNbeA3c_|~0M@%9Q5Bu)}StuyLFtB5_vcK*8OIYHc7p^fggORg8KmC7cn&5X|&1n1k z$GkpY1k(@YAqL84e>(s(GXTM{Hv#{gBL2HoCnLjb{E7uksCzuocNcVm?WLG1;>S#> z>I2xOdcGBv{{4!YFXtheuWf&S;a@#5>);pePHsF8KE-TJ0zhbO;M76;>p7d#!Fa>D zevVF;KejZ%Rb;*bb~zXFR208j7!g=4Oz+xRs$W-=VZIKQV|yFu_b+A@0+RXVT^SNm zFa~?lw>9ej!y7{oCtfprdFQWL{rMwb|z;fsB3*lAAAFp7(nR`0@4;$z-``I0{<_+6!k{Z)In_%DqCd4-Le8<8!1GllQM5pV zD1i~yv+c_r+P_i0i#mS7r0cBcAJ-4zNlp$wJN%acQ8VZ8s|ArZ82(<%arGWv)bi%x zb9sMEz;cFQ?)P4?P7hm9PJ&i{?_H`BlXA(x#N`|;lq^DmyjydhASo2Z2s zNX@MH)mW)N)ZtrUex60{16b~X;WL(hvBvL0>QgOXd)56ZJ2Rj$g-=@GnPK;LMtun= zZm7i2(m>MjPm&ykoEm^#ghU(uM0T;@tfNltB2RwieJsl zK(mA7PksEKu1En!`V;;sX#5VBe|Y+Pr2h}t{XaI+|BprSKc$!iJolZi%!#`Ar^M1f z-9^UcjoWYR`o}Er-)UOz5ni19mzny1nKxce5bgabee_R(!2AhsEU0eR+UflB_y2)= z{^wn4C|CdTxqk;6nBV^&`K^z2+{)PLsH^wJcqhurD^K_{%St>vbN9ld^CvHSy!PQr z1@kRRLSho4r^oKe5C@%~J@M%HgDY|!%*?MQ1&wZd_&qy*+-tfdYAtffXzuymb8C~L zBqvwb7%Zj)wYa*J<(dXfPlP>kebZHp1)CuM%XVy|H(f~ z62p+o1hS#}R_1kM4uC)XhKtCsvLQd5SQ5Xil_a~Hh+ z4Y|kMB?rVc%Y~7DLs}mvV5OiCQGF%nVyiTi8yw>9tIZv=hIX08Ew<%g7I)dx}Nqg%TYws7c z>w<>fbwxe&$@pw*3+K7;+6L`|Ps%5%X?KOOBS5+@`MVE>bUI=*2p zT(NnEm~HeSPS3j7=toEWyfcR3dHa_~Db@QCAPj8k+(AD7*|8vDll4cHU1y3el@q)6@9GjX~0=Yto zfKcWB_Yi7O;}yZbD5-yjLjE?Q{-T@kw-NQX5%nh^@VEc_BP{>tWzygN@1Jyge~ZTa zExLad-7l_n0TcKlr`{!ejC6snm-=}}6lLQ_8mhVWq}Xqzzs>@Pq?>Dx9^v)#`)6qY z&U3u*B-Z~yhCi%I~eIwRvHlT2@D!hS&-h1oozf zZ$P9bLddZtf3m4~?BRiEY3MkKmjNYj)mlh|hB5)+2ev2fkOEp7#L)swc3`9*zwL!C zoCfRB)trQv2ZgLk7MHs+UT%2gtNMeWqKwaDZ$nPnd@69cqxPTjdy;gH?cZuf>J)C;22}(RZDva%F3`P1S1K7Wr%KT6tnmhDyMq z!`@ubbT!a&+z~`4x2m$~HH_lXf}bHheK?tOs||!@X)}I(|_S`3eM#BI08Aq<=ME`KA6e^ zDEU({fJm85@ish~QJS2s-I_Oiu4v1=!!+mHJ{eo@DAcoElnnZq(eq!Wh0w3YpIl-o z)yMV}9Be31$tjGHq1G}-EFcH3W@$}N{-n;~8|y#d%ZNzsKAJY)wptjTs z{mZ9Bs0|mrvF-bw`&@}cJ0lB8yL~3?K1j?GyP^Cn*Og#)$>I;4y6F*lp(W`?n$!u(9dRv`Kyft0UimeHvAgt_ zk0?OT3l%RnFzd^43)3esYwODz@_Vyd#je}>L;tnrsS1DCk)#zT;5F%F|+V#_Ggxg>0*_eIhT`bE&_emsHf zOm_eCew?!>Mp6e;pRJyYZK6h47xuGx@2yt2an+HJ!K`=hweB0Yy(Oi7j7>-7-NqYU zq9l(EzEIrvqh$aBUhP2iM#YP<9dk`|UA8A4eQtX6J-p&-VRh2*3PmCbehM)99Mzc1CdBj|qUT(SDB=b&qtTypd0RCo?wa{D-FmDi`pXr>d%4?fG6|sD%dI)?5c!{__qZkkr-J z6KBv1h6}j=^eU-KF_u;R1Cz$t&gz*j$w$%I!(|u1c_S~(BM%(+c94fB1Dfkg`m(`Y?)XBxptk z^?zwnLM^G^7sFp@_OD(@HxJLWra^-j0qGVs<4M=?C+Pyjsf7JNFFVZCvF*1^YC2x9 zn+o>&vjee6L%2JH3pQ-~a__i(t^|Q>%fs}RA1^PlSIu=oD7Z!Uw)xI0&=8%u@o63$ z^Pa4jbAqeBG%=o>Fmh()__CA;YCt37X>lb)u0T=l&<+rv zfm8!o230)=@S$>i8ZF@%9r;6({h!deyCKIC|s_#%U; z*KDi5XA(P*TT#O6RdMqER1&oC%q!WnbDp8<)%#T$g6Vny%;kW(iw7rqwz6^hWdW7= z?|y!XEmqsi8X*Q}h<@nQo=0*C8CLi_#P^t&6*%$QF70O+p75A+v}7ilpOTt`=Sz={ zQ$bi-P*1`03!UnE&ECgnSM0n3D^m3n&q=6;tml6uXxuZ-P&d9J6L$vxn9@+w3Ixe$ zBc90|Q~^^x@EBx#0QO`_Md?%maf>7^%=if2`v#6EJP;xABjxGUNI)Pi5RkE}RfFHw3^i`eGLj zT6Rhgc9pO#+wV=D`E~@@D7(L8^Bi**7x?&?s@f)CjsI$Weewkx>1joO2Csi7V5cRu(hwR*c@c;}Lz^(Xg%Au@Q@ZWAXn2U^&J;ng$;53F z93p!(Z9A#Ej&wSOj~^2SY&1`}TmY^j2V|!T;b*+kAtXAFPn&w(xT68^!UaHFsg9Ia zcqy|-^ksi3rYxv;;N%Azwekq_8Wwe8>DDX2a0!ige3pQ)1#iO?(V`%X7;6}LEZ&4U z57_yU*=?y!3SM}qPn!KXt*cMmv+)LQ+!t`Zh79V`D?iM#I!a(`(hHh`FLj*)ds@mk zkbtAiFh7~%IQ=-8^NmcPm6_%(!hpxDN1U$#%xKIW(GXEw!{dp@+|f3C8xE$>f&wUD z3mqb_^m|tns8t{7hzmyhRtJHd6e5Oz;P$#gbO}ive{tq#I=Mg=T-1#|`YpIN7wMOM zvv5TMu<6Hl0Ng*p`NBaBjrbm18(pl&l%yOkQCqqQ6RlyvNV+c>0M1y=6c=Tei5mqQ z%w|C_)}_muivVZ_;MRKs(NW~wPdqJc=-h}36aew-2X)*5N7x0FT|C(PvxG>79n|$W zs3HrA@r6lLke`J~GG2hlE|l0kv(zHESCy*I^=Tq7?M>_$C!o*vLiRPF5VXO9ZH08N zu*IW0=?;KkvjGFSEh~4>k$!=guRP`Of|7!Lbo&nQ5M=~s-4zid#bcM^+AF}tSNdK_ zfH#5xHM!;uUx+y7#ZAGx(SI`Js;?5MLmlW6GyDPT6%FuJt4z@YKtC%#u4(xHyC%K>zBK zsdV2P3L0TIx|Dy9@aK(#n^b+?Snu4ZrDj?b_#WbIS6W#$B6<;zfDec3Z)l?S46F<0Y``{pA zi~3sK=wq6ePcWtO+ugvr^VMM4#P50!AVi1Y=biyz&&|HXAb?b3aKW;S+GkOTV91OdfSAzsJ1jFJyZZpz;o;A3GhXd%YbFynKg4!MX$h+1+&X_q1NsmTITJ7 zwMp5-S2?CD_r{nQ-HzastI`~Q|YA)0)Vzvzb<+KRy_86IcLwuiJXe#ILjR_O?|gJ`yCBo z#LP4#EuI8~^6YUqF8z>QMXweSYV}6G9mUrxHLsvg-I1@`J}81cL-9yr3;uByqVpPn z_YKqUHv)zzua;AGZ=gfys>i&%6#GWRb}9nlhuWX1Yl?ARC4N_o)P`Ek;$>A(sZs)^(HRiw!B=z2cn zs7$I9G}RGpCjemNsHXfu4h-j-&8O0JqH3&OXzmFgy7U(cKPHgtFfVAu*AH!f#9tCP0PLJwY<@V3$33|Ho+O(QeGETTiQ-!;xab_3Tu_ zI#VMsa?yovn4bF6#Vc;r?0LzTgyoIs07zS|0`gI_425%63e5K@7<0i|xlD++XpzEH zXEvjKc}S@}_j-~DWYd~L^Dln>0I;9{Fv4T{^ruu^&;T;-7m^($oe|u)V0em@_TYdA zrskGsC^4sm=c{}>mU7SUMqka78Hz|FE2d@<#-5vSX>w@{g69qd0ukBFk0tqbzai_| z8|zruBj=1whsHzW{6P!aq7i7MMX%)EI1@K~Gs32iGM4z8Y(PhmzH3AOWhWi@01TzPp8KwYsQ>8=Ok_^eX(zJfO!SmRFA|IGqw&-e7j-s zA3A4Q0*y=?DMsXRUgBziy;=E6 zfrs-f8=cR5cBRG_fyHo(s-+h5EOJ}!kx1hcPlF zd2p;p5hTb@NK4xN$zXJzW&ZPa5(sv95RD38f{xpwb2eHb5tg{gXlY`#WF>Rcs>KRY zo~&qlR3V!;X79iTwKWLeL9Ms(2b;&HbHwiN%htUK(d>{iu<72btqYJ4%Q$EdiG6Wd zh8YG71Z-ng7o(R!l=)HvUvYAwNUI#tj9?Yd(}`wE9|qdc)Q`Q>=a^RZw-X*<-U-7{ z=Cws@uChg_ar7$rAkx8HWF?qs&8h7P(?xE*OUfb#>67Z&!wHj;ivg?Unp);l5!zt- zN*VXj7G&=XG>zAWUMiJOqmzZ{_4ByA>B#vgrWn_y#o^1=u;s{FU1Wv&EY6ZmgE36v zhJ@+??Dan8b^PkLLFFfJ|CQL3F`$BUqqcltd==&ABp&HcsZj(RP7z<0LfB03t)GI9 z!WIl=&mPv-do4yDxK9>$o>{J%X+Xr^+@D-9QXy&OfxDN?9=4i)Un|Ge>P8-^weAGbnb-}OYSafs=Q`RDW+SwG(zlvH`=XIQ^z|@ zc#spQ*}OeyI*;d~-1;jQjRQpIzGz1-!(n)* z&wKMM#G2(5TV(ZYRZFhzs@a5ueoMs&TS#?)nzBezXzZbRBaaVeT~?ZyJ;qK4Gq>J2 zXwB#^dYFItRKOX%snPC14r}Go$s}E~a;OLH?Bw)m&aSBX4s37T5i=- zmt&=_907rdl068&Bh6TZwCa9MH0`me0^41%`To{qPyD$l)A&YA^z90s(S?}pOkq8m z#sCPng6BXn57ABMXF0|bB1e$D(J%$6Q{|qc*wnfJl8qSHnJC=cB7~TVjg#aW(-$@@ z?E7&a_asB+!)hZBV73YZO*2qIuk=Ijf8Yc*NOK{JHBeeQ%-Qd=--igl)3g14AXvUc zhDww?Y1`YlkIzlM(N8Ner!C>*kLmE#i^S}bcZMcyR>nW z`5P^f>e%kY9de(_UGbE|++BVt)XgePf~V+eefG9nS&OVxh1-x@XM^zkasWdK<7+jk zl0jMBJUZvIvBbcg1+5y7>o2ki~Dv0gQ{n-?edBNvxUvwhwZ>i&T=n7fhM%?}!!ukl#Gw2_{ z;n!1tkQP}5(}j*!R|kqfih8ZwcHH>CgMapuf;HwMi;xF*3MIzu>Mj@_Y)qTSo<3!$ z;dJJxR_9xFptA-4bik4*=Bf;{G!UwuMIEDzz@4u=5SrdCU^Mxz#+(ftL;~5T$I!+| zeZFefoWo`go0&D-z9#pq;yqx_u(8CR}Je ztb}Zy9e$)SEXN(lSYAnfG|_yY&WfT6)83$>Os`dSC~VdiEiPRDAlJ)U*aeApB3DaN zwEWy}G4dU9_;l9vV|MGnbT2LWLEn5W1beubvvec<4V6Ebk$;p(*S}l2Q!4zqFLuQz zq}cN#oiO*v_H4F?U`LdJG3F$JGy6QkLYgnpO_suHF**N)#rR8_i-={{jr*w6e z!hAc>8qOQO1F6XK*zBOS0N7?erl=n_myyDTXg-@hdyLU0G)1Ox^%H4!PpJp zsOg$#32&m3cBfn~O5_dI>f8h%2|Gi7vkG~c-hCoS#X`7>r*SPqZ`=QeOcTq-7NIaQg6_-q(6UEMLAHU0tQPA+TyOexX@sXO@{M`o7FW>&Mu*=?(Cc$zNvM^^E< zukyzdnX8Z6(1k6%el&IHrwQYcSaacM=%-++wwt)@^VWySMIdro3{3|iHP5KhDdLH- z_KDsj0wHYj6DMS+j_(-12Snl@Wz#Y^H8;%H=dQL>?X~6Jk2*1rp4xqWLNGuD!O-7K@p_F34NbkCaI z28u4sU>h}DR9vy;QMj|z@?lZMGi=y z3-%}sPAtn{e_O2x?@;Vx9m59wF^$^uZ_~3X<99`k6A^$5{LH~`c)4RDec4KBPx{vz zEwSgP)m*T3(*qKI1xWaq*vuy4c#)fZX6tpONHIx^k{VZpC~)lFuX{;S!w?+fZ?a(# zt>b8zM7{9KKAt)<`c$V6)*ldiMzJZxMzo_q0&6h}gdu~xSaO9v zu0f&%<)_gfYovd7w_g}wtP79rSd$z8r|#{(P(Vomtq9+`CESmIC2f#?Wj??fp1Z3t zy#KanzoBR;?_gPoG&#n>V#jExaP!TW;DA;oa^(K5_*Gj|&57m>$dS8qYvlNs=zMHux$wBV?*1?hvaLuHXDVcK zl@Zyt|IO7vnwX+lRt6Utke;6eVk^2mT}Q(~Y();rc*$}`?48m6lJ2q7p}ga2(g%Gw z>ZhNaIGWB%sBpxd^xuZh!|YZGfdQ(3^de^p18mDN?Cph6h!ol# z*z0e%xGPGEI{%O|c2sVq!sExztRKv~OJ=}V74q)rDwP*(4W7Pxv_cIhk!5o0Iafp9 zzis=~WS)G5AtpxP`k9L&n++`F}8^Flm=`gZW824TUwn{p= z2P<)VZ%($;7`Xqrajya$-Op)Er9cfS6OsE?Wb`TI@K}JxxQHqfh5c?RwfCj-YVeAc zL^|*NzR;3-c6q78*e0{`z5R(SL!8HMn-mgP{aQPGFvI;8Gq>O7CsfLjn)LTMKNj^1 z(r)^IJhF>lJ`F`Gp=y>ByW3IMgJX%EM(y;!h#7BA5Th=4JqK#L(Tk;Vuhp2VeZQ(5 zZlf$4cM`mKF{f<3tKtxO;~qw01X%r-Ja>H|CgnP0^zYvlO6U0= z`he&#$Xu3oi`l*cDchQjwrnyhqt0fM8ObUpL=Pv%j6hb0lpe7n80pfkOJw za{^GM+8gUrTxp!XA^=09rR%(6MJ&3i19t{>g`;4*G>F^{6z!UGr?TOAg^OWiCi0@c z*iGJ^91{oC zLuBd9CaYE3;8|BI;}S2Hn+wKmUv46_{Y4J<*VBq=WS;?6=U=w?LVlX{Kz#; zWhdm^jqIX)KPpso6p63Uu2$@n4ZDxVpy@ARG3zV{?7j*x{4zgEo3R%G>~Mo{7l^_O z+^Rkr?sA?R^cJ$aizRUJTVu~Ez3=Qao5}K;Yi|rE!zEV{Vsu&@!ao8;06BfQl+pb! zLXN}d9AwoA_Se94?-ix@nhUZ?l@zeiHNLuZxkdfT8Gq_ZrG!A58hlo_#J0(l6$ zwV?*A4KdcWGN2nO@VcQ`59YF4^qy$cY`rNYEDGXw&pO>SOd}qsta|o~2G}usa}^qi zqphYl!WCFYLlA0cRmLFMV@b+asuogT+um^>Tlv6|@d+h9+t*u{S&XE?B2(GD2Q3a; zEJk=>9-8|{)E6ZkpFIIT)mr@$HdWsPhW=I+3C6IGOE5`$c2m7F7r()=LG0TUvp#DB zOuuYTdrJ>M7SdIiMvESfm}{Xppyn=%n{W;;Jj!h~s5k=ALm%H8w>WLzpY3Mh&ZXbD zkCx}ix|DS^eiBi%|GB|Qidrw&G6kL7UmaMMP}uJUEo9Ija!3VMD|co|(DM-`)Evh^ zJ8CYIJ{%uX{6Q)dAJ?`H^zAhWGVu}h8w2`HctW`V2&Kw)zy(1aG*zVmtbwr3tdzEL z^{_+c&r3y#829DKVv;70NqfZQjY+n(A!t(~LkvnB>l;gM?b1t^zk^Sj$CCy)GiKZxuBU zrcWhTd@l}kPPC-4ZCEsvC_S^t3_d;WLj`x&sY?zk5VuLdE{66ijsnFo$-<=XPzQqt ztkCR&{IbO$jL}WPeZ3A1epA8#Q@LI-pZPg6cEiuUworIfPsso++UIvPIo!|vGQ*v2wp_%$;6VF&n*>o+Y%C9}HZ<nX=g=^l!+bWmBO{A=t#{Zv z$Pg%Xy6TNj&PGDxah6Rz7GM_sb+x(%>L~T{4SM7XWi0)AdpFNyu%eD9bjcf4)-4$Wvq(+Yzh#m zaLWG@5<=a$yJJk&x-W&=Q!pdA4qm_R+Mp7tiPPnB!AR&vv5#1GdgLGE0U5D$;^Ar~ z&MRlFN$OGMT{UT8xAvsT0v;aMd@IHE7zQY5uSwfNm{3Q&`g{hPil>nK64hyMRM8ll z_}qJTEFE;r2

M4qfUZiil)A0I~-!;bjrotq62cOFZ5R(~yR*l!HHB$793*XkXa zRhco6-Efe+Uo=v3X5Np*dT7dV@-tP{m&5>Ey-#gD>l`j5(jqFe3AQV~-euESxn~l) zJm2mwz1U|nAAob}5`{mXr#7bsg(xy3C%562?2fgDL|-6ur-tnx0E+{u+#-PYU@{3` z7uZ?IoBq&2qRS)HZ$LaSi?!#{J4RfrWx$vdacck*M1c-2ygmrWeESnl3EuyBm)+%8 zbI$g?aG}xq|Hs&0heg?TZNs=CBGRFBr?e8%-69~0bV!MGHw+;uEh(vjfPkcQj5J6} zN)FxKH8bBac;CO@w!P1@eed_rC3-n{ver6Q>}%hTQ_1(L`%Uk!^w|^j7gU_!Qh)vX zR1vr7VZvwWDq_^A`q79`oiL!#(zE)bx{2z^$~KCg_EemVWW#xV56%;8bZrG3nO1A| z>Ucc;4$fb--ocm96xD_k(=2sfQvMx#A4)0Y+;0K<-ZZ%!n(ly`pIQFsah~@aaf~=` zqgAhS3NDV_5xg2d{6CW+%K(I$+U z88t!I&~cC)Der+0;qi9)a^SZGef5&yT?(iw4NQ?-3xh(Wq_KV@$))(LR6d$Jsjt+;#b>;)GOGsri`xaaI|X;NQXI1U zjA{?lC<|#Td6ZGeMb#h}T5WZzh?HLX_4dsCZd0%J0&SVJ1*8BH;quJMo{jsz^M@^& z5Yd_cn-uD{K-yW>l2iRqV$gG!4ey!Xk!Y_Wr1fb{sr>N+)DT_-nWHi-K;IHTQc;al z_%(ZU4zGYBT|m?(5Pf#H!LK~t&xJ8!4bEp(+Uz77D`EO_i~W1=@n<9(0;yw* zxSbZ+)TF9xte72{jQG^98+W+$Pa1py{xb-a$?3LI#N#jXY8}T@d==QP$5UAO>$Tm_-bY^J_mCd>{zqIteplvS%TcNf~uUJXHWIDB}28) zBvG3-$4+f^tOIEtC-Uun+NuN|i*JzT!b_?6&4q?$|F9Q+DoQh_yE`8Dmr^KUdnSx2 zMow-*YmFWFv|d;Gum>^1o0Vg)f*E5ZB(66Fq160fa`o(AAq^SRGJNpvrK(WIuXs_1 zrjpa4rxl~h<`4htJ@2>gwA2|g%@MdX=5$~Ph5LoKES&Tz-L>VX2=ic| zwe*7*Ev)cNKWaE0wHj%47lo81M}rFvLZ%(+s!v1PMIpx{`+&HmH|+qn3$9?IbCtFH zx3QN;ZR``%;_yLa+)O;|%fA4DZ0De#3Z$IkrT#4i6<-EZUlnB>A*-%o>v<&rOMnf6 ztZ$R88@Z4PNezAmLF6<*8_BC@O(tsf^fBh-5P#GmBtVE}IBjhBN!Uh9Xo+$ym``1l zxzRZxy0ZUZ^#rw6gB%pWg70&bQq3W%1w)dw433i%&VP1N&mq4+TBx7=alE6bW$ahw zxN^pg>Ez78UCDk?hse`!1FxW~uF z_yAxNY^J>y?4m)t0E~_`hnXIZ;Z(gPUYdP-WrjC}pwnC!VRsQ~95pVz0zXBrq-J#im&(p`5-;$EBL; zDR7X$b0ywbfHxH^03hh^p6Vk|RcM=yKamzgly~PrvAkX>^>+|<%$+~t#v{T~ zH^_<|r@r=X!UXj8fn=;W4a9F^uNCw-mG@pYuZL`nR*ZEQRgVDJr42Q1lBCQ18@l4a z(1oST#Va2m#RK+o2d^Cjb@r9uPu~Bi;q%M|V@hiN%@Q%1sHBK*H_sh1wzleyg2z$h zzWrbEk1Twlk34hzi*%2B&YR;u*!?F-_cCNzFmSiExN?2evj*}4&_rVv=6#uiC zvMK8#ykw^K8t?78y}*SY*6iOgx_a|UV)H*sGYFpgoD^BF*$6l;>sw}|-K}pYzTV2Z zYDL`ht8g#be3r4N2Ns!=UFVNe7@?jrZ9K)e8Am<oaY=Z@oi@BZA9Xt)x0j{WUn+R_^-iufC$`?xn(lW? z-`l2~J1X%w_Bm1(gZv)-zR()UjXN>t=;C)chm$ z&d{FN82(8qfy94MR>Rqcr;}TwL{G&_Ru8=)@1-C%23D3 zFv~))>Znvou;xh6Jp>H%(R)jKfd@@c4D=76iW)bHSXss>6e6R&Vq9#UnprS7e%AkF ze3$FpFO>fiuz&_>d|%Fzto@|%U571TcV$x1K$ib(u1*b}^Dm*WOA}jTW4r0b-|v-o zFK1~hz3S^+*2b&%Dn{@oWmOkL10AR$ra@=g;RsJ6otXRJ1JD;dR>;NA+M;SsyXFnW z8bi<=!>*^_L3Yfpb{@LJ?AEq@pOmf4PVWuxVcT?No+lB&K8QNbS=Sy#Rz>LpZkrtd zh^jS2G!lTWB`x@wP~Wv4T2`(qV1qQr-kv)^Y`y7Sik1AsL)JKn!iOrSQ2;ES#2aWC z{Hl6KP%Cz0DV={nY-@&~YdSi)Y9ft{y9hl(J4L~PihMiEwNa6_Ygk2}#&iEm8KC9} zQiV>adhBULt!2xLNI za9cAbD=W261`4mKzFWLMnZWJksxdf+LJ{KaP(sib9+EyjNP?DgaDx8ar(Ax{#@>F7 zYx^2-zeX^k_8Rg_mJ_8!QLDEvIx{X&u1Lyk4By2A#j|u#{j`DOjghwau8h>CBy+1S zTuWo{ZtG4Sf2;Go1ogM-ckEZGo~$o@qqHO2ZP*Lk2Q-R)CMO&KtcEfJ1~AC;Z4VxU zd+cjXnE0Siarl+>h{!e${8T>mUd(U$jzy94Rb2fEqD{u5ftA!QU~GjPBwei|>(81A zXyZ@}4oT3qT-!!^zJ{F>PMS)vCbbV?kKKgfGspKOu>v2MEVtTdhTMKSXl1KVAPXELH>bOAJT^ z$rFG1%<~U{%y-@^n#T12%GD$z)a!#XppaqXWSrL@2RQ^^IN9pmpJSgo{}~R~x0M__ zsJ!Na*Yv3Fe7jmMufY_ofkSe~Y~$eo657;45i)ORn%qT5!(qp1yJ|dryNl2=KW1Coj?4 zEnh!$gV;S*nFflSAr25}8v=&Q2*Ko%G)Y)2O4IXB_1Br1{*kq->&e-~nG3}RPSX!k zIO=MH)(;#Z5jN1z!?&Yx2gQywQ=eKqOBJ_yYhpx8c62swSB+m((%d=pqni+Yiu3=k zz}f4nOvuI?VRvBq#OI^+1tR$Yaiu?c{m^T%NMm0qXJWd#u1=I1I2()pvE$-aXAzY0 zt!g&mYTu{KyKxWb6J{SnxUG?tTcwx~duxwf!S5r2HIYMzt5A zwQC*2HH4EZOn$(a5a1D&m9Z#0vV%Fm=;-Een<9KApEhM>ns}l$(~64KSQpx#UoBqA zj!jv^Eon~lfk5N`O{HUH$QJfMzZq_50>>2`Sm;wz{wy5GO5@KYcKFNBrg0ojz6r;o9`7-$ml|$jl;W=77-MM&5#>qpK3~O{1FcI@Js<4a0`Nm zJ^eH7Wds*m4{SI+B7I8bj69+#v$1aHjPXZkds>wGzgB0#sOAt5+fmGV9xGN4}vOK~l1BvE|38*^0Nm;+^um`r+9 zn1tWy1z$>zkWrOrk6D59#)tBCaaPH+~r-Esl{*Dyy_HK zSJ^3etLNL>U%{1%HW;qRVfkY}M#0Cr0moayPz#xEzm5ZbyDk8l67OhIlt^XE9MM<$ zt)|pHv*lXPtVaz2;UCaI{*WI4hY8`fLJX|&0g#TfjfjCY{D3VWnP0qa!(#2`3MUyO zug{p1r4eaAdOEvS7XB;USy~5IS8#awempAvl*B4BxOGjODG0OP+ON=VEYxEBuT;ki zdlbKswicP?cxDL2JmP?oR$BJ6x9=%(`p5hGM`lS98+#!!gi-zoWqkodcJdjxY+NKE zJRr=T=3302o^$(ZQ>&VnF#aL6i@NWbS`J>hyY2luYE{s;@a0n7@654$&Bnv+AeUo4 zkOl^5BKh#Y%X#Y6R)9p!d)oR8qz*2&sqe5@W|v`4mG~o|cdH$+1^Q5_d=zYL^SK*d zy4Qsg1mPHeM(joIb>R(`cl#TgMl3scp6ID2g`qAYRERb@4h{K}B*@inA-$qX^Ph|J z3X+@5Bt8Dx?Ufw{zXq=;7J3Pg5Hz$C>ZL@W$xG)@7mJ0`VzWaj<D<9>AueRhH>C+I&Ve97qq1+im z=242E_|)D&sFiNCbQ9Df@i!TPy_7H2c#CH`0v3x9*161QSR1^a8r~W(0w!~PhKiZy z|4%<~;a$$fLGe?hIk*i(LrSGD8<6KOnr z_#x_t>Dx!?aUNbI_bg%ok;+W{_f^|m2Yc<(Ez3GkS$kh+Ka&lR@>=+ z(B_*{R$r-rdwG=?NJC&TgkqJ)qa=XJJMqwDgvWBfp;LJPlm{gXA!7p_kF3%bS=g-# zQSIB*W+jc(l66oX>QXdv6bo7woK;y8$}sx*ywk@+A{ijU@wBB^LKKLi&g?}P=RT0pofB6+hAY@Y{@{eJo{ik`0q_EH`%C6P8;{-_qWXuvuh)kIf^fb3jk(ZU0Yk}U#dGK zWmw(?>C<hps(tyqW{f#bvGmlP4Hy$ut7En|0 zc)S`yCO1HmVr~WQ0s*zV!|X%)H4wcouy=aiUsRn6oet|p?fHDKPD%pOGBES+ zfI3p6g)vT;bPX;Khn}qdo<2ypx*9%Uj|0BItIZ6;?6q4GcO{}ZvEqn3yc zzW*xl{^|1c<3=|9v0oBaNP|>z8>GJ5bP{;%pr3k?HoW^7sx?(;r_usOqtmZi1xG|Ca+!MF%q9tvH&?^;LKL*Y1(>U?EA^ zw*bB|89fLX!l2zDi(@EtkcTe#xpC;h1O@WNbKsx7r|5ufsedM$G;PzH~vs=b60U5^PImS-^>#Lf_y=*8`Vt@S~>hVn=(X7_qkSYQZpBycx;j#>1o50*%N+@bakZ{l81AbQrk8RYBNd#Y~K%R*M4k|!)~;Xk3pEUYRc2| z0o^Tq(Kp6V&Mpm%+ab*b2Yz3Q6jwo4Y65)Ytlj*7R55!dXM2bpQ)0ss#p*<~XVw=DO>;a0_bvA9Bi;rl2@crrXH*NIA8aS!^qvK~0`ka=) zAN^-(+Py0|9saik& z{Y264X(RlHLt&;khDAGHEQC9NX;p8FTtOIxn&^^#mF(5! zW$TWhF-qp2U?+M32s3s-4mNEJJq#J7C7C-otr>N&u7#XsBZ%mmM$ZQys7 ziAT@sz9P9Ss@NZ(?y&^5>@$%Id(cHy#+!!opTIe_htA#gD3O^Os^R&kJuCl}zn+IU z%bd2?PH05V`G;KXUT6b*Y=9Y|xOVXwxDZ_n%g@iO(r@s&w@5oORBs%D5SdJW{xV3T z+Ixv)p?xWaX7lAF0&oz84170|z91S(P;9Ba*@HVKEkSoxGL`_keV>>e-xGP(78@#l zCj7Y?S*XH;gW})rxa1_ERtAn>w-&m=_m+QZ_KzLtArfI7KANcX^AHvh<21{)7B)6+ z{9s-K*%=SMAkflxFd^aR)v3;|_i**xY}PRO9YFVy>~Y0vFUjceoSO#hO+J~kkMCAj zinnJ^6$E4;G1qv=$=b$p(tI`b`!FtYVd?(Y=9r5vhm8V zVbuLc*&^1$>vUTxJRlU)Wu@@QfUHg~)KfyUGoVxQQ;oc3W{vQys@BGh*f8P28QQnV zGai$1zR0=F;niLdLp8KsKo-`q-TmuDk95#kZy~SV?towaVWZ-(Ld#vW7D!$VF8$USm{F2|n|9<=u zG$oA8;=B{&g-E~8L~$CU7E9Xp6d)R~E4Ig=PD~hn#m%c}0QhCaOFIEq2RWV(GRATe z$`QfdRLo&ej?bANw&^?298<~e6yQ@`v^uedH9)Seq!TouwEFN8o0DJq9Qdy!za73f z3G96l$cXei{9d-ENOCvvc}A^*=Z=jLwM6aoRhxBD$;ZsimM|JTpB;~(UnB0Kfj)BK-;(8mG!5`U@`i!6_X#ZN93#YfZ>`|(DIHzTU z<#URMi~91Nr7ykslvf;(zkad>G8&7ns4P^a+fkUl>Gbiqev>NU=M98?=ki;@kpue2 z)p0fswZa*IK6JTL3OV1vclfPUTDP0Gf8yZRfLif$@CZv5*R4{R>;m4T?aB`0!PNBL z^_RyMzeky4O5O7gQfurh;Y3%0I{vecbGnx1)5yyj|KRs{;=U1Pi=kSF6Z`0Pe}&4- zt~YXPw2ZcfNflysS)w-eS^Cm1vmfsSindlFYr$`XUCnJNE0!N{VI4;si$DKsK3F!a z;(^s$Tp|5!M~fkd1Ic9|Bx(C3A4xa(D_`Cq3?Zh^4hXc)ao&#ieKL8uvcrJ7Ok}GBY9d?w{Z(G@xmNtS*2i;W0lSlV z_q#DvkmYg}Krc5cy)>NITszO4XgWiBh6mD|paMo+>;P7V+HtVtq_3Df+)exyU)hWp z+doXP)ASOUXe>La7Jb@yngna0E3W??yr2GTbUEHw?90NFevG$b{ySBz-$=QzI4^!% z8RLifZN_cyFu%W>p(#4j0)!)P?ZGZ)`^O`7^|S}>Q+B1f*8A!G;#?c{{kfyL-4>zIBj2LC*BKre#emxvRQ0 z6}o!alouFV&^SMhX0$VmN@7#LJA?U8 zLwJX5gLLPogswNceXyA~Oq*d+%Y-L7UZ$!a_r#sX-}MFGqL;#CVvss)T5G=l6XCr( z^QZg%ZJ7Xq&nFXCbGL^}bqClsCODt`Nt3-4_<>pP;q!5C)(7&=_2z@%B8Fuj{qRcDZSmWOq*Vxa!`6E}7E>CPV{I#lZI+*Y4{Zrj5Igm*1Y3^;iDe+i#=llWXRwA1**$;{m zQ}mAkQsF+Q1iO2e7z{kcqgLpn(R`TZ?Bg`f<5yT{e9LOqSr53v!x;yDDcfP9tmP<- z=6n%5Zk(bX$SwFh=?Rbd520JUNxK-gt%xERlBrb~F3a6SPQB3Ova;?iDCWyPAI06* z8pd3VOZPJNav6H8l)&X+G^asXKJ(Pf=}+=kf<_^RCer{5c)aFUCAUWQoe(jd4xWOn!v z|GW&D$Pn{6;aE8#zvT+)lOAjNdynr;%c8|K6;eors-@c4Pl9N3?EC$LZ5rIP>JH8t zW#=m$hM3y^(IKfuvfB(Xe?J-2%`bfj`7;~AsMM$<=D@rxGNqpV4-A|g^ zOcMz!<=P4Pgw}%y=+H553o1%+BmZ1(trF)wZrm1-2;LS@c$BDA*{94X#!glyrgj|l zen^ykw_vP}n-P*dHo?OBMhJx9dffoheIf>NX&dHlHW!Nak zJGyfyv=W|u%{jn~^K}sGbiD^+gbqDQ0UVbc!f~j-p8rW#qBofKZp-`{!yLNYvTi?t z0@sb20H3)D3F}23+r%)e&YdVXd+c3&`9p{X-255iHVA~z%SLWLi=icDv2G+>KJD>T z!Y)pSilI^Ds^%Z(=YPgATB>yq{C>`t8S zB64D4ejB*EVS`EF)IJc^dzV(5Giq0jO1c}1l>OFH7X(+gf{8-#KH1(}(>)tO+fXP{ z_twF|0fYWQL1^lqS`%?K^cK81^6T3f5Sgb7FkT6bZp(jr}<#3 zlqB*nS0$YU4Gqn6u9FMdnp#f$eC3c>U@4*I&y`;D<3a(0yORFlA`MjbCH{(g^cwz8 z2{7%RJmgKj#oRVRBSrIaNWu$H>K2ezIK$*%WU~O(!<@`azqF@Y+{*T}D(!?GpU5e~1R15;2}LV8NPP{; zAA6%Y$^9BXIhpuuw?#tmQIyoUSWbeMS}}^sj=?+JcS8gBiP`E;-?sP}#Sh5w04|9SD#@$XX2k3~#tH@kWm zd*?gr14W`k>&ru=vPht^ogb--HR%__AHI2%eq-Mnxtn8LKZqYT-I*1m0==5VZY>CuXc!b1*`Xy78}KpwkwbMneU8!l}e@s28z?ug?o7E z({pkZggP8{_R#%av^BJ8>7SC=mTk*!r(p>S+wqEW*=J{nTW4o6#3`=)1mHa4qNmie z+??YMaMt%se+kUQj2q+5YrMKS@-sNM!CB8H7%q*6^v~(bUslP9>oce&59p#pa*c_V z$o!cu<~*Y|@cyN7Ebtu-Lw=rKt(PO}TP4OPSzj~6=xp^;+|GT>82d(&oY$P6F)bWY zTt&Q69rJRr`)KXY{^7U7ImGA&pGkkcY9oiq7JE2js_-@3T;H^YppTYfVj#nHIwX@EN^+I!u2| zP;y@BYpHZv*cz%5l#>@H8S9HV4JZG^YZ3e~a@A4h_qd&?$#9}o-l;s+!(iGjNJpvv zr^9=kM%BZbEQZgah+V~35J$(yKdt|uKO^DkylU?_-9h4pxvcS|ZYrs7N2}{i6u4Zp zt`{t@`@HaUT^Fpagk$G~D#3ZtoyV@QDzvH}&W40D9)Bf3CBS)Q%qe2vY1TY`5p#eXQs%$2_+DHuS!0QiC5^mq8G>3%R%5S{3IwVGw^WnI^@F< zqy1%`GI3u{43*^1uB~pyx!Uhss}q=q-6NDf^QV_*I>+&kohU^%qriC+x$|uH=A6d0 z0>@^z5`R8C{fQ_<|4{hv^wNX0U4)d2heRLSRL`*wmok4;7!|Rkho}9hQO@T5xOdVL z?@fOb8HNOO7juShTTg|K_52M@Xl<^Pi&F~eV}d2UyT5*rI}mq!OM~SZjg*sFRQkfu z(f+MN19&SeJ1X=JlDcBuIE%i@tphmq`cwZ};kP3?zf0HsMEO@%v&|fwhC-AT<^$*x zC9vQu2NqExV}1{oEsi7|^iF(pNZ9ny7ekv@em1N% z_OL+vra9h+99(&MGVa45z5fzP)haQi(P@&B3aw-II8QI7QPO z`_`)0O>~#LPEM5B!XJJ2_+F{vKLd3kIKUn_w3PZ82qZHl@qdwJbK}jZ1e7<&QQj0L zolH5l>6FLJhr8Gyt6oan)Re495E)ZzC0aXLWj+%WJJh-x(t{@x4^PXrXxi+n1r{-h zWbJ2bZ=dbX2L8=`M60UDG@WTmlWf@Rcw6Rh`3Yl8duL}w^#pw{M}&sbOrTJZl%`)5 zZ`74Le;0aA!f3I^nAKu8X?9FN=*d<9f8qVTzqp9*9kU3bMT`U)*?n(xU@prKD?zaw zBnloZF`#g@R^0W!QzmG688umEdLkl^E?BJB-pG(|g40DAwNOA6(L(dYtiR$SL*TpT z9o@HUf^)$QXS+uRKJA3XKfPvoF--@*TKHDblR1O#H&ehM+UN2XH{$i3MI$*1UNw*1 zQ6>E6x4-jA$4mIo(;2#p5`gNDC#CuP#*+H%PObD&DhDS?Q1_0@P)S!Pzj+fk5wGZL@=Cvv`Pp*( zJ1D24#Aj-`dpgrIor7*$Y^MiYnEHQdjO2{Uje4+El$y_4mA@%6+?=U5prlUVJ^lfm zdXh_X)7kC|po1sz?^K57MGMJX3cz8?+Gk4OR|3`xBT3HhtTzeS_by1WRfGH`P#)vv zfDu;wbv3#_(~y4P!U2XtIjTBPJ2OPhnkQo6DiMssS0?bke^bP^{V|raUc554E z7|tm4E8G8?ggud`_dYET`33XqLQOnHs+M(Tn`EAVpH}Ztz0?pWb}xlqUK^k)XZ(X~ zB8mWfI#lIM;Jm4v^?Xj~3sXPe-Zu^&Fs?;+z@_*aKEGO}LjULyCbvN&4jkrXTpq)< zsPqkMWj^1@%(HQUyy~?f8wO_5D3Z%jrjV6gK7zpFQ00CNKEFI`A4v*{!!> z=VY~{)J{k_|AO#e^AvW|JZWD&P@XXJa?l%J8~ubWyC8Vh)1XTY8Lto%DB1pLYD1NxC8ml_6iH3!oFU{5e+9&tf7v!gj?w}*-W?X$~hOxst1uwjHACWy8rMuPHc18-`+v24J&G2GIio~GAl;?VE;WtBKf&J*Dhy%LwO)eymZxMndV@2gzR zD!Dc$Qa^yR{1irL6EX}V=7Q2bgC{^#|Ics!Y{IzdK9hIpzt&oVd9iyXa&2Ka^3O$oyeYl*{KEVXO66~HX?!d$Xgnns5Kp~H z!SDE;n7A?KhZ>hV+BE`LuJ>^@OLVdXrz`g)Qybnq$q@2NGbZKHL&t!M-uj))-BW5g zXoxvtIiS@T!e!dYL)*+w|cT0ealpV9pn>=?O1tf%f>i$~@_J zO7>vV4yw+ad$Bz|4u)T{IB@){$VwLXxvw>D8%Z=<{Zg8(QTaa4rSLrrjq{Q0qX&Ll z1?$5D8m7g+abGWe`eIF`8Tskmcnmu2f5)l72eSX^!`KtY&AdtniU;c`5w~>NkCQx@ z8ABgwV(VplwzR6cS`*5A<&Gy!F344~D#b8_52739XpV@;#oc zbLq|F`vh@VbovXP-5&>^;;(lQ2XHjpq1%kHTVm8Nn{N$jkIWFRNH3%>zq3chWFlw; zbt3j|y1--gPi23mR!qqEICngBEb?}nd8UvX213w0I5+9S>Wn*ceh1OywW^p6xqpR6 zg$`oH>JGc8*rtYhyn4wn+`5#*ShujewN`0iuf6 zlq~fXF3&IbczY^^y@gp9!>PLqZf2ms2mkHSd2N4m9nOuF3?c%pKA$&`w(!tZHDXV? zEs8|R5k~R0=0rd45fGA~l36;H9Y2>td^qMMFpL z+@wX&EB%084%YrS(SZn7!Mbvd8R2Qyvj>Sb!=+Z~Z2C}EYk$c^1*uB`X3a;jH+gDL z3Jm=_NAGOlV={D4OyO=Je#MpH?1YNBezQ=Ydo<$S-KSSMe`zjVFmbS!%|C8OQ4tZP zb!iG@jI{*ABZ5!VX(X|}K3^7fE;g*Bh`Mlo;P5fPJ?JS#sa_Kv%kxXsq#s3&B{8$Q zj4^M>MXb7l-D`$}-5X^Uqk^u^Xq75w7jG&MVNEItMKHKd7E~bOe-#Kk!{cY&nIj0t zwJ6E?x~fDGKZZai{diA>N6N(^C-Jt2^BMR62n1rNR2_f)Sda2;S+as2IuH4K z7cgz?Z;ftT&lJCKrVl5_PALxPDK1gU6s>;maqo03g*NsQ>vR{X{y>-N8&d+KVr*L+ zzGR5HBn^ftrNBJ4$@@GzuBkT)4NtjD{`&0g^V-nY7Dua>%f9DbK}FYCO8mrpYjzSY z#Sb5M8Y^v{ddeMQ5(zEQ>tD-1qH37ZL{5&dmbn~J)OwsfZSSh|7GbpvXB60~ znP(!@mlcM*!?H%<0kb5P#*rY+<9B^aY78S%H0yCg=) zz1n#qq(18O7}Qx>r@9hBTv=x3tTP>XO80sutRd>#aL6NZ$)2-k1utlB!e}n=rj3jr zH{Kz8iGP!0&M5#IuqnB8^YlA@v>C<{ETTKMIWkLli-tQC5$@hh2- z!+$Lg-c5RowH`ON#AH(V4=Myo7p909)cu4v*suwNy3Q75PW&75_&71INg6Si)h?py zrmk+58he8YIWoetVvU{GWLN!bi^Ho;Kt*x+jlpwllQli-FRba7K#-1 zNd}9xZYMuoe*I|3?Z>;kMbMx;q|GIxQHID;3^r1thp0ATN zfn}%1&MjRJv2!wnOzmtF_u!b_qzd9V+Iu?`ckuC^A4B#(W(^Ux=m(gp-%kFqNzkov z^-9CABR-swUFs|QKfD6>AMCyJYN^kg6I$f!$Nkrj5q+)jQ7KEqTbnYmDNM!)^cKEH zBsCPntTPKIe-gTzsnZvRFGea(FAYUxsmk5Xz+ip{;d0jrz3WQ|IBSHxpZZeSu=#E0 z@OUkHeq%2Yqs_~_p$y;e?KQo3k42vHU=5v!#;bia#O<)VU*Hbi;SBF9RR?jW)iXK7 z6@6FevX3x>tLncDPLImq7ynxZ=i4gxeQ>yEh5}|(5iy>_0vi(<*<6+o^<^mSVFNIG z45lIR4eDTs8W;T}GIjlT2$iC4CipGRug;6%mGBp$Xa6zo*(XYhh%*LMdUg2+je+bm zkbC~3+}C8Z&GFGkcik?z1oh=0&A9ZwPXG<1}9HIYrGJE;~8%KhP#tbc`E_Qw-<-D%P|yY#G2V zuqhqb+Tj_Z1AT*eRCEU)jwKu9&rV_+9HLkqE@GMqnzUfr?7KCB{-1qid44lr%tf*! z(1hHSI8ypIiN5LpxF!bUmYa|U*S`S8y`3{|JY2eQoEHa)zN368kU5wCU^DdCX5bF^ z%WLI1$^SARJDNhz8OUm93c8GOWERj>tScQib$i{&aK_|RPw$wUZaGULhaaLYg#xPH zD&GKA0H?}SKKNpK(OM9;uo)S)Ha}cECGq|%Nk_^p<>nT{+B0q?_%kPs;{Ta9Q1%sZ zO}Vk};bA$#V}|6IWotBKS!YWT6Y1icy`Y7-^_m;~xsJgu}HKTNhS&o-(8&xz)=QY8ZY4)1sw--^CqkCP* z|Kf+c>?6%$^uh2jsoGWTJG)X=``DPgks_^(F?12ZtWMAC6REOb!f4v7Pm`8C*VuZ_ z=7dX+HE--g77?IvD84a4l`a5aiBQt9e^|)~;bUt!K#rRoFg7L(D4pc`Xf`I$iKb$5 zja_IY!QYIfuKKrN&?bERteF*_X6BHXA!V8fPXn7eYM;a9DLE?T&Q|?_<;OQejB~@GEwMbz#j#jL?SWXVI`Rv6%waqiNt^t0(5m@rg9$R z*2^U9g#~y+sB|uP6ygjL=hcCt&8$Cv2IqHwn4>8?BUE%OGmgzJwC>Z{s9d=7dgA2U z2L$5wi&ABdZtb%0jq*|%>RQ}yLQd^Gba8j7?kj;ik=C*`2SuEiPA3`PrP^nGmvj)P zznIgvOwNkDiPa^7f5u2~NnT#aIJQw+RP6s(O9{}y*#_Xj9`@%n6n@|rXxRjEgJ>?w zptAqNpl3|*G+LL#PGp#3kEDA`=}r@+_ioBk^%sBkfM|75a?_hQ_VLu^09~+vxtO5w zO%fi=RH3L_qnjsbkN@>cN-2{imFFvuai^56EoXbz6Ng{-l{?4T!t-w?!Bi1(sZUSK z2_XIW+EOX^PyoRvu};m` zv+64pQP!@`g0h-EK!M~#@&7t$xtmUUQ~5u&jz3lSZLv`U_e_J&JvC~{O8^py1CI7DJDy@9_f#wDo-Z8KSNe&{$S#eX2AwlN?4_xcv*{U^v3lB!=IJo;{cov% z{W>py>;izGr{AXZ!D7q9h^$JI>tx;@RTBMhw28@_%tIT*3r&^|m|FCCI&Gz-ZbeZG z(ohIkqX7jzhQB*}dy)^c!TT;rUplsb|Mdvk-lPku6aww;XYI2R$E2~GK#>E+LOboX{8 z#*ph%nepJ>M!)BM*g{U{l0sg`0ZE9TmK>nzUsNi8`B2jhv5%mx_2P1B{2TDJ`gO}{ zb&~U155BS_DJsRIAs-&ywr zbtuP5b5zdW!)UQeJvOjh5Lq1)riLN{wZ!UFl`U~E&VmC}2>zwS>J3Iz|Mas-dUq@h zl$*gY9#GsBBlJWf0|@Jdo1iuseow6xG0%DbRi2SkE%I;1j8{5#M>0RCWkI*p;Cuih zfFF~8#=S?RG(%qp;%5;RKgs{%rzceyd%543ASmc%OHSAsJv#$hmV{p)4wLE6{sO!o zD?#{NQ6d4)3=0&%5^K|>mf~#j3IE{F7bj$5O<%J<@Fd*JTg#-UbHljz*`%{5b?B&$ zEyDu^r=+H4A8X?;DivyepP&Cj9QF8P$Ect^o>{8gbFx3*Uo;cE`XnUmvVfJVl7c7V zVT*rtx=T3edi(-CnbY`gsn!n+m$hqL+Sv17ve`kQs+hS{AQ7mSo}A4r%hZb}iuV4C zB71o9$RI+99W91>wkImsBmIPM*pUH!Z959%*k4A-NSn?K8D9Kk;NzuK`nvyGbD1VQ>bL)4mapg@6#pars${h%lM z{=c#3#cetD*{ISfA@9Y?nDvWdohP*(NSf&_k>Ab4T5WA%_?a6YrwGv4LjU{tFLO?8 z%xSk~8eed%q4Haa@e|rC2`?;ADCtfuzH)`Rh;L0ivqvtfo$j0`g0~#G>_nc|fsR^y z=dBkrC109yN0XO4-{83%)t^(|S2lZ6{|U>Zbq0g<2`RyV7f(`zw>Wx`a0&l`uljTc zz2YRhh&u{45Usj1-!<`@rgr!2HK`Mu@Dxjo)Qrk%IpVH4mM5k> z++B*@)6}}bf9$>CKF$+KiRyqX+HA*Q1zBkQMK&L>?iKH$uL?&rF%+NR}>oc;umi-`V`5;pfNo^0%m@mWCI#Va4wz&uh}*_K>-% zmS&45xdM${2CDGN#OABb_0L#@JFZtE*oXp3kkts)<^ZEYJcW6-Ny)qiTDRwO>fb2N zFRSF+&@+c^&u6-f_6SVio7j!|&m&?NzI7&g%{?h4Tv_|nF9nLGLB=L?)J+>Ir9NOz z3p3M`0ZGBzQQ>EiPd*bjt$TxD$)_hrB8M#3`n#%fEujFXD)s9q9dLwECRHA>4w`4< z9ub`K{b0rZ5lv*%o#Y#Q^GjepxT-TIIPQFP8Y1Uco~_9Ed_0rdJaVexA=7-_iK=|s zY@VRuu+@+H7L9CUsm5k3-hCa*bAi9{Y#~=Ev%TDUMz@M$t((OS3&45=jEpJ~z16~L^k>O@H@L!y9fB0fIyzQJ2+>QPRChz4&yRuwH;5Gp7nTk6VsMySA=`hZVr>QQ$}<8 zQc8xMR(2udwU$$SPYno|2f;E+wk~Yl)0FUu7My*?W{UtkZ+Hr1LFcBC9TDYnp-z)V z78>4mD{K2(6Xjk@#8p}Z#x0Pm3KQ0efVP*XENSo&Yu#W2-<67RJvkzXpX&Cy;m=X} z#7#Anx;Z#q3q$H*HjvNF{Gx|Pld+3qqqM%B$7BPi%o^fk#)Ri#rauXzvMhW&EL7i(=C3Tpnk&*vCv$nbRZ#N}UO}nGOA*Ea^-ekc8mK(=Sgr)TL z?;x@cck#fse;1bZV;0`7kkZS=@dW^XWF;+;in-cCyU$li&ioa1PxMY0^B(L*^ivwD z@zsATwJ#bCB6wmkdMNF0mwfz0X~`p2uvGbP7dim8d%WBE4&_J2#~QcFQwBYuCT{== z^M9cSo)AQ&C|>3H$w+x=xH<#mj?4Ow;heFWKX}&3UU?mQGd@UX*53&N?o#g=fr7WdqQIfmOu2IKJ<65~W%+JTiCM zps856#XF{d=DK}|6-66K_TAZ96P7SZ7VGcjh9GN=**t$c`-i5=8ts$JfH8)=IcqZ6|L|b#E*D_g zOwqh|l#8AYi-+fsGT6;615f-dZL9fTH?pD#_PR>-q5 zm>7jg^7zHyjC22fa|2y}c%^Fd^X^ZK6U~3hzJ+y3k41}j0t9eTtpf;@6hNRE@KO4% zFBC!J@kk)Liq1?5L#&s4%iPPa+Y&avg7KkC^ zJ~{RW?sIxH+-xSp$t{A3ytdsDsdv+vAH-TyF-{=2LOOThCy?iBavp0pj(kJiCLeiA z+_tW&JBXvb(PNDiJ_znTK*8Lr`?8Yg`1&jgsTOTmtA+pgD~jO42Mav%9N+ERf^Z@H zKFSrPFPmgZV3D2TG0@sBx5o$hcKjh?wM2D|+H-o{Ha*bCaqhRq`{4-c$QLMOALK7a zgB$7m)K2}2XFN9GH_ki8LwW(%hh)7(W}P=mympuSILd=j77<0ExD04RTGjpln=t#w zl$%)KCOsesr79AK`70LbeS`NiDXLQa@xTPct0%`Q`?ljx0y$w zS1WCAx=9NlS*U9}TBsY`4-RX(Jrlii+-vC3i&29@C0Bp)^fk{QPr9R8lEZEI@xF(CK92hRk)j<1PB? zaB8O+>v-fzL*eH#7#w<4KNJG?N{kv>{pV)SujkvS=3HKpo^SHxkst5SeH2pvoIKrK z?Y9l2RbkZO`%2`f>AJqQuTZL+DGg}bpgTxIKieEajv(R=7!`2UKVDucx9o8a4haD* zsS}4K(ZR47>i%3RGCATKE!PJpej{-HJNss)OsC3B3Rpq&{?E4ZUG|^?u&$3w+j9{k zYcO2I;Q;)IYi8^78YnxGs4(~9j!@!{M_IIN&m^wd`owhk3itkA7{HL*Kzmt1~7Y36O(S(z4O5`oZICd z^7Zl3cU{58AB9NA?)I*WD!!@tx3!|TP>Y)VQJ=nw>mNJEOZ?xGJ%y$39WH(agCi*+ zmxwSMFJ=q=?&iuTVCam>S$)clD^xE)ng}@Z12*}svGD{Y5}sY18>2})AGbPSeR}tK z&2`qaM6)K7=Kfn$iIdiQ>rLz8_t7}3KNs`u410g^A`|m^AY2^*4IgLau>urFXilFb zLvc4Wc7{`HigrFx>KpYYgZLZ|;TwK1@3%gAeo&Z2WJ!(*fco2a6n!p&*-!bq^ar^o zip0>Z0;+nNa1}J0z@!$ra{h38{&ja1rj#Ro8nojUsc{j~^Fq8p?@+(&txK|Q3LaG6 zG|FqiI8|Ql%iO;VdZK^wzlMrtRO;>1XF`HK0Dxy*=+=J%=+lc-RKP@VOY-a1(@yH~ z=S723x=Nj{XTJ8<=X$3D+{2YWJz}&p`(cmQMQY6FP^UquAEll_3dKkA$+tUXS%rJS zclC)S3nI-PuUAhppTFS6g;^g>ga%q{8BFqSjp+GsYt@(tMwy+S2BWXej)4UfEwIS% zaHUGzA0l@jzLp6Yc7L#1xsRu8(Bz|0^P0(TYmM2#9-$C^x|tXmZII(GRqHaNoQ@4v zsE>jM0ZMC~YQz~LOr2=!!sdOn!0XjZ-Nens{NAs#O>S)3=yJ6!W0shc#VrXee7tq`~3I@b?thOgMx==wpa(&JvRi)%LqQi&g8b1 zIhvf^dC`T(ahKeK^}q0Q25H(Z6A|~gDX^hiu-W?wWL~cgr_O6( z;3)j!9f?>(+8!Eea(!qEVK&33k(WXvGs$$<(y)>+9Y`ZVBa>4x!0C;Xo9{d%hLUCD z8F7|dj^$9OxYp1!>Qu}ZM_$0nkX%~Muo|zqG~etK?amdU)2<~W#VVkY@xdRX?3zL% z8$6B@4Row9iHMK`&H|DfHJYrbx&2f4cWgxhG6lG-U`u`o{$CfsBD@j-b-H5lw~Jo= z-SIsxS+k_~84?KpA7x9U6ID~(A`2GH zz84d$728(}l?#nwqy$Hn*Cb&{tsB6sv&~BzbjI9JVak|&!N*o`hm1?D7wE=F0gEI| ziK3DE%H%NWPFj*YWkimFs3c|x*r$hTJeVwuGb@qD{x-cE!}B^>@eBQ=z735DBljo`~2{sR$GM4h(fl1iEnnl>yOiz>?F0@h$t!1 zo2j&*Y4dmws|3cNux080KKspU*YND)`)kv>uvH;?^3*NJ*<=$(%1G5*Z~ftB&tVZk zReK<+M2piH@>@!Oawl8AwbjT~TXTfe4j%d)-OD>afH-W^DZZ`FW{&Y_c+G(_k_Ux= ziyR(B>V@{jxbMGXppL|5O2z{+Kb`%vQ@bNfJ~dLr6~A}HJeN)= zj@v@F;LSZ5Glw)o4|@alY&lZ zXnG{E{-s96-Sp8P9$r)671XTJeT4A{FnXf@3~ic?q?Z4`!6f%Gn9>pVjzgNhF#-51 zU$0|FJnMXXtEj<>#ankV&g*!|_ZK-c6BavFe=d6RM9i38lyCK58(HpufW5EM%FK*Z zz0v^3pH(XA%)j&8%hQdX@2`UjGwJyf`e@ZRvRkGPGx$qr*^4r9y8mX8LVC;KmJ^jY z`8%;R?MIyrgg21_c@GVpT*Hs+SJota3NF*t;R0JSf4~idi7`kPz z0kr@6UtUP2VO1PCo1`^gT@C)9(`ag-%0m32!^n_a=j}mm>N~_`O>EtDwh7jaNipcR z5IKG+!w_&jxy4K~9QO@yS7DMN6CQ_gTJK}yJ{mwLI%6_BgyA285V@nqzOM`cHc`77&s`iVDA2c| zo@7f!im1=xlmc(n)d+X#~=PWTk(dot<0}6Sw7tu_zAhzMcXFb-_^+?P)DOz zTb~|(4SqKixLNT6EFC6C46hzD^r+NeZ_ue@^KRMMOg}7pUPK?q)nQN@l1Nui7xi4xXbziuu#}_!m5^yls6Zo zA`c5Obbv!|?hUI!AUl6a{5A(~TstZsN#av+KwU8E2?pc4`sW#COTw&XXM4A&mXL+X zl?mVZd9ctZ z*Uj!bXh{SND#g895YE4h8r2zn?im0yn)8WcZoc;-j#3DYk@{LiVysBz8Rp-ecymO) zX(zggyX8_XNvu(C#7iq|2$lPwD(rs8nPa?6Gq%vcDk3=!jh&IU%BBIfTU1$ziBppQ_8fC0NI!=-_lcv zmJr0_BM?pfaCHc9iYVb10p@Fdu8U)#8a;<%E+t(a;j3Y8ERzGPKf}`;*p}+ONGw!~ z21mNcC=@r5`zR_u^xzcDR7uk(-0&?|=ve;U>{2n?lE5F${QFjr8BDOf8M5*9X_2=# z4g6Ni)bc9{^?Tcy#)dh*NLTy@=ViYx?MM;7K2qGVoBafaXbv^zQcKJOHo~UNwG>XL zy?K&ud1=Sa?~Ua;{LWu@I0BIHwgWYG7vY@(P!Fcr!L=47RgNf;X&cF-Hz-kNjyDHX z4pL%~S5g3KR22I+z5q({RgT`oGt~Z?RHg+e9=Hwlh}vCS-uZc%!m|fQa+(Sd1qx{b zFueAgo1j;0uw=P)%ZI2$(`6ewH&VUPf7IhO!<~cf^Xls!R@*#z2JZ0LJm|`_{wV0& zxDN|3<7GdgT<>;tkcnotOV&4qCn(vJsg%accn7);_jWO9*7|wbLL-J6n2~$@Bft2I zcfag)^IUzAXqSr{-z0WS<+ykDj|ruKcNy~DN|@bLUAOAn)RmjHdEg6O2%-uCxt&%n z1eY)m+Xzlf=UV~Bbm0yqRzS04@&~c0ga57n8FK%v|9~>epp@r+!v|~T6l?T(>p+Q4 zxa9>zDHG84bG>=dYP-I2t#1l{wcNlke6!yTm3?gsMO795so+0oysUJ3A=_PaCrJ!~ z6NzfwCBPSEjL$M&H7U&oNh$pZ)IC)?t#<4)z-M=ft|t+eO<+pZwH!#$H^ISXhPRWz zM)f$5=b%mm_DUW6HCRD{jlgm=BCiUwc z%#;McJl-V_m9Z*xeW21aln{=&pp5+DO^5g1Txn*I!@wA_soS6RbM;&Mh;T&E=|(eN z-L@1Ldyxj*TtM{Pm|30bC4J?`uc17CAlc}ze%*~=4VC7G=fU@vVUV)(A2TO~Q-uzd zvOh2-QzJ8^Izd>)j$#P)sQ=8zNO~IHzdJz^M?GZS?KvS>gRg#F?dST72D>QZ=oR8-bm-xP6 z58Z%BMh_PqUVSA=#FDFtoI8Y|=~kOBq)AGob#Fx>0ZpOdcf^N*g;=npAukSFMWVf# z*bwl`AOYU2`7%fri*JBIf?zXSi7K1O*p<4+Wjp?AG&5bA?wLiiF*dFs=0dsAMgJ4L zZ~;mPyXAmM#L%YhA>7tXoGFXFDU~#eRGwQ@c9z7okNw>T+)VUTivDYln%*v#@5pMU z=Z}kM;jc=ur`m%By_(7hQ`5QDgNs@$tG{Gy^McS#U1dVI@aR3ryVc1#n2mvOE zViola$~E5GoSLF9d~fO)TiRll=WuyuuHIr3$y_(J;1zLb==1}3UxFI;Um`jmJ`#wI z5n_lGVF6_QD<$Te(RMR9M*49QU{LH9uhA2V>i$$lH6UFX^$h>JOo6oQh6U;5$m@@O zi`3GPPV^Weu$A5E@)^IB#^sHj(LinLqGjfBT{KB{MSBrfBrEKihG+=*%4c$aq z?-ekKRtm2PA{PPV|_nu$j7bgLqqni#JX9=NX0@r$P3;(r<{`T6NgrsR{+TGun zJ0uf-;NG?tCJe|MVs(e@ZZ%+r1!l!ZH~B+g?O*4A)Byqy5(9hBx@3+X-51%0IQBuJ^o8tpB}tgST+gElnr8 zf@EQ&`bi3j)(uN))P1wSA?Xz=tjTaPnqK%_=Xxm&3`~;(AX33(zxO(yG7ICgUbSd2apk zT4UaO8PwfT24=UO1X|HV5ni$VMH-T@vjB)uvTPEafr$$3T`Mn-_bnlJyJah75W+_! z!Yv)BU67i12R-#%j(OEKtLOHLKrAyv0!wBfS(0p+I40Tc*IplMXn&$SQ6`Injd%#g z2{pjeUM|i7er3z;NFWwz2mH<2qdM^pIJ#(JxGY+IYwe!Oi)0D3@xoE*LL=bVi@iCL zS{oTo;>7;wU3Cx%WBL_9rn9Zz;KwIKByXV-GLX;_)WcEtX`)eOv%X z;#c%UU8`oFS3!vFF26 z=c~I6d$Cp$j1$LOq2DrKo}l`teR+J)ap3Y5Ah0t;|ITK3(boazCQkl@pa%&|wSa!2 zN_;T|`HN~)9f-X}PPSayT*OWOp_lf--h=&p8kGY5MGuTrIo8`K$EZkF7UF zX7z+4sA@%BA2==ZKA(*7uLrA`Pvz+A;5J?t&$)EH4qQzIvOL$59}CqfVyrLeg2B7I z7~CPh(_Tx057FXf6$K;zsNl`>jA@YE2DJG6I$8)nU1@G!mxU*^$;Z+0- zYl9!pM}VSj&8NgieJ#jB{~KUVTm3^?zOwk|o5j;`h0+85jNA`DTsd(MiyV5c%59HH z&Ff5d2GmNv%O)^%>`mllxNf}3W!JYNr`}ISic|2XbUN6UAI+N~Ix_&G%>uChonEOA zDdy2nzHQM}Pcwkcx~x-x;|xLTyS%cL0YL~ATR#GXWNi}^F6QSNu5#AD5urpw#<844 zZQ2L+^%afgpkg^^?nZ#+``vpIgaLXI$y=WMCQh_4T~P@w(1`_!u#O`@a1dpI{6`<< zVQOnI*pJmuihm4(xvtxKi6gkyH|1S|-Yq8w+{Jj6cy9Z(G~5d5yvRS_Ted-Cv%lHD zT*VJh3)uMQmu6!nbIQG!QKW*f7a2_Qz{xcCylq(Sj9K{JHWbYpwrUKZ8?}RlJ@Zpj#Y{SjnKeizw8|2876@Pc-j@)&hgWs9h z_BS?^s(`=fZRT}bZ)-l;N7;|DQm5^=@{Ph&A20S6qBi)vmxX2JU6 zVTI-yb|vEWX9uH^v=)2QY+Nl(dgv{tJ>%coz@VV-stx$}HIl?^7Exr!MUb65K;Hq* zohoqdXxB4oj%KUKkg(~@RB^x&U;KY=^hEyLns`mII*i~_=|T4EJqZf_*^k#vrJr?pf88v3${sY~O}gSoJ;DO=_#Pe<}XBdz(?0yfu*6 z>VDkZQ56vT_vpz}e`%g8tFTMiO3Yhe9nOoacok_qxJv|^T`44_f3UX~fljM3Sp)Uo zF+*_s4k;V0*U-t5hN%+T!aLFfK5&}nHz3fOQmG2NourKwxoyylVe>tV+tpt~Q9k8D zIahz5Ka~HHD^4>%Dg{fcDaypAL*d8`D{5twrDoj*`%=O?`+_N?(O^We*Q6k%`mT!1 zwto2zVQaUK97;`&uKBuoF-vV`>U2qp5>!^Q=+X)Y-~@2_R3HdBC;+g{L-`xIJVo-d zLs#T&R6@ebA;fd{EBXkiLvX_3kGNi`Mt`LtkrQi%dG%hhyG5h7z57l?4R{-rudN1F zOXkaM$+l~pkA6<&+WbC~=zv7%(@db=R`fbAJS`zXm&<>Ta60KbQ=;rnm+HQTdwapb z5T~n+^an;%v|um`UT(lT^_brUUQA4EZ6XHz<*K;l!)I=rIW%h7#LdS3ij@f8y@_0U zh!F>uG@o5p^47Hk?7-@EkiF*~k&fODm7XgJFd>^r0F4@I82Exx1pxJtKx@40-Nt%I z!(Z|h+ofjYP;91dnJ&YY$8P#?d{CCvoc&_3o&>crSUhm4X~6iPG?o7>xM|v^+`5NU z#8dgX8Tw@-@N&9PV^b?GtRjnPJy_ZO!9|aYPZ(G@Ur?#RKUB)KmmQNXR8o<>4>!<1O8b9AVLz$>%Q;3SR9yd(=9P@~hq(Pto7C7!RHsLTwtgd=W0; zXhRxnUnn@B+XFcmFwKpUyby4{D*v$QTUPpMoEL1GzqUVNxjMDMoZHcA-ee&<)K_Y?eL*&+G^3thLPIzM!ufa@#Emc)lve}Up^ zPOz#uSis=T+ZJiSkA8Vjv&d>?6Oqov_PWRQ(nqjk-w&>M#B?q(Da7z-)gbTzX z`TPT|5K4X8_t_CIDT!}&p566|BTTe`_KuRRB%AJBl{3-$WUb}s5Oo*UZ!gZgt;`+) zs-JlMBVJn6GQIw_P3*FTTEF(?i8X4R;o{3O(hw+Vm9$VsA#Z>a=OZrZFM5t%hr1OGgkv`vpPS$YY~s1x zoMaZD?}g|ZCSI8zG>P{pu%0HpYeI4>hKx+TaNH6ANp$?v39xSnr|0NZb;e&(L@Ee zbIo~{B)quW(XZ3KVTo5WBHMM#6v+ zkj|G#Knn^I(x$N+gqVO^pVATF=ORgYQLMGN@ajGb$O@WnBlqbSg2PdBTyxuVurj5= z>%qhXjaO9vnTpal-S@lq(~+S4R3aXOpFX1k4>n@l{E)RCdF1TEWMUTHuWS?}#wk>G zT$?sTDjEQR5wzul!+HERLC)>#VdW!EHj6twS*yiBF_Kr1Y28ztv((NT%2hPL961N1 zb7(Uq;{r`={l>RBF}0(2F>!DZfjl#7QJJIN+Jmdh!O*g-r1Lo-OW{!#iXhYzzm(gc zHB4}S*t?totp|?^qY|;>^`&JtL;EkL0WEQ5#wt@0T0$WHN`4Cm-pblBjfsARNs?OJ zp^);Pi6s_GO5)M^h`+TbJ=||ppbw-TjbG(Hqj0mCjlQ-&#gIiW43L@{rq0Z)>}OfO z8F)^OFZ*#=%~rLXHI>*XR-rHLTu=vwwD1c{Sj3$uAg0g_tTuh>E)yESL+htKR^dtX zqVoi0)X<8nmMLT5GHVQj2Xz|kH9oI^1JMKE?ypZ9HMa~-tpH*^`|8GS)qrev`Z^@m zW_W6aOOs9M{8u5(66ALSGOqX$pVMbv&+0K$9Ka@ybf$ z&m`l>0`rBscc0Mo!ZOme7wJDKchSAs%n?YHz7)A+|3ge@UsQ@2US!;oHH*o)-(MX% zzUcIbr51>jSKk`-s>qUVb#VZa1Xd6(i@$7s0YxN&F&+feW=0uFRbgiv#Y5SI#-h!N zE`)z4)Y8RJ)&wi1@M}%B`5}|HWZC&Y^-lEb-Niez<$7NYXbsVOaRS_77vKVY#a+K8 zm0h$fjK;QvJ0Xcw0lpxHWwjyax?Dca=V#W&71lM!#6(uc&b+y7?g5q z#ewu?ssWP7+Z`vF#~P9!T;y#3PtQCCd{;h1v&U$}uZmQexwqsL1%TXxpg_*Z&LJ=0 z@|27O9E{yB!9u%P!YKz?z`Tbc1<#hHIP$mLX}|<60HBUO>R8T}EL7vjCNUe1Gaw4i zXG=w8i2cBv{;4sP)Q^>aJ@2r}8U^ns(ZBzh{uLj)9n~C129{@tX(CZ2A^}_<W z^xk8T0}(#n1Z1J-59vmEuW_(o?@F|;QTmkiX+4U_hyNKpz6OA3K~k|REPMce_EK51WK2U$Bqdw?^0c+vEN@k60h0S#+vEMi z8sI(lPqS=~5^n886rP7)-|ef4=CV{(c#znrjir`r3uIbwiH~l-jRRZF9!h+qOQNL* zvWNfyutkMzIxXq`#&LaGwlhY^^S({Zuz3SbYjYEA3@u8`)D(c8)ulWm2@KrDx^*D? z%|XQfb{RWmcwpW(I|{yr>Vk%Kapk>(>)Aa_VD zl%r>f{-er-18#f#mZRMAfUin`3oj(*tB>SQudH0YDLV?-cN8nOihxYnS(X06^)J^d}jfpeYN)p={Db7+TsT)_IADVT7)VycRx~}CneAjH^yH86C>%VoVPy%co;qIe}eRJI#b6~51v{_ z_Oq8SUW}R(37pe5F>C<`p1;+Uu+f;5t|^HNjU5#a559k8mgP>QN!r~naq5Z$LZBT= zRVnj(rsu&_;os4tNerpc&YAm>t0WZppOXu4rAYs4v zO0en6{=@<5Y@;idu-YBCNh^)V3q_O5)}WBG+eXfny8A_6uyS1YeYxL!VmLI*h6@-;DRS#Q)F-eYu^D% zKJp)j%R7c(@J(vM+!5K<}5`bhDKF1SHZM@{kY*odct=#JG_<0#}_Y*Lh zwM`YN)&E689cOj&gu)%pLBrAqo-;_%FNIiin^+xQWm73OrERjp-ve)Oa#s3Jctj4Wx$=qx&EO+goK)Bojoow@_IWVvHCXsAy6)4tRG2p7 zUETjk6{ag+66#3lRPM(0KM;mD7HOXb10L#aHgM^5av297&e3nys}#4oaxE7JdIW)1 zDs{SemdS(woZS0)vops3M%~5Dm_s5>2WbplA+Hl- zFU=W4Ixd^o=-mPwdm_*xTQFXQy5-Uh4l(U{am0@m*QmC=6wj+qFCaPkqL*`ufCkt-7t2J^HkhwZR7hd)DLvG98 z1!KQIEc@{o$mw%!{~^mTJr*KH4$q~$eC2X8`>r=pkiS^F0_Ev?cmY>YxxpSsy<338 zfY0*|o6~l&wK$U8x>%zIbJ_Jziw1!%LR9>&>xrg%vLx?Si&2+_4St3MF$jWCOIaJt zCLIEH$$o(>KPtEW$4s0BRXSqeFnspIDZ;8ao`WJ=tz4BAsQ1mbsw6v7Vw(fLX|VWA znm-^;rEzM#YyZ=5AsuSDo(<7C%jMpQ4JE%FgiS`H4wq2 zWIi`0Vjq<>y|U)DL~8TnvL8zeDID-N?ZCo>{xGX@8by!uqwCQkMLk{g8A)xjDJrfv zjovYkGS=qLx4Z!zjT3Mv)+_05A$$&*wAfERhsS2`@@D zL|YYn?FHm$UA~>%FP^k`{J>Q0>$pkv-F&s!(UT*|yiHOrEcP7WK2}f5q$qZrw*xGT z;t|@+-O~+*?$MCNum7hN5Ifj0QIZL}U!l+^GMP{L4(WM6!=Vy!!)U!n%~IsUg#GK| zlh=E#QMKhyY6~5?T6~Z%FVSFs%bfPfnb5Lu6OOhN_xl zieN-Hi9a4N?LW!eFQ$|WtHdxRP{nVK;}K3C`9k+QAM^J@G1B>5Vdv}2%|$UpN1(PB zhk%t}ZehQ>?m~15L#n)4sW%hT8qn;^Ew=2HfEq)0-N;netJ?b2F~cMaqAo7=1qv@NTVPr9Nkd}G6f2O3fql?^h;geaRw>06 z@VHUJ{t*d)?c1}Rpj3CX6H}?<32V*wTqz>}tI{6cVsd`ZKmb&2C6(%g1#D zG_U1F-jg|6GKU`Uy1v(w6H?Q3CRWSgY%{8!spJn%#3=q z5}e&c9b@qn*n{8eUgI`62&12>oFzs?I>$q2gPK8gUnRbgM3lBP^8(I|8 z`@k4skzV-sOb>kT#!eMpocIf+&?d7nzuS|s;5C8RwH-{AUmcJ|9Bpz z7oNwr<{|icslt+M#kR+`K!z)cvYdM`8L=0?aw5zYQW{h<8?EQUZA>3eJ# zw`Y_9?k@frcdrQYNOEcDeRH1xuGau}x?Xd*Zx|j6tlRZ~UdAhbe}7n;LRu=S*18oB z#FppxUCgC`(a#J(@9cmY(tF?Oo@SaxJn>r&-SvFyyVYFf=>yPm-CBe*@Dtk=IGAI6 zqc_Msfy*lG?WJO4SzY8(!@rtH+`bg+Jbtbk@@8z6zXJRVVs{rnpSf=kOS8lM`^~|G zFk2x*l8eRhMr(e_^!FPFU}WCi z6-C&EdgaGJJ86JEBENFz`QI=2w|l0c1mh zQosd#jMpjbm*~tr8@x8VdOY4~L}=J_>KM^fkt?ut;BQtd)8-wDfIqMiARw>BM2=TX zuif|vBht;4+uNSS5JN(7!hu(KW^#xR7KT9V7NVzr?__ZJM1J`61#&7<V7P-e=Xwqvm|HQM=Mi8~-|vDm?;yV0}=b$?r`-HbvlmtfFX$Jj);Z3wTE z3GVn%Vz^Dh@L)bsEBGOeFCr-;b4~mza#l{-AEc~uIQ1J)z9&GV=ht%+6&a@s5Fdbf zy@~c3!o=!7C4s-t6}I0&g9*n-0yalx@#RJ*toBk}<6+ftvAIg)20P*YXis-2j8>i1 zdzcc{K)|L2OY55_pOSdIU~s`ZIgy$64jt?au+|eTT6H4Fq)Q(jEn~te;#gX4aqpVv z(yxQ=2Z6B1>&a&snQgb@(~Y6Y-3MTkD2D=q#;=zJZv9+c4#4PvE4hz-*Bhsg?Z@06 z$Lwq=zFA$NqTS&?Tt2yPI$J(|5~7I4MA&`2x9a4`NXwRbrg*7&&iz|gtc64yMa-%* z5yB3e#@f;k&eOIP@mUtOO_p?fqbUBe$C-qCB_F<$=nAA1IZn?!$#vOr8)1p10y3(d zaJ+M`$W&cUTjl4nUZ4LIeBN_Ns$VYz4%62Y;en{!b!yqxU#`d$ro-AMM@nP9DLaq% zS0A?$Fo?2E6HbNYVW~c-l&CBh3;zx~ZYFyxU5la2BasT=Uv*YnW)D7l|K4>eAldxK zThDAd3kR@1CB`vIP!n_fqulK5>?juwgVmXJDnboum_%ax)$}~N!w0e&@H*pYBgN&m zW0ccQZcliB7Xa&Ixv5Šm6^nlC`Ay#*q#V?RDa7SR%TiQ9A+pY4HCf6a01g55F za?+J&9$%u`5ck3KYxHn@p?JMvAbMaiU5F~17GEK@$8M}Yeb_*Q8L#y8ZsU}EwD1CN{vGk{HuDSx3Xzlrg|=dVpG6!3z&F`dLcr~eaYae$hZ`Wd=GKm5U8L2SK2s=E)BO^Tst!(Hh|^#q zlxDw!UcUD@-I~!BD%Gm`nL~AojmRb)t{mHQS->ffiE-XnVi|W zkxyqHBfbMrR|w379}w!{U;Ym|>}HK27VsCp^dCapv0Nb#X?3vyWd3qoX%3GWEYt6x4K*0XH%L20mhsng)N zyY$HYm3vs9hGC9|^N8s`o6%Wmez-H)Px>21Shpvkd&Xd)i`5*x^N7Cpnl0NzbZ*a| z2rIlY4h8SiZ z@y0zTGV4+ey(zJ06Pn0nTF3y51Ad~CeRKdw&p7e`Tdr|)rtq24^~SN@K5iHud5Q7pXoVmrp6|%jc&wmOz%cK z&^zK~XhRWP+8^lAez8Mgfg8BVfN+mO0OemIfb~wl5)K20DD)N7JFq=vJ=J~vAq%t6 z`G{{Z_;9wu@ax|C>!h_{r0PP(P>6&CJkTDKB7h#zygyyi6G96>ueIgiEvI6g?6)aE^@77|3Y(^M9_@n z#Rt!;r8)a3+Pop_>*TlDkhM_xBZ+lsN^|&h;5`+Pq1=kc#`8PnN~3rAA8Y6j7yir` zfET4zE}}Ie2+3l*ET>9QVPJgAza88Bz11mmU+ey=?LnLY!$1wxt4X`UFWz4BZjGHj zfa(pr#zqmqfBvr2Db_h*UqUYTxxXlXIc^7pWk$;N`JX?&;KpR5O{f_U-60Xrwv2>7 zm=~q;Cm0W;r5@alvxE7m!ZX(5!H9wowS0BNv#o)V?AK(%&hc@!#CzZOfpRaO3WWOg z>$zFljAfmOS3uoZM7`zl4iaGVN)P^Pf(;8PBa{A8stV-n=H*`FXmAW0Ze z&>S9~2%=f54@M9xMq0G=A|NGQHI^}+SFU)8dDa71Tl$Yir z@pODDyq)I?V*DcR@m+2NbK$j_cdb-MH z_{lvqo>Td69t9+@2(t_#&sMgFj)}hxEcq@s_?z1klbf~~Tts;#I|G|7fV`#msDK{`FOW(ZYs-mXT zseuhAo06>{1%4#D*k|wYe3z}K*PZ#+jC3mjho$fF+cTx`P}mu4Zcm-Zo`%JrS4SgP z2p_$OUP}`fU~uu}B8f0Ye)hS-V<@{y#aeL@13qnm(nB0yM#NEJ(|7ZiWenVP2eyTV zQ8Fu&G)efYK=vN{&iNNrS}9fCVTaT_Q;L zNS82*2-4CWlG4opLwxH(_kQ=Y_w&5Z`}_X!zQy61wa)W6^ElVKP#TS42Z_bX1Qc>9 zOhBGHcZEHf8wN%P?+Ou6{3t(jT()Zhf6McvaaR=%zm?V>bv^gYw6dOjx$+r2 zf+`Afg4?>fLa^e&%o_*Ap3piCfIN+6mj^@lhABDKg3jO%QKg_d z%-WVr%?r_e#==8K3zc;-_7^3LOn^L{n~UM#w^$M&d0xHM8E$jSYMyt0CYdP$b8IP( zOrV`5)ChCj?=I=}z#C3pp-ev%C3z=)@0zWf2DRSotb!`7aLM0o49GXV@KJC1twwT(ZH6m& z1Qc8VpC&O)2d^3i4k+${AE@L2@v5CobSeYO6?~RNmbG+Xl=PsaCE{ z!VZlLHnvY=EY)Lwl=CI>^hSN>AQ>Dz*4P#<&}bMa4ZO<)2~yqfI6mgC0N&H51L{KY zN54Nq!WOz2isJ%eBP~HepAiMZ9v-zHdb2ltiMs^|+Yl1AQNwhe05GqT5c5t+H2S*^ z^KSfS0E*2y21>BAY^5*T$NRO+hv^rXML6KmQjXP1qK+o9$#aTccsMP z?lk#bV(~kJj|6Z<^0ejY`z4N)wXoMDttJk$g|gAFRfab1QO4fDDFX4O0^}=i-9p$+ z*?GU@V#X)3&<7C93lGa02bgXu8~5o$APUBJ9-+JmuE4e{UG<<%M?hFnhT*^~IiuZB zg_y;}?(X7=q!~{_uzGqu-#TV`HuC{ruq4x#C>sCAc$bvl$f#x7uf!>Z$rv<-zzm0n zjV!^5CH9@iuNm>n%VAP(JFyXai(z=|a$r@5z;7Js#nCE)rR!`@P4vHnmfpZT&ldV+ zFZ`uY6ZD~a(x0#Zu@W27DLdU#E?%(oKh~j@S!e?2^{W1~I449we{o5YA%MBn_ZQue zR0_e;Z()ZEw)f8Uy;*BI*E}dP(Z6dQE0m#_^1!bl{Bc+WcaLOdW~NoVpmTA) zSy}$Ft^$Wv0>_JhP$#CEa)TH?(}=wL6UehO+2))xnfkYhVRNK${l{&zC3!C!1`40) z7y<7P3gGMUILSh@swyenW2Z@IHdBLocI8P%D5iTQck^5yUB#a`crN0$~#=H3i9eHfFP z-M6Nh+tvAaaHIdm!+W?MjqsLlR1=bb%)9?B zVu9-6;ZN(%aA*fE_?g(wQEOh>+Ll(0Hv$u31q|rYf=Bmo>WO?i@+>Mq0W9%%wlo*w zNX{$jm)3IzJ!=h_zJezN6^Ks=~Yi3nsXw;7Tc^s@< zT=BBLG3pM=>*!k#2TODVms0HAS3C-Hq*i6xcoQd8 zP;(T|8yOk_q|*>?#NsD+0N~I=t4n3q(C#3kb8`nm@=j@hH*@qx+IZ?RIpoyBz-AB( znq#CJA|gUjq<93y{BkGncWB;e997lD1eajBGR@#yF_AV>gjZn8!SoqQXZ*KG{|c49 zm+=(N$Z|*UFIxLI1lMN;u85)uKJB@lpCG zxdyRU@)>Gi=OjS)dM~@)s5!Yx4GG5k>L!v7H?|z|&54oMp+;;Enp=+UMP?Kf z=mW6M=V)%QHM4$a;?P>KMR6FV7ilzzh3I5xft8*ED-~Ag`XC8b8vh_3dAicl7nNc4 zdz2M|IAvi95!^rS0s!vL7Q~gp_V$>9K=ePAd@!G{XySLQB zicd>KA__FR3@yR|CKSJ>W`pnJ{s$&PtEXDA=4s#g_>7lqQ8pWCO#i?HBcpD?i`3kf z^qgB3UsApndrcb|mb3|{1;nx?!% zO%3fau1nLTDX!XqnLH9&5B%Dl z7H}~9T18noARlS@Y82J!Q0(41H!4kaT=MH6fmkc*S~Uo@Zg+NpsSq_>0~u`_qWp=@ z0OhIjtZasjlyT~j%{H|B;n9CDtNLlA zThnFByLuy9$s%I+Pcl0BB0&FH-%@^4MPI|nV6z-Ef|N!|wGHOANzqy+jW z856(K8h^ZutghQD^ThIdt;TcajhE*>FS^%`KfddEQj3X-sm0Aqemz@75Ru?%(sWT1 zd6H|JU?S`2JG}~DyyD>j)iUWuUq)cJj$e~kG*6>*Lvm(IX6MTJf>?Pv9OH5P^Jq~r zZrcXl*b~za&)m$qKC^Ki4o?KYj`~us|JGpGI2AZ`#9x8air8@g(c(Gaj~~Zx;nqJs zJiO@GNCUZse!?rLw2Cv4O>liF-B#;wJ0d$T!%?_J&o^|I?K)|FFll@wK%7YZt=hN5{&DOEYtyUQ&9vZPa$bv;&HK%rk3w ztmM9t(XMLZHB|G^3>N+7J=lDsSkSQ|+-~j%6y0T@-EWBbE^9EM^c^(#lP`)@kgtts z_ri8uhZ8%ZZjDPzVU3QgTd0(K1AG9Ed08>Lo(oNHF$5{MoEy--nZB~*o3}E2$2VSV z`B2|PLLxo-E7F@c_Yc3&!y6~oH!MjZF^~ZAalp2lQITn3GUKLf6Z?zSNw|94R*!1krQ?tuWkU=1WH&P;Y~@9RDy zV$J)s#w8$yVBN7+8^nsKnm(6Shsw3kl!dK>t!{u=c@8sCT;4Eptg!^wK%LyH`@ME0 z5;tEt1qpdgHlR7>>z#D#&JQk=U+`>(Dg=4}pa#n>g!WjqQCe2H?2{HF+jHNnfy>i) zF4@4pN(st3trfW3tyR9D#sHi{9{v*-;2t!m8jO9?GS5I#CHyPZpMRt(Fwvl@J6n3o zD&`AJ_C(&x^1C|wmV1Zz*0Sr&=+=0Wz;ogtR*s2YgS*I;&h!RK%x1jX^w`X%R}*>1 z+Lq~A0Z6C?e}($%zsG4$tM%qiSy5APBr#|0wE-2$;gQ*{02F6ZQc~3dsQ+4|#*gYo z?RF;IVS56G7!P-(WDc#U*(qWRz5#6fPk1#II~mMgOU@k>JdP>9TgPl{8}VHt6Dz>O z@fWR{r)UkNBe;yzb#>)`v#3hKhfCt*DJ@e9vu%)hCY8wsi+g>Q0k=!fqN}xb;4<_# z;>Q$7sIppm1snc$Kw+wnth>kiSJ}c!ReXFBDQAU&VEq6d#p+ad1(bxDNc@5QU*S3R zy5G*XoC0WjQ$$p>IVejbJSQvJ@VTSWW}reB9Q>vkyS>cdt= z#jgER$!_kOT#GmPgCCs|D|`@`escWrxy&R0s#f;UH(8kaZHRf33VI#tm))xM6*YzP z+Vjz#Y;n%K49c3Z%JKO+aX2-*pB_=aGv({Bv?Edo*Pr0gK%RI*-d3Oae!l{6w^Ntb zcRMpp;aeP`qrPL<@9BT!cu;Y7R>)@Yg2ZR|$tX#ynaTA;vHTs=__d~k;s>yv?PEo} z#6Lb5|Bnxrp`%MLD$=3z7M@8R>>B#z%Ux$GDJ7YzEHcIPnNhc!StE~;LHSP|CV|Z! zR@6Q$vM*4j<8C$Yz3qsrIkJXDkj)EpxQVY_q#9=?X$AUTfIPv%@%QXTtw#{PUJ!gf zx;5>%H|d0=7|(YiogJ7wOmynz-fUbbA)%c$ON^3!d~ZsnDsfo*aN$~7XEJPm|K!G- zl8y$-ag5?eB9UK=FmVj|_of!eh1&l`YcEGK^RwyJJ$l)?Q@J)=`=dc#D3T2i-j$^< zMCZT?z2@>O=8nJ21yOM}Q{H(!N8buRS?hF}kg1r>ihTBHYez)44xTz?@eTK4ZJuo- zbm|K9CEf%YFbtL>)C70L`+jX8e(OlL?~=x;-7hTJ`NBkH5Q=;v8|AP<=9l+{t57;+ zAANtB8&xVYAeGocFB^214uAl*;IHGQcS}6CtrgtK(K;7mXF1f(?hn`tg6=C-UtaE7 zvuUW2DEjJNQpp9#$N@==mZ?fX;ZK73*BgoBhcOY7aS_sw)uvQ_YOX}Lp73i+OQIV( zORtWT4ogxgYm^k_NCz{ED!whg?swWf>tS@5N?hH$Cq+Q<>Av6b(D-0R(F_M1PA}md z>^tQO=X(TSZ<=UjC6~D?1nan34u`+(d5z%Y1ZDDj5#`$eR`q|&77bzb0g-EUAchF@ z8^)X8#+TH066nNWpOVb9W z#A;|FK4s^;&Ls(jR?sBq`&Cx#!Z9%_dd->bqF7l~io>jNN&3%VW_GqV01<*9J3$m7U7i;@0;$3MBoEa?i-(fw~E zL`ejZgI7daf-CH^4n`EJ3 zoft5p`1OwRj|SBq7c?z@9H)arL0y@oUB`aazK`cx#QX;@At#xMkoX+MFX_8kgemMjJOKxrc|~Cx?F&C3D+RCQ}87f zc@_f9K8_VMRJCq!saE&}4GhrHCxUK3W6%N9mmo)ReGbidj&>QJIg&B&^%UQw*5uVf zISq8T3xbb>$s_R-NKor18OWfr=^p3>#pCSt&j~#giG(uqv(KZZhB(SFmv8Bc5WFD( zou4VLB*6mndoR+|E)A7Bhk&d}^!_9<6=&;uxVgpru0z$!cil#A?K;{FS8uxHXJ~U2GHl-TiqUb^q}3?DA}s*>%Qn}52XYT0PF@|vmX#@)KnGlIfxGyQJFBy;?{Qb;R)*zC9f`=} zB2E0v3RvO|%^SQMA~$)Wh=KYkKB6+Il>a~>bVLL0(`p&o$8qr76Q$aFw$QQ8cs z+@1pYPbEIZvxT}Yaok__?5s?<^eg;2mh9G$YZ*fOA=WdbuI<W#j zn4gUuL$ro$0{$~0xp3gEuo*lr_9CteG?P9KB&R_w4f#K<7}7T;?pvB+P%DN%w7k&L z8&}d7?ZSFj3v9+kvO}mxD)X;hrDs@TZg@|HQQLldJVK!1h${C=Ffg04Gg9Cp2ldEL zcDWM`^-uD0^X)6Qlhdh`yS<^R_Eka4_&_l8ZewT!tDjsoFg4KcBFqMy1k1zBGt=mJ z=Z|{d@v95bNkWzhCeJot^Q1jPL)=RSnCk&ME4(iPF7PItjPV|ug1a9RlkbPo+SJw= zkkjveg!^sWL0#a&0}qaC&h5R;qrpXUo9P4~Z+cDcTlmqyjB;2k)KA-| z(hljjZ#bCPtK&+#`d1$F&42HGm`=HA0I9T+1YbxxpDjll`y*z4qBKM*1lB zxkMK{bN|4|jdAzkb5M^H>!e(OB2vzuR-~FajaBHvhWk=I*4#A6?WjECC__DI7$g+{ zN_>8yIrtQB&8bt4zPIEd<{R$&5ODz%uuOvH+j48Y#vMYpu~82RtG4&7j#4KwtLeT= z>apr}c6P{WGlA~YroxUbw>S3NzbJjXQ(kBxPTRNVzj(GD6IMpx#^~r~+Dkg4;~nF9 zf&Ze}csg>BFzSgd*lcN;RoqI`NJ!k?o**A{O87+OT^LRFa6tdq_ z8LDtZ+anwzODie{l7vVH1{Omb$;yD~K6x~s0!dr(Py0jv!lNN-z-J8Am;Cewe8$eT zbbOjqKI6&1^BKc;QG&G1C>$u>o4pll5Sg(PdJOcf( zZ%>9Q_&3S~tfBy&QG5;bzCy&a3SvM{$ygyLECe*6MU_H?fCbR}qlZhKz%=os%-pUA z2qsfGa5Ll7eduKTFVe#IFC820Q0oq~H8S~GK6%kVk@6}mSMD)2(1qL!(2+T}O+c>d zOVu!U7uq=y5EsRReA}oq0|UV%=U+9afar7Xg;q4B+!vC6G=-Eho5YM(28Z2%Ocp3p zeQhqYIH%v%TZrR1QzUMHHw@4JJnX6ETNdDl4|&u&U;}kG+Da8z_{1toqJ&cuXlP6M zyk6*YaZD=%IuPnu8>S!mu*vjCh5;(jWCK?^*^)?NKo(szZa4GJbpaeSLZsFCqr-?~4YR*}=?~P7huJYk6`x1=Syz{N-biBmNHtD2vaQ_dBjS zCoFnX&2Pz0>D7yR3l-4mz4J9Q7x<*;KZcnq!U@=n0uOtKYCt4z6Y10mp8_TKe*uaS z$HS%el^Yx(*_q!79a_g9;(fO~B=UPC3d}ae(C^sL^~_^g>5Y)9abu8}M1W8Rh?=aF zh@BAa*-m%kf&pqR*na9!;SuCh{mp(jEWLfx`a%md0hblebgd;;32-Vr3eo?IcOWIS zuc=DvOQ-BBtxR$FMc-~ETQ?*2E@+Lj!T5K04m zfxAZ-#@XcfK}dQ37b%DrUT@m>e&Id31o=<}klDVIYtXweMNf632I8fz1EDArSh)TZ zDJ`I9e2?j2E(n4BB!7FxJ^wvYyqlF}c`sgkle08Gw^Zl?-=y~+BqTZC7)lmyj8wzD zWt91P_HyHW#+YMvd0#T9RTM>;g5rPi?K&@^2Bs=$2Z$>hh-=n3@Bb;C9h8H_b>;G# zC^aCifAS}Pd7AKzqroRgdq&NaPpDtGqOKc5bpEywA@dHBFNIGW8T1zz zM<>q_;yV*Fc+C`T#%zs8PaJ(1tC_i9F&39R_v#4$6{l>jC|l?tv#u?`%>vM$mNG+* zVv%2tScNLx!W$~u(zhdd1-ik^Wed{GSp2K?L71C^i$AjRR;WaYet{2f>;kxAJN( zzGS`y${q5D#)q#ttejV$yLHyzh%kZ9N6p;zPV-#e{n{I($Ln&L4-d}s*0^)a z0H1QV24w6j9`-f?eyfQiY#~wQRQyk369&ZtHoi4x>sSFQ@;UfKb()5640jYJP#IHea$CZ%Wtj8V7|eKsDT>*fx5cA zy%c5@);4qxf*xHS}8OP@)GUNSpJiryVX15I{B88ANsP zOd+6dkl&&$Ju~WXR6%M=Y14`{GSe@sW*G4QEWDBk{RJX zf=4f+!=GFx0nSH74tzJB1=*vQa^2ACh{>dAOJ6wHgO2*6f8mwKy8dHzZG7OR45mohTpo~nFHv|yXg%;4FCzyQ$ z!aob}E`DEI+lU(6Av;}6pa3+xs}O>(ksJz8;PZK>hARCZhPnbolLxstClFpth>=h{ zwjw?aFYWoew{4*GkD!eP^hlQX?n(l%6hSJvr=i^kS#&XYs-@S1xX1q96Qdk9=?9JV zge!{$8fK9j-)4T_6$OS@d}??g)&8%B$D|2>-E}xfhu26x45jlAGymiqZT4bO5Gv)q zXn+9U7EGFP`;7kuBH&AT&R$D-1AyR%1__=3>8)EVKP%Q)yl`HzD#`wu>}3ew;}@GP zZ(`Nv&bJe((HYj-W`Gy1A>Z5rSyVQ{f2l0+(QQNBcXaoLmJY z95$etQrhdlxH3ob;uQ13Fb!@2O^;NHBNse^T^6{+A;mAEcY0jBp1M zE*{6vhJgf;3i1e|SHS&^;4c8s{S0Tw(25T?b6jU;BCP?}ShIy@74(|fw?5V`|6H!x zFG0)($|E&v<*d@OGBtDavr}TU)5z@kQf;XFj)34<9KJ1{AwZSwGo-$$3PH89?l6&{=P0xqxgBJITO z-(7}!nJXjZEgg*L)^V8{i<1wC?yNOn`Mqr4UWdhedp}U?jcrCx3=Q3pBom#9R08$k zd$vf9{dPwbSB-~5J34lU*5s#_GAR%=NJa=jDAxuK6>*aLvx4J8}0N1bI0D5 z6>XWCrN&})rZ9;@w1sNNgWO1#;$fBk96DI+;j-0T?L zFjwV}nNuavdsAN;yz_&@=lz5A7k+&Bk~nMQU@q%wf^q3-{CKDOQj>ZW&rKEOr_~>= zYlL^6(%RewY(FuZ+Q*WTZ&e#(@6IkPFT0u1juNi9T~Z?3^s!6IRi%~ zj)a~lK!7kvaXobE>=Va`)$lnZ9X))xOuY%+b~_jJMY60UK}+0DON#6MrN#*t$s2cA zWbu-YTz$(PcY?%95RAPE?QDywo9mjd=G2bYM%C1LtWU}t)-GBaR!%-zv(jLFr-qj_ zeSRM6A)Mp0<}#Dhn-`#V;^+?W_v3vEP3*NVzKOC|GNNYE*RVxz7IOo><)4RfCa2& zycoFUBQ>SK-NT)dhtkT*^eXG7hBv~uhM&WOuAsowS%91nv=j^5CLIbQ0jD-+&L0Gv z{uYyzFOsr$b_;FK8;dzcTwF3}jmS#Qw?!D-X1R!8-3Z9Hl_xT+%ApZHt7~fMHOo_^ zv$L}THhkjP&azF{^_PThJDq(7kqzOt84sXw86eV~6&4JPKJk-=u5P5Of4cT6x~IIH zsSV+keFtIKy#Kb0KG(vx8tiggY_cxwOMqCNjVT* za2ZpJdetlgeI(|fz^trozg464kmjnGHhWVrJ<6p6^$Y(fj2ULRc;Tw}6DKZAT4>Tc zR|lJ+HEGIBZT@{|5R9%bGniDGQ0O)w%_okx?9!LsZZp15Hn@5XVzvoe1{i-#hb8jN zf7tqZ*rPN$L%HLn!5)$g{(GOCK7paa?4s7@54?F@i>$3>N>D+0!aCfn!%UtBZeiTY zMWjyX(#tZ&R4?1Sd(HG+mGxqXX4Opie%R=B0rZ3A)%2$rhv2oWy7iUR1Nh&OhfiId zQA_8?H>N=i_eRF;{e&wLZpS)(SZ5$nUZMk5>562Qee;(wGM1-W_n^dLJRo`mYclHi(XIqy|o%-Kz zxt8cny&X2IW!6suGhu2s9TNO1P<1EcaJANPgv?LKo_u7$KWI=AZCk?7R z&IV5$ZQOVJCi8#aSo*~llHEYbxx|KT2*0Dv=nTi~VKG0FX+|k8wpuT-9r=>Monzqp zvWE+38i%aYnF3!~0TS)Wmw=Hzlzqoj;kV@@V&;N`*F}H2?0-N6sQ!+%Z#46V>lLo1`|5`*3MM&uViQE!C24ur2Dp^*mMW{iylW^DwW?7Oox z5tBUO*K=nH25qi$J$;M+oaCi~7O!drhaz>W#_=TZBWzVpU#*VQ{~{Nx7n8KW>X zltx2iD~TS+HBE-9En1k+CN2_icDq)E9q7Gdo9ZK_;3-^DnNnOQb6JbKL#!eUj4*+G zgU$T?Th{h=nb{o&V~c@M#$s^b!$#(rppn8-smScxb3x3=E`n4C2N&EH@{`(BeXKYB zOWfr^TMJFE+sajM&3K9)FWJ$%Hox{sB3*!DX^57~Yj4TMbsck8?dtV@{rj8G)#xNF z7q>@g8-|UHEq|GR)xP8$$xjmLnc4ZCSF^p{C_*6BWba-xhp9WKSHlQRyr?eN3e0UH zsRJ%B%*)4zdym=ew^jJ4$ux19V)kvnM#Q$y8Vq6hnp}z}S^Qp{^iZo5h`XQ z#Y(HyxD&;1n?sVSu;g#|-_PE!Q->Yzr>?khgziO$bKs%!#^=)H~dp`Nq6M-4rwR=%2URXVSqs!TdCa+&I%RoHQXSSOeLrele&8OlQR z?Cme8tCY};K+=Q{l`_(`>7wt6u*JyCAv;@~wfmto%QemoQsOy7Mi{xukLDW(SHs0q z>t>{$tWzuum1Mcf&-j%tk67zX5zUhBYi;I-CZA`UVMAW~DxH_OJb(1?`zrzMbu!J| zrX?+x2)@s-MN&(iBEVe9uBE2hxOdrusYcfz(pRLS6596+SEY5>bCT=RDc#$k0o_)? zXTOQ!#chn9mU|m18ygSM_Hk;wU$*!e*4(ZwxzE1%NpJ|{6>O$er_fNbAS1XNfZ@`;vgke3Jo zS3y(pIFlj}@JwRWMUbChoPA3({Xwf<1%r1seQ5uM`FUebg;^s#<=+}a9{ zV2f0)M44T=W|n1o>H!e#iQ+B;?XWpq);0Q!=K1rvJW&D`ax!_-^LWG(L2wnp&c!`1 zx!YQezpNFe0uQd||$nH;&-_2hx9G3Ua(>)xA^ z!xrqvR*Xq$QU~Y1S$yohoZavHN6)Wc=~#O!9w)~_0}Yt%Bc54Bc9MVIusq}g5n_%1 z*MX5u%|kMLXUG?T5uYiJFifs!lz^`WX~h%pu3;I6^r9SYv6|WfK5PSJA&i!X5R-XC zIHFh5VDTqWuu;%I>;?ny8r^~S_S)v_xM=Iv&K5u37uuivzQ+B$D_Xk#Xe(7vFx=(; zBn)#)b)8VcpbFNarw;NnAAP%0 z{r*+UkcUrvcefySRbUr)MA&56p?mvzgwiOcF!d4zt*j_IJHeJBX*1KXyT&v5(07OZ zhoW{zr*_lEZALM$Zk}(YS6yA2g%*Q&7L&2cO|h+u?!VOgG6ZQ_Fx|T5pLeY3{40Sk z+**O*!d;Pz(w6dwoDW+)xqF&mG?0)B?s)}@tU1-f*|m^M^Vj!$w#F?iz#m3Z)b&EzusR@Ml*ds~|O zp3V>D)`IyV`Xh}hzzo-+0e49L=%#FXwockAL z-bF5k6=d64FDje5P9L~_yt_Y8irJKnj!9UaKYe_N6&;8L93fnDVUC3Y|N?P za5)Rc?cWs+DKSD&ko7xABZf-1e89A3*#zdgC(^Rzh_z1`4D*5MOfi9t5UapHib?vu z3+z;-^i$DkO`PS2eW8Dewho%O!F40c9wUjb^gT5W+xa|Ou$@jO=B&Vo+t|m(UjFEa z!K=c2xmTHDa$W70ciHDcb}$9WsK_3go%~%}W=`7OB5Unqq!v@oY<;X45=jjPW?vP% z;tVi~ZFl4n{X&lojV&dd<_KkXg6!U7o(@Lq8OBMcUb^$u?ndv@O`P4F0jZOtAej2zb=&m9;&xY=J} zD5rd4UqWjMHB2dfU;23y_~PW{eFUE>>z@h=B|f0SU$b}H%WGe~&M`hcQdt~>y?7R! zEl){9k=)cT(@Cuah5HEvC|K6pi^!1hv7bqqlR^ zT6!RwEYWb7WG@sLi#EUQ*#!&0o0T=b!uQ{G zlz#6$wCs6>u1_bTPFK^W*ICkw6rTd#*_*SeH$gacankHzZf2eB(d{hpNaazNzSb5* zun_RlZw}))fWk!E{WdL>AFhtb-r&@J|B*>>>M;9d_$tb_`VKp=_JhC@Hf%MovqFK{ zdx_K!*SmLmDY0OdeA>!WNY!&QFhO9mzMFIQV*o0~Cu!&8w1Jia$;IsD7H)VP1_U$L zXy5?}W+ke)r1u|!srkPN1~~o#RaPJv*CS1r#i$;O@wL^+HQz0}?;(xWJUKIz9czg7 z_-G@bS=TEXt0k|x9-Bf%yMI3EJMoAe8o49T@C3$1Zm|0Otu1dYxS1NXIG)?yM=yEn zY9-J566d3k$$e~BfT&VE#8=uX=014*TK$}Ws97>NU<4-YkjDfLFvLh|%MZ;-U(85I zW{XfBE!T|`Pi^seCLi1qT~=G5srUFT?hbfC)K^C;LbvTs4oUDvaH99p8yfMra`IUo zV_?WuGm$DT#Oxp>CJpSkU4mVUmX6S7Y32+Oo-t?_aGlFzjuwUl=z=aeW(J+$E_}CO z=2Z!!vghw7?(_E5GRJItcmuuSl^&!ox^^$P=P8m!5pv-loV!a$B}r-9BFoGBiW}7*^^YlMOcWaadWF8drZ%!R zSjTst-&5w2GN1qwxgf-L`3qUzN%36!HoK{PJeXrY&~pbQDf&Lq;#0?~-iY5eYyti5 zs9A%1Clbm0Nu}Y1AoXl!8Y5<{`o0*%768Q1%6zn^3ywwJ=W976hr~_*#QuK5vy2gI z(&wQ1exl~mSB&YcjUqQ2n0Ok^OL;gVVt#m0^s%Zp z0nqZFvN~D=6*BtfQe@$gBbGmQ|x_7?TcPNy}VUKVAkykeD{%S zi=(-Yi85pRbzfF(MI$Scv0D2r)Ds;AHBeg8+r*#eJ(5c{nLm>NTzSEjrJ);;pPl~x zU;OM&ds3m}SxeLB2M}jKO#1ua;p~x}pL`!#KeDbIM$RD zRfjnLqmr0&KJ%#G^ZpIr+W`p`r{~N(y?Q6WE62rsHv^6N9U~O0Hrc|3Q$yE0f2r@2 zGfQNeY;3lIvk27eKY_7j{d(mOI&#)$xw-Bs5sb@X;TBV>x84tXpoF(M-c_oyy-CNp zV-HOA0zQa#i*)VGP|mxr60;E!v)XQS)6%xQ*m^2n%7KCWhG>c%4^K;1&Xu*n|ST zsLep!%sXq^6Mfm8uGU=dJZJ|b_4^3@Uk@{)h<-07=gm&b8kgP6ho<&`&IXcwc90|I zX-~Zf0f8Ih6OV7M;$4xx9wi!?ji!|EL2Y0>c~8dwTkVzU`zavH<&@CgxiTd^_U$N$ zRW&na1{}?v3sh@-P<2RXh_Q+`{`_S^73AdjmHo3OXGs@J06)fj+3G4QXl#m}^LuWg z^{`<*Z8n13clvH^4UEYhvSj=yV8w9o9V-e{f9^>af}pS9KZ`Twa3a zr-)eOridJ%$n}#0H20&iZ}rVyddqtE*R0uQWpyU-^6b|iZSY3=+-x*$IvVTm=i%vM z``uKNG*S1W{NgQ`#-_?I^LMncow%*+(IiXqXbX_U2HF__ZyI6JnCxadOi;@`{3c^_wFjYZV*U;Keotlz<$mdM26S8&)89Lw&&mxMj2f)A7D-h1RC z_fyij(^H_dvMFakS6)vjKuwMN&~SUk*JcQVb}|?=&D-}_0ixM7277O#!PNclyVEk1ZGsQoaqjbF5Rr7aV z&0B#s?{Xs@2=>d#E0@!HPobwKHxC`~ahb>VafJOd(*bO{JiqwKXt85NdZd!xBM{)| zFVSRb$XTD5Tx7=%ueoXD+^z%87#;t=ioiP+gkk6IvwaHk0u zOF~2uI6bke`E`#T92a+>0Wcg{RvLmvyYfka*u^p0yN7iNGvRiH7*(w#mxMOl7-BQY z5y`i{@{!d>f%^3p?#sJREUy63HE$~p%roTD5+s+?(cUQ{K0L@k*;1BX^g(%by=r6z zAjv+>C5q-p>$k$QCA}2bZ)GR9cX;d^ER4+y#*3P3b*(OjTL{i>8+KQ~PY#g-XhU}1 zr0T{aU4F0hb#5;8WMj6Ga{Eob&_d8DiAy1c*AW&x<_KcdXDNCk3b~$g64!?WBm|+d z2Nqt~8d=tmkgxN^rg=E_h$xP?l{HTt9i!nVyS83CeS1wN*f`N6aE4m5i-bR~5ISWB z+`F;m`lbIrUVaHwma)>QF*4h~>rKAxwamjPetW3@lNno#;GTh_*YNH za(jxX;MA3|z1u#|yJHcU7Ro4aHqZCAg0Wp5xK2Q$AI*1i|0`+og<^0j-(8c*S)jb~ zn(Yuq0OZt0$)A2xjyypqr}x)@U-*(@j^sd{sjJczZB0Hb+Xr5fZjenOVU4|{(&3t=6Y zW5A2g3~2)g;1gV1Ow~G~_9lk0M;XqX5Ra=D$pm0R3rukrOE!-!8!5^_;HzRgcZr8g zr_%obY?krc9=&3ig98*$r=H}4}9faQ}o(9brFe%sU zvYi7)#GX*AEWXemBsF`*#pA4SM0x;S&TxTwXs49YGs&AHEW21cL2_)&eH9zJVw^B_ol}ASC8bV*Iy&8j0`$7Xa;dr6&#`}Y~~!Q43#Q(jGRyQ68glDOZH7Uw4ME7 zZ-O*ce>Q1LePI^|U>i5`Af$GvtK91VtGgJqxZ_&WY&^4 zm!~i-S+d@S4|~9o4=X5`e(`oK!n=qYnGZ?yVV zYYZQpty6mIydmb1;xBu%^F$yaInxMQlc#yJ2np7t_)`!lBC>V%p;kl416CP)RVXJe zMsuh(K$0~DLPep#A7U2dyF_eVu#q%*)zic+ms;g9h}LzybeYK$u6;echV}hH z8+*ZWJI*}G;rwNXJdS_#S%qK=S99$_nNk$A*SJi#p&R zcL4;}ptMRD-PO@@n7S7;mCm{rZG%)6gP)3oQcmvLJbCg%zcMZDj>qcob#!gHQh%YB zszJWVjT)@Iwt&(Fk?H3i7qaO*u3{lF9HbUIc7vdP?u?L$7ohMwv9FV>R=?tTn&&O; zlRZ8x$l|~WnSx8KhPDrMWlvLA@NNLeMN~{59`9{%{?M!#i?maq{eUX8AFcdYevW#} z03^s4+Ezm@ft7|D8G>sls4aX>fAt19@Dq{oME5?J`Bh_CB{u;3)sL{(x#)-MefKR% z;bOG#)Ny4qpnX1p(T>KXB;3l=X#|gIml`FcIIBZr!%cWo3k;-|TUBD1c*7gbw=JT{8z#U^Mmwq1rMU^ zz(G!wbSgia%$n~8tdKKgk5EHq1G-@+P>qdvtHiyP!*CVw!$MnBW^(K+7p_WPKYUGH z{s0V?1eGU~e1CKkUjnSmI*wB11=!*ey`uEeQjVSDsZMB>0T=T)?2|4ac)*xzA|cqI zL%Hgmp=oG?&b*Hf`F4qde0C3BPUKc}UE)fA~!>Neu0UC;w2f0B@_)Sq=J0wpX zhssVG{dX&;9;TQL48p~vYMN5Yec|%2ggxl<{-u6RKTIj@uwif`gq zz?xaY`!D-Z=O=!@g*zy9>R4Nv{$aLE0WJB?wc3o}e?SxqinRX`q5$5;t=kiCwtP^u zbD6rQYNGqUsR?ixm-WEN2Dp0#G)x5|KvSkPF_%;*087tu_WZ?;*o+Lz)l+N7J3D%G0R0L2{}AApg&NakZ@P%pm+_yNp`D<@vFD`U%5J;Kn)iuFOI( zYZfIp%ABtiFUjhHz^;yS^TuM{jdZ>YicI444R(&W>CwE^DIJfq!-SK6A%li+&O%VQ zm@lMwo23-M=1yev*qP2^>HZtRJ|JL>CuGWjyY#*YLM!@~n^-l~zzFUrXcOV)0i%NM zkc%tSy*UJ3TIc8Y=#Tx=(>T2W1zJB5*qidJNm=8+SHV&Ih=9iQ-iW$`p}jN$jgyD7 z0V04m9jZdmtFj`++wPq4?gk_yee)9mN{DTLtNjeX_7l#u=psb?Wh_p%Zj6WOU z|Hs~2$3?ky{lki&A}XPR(h7)(q;w6UbhqSi1Vp-}OA%4&Mq&U-5m35YX^=*`k!~1Z zfZx6b&pFER-1qZ7pXbl_kK>tvVXn1T?X}kauC+}T5WyRt_8)S53198qQURlK1mlQL zl7NtX?laF1mi2J~yQVOY(pd&P@%jNSeL@=oHNOZ}UIcsEg7>AQ2PXjN4g#0Hn1oPw zc&QSgE#~%3mBvEIf(A~ke8@`4EMsx~9y9~VLeK$#kkM2YpUeGytw&sB!~WMTAoREcne)zmm;G z!x*&9vL5NU4@L1LP!E9Z)dmEW`Y%ep%7P}(0URJS-7Z%o%n=G|RsmqJcD`vCN^sPV z;PooTdf%YFJVDAg0J^5fGS>xq$b9f1cqhKtWpo2SfD3;(8FOEq7R}-FXbzK1yaZrX zXu}Ty?W2s#x_b)a#!i@Y02`VJO+?EGOwxuJPzt)Z{+_dk9njgI z_Jb*Ppa^ORTAE~x_0os{1Mso{__nlsfeez4@)7tpPb3WLC;&}nQ0oohJDC`up=Z&p z3my-yL%+EI0J6kixf5+6*I{1&|BLZ|Ek?$jdV{3+d$u)NFiyB#=w8qW+Q5jh&M`UL z+ISDHDefBhj*WixI%m&RseM>60=dTX3>iD0*BrG0l&zVGjphzMh&(+#uYtb=p?CBM z3BFg~Igq21Fz`Z$H8-$9#5%643n^_5__YDYh7u|0&mv;pN5$@$cyUs`MwbwELV$ij zy=v%vba?*&SG?lj)S9yEq+La*?YznqXvcw4^?=gKKv8mfbM9rWom1cz5=mFv0bek0 z68u@X`!>dcRt55tN&iQ}SYoWwSZcqnvuO^X49$MVy$0Iw1ONqlafv2`6XuN=61IS* zD;Pc%X=kZIA&tvD3o^VHG0!2r)yFd7s+bYb_=cB_2U*++j~l?Pyaq?>;DbSzB3R}% zxtBa&?VKvlw~T2nSzbc1p@)-T1`$QbrON*v~mn<{Vyk*(Hq~*)2ZY@gn8=8U#9_$N-50KSo;;fRfw(>SL6&n@`$x z(BBRw9~i@%(FYVduTRWuCqH;*1ywMHFgT(|oR&4#&h!^g)X_uap2RE#F2Y_o0ullN z!BvOJhukxz+n32qJ9llf^%{g6OoxgScBIe+kXm}?g?cLewaHo5M>cjH-aO;aU;>os zs^z51Ro{3)3n>u)!PF|OK7p1z@8iwKmv<5*VT@Fw6roJbrkvUg8t?(AiR)+5@c`*0 zmMVFAs1}(IX>_2qn+Xu_>T?UMgHop$A|CXFf?0fFm?k_G+rtIaV3T7A1#u#fvL_ha zK>gwBJR~yP%Usr5n%6iFYJ>Rm3!aK;>{SKrG(!u-ORW%8)Ri?fF}w9`bxxV7=^2bq zjuinkk#fB3M9Idt6#awe70;4IJgkQ;Rz0N9#vxV$$Tjq5-UObI1k;4~h}>E)6_IP`=*R~9 zY9JScDhF`#KyrRZG2{7r0Qwv3xAhbtq`RgRY&08HYw;a1D!%FolZ-+yt8FR-Tz2ah z+zJJ~&R-)eHZy_NO^Ju7%+JVb2=;Fc4htik8O&Ag?=CVFJu{P{926yRpiqAM)U}Uq z*Y+lf%C&NB7Srh`dkaP$vdQ*(`mV+}?y6aRX|`U|!#S|1;M?wfu`^2z@B41hv3aU> zIoKqF6e^^qYP+xR&1Il^*!EGNxtqxdY|Nms2M1W`8;{uurYWj&2udftCs{x-v)w-4 z)C27dniw|`5H1TEl?CCl?vJ8w|0^yF)WY1ZvCN4X8X1Kx4iq%TYL!e1HXRI}AZPXZ z^g(7P;nVm_IGe{4ji}*+i(tZ%h(EW4A8hsVHCB@cxsBNnfWTc)3loB?#=7l_&rWQ# zOZ!S^JGIGttFS|m@_h}Gq)cnNcVnq`W7T&}80X^!S1{Lxo+cEvpJf($rAhl%Bx2({ z391y~=FjuAv~;r+XI<$HVmAj2!Wo%K33mSD9YVYp7t{;0^Q`UwV~OKA*}9x=eY+rR zcIJ#v#Z*Ean13rM=npi&#;&st-blpo1vy3}P1)ZATJAyJ<8ychv@3J{n7T5!^M+z| zzcb)M)yDd%Mk3a@A4u3*roVVJv2yo@Wg?gz$2y&=n^;toQd(~MW}*Mn{jH@ThKw_~ zUevD*Y#WJMuE0I^jb z?;U|CfDMJs9l`&^Q4sF9pvoM~1+;=o38d~;?C&6yAp+@`|w8mUAN}TZ5@#ZC6h@+VMss9`4 z0@L`RDxS^QAYQ6P)hF+FX5XiuEygtDdRAI zkfwy+vNq*{fipS&>J6s6fi#BI8m6~`xf#+%Zax+5k7f(SjB2n-gn zbGu>x386gVAsV~Q`UV;T#KzA4rrO-+E&13}y7Ho&@# zIVVv`PkHlbT#>?;yz}!eEVgx_5l}6?E{J7>mx*6=g(v3v&k$2IXfYCvRt6nWT(l#; z9beyFC(8C~y*MM;x!Cco9iP>66>@z=KV08H_W@5*jW{_=#-Xvr?)U10qMF$#={W=) z93+XG2cRngqSa7iZ(eC8#cR_o8rC~}dXWc)H-oAyZ4*TtbcA}GdRT{H)qhXV`v9q0s9^s5A1l%A$FXVTtZ%%|Ik2% zeZDN9pWOp#?4j^&7A=?HNpk-<(d@d(tFCv3*5#~aRbS3Rguc?E|>b5y82X9 zecI4?)QdFU-8nh6Zmc^s-G0zGtEBA(*MDbae0dL8OlzZgB+$%Z+2mpewCD+4@3D5b z6tuJ@{)s26uHQ=^>doSUWh`m6mxVdHjrK0$Z(VWyH3sC*>7&)lyfq&-G&rb!94#g}b(y=QoS3XV7lK3QNWXS2w z2hH-_C*+r=uv#M={G_5-cq=;kRaNV=%qv)6Ezrb2C|>#3f4&p0KmkzVfY*;F+k=yV z)uWctpB5~qQt5P3h5y<_w4J6>c1xDoe%c3(ocDSHcTre=S6MX$R+tbV{vckXM;-JQ zfObjkdf9b!PW+#qUW{3~%^*%1uYdF;ygOjcA1_EAqt+P{#aJnWu+1#B-2Fyl9L%R6 zr111h(ad3Rw8h#aif3RV%z(a!VKs%?0K6Wn3nFf=ri-cWAR;r92KP zM7D74w^&a~w^mdmy3@m&%$HFPV|UO^rpGko=eGfd9#-27cQ4$ZLI;a@EBK(}_RI^l zpFab*P=yi7Sh-6hkXklm+37zCrVu>0YYr-{glVpvH1*s z8_jy8{OuL6qiF*((##d)w|&6x;z{ve*(=xL()58u9-18wG)@z+_eb0DPmfiikz2&- zyW18^uhy0!mfNy+G8cyP-T_bX8cPPY&ajr8 zGpx?n8CkqdIMYC7?64+=eg5t-i$C^Ofl02(rK#(k+`XfvVn9nhn)~weQY!>Ah;(L9 zHCOhx`;&&@f)Qs!d3!^iLhvp(c zUIJPx7z*{P7J5*6+#=FxbEp%x8Yf8(S=dd1A@jlAHYw<}ijmW8>7ZNA|J4IhmSD&) zX*^c-eT%M$gDV06UQZ;}5&iBjy4cS>C_Ay2Z&$8*Q;IKd@_R3QQ`*q*8yu*}XN=C) zXa<95TbWfUgSl8Zk1V;`Hsq!L`s3d(G(f~7b(^8{iBQZDr_VxlUNNtoW1lX^*epD; zw`B*vQ-@gb3fhP7?bAc!fgu~c!))pm%*Wcv!4@5+9-8|H~L8;zvwF^I6HM5 zERed6qYO>S0mV{PfU5%YpU`Rd-vnb~cgVeLf*B3j#wO@x>28p6E#&_j! zotU+fwlz6skIzS7a&uFZycrQpE{7#q2?K8YVBDv=R!^j*I$?(bCxFnTx+ z7f6Ml&x3Llkl`r-se<8Wf3FbzDg-}u8>`RFdE}+u0!tkc*{8hCxM04uP2gXVIM7DN z>e5q0gR@)?b^y!$w|~|h{wDhPE6^>w2_W64FU=j%@~@uAdjewti|FtTsY6#`!UP%L z*BiYDZJe*CS;m+I*Sx_k14s6K{QLi8Z3jJGolDb(k^EiA8h(cD{`m>$#{n3YTJB{l zLH-S?ETTlA$)Me-=)kQ)8SIp99&wX_CDFA0CgTlM2Tz*Oo%a9sG`x>0l$m>BJ zcwM$(P5*yqXQhe<*Rn>xkxadSVa z|CrFR*#Ak(Y`5W%{%xISMWvxZvrQ}?Yk}TaOhqBMTjinZf8VM4r~|rOB%`FDyF{P` z-2>IZALCMf5__d8WdqK~a97kiIE)=lumYD|N}H8$ISH>vtPn-)CP!LLn;<3wqd*5B zFnwe?%YR;Mo}Y{hkiZNVtaFiES4NjK0ZW1W{r)L`N|fvqBX=q>=^mvZ8`c3cg( zC?&!Ot6jCV=>jC5gXd&mqy2~f9BBPiqX+a{WfUCu9y^&}|I72;4Kc!97e@3)@$avF zE}kcXg-Mh2Os7n^uD)_R3}f3~P_wye>#Tgy^)`+a_kIiLtA~Yru&f_t-4!ORA!a(mnnyOh%0jc+I$ z0w#gY&*qZ4x{B@b9GMync86>IXcYsaNCq7`*};tvJcqs!Xkg6WUv~VJJ7hUmFQ0$? z3@wvVu$g^%>5cKL>>gv6?o*5~)gkO9%H`Y~P`KIOUx|X*?PbV~@Iy(*4LJ(q61Sc# z2jQi%&E2JIrROe3u(mj?)kk;G`Umh4h<(9067f$i;TJW04uUV1TURe*L6%Ty4+3o; zTzo8O(DvVd(M%Ar(_>ekW*!~L)YV~t2;0FuxDAWx!U<(d2of!Y&8uXEz=xhbx8vv( zzz9x>p)+XV&eFpMiccMHaGvLpw-4_D^)=VYhqIvPn~jalbNCDin#rC--@ktk0N1}X zO>Y|OPrW9Z+RV_XUiJjTYknc%$6GLlkwEmr*-J0b}1bu$V$v0=aOJtXrK7*MM zA^G_nvro*!TU%wQB0&2j^N-?O=fTRGn|P+i{YNck(tAfmF+;c6?I@dm8*b~Zf%Pj| zdvoV@z~qi;P}gnm>$`>69k-LXm=?>oR$0cmzLWhR*+v9}ogfjv$MHd_rOESI${MCwC7Rb@ie8vN#lu*w4bP2*ZeF|nqKu5t_2&U|OUUG)r$w$51Z`?$ z6)TTlXpE{t?O?8BE$0dcoAeT@&zaTAV!6d?@HDxj=4%9mg@`R zG57=#G)5eCj=j3#3sb4u7$NeCk*Cul=z(8)Z*H;AM0&k9OUThdb!LD53O1)NoQr9> zAL$@mEp5;aHAR;1?>0dfPn?p=F&QZb^IiIB&ZuwAoL;fG?qgv3chUIm7F5(cM3j}d z`;V*daUBQ}+$kioGkkNo_eN47ukg7fp|s)R!QsY?!Mz^y3+HkLEt!@+=gEB#w6wDm z6B~|0yY!Ls?H&_q z|J-H9+bsiI0c?!2auEW5crJ|O)C`Zikdj>rmN{L%>tVRD`tFQ=&!jwRuY+2b(f*u2 zis!&U9x8R{y8EB#yQTtXkI6EMy*0h z)hz9>LXCnuE66PR^&EpY6s}vCzu_1z%n4&l#QIR!3%+x%J5eW)p!M_8K-vArQlw)h zXB??qyw0th4FuH{ACB4aZFD~n{XkwMaTE7oGj zEkA_0nV&q8o7&l_u8otkE>&*p?rG6vKeFm=1P^0$_;S3nOE(QOjEO1nr5Vz}eKp$$ z5iUnwJT`OkOH(!sC3J%;=(_IBhCup)M9FX&v*A)Y&P*+ww9&Kc>uVP`zg~dhGHZve zt`jug=S1;U+N*tOle~pHw6cC;LjM|!DW1=!rtOqZxIU`XbM42672m);goKl{Csc}+ zvDVY5<{q#jWT3#Dei^&btyRke?dFj3l)h`P?B22&(%il+;UG&TEE!@I zYdSG^#cFL5f6-8{H&g3EAuN>ub^0n^c$OHtN%t}^Ek94qUuTDZ@`XkW;ZAa`n~Nj(w4 z)oWfXT&%9OcFu=s!oo|iH#%NR$ZLXkI97AcKK|~9I9dDXF2O$FDghbUJC{{Do|_^i zdaIU}RujAIul)UU?6LPdV|Kn-fBsYF#tdXDho3CLPz%_7BrW?d5&S2e-W46*sLN8W ziw)vk=5NJ1vj;ITTfdFYbg-^&TWbcZapM!wyHA$W#<&QNe%dm&^` z9kOrKG+y2wA-;h=i zBsEFqJRP#diOul5`;`8=uTELl9+Q)wX2(ogxU^zlo=Z-1Bu9@DuHN-L)Iq9JUjEvH z$grDlbzX`Jeaq4+C~qta?=%##s1>g|4Wbu3rIWp*^+|7t^rjQ#f$PI=G-!L}e6Y}+ zhdou{){Vss%VK<2CxdiITs1o5s?FlC;E50=&U!jJb0zqH^<&Xnd)J;*!JM}kN8IMR zmCFX`Lb9@WB&Y4R)pxRAAefBo>PGE)tHT*k&hjO^UnpF!P6c;Ed9_fn0$2(7g~!SjN-l!(-muVLvkX@v@0Ms~o^3~k?3v~a-rh-hSYzP* zJ)1m1POHhriLC~zfdZ2Nth=G}@KcpC@9r1 z|WD~M)2C2H<+GsczB6)~!6s>cx(^q8W29Umd( zIQt%~E^f`*>ZcI+Z#_ZX7PP3%DkVkh2xT+oSwGKjSo+*QXASOx%vi*HgCe(8vy9(@ zYwAXtUcGxMwJAt=?(*%MTD#|&W7hm_>Gi%!QBS43S60qe;de6J zgW8zRVuP=~Zh0*N^OwZvPt9<}r{o$ZQaQT74KEo;uX>|8`$t;&gK3lz7FcL!;SJt-cGX^)rVVcZHPk;e?-$H zQDU|)m7-blDDZ9~k%;Me8r66w7C|P=9aTojD7S6nh<~c?}@Ey3gT} zisyyQ5^2N8^A6?#yL_fvI9G zkU6e*>n{DGcYpd2YRFd@QfwWilB1BuDnBA+HFB|X2qR=-0+^g=cxD2a2%AddOicol`A~g3~9+&W7yMe;IBI&Mv*0kWDVz~9)sUispxh@T zH8zbvIh(xLo1|>dJwE9_76^yjmVgd9p4XLURDamZs}TS?UI02i7W&-z{qbZ0VANo? z+)+YXnE{NZ;Lhb^B~b-+L6_Svh?$woy$+UjiyWtdK9PQXx^qrB(J(4A*_u&9|w7dGyJSlsI#xT|3v{lGC!`z;Urce%yN! zGEh!VOd9arl$ekUsub2a_ghs!iUU1F=x{?5fZYWj0u9D)YHCdQOHPpNJicC$LoCD# zjMX5CQJ?p$CcfC}a>to&zPdFREbo)`**c}M$Jf|bzuyd#@0!f6{zp>&(vcSLm0S3v z*#7hNw*e6-h=>t({o{q)BbvCtZ@H-Lk517j9e^@4khCA$hbdoRy)Bq$)L%|F;hDol zl+hQM4Y2{!fHo~Qlm1ql#uquXO^B!-w6_YpN{+2(LG4yvs*okakOnUZn`}eKc5NlM zXiOm+6#Mr8lB${L#W}EQym-L;8ynR*Ccn{B4{toMiQtDv3Zrc$F#ssj8X#PS)Y)9>&o3!($770>@BiU_2VV3gsqrR6V0gq6v1u5B&a?;Ld6(Oe(P&m{jY(ye|WQG0?g zxwAD&K>MlLUJcr$<&u)w%!aFSbrr69iK56z0-spU{^}SglQ8>j9F!zN7_)daH3u1J_|`yt zchz^!mRKBw4N@twcTIg3`pZ8<#CeCTc*CAk#R^f;t7L@oJ8c_&H$v>%8i|)XJJ=Ha zfn?I1nhDgkVK4FZTU3{PvA5iPF-Py)IkjTv&iNryO{t$Q z+0L+T+2v+wm)%CVY{tAxiDi%C*=;Y4FTTxzwr%g$~8-CHV_N6T(_=Cr_dZtF=4 zKS?9qjY9Dt8p+3o1MiD^Ou>bdtX3QLodJ%vMiTqQc}YrX1VI+O_xwotllkx;=iSlH z9_;GP`E6DDyvwyVoz5g-O~W^4 zzxb^HK77#o(rSE?PPAcXI7ye+VQaQ7#?*G=h3asSbX38d(NkjBA<{SGmbMhHC$TGX z#)(4G#N+vu{8(4z!4qka`*{;u!$)JgosHn_BXzOr)Ab_?SXq0+%+y8>z#bbJ;gNnf={zucW?TJxRm7o9m8^t1vW_7Pl{dj z6h&PjZOG!gr-w@YLq?7r47F)8Zw#eZjbWb!ONe)qh`6dHP%E+;; z#Q}AlH2Y5p39a8&*)DJD7@fWEBJq0Ocx*grZCO?z*x@d%xYx$4mYu_(3gU@Es?JIO zs=)S|Gsb&lXXH*@^P}{B_jDAX&Nfy({F2wptY79Q2<+ExZXSpprZ`E6R|xovjSM^9 z?LEjGFycz8dnc=&ZB5q3fsv*Rc2A=+t7f#XIbJ6An8Z5kM{WK9_sEZu0``&;lpc%M zFty?o+h~*I+6jssG%KD8yQ1dqL!QXdS6!^T|AJJ?fo-(~_eX;iC?FkW;bT?D_9vAZ zk|keNwWz&%{(Db)#Q?4E)jSt613tf!{DP{$^xjPI`K_V66xGx^OCnM_jpSSua)_w4 z^J?$R?gQV#LN3FO?02)XH%)o?Z-g^yJteOxTy3a0q_H(p?rnS}VKGtUR?4VxIC#Ct zYB~gW#7%OE!EVM-bgtaX4HjR!c@-xl#T6=d(eH1sA2uu$;b_`5b;=4%b8tO!-fil` zR@D0%fXGWpIj{63_eoE!1L@}MojFByO*oa8E7RxKgije7IP{0xN|A3fr~AK;6ohZg zev_t8yBC-r<5awqZ<0bHb;?5t1d7z5+FZ%d1p~)iJWyOBz|2y?gdbQdHyk|DF_mNC z&RIGS#So~NR-eR&8_lSnrx=@#K-}&(oLD2?r-@yW2P1l`0FMO?@qdn z?5D=GYFRuOVwvg14x&>O$?&JrjAsvlyY3hUT&B~MGtS&|c~`nST@qGD!8L;d%~}#iGOFkp)c@$^kTUzAJyC?K}~r1X;ICXF51r$=*KvFG*SnWPZ!++3)o`_*bTh{zWqJKoM9_2etlhEW-5(qr zqX#T?&SIcPXYFE8=tF1Th=0s=o1C+8vWc5ydicOD1jN9NvLmhuz}({n0--ubu_EnF z>Ut#_J}YFUwpNUnlLv^H#os+%l;)*P8K?C}(sO0oRGm-hT!DXSY@@2<8fY*Dpmi9X zazbHG%UoZg-y*U1!*Z)U)Owk}^dA@NkeD1%TD&g5Me z^&=0CbwPCGcP2~IznPJ-_PVLWbL~fl(yS;|LJI!c|kowBsIi z_k%1e#&Bk`{r+TqRTohu_UBRW`A!K8GSVH>*>i?nqph6|`O8SjSl5Fqz=J8!NY;P6 z2RGh+wrk^ilYv*l*}0U>B{dMl5|ZlsUs|F%KG+(V@^WyfJeDolV+*}&(E56p`eJW* ze}(L!hk9Bi|4t}vIEu2py}gyuvT^kgsSD=wv&$R|mUpVz6^t2!{IBeRu(07v=LrNw z{aoJs5ZSP)X|p#)OneZ9D@xpIs*y&EcW7sSt#^rkZL-p>kj#LcD=0c{06XXPW-Qnsx4h-~j8+QESYDQV_IxS74p^)rN&sM*|O-#A2Q8TyIq9h7q+Q zLh)hFb5Bk$mWij!SizI#ir4GvhJxt8Zi8%pUd(f08zZ)wN)hC!V@iaOi+pfFEcG7t zran80<&Q4rhH$1VS>3#QNJX;pNVIOR&oI?HQSjTnQ~z@oz=0}<>9^?*MP^81Ak_mK@hFk~@6r#n z4vR-PjRxk5No_OYP}!E9gxBIdA9jV$#W|)j*^)8z+lGEn%dYoqhZ(YO(lO#5l4XK{ zDHRVd_!XYFH6vb(=Is-t426mUNko2z$2OTG#T^CNDLzxcck~gjd*ujF@xm*=BwygV zH}$yQONRlP4r{a1_6G}w*SL|^&~}t;S}XyQP@9zUB)(al#)#`yYe;;w{Yx|kixL+* zta%&RBL(Nc|0|wR8TG|$$MDJ)e9N&zY*4H`a}vAXy-7ztm+4l%9SCI_Uz-Y&IjaIW zV#ov4+21z|WQ{mHs{i~Z{DI3k@x6S8ykO$zROaQo32f%O0r|_gG!ItC)6JVoBZH~$ z?{26s7KIN7FlZch<@;6zHmPQcJrYXDZ(Dt{TZ`YT^IBatiX&sI%a4(4KpaF1q*^h{ z6#LsakrgYP1_Pf0JE{Vca2|7ATy!1*mcQY&#+|WmUoqUV7ns?<^=X1OQ4~R&yEq#x zBAIWZmbaKyL3T&cH73op4_s+{X4LI5MQY||=C%FDln)zTMPF|^2;S)i^{S?4BcfH{4|Sg)LeIF z&(J9p20V4%Y#`^h((8qI^+*_}$vb|;c+YI8nC2ARUfJtlC9kL4a>9$vxKnsQ#f{}O zc*bi-M*1vGZfl8=Vg5wrH!q=sA`)T>3MSmV?>am_Syh2Atdk|AY;vEL`X9XWR3IF} zPV%|7`i}5XL+IU?P-HN$OiU_|xD&**90OZs)GEK@w7t~38^WO2zf*e|L{XRWiAh&K zw{AL{{9mLH0dttU0{idvn&RCgDkBx^^f$ipj%boMW92RMDN2N=$3<0d8msDO6OeN| z?RsX))RYM(8QCWO(V3qdqxj{#ax7nVof2-|GoZMUck3EG>&Yn7EuGLmK)C<}v~KTiY1{h3w|C;&phLm73F9eNj$|jV66$ZIo_d;%SK{v5Xdl>({kvwPtsZ)|XzpM04Nkd_Qu8(gR%yeL0m6>hptHXb%b{OCou<`#+73k0)x)Xj^Uev(J1Q!V--oL3-LOS#Sy_oqnJR z&pa7@@4jo;r%TC&ON7s;crFs3eFFJE{A2#_=QRSql6;h-*Bvuf`>BT26=??rn2W_*p^uUpXJuTbI)tYhs9=pR)(vdY%rdsG zMF3{awWz{Frll!Z`Dnvm8FwEMN7AuO-w2t&KLudQkh4O z9!00vfl&V8DEYO!wiEq%^BoCVs#+~qN!3dAiUvy^6njNYH7hLdmmfU+=)C^f zE%DKdz1)2xy!$Q*^^M)eG@@Gz9fk5P4R5Df6=lZ9Cz7;MVv8+a^3?Z^ipBC3=~sV8 zP%nA>on?olzTr+yP_eu75eTqNji7P<8?)cVmrPiYAFEWY>g z2i{HdprE~Wu^??&7?Oo z`fI5a!Y(tRrGityy6<(C$ZA>mMDRRLCFS{8*M2_D&h3n7*JsCb{`RK=gU0aFfg-xb z@Z<*0oDrCfeqS=`U2NT7D=!g86_qoRFcQ{qhQe(Q6al`BdYh$4-oNmQO=;=f`Pt5< zLirk-I@{UlLDXbtmfjLdxHVt520B91c5$o+?wK)D_M9bY?`r006#?XTMVhbKs$ce5 zyW~}buFE#X*N8@&+P(wTpS90!hZ)^nn|VefT0}OVh)LVY29w4DG`2p9%9I!y7o3E&h>?a$i-k<{~@)|1L(3SdwuQ>jgH@Ffclrxp?4J*V71Tn$2w=E=; zFTkXtS+$0p7lolZjtlU z>zoWTDY}$BaA3{Q^)E;{*3=?P5mo?`<_XQ5>kYA}T1Ma*mBjuR2Nkl5ux@$r6{}muhZB z8j+p5axNFZeN$h25R-j0{`~!l6b_@ zpHzsmU>PcEL+~>MgAg_^Jsj;dz|kH31#&apes0?ZW*WZi0VUkW*X644>xjFVg+LjP z+IspSL&QhJbro*Q@kCU7Ieq;3&7`G0kjtV7$Ss?x*vr#p@6f5{=MEM-C^|IO2^7Vb zo|#iFR>E$GV0mY-eOaOvnfw|BZbhpKZt`H(%PIhHGhfd4Ue4Ev6!9I4js8Z{-E*zLF z>oBe*iRA z?}8r!v>!DHGjjBl%L9`G9*EY}@2ne4HYQ10t$(pyWU?@Ra4_3~S^y1|KcFnfAR0fT z)dYC%f00`ABp??jxspWUjQV~rlHEb+>!HiHiBB`s<_FJ;i?qt^?@hN6GtIO`WACCg zX$jv~xbeRbot7e@+Iwn>`>G9Bh@C4z8*Vp-ZzpSISw_?co#9psS6(HJ6fjI2EOe9x zp<)`An9v_F@w?kuHC{V^fu(MtND0czCT60dbT7MJ#Qxu5upYW`o)-Ob;m~UtmRDcD zZ-C$Yl?-;u`}0j#!m9H_t9RWWnusL8#V|#)AGck9@rE!wBErT>W~U)NoKZ6%U6o04 zFhhfoDc-I4F3c$t`7dywpLpm@5<|z4Lr5-9uAjzR8Ti~uzZjg2=p624&rC2$ES2uq zT9;TX`4E~E*{^DTotcSvcr~_OzooEoMxKA$ihPR=Icelo@*l&bAyp^D^=$I&-kDJ1{b>Cwg;m6 zG~Jf~9~4_OxHNWP-862C56em$d|KPa@TON7Rhn!yz=Fn9B^=oFkrr7=7Te5DPPar^ zfe<3#oF6l+paNdXI6lK3I^c&a(qAq1M)WF~@s7`geV)JJs;yYG=#9`I%zA@#kejrIw8^g0}#S;c6KK0eM-H3?ibv=#u zrbTQ6=hdi~jg3z#vYmycpGMKGW59R5QP%klt}g=l1$E~@hSjF7?Zl%`uMon__w7*U zDG8&HYM6Kb+Yh%FxUHMsoziAe65d)EyqS~i!`gjH>-*k@aS(&3%#fihDL?fkkps$C zuU-{9G83nb9i*$5cyzrVsjaGrPNHDSoy81sZpZi|a#efJZFf?=Fhh08rj`@}S$W zM$!B$1n-q)W2A%mR3@$Kl2U1wFxm(^5~biAoq}3OVXsB-jSaS)(D{SmxI6rJl z&vnaU^=JPC(6qlLCS%x*8yuT7>VAq!rUih~+LAT5HFmRYe{M5* zl=KX7g~1w*YQCv*`(OpAllK+O-Q#tEfN1v=TK|Q?t(VPF0s=*2t|Ny?Yjbgvun)!S zq}+w7H~q;I(%V<=tO)u#uIU8#BwwsL=MO5nTIZmnbV0GR01!rX+6A9r{Sm?6LEg`= zbl|{g@9a)+E>MI}9YrMnhJoq8vYKwBFGH}x9Q5|WE@bOW*T${$?TqsVu_%5pBY(NI z90q*KtPvX@j;8_yvzVE$g>(>rXD~&drM3O&Tl%$DhqnS!O#H)LD;w}hfLDVcT-v?C z-9L(^f2K}_XD1tj;g0;P36fK-)8Gibsrp;6^rj%u>C%nN#I^u=yZ+}+b`80!F!b~J zMW%nt(iQ`6l05I;bY##X;DIw%(Wgkc^l?PK~LEu>M`-L^%p&ln0wr-_ar)qXCup z(oEX)qdvaBqC^X-fbH049q&f0lli0E;4}be!3n&E{njQfD8i`Q^_P|8H#Lh>*|HPI zV!iKDs;0t?MDP)$9+Bboe?`U$Wk7}CAG1B%*E)w`JsAP|I0kQlTjx8RriH2F>X%$u?@xgm$RZ)LRZ)oBmQMsQET&*6m(PaA>rRp==~@Ym>sruzzRX zbIeMoO-7NQ<{SV+2?gpx3#4NLVxE%bzVRDQfSnFHnpMigTu0L?b^+LyLXGkxzheZ^ z-IgnSC_am@Jx%{7v|q8We8*0W**FLsQkDrqfa+bl1BO zz%+tRCDwVBtdp+5RGk(eOj)|=3W?4tL9WZm?LAnS;73R`_Rd+j{$4d8H{zC03g!+1 zFZXZwAwta8;fzeCC45H2pB}A}e*5@14Z^6IOn+EIuA4{76zNY8@0c#J0o09?hoC3e zsR|2H{;!sfRhT?kW$L1cAQbh zX@x9HoX%Ddk<}mY^GeyKV?Co%`TQM>Dm;rR0=TOa&Hd+~ieIg?3Ih0?w{1liuLINp z-x7Q1>q?J#SOujxo1$|a*}AfwEZr7f#2sg+=`{dKe0x?^T2bykgHhp&a61f8Qn&<4 z3T94_gBaF2g`NQE0i~EvEL)Ear~vi?32GGBC1&f}yJ#G3qASqNv_s9mtQ;G%@} zE|nrnSAR3uF%;*YZcdCJ@*iz^kCM@LTtx(!j54k~f6NmKNyRz8c;AsLP1N~;usQk` zK!>B%D5}DJ!(Qr8`s3VAZ-(Zb^zc^PNhO8NqW9fqsQ__PWO(83O+Nrc%^p%x#c7XR z6Z1P)Mq^y$7bIX{2--~Wj%z-A;WAyA*#M!(J&HI75?Li#3 z%MxG7Fs+9BH-zrvOpUiT5V-A|Slnz-JEmMeX#NGeMJWU{@xk{O2H()@`}-epoI%yJ zVm8C>hAzY5jn!-b%!iPQJ2;oa%v=yGF;^@(F@|s(+ z0c`1*%+Xsg#|EgmM*F2dg>v*`%4*Cdw>U4pu7r1n-PXyzp;`l+Q2<(c`IeGY@y0bB zo~b$gb^W2&pV4~?u$f>0EnVnm{MMKo?tDQY;QO6zl#6>U?=nD-K36~!Dpff@>b;8@ zl=`H|W${C__G-N5AU}VtO0~@~dH=~uXz#lv^y7%S4X6s=z{h_KI7oY#7Y2Y=!_+LG z*77aKItp@c@d-4E0HFeq(Et_w0lpc9_VIZ<7n00srjui=4}C&YgN82HKBGE~_ZG5X zF&uCxnfU6pJUQbPni72Ygh(2f0z zP|F5zODe!6J#0^4`gIo=EGtlA}AH>E(X_}*_xa4Fblb@dQaVU z!H{RseBCvafkXuW$Tl#(HQ5GXFr1lvlT28Je+e6%=y_r(fPysRa^FJARCQ~^^-_i8 zqay3C(Sf_*Bna_el^VCcMicA|eBgKq8PzfBZz#oy41G}m@U@{i^AW$^YAR9O#oq2y zLw{{4xo>8qLNnYx0FOP0?=69lme|x{kpJWmbp1M4(0RNP@P(j7MJ#Q!elguZuWhB@ zYH#{;fI3C+v2gx}`3FIsYpvU0@kpD%yN6fafhonm?z^uAGj^pDlh+XQ^a4v^Qt|-w zkE*}dYgJj$q?&p|dccM~#%}CG!`jUBCeWxr)CE{bv~uj)vuC5;L}E73lZ8Ymlb%uC zFq|CxQf2k10e1hfsTAg~uIR{rd5A%~!>rwjd2}rH5d@;OuL)g_@d?iYUk<^OAmCEF zX*)kHO~c2kBty=-pneg#IP1Lh^p!Id>dMM4(T6@4llHX&}DLWt*?UGgQqG|X5eCnqJVfb-}aUQf!aD*G# z63@K{6}Ip+U9bAIOLaDzf}FScFk95Og>C%Q;cCUV=s9!b0;XgiI!`e z=JF8mg&qNTVzZ<5k$Ld?v`~a+ZU4Wtk_0k>Ft}s+L=O}%QR)Z-sLB6rDDf8lF;|vVP4V$kutmn{SUu^uDLYwS1&sDImM*%Z)h{d zjCzO5*+4KXAtB17=Tw$NxD88xDBpi%D)rmWf&ZbvRw!3M>0k|%5Q@uGvow3Esb*TE zJAh`(%_Oz9A>Z=b<}M6>>VD{#`ZO7%JL%!}H^Lq%i&_jqXzmgiOO|K@3CqKhVXFVr z<~=ycrN2G!Pp|%m!V1Fs(fTCXJJFc*hE)v=0(fC<07>h8j}hf2alzM^tuLF#5+C(b zqXitKRQ(f0mWY`oh8@i{9>9RX2#iAWQW-Vun5q5=W}(whoM6Ob-72m&HaKza#1(o1L| z?VWGXQ5f&NbAM~@T5r8K|G2)yX-9?_QupSo(d-`~`AQ9{dg+bVwv)AEGhhRs&T55zfo~1anOK zb-`lZgvm@m!nOB0bdr_^wS(*b#}BcEAh7$zAAtB)1YP)08zt8lD;_4SY0SBgppWJ%#gxrwvdEO75jphlVr)shg*8NprOMAub-s4PbAT8{jMoLhP83s)k) zW#3iEd9gN(;4yfL$z%P1;Y+!{IuGkeSDa5_v0SBZE@lwVhY4iDP8=jkWNW2m9ii`e zI&Fg5DDMNxH7-;R>4hIp^KJnM0=KZc96C@5e2Pk3NKc;WM?oT1jY37gjbUm<5E-sv z)%)@Jd_@> z(D9}sAi;^R>)?8^g;t-y9| zz@?_O`}x*W?a~JDahBp#F%ve=jpbfy=@RGZQ$dc?cPLGEG6|hu=s}H#bq#)se|$@? zE36@6yvOXf4ns+}HFKS%xlTS#gkPhr$Ia+l{3X_LApR_U z1zLDyx-DV5q9bwyy<`qr0_Jx+c6Zc_CZ{v-3e>v;q>*pKJp2NETeGx0^kP@9@+~gf zb!I(Ja0gk@H-8~3Iuo#O9LrY65;m^-a4{tEXe=Au4cF(OI;-^^ z1za2R8*w#^i}}2fqw`*nj_##l<5l%kbHLc23Q+p}%6+6pNR}lRfL20f3%$ ze9h!#zIE%3LhGKH6_GChb@hS;G6KRp(PN+T4cH4msS=2^PQi^WgUPi&%`koM1hFmM z1*NCv6G6`O;C+cux%G|k`CAjgI0Ao+R@#u6bVEO_WS(yrrI$v2qvs}{nm@CN_x1A& z$v1Da&}6xYF^vKZH56}MvaK+$b+tVAz5T+!P9Xg}t5gEZUrK7yU~pFe5lts5QFm8_ z5~ya(I+7}L<3_&NN)TNB$$7y#%Z&#I?Uz4E_&$Iqpfd5%V_Eogqe+9ZM=rKWS~(-R zcRF++J$Xo)(skHyF4wSKpgvSE+hhIR-KEjz^Gyt5H^`3Br(G|Ke-a}k9aC?~L%duY zz>paew&D0JnX^mIn{3zka@uvZf+c(j{sIVou8^-Y3E7*jq}W@m5R;EyN+lAh(0MLt ze@X9dq5BZ_wvp}Fqn5#d$JsU*ZqpO>^RPdtyU6#AP+uR)Hr6=VegXw6QPMUae3=YY9!{xqj;|rREQ8El7@kTJ#X~qYAonb%5XZlQ%*#D}40pUtVzi28RXyopW%*FH6$BRE&p2a^tYmooxx?qpP(Bo7~ z#jJ$7U!gt*zjHqYxa&Sml?K@T`Mnz@k$@UMvkM=CU>f(PukkN}Y2fWg)E}Pmh8{XG z$+ZjgfMP%oRp_4wp^lPh1RZ9Mop}H&J}uU?2?NfKo3%xLKn@{8@}_>_i8%IlNUrcs zk4ZC5S}oPqaG-x=#JXM(24_KJ!`O^!RYI(Ei{u(iuR3~umZ_Er052yl@JjW!7Yf*I|1T-H~yLZYQyLLkC z^i-(J2@5Tl^ZZ7GFe?ZwhOG$gpE5KWoseYFaN|(u__)>p6o~lpp&plo)YKhuX1|HC z^Sx3*cLyS%=tqtWb+>uc~j|yFcqC#J8<=r3|{e9rCJJj~SZ1(^> zs6PPgBvnxV_0-h4UjS6&*(CMDX$!)gvBoe>cgd9yG!1QY9FU4)kA8_|s5WN0oRzCK z(t6k+i}l>Q;4;ioeTYd0vqSjVm%oXx&JF;J<4$;gFz;A%YibmeKZYgWe0NC)UsU5i)@mT0KdWhQ_p-1xgKt1U7FKjn_A{2`huUb&7RXjzeX!JsFLdnJ7LTt8u^a=I4Gq z?+#{6^ES6c6i)FPF2%i(E7;8;ln^=6kaHBcXYZ&XC%@w0%2;hr>5HPF%qM(5P0HQ_ z!NzaU{4yw5RDM`|yK^RI=iS|?oec6WA&7f~v_k+k6>%(7=G8i;pW&Qh=bfeQJR1=g z{bG-64?WSoc?=YEyP~~VdgkXRYt(+Frava&ktEiiUkm_tatZMRCOvH|&Be(o2?pWW z25cBKGO^={3O&1adj461l1pt#@=VuRRYGVJ=)M3jRRpZx?t8U36 zAz`3E!~UEOWo3lT@(j^-i&@XSw!A$Az#DZrQ$Xc8{gXdwZ<{SAO1Q*hXi4q9elK+2UxemKfOpuz7FnRO1i| zaTQfwCEU1ftuJwiL(%BOPsPsG@}oD5z)#-{ifoCVEksCl&Il)8MM;E++IS7HJI{8X zc6hb17Soyd^5s}hm!y5Xpai#a1$LRiOjJ$4USo;}b8f8pW3#g> zN^)F0-FscO|LPPX!Sj^(iOFQD!1uMa9|H%l1#|lay;KRk#q9&CX_~}~$N0QL^os4J z=eVv{^{{>ZoyoatR4>vez;UvzenYZQA&_3!csjhPEge&RM5g^Ph$mfzVt{N%%Gpr@ z`>6`Xd4JyC{Im{;x?h2L9odX;T>~dAeXeBtB^l!Jo)NZ}j{ydBbHAHY%KF#bcZrUI z;QCE`;B9YHq}(dDgzeolap;2?%!^CEbmeIPoq!xxfJ>}-91n*x<2NKE|})+#qRL`|K1`<+L#*NY?cIi)91RcG%s#uus1WvgDxf+4v1 z({BLJiAU?`Rq*;za(?e;rD4`fM=lR5%3=}ZVuD8SYPz}B)%Ta~F<3U61J?ivUu-e($R zyBgN(H1)A@67jKehsu}cxn5h^Z_+MIGv^W}PKBSMVCeC{ik6)!)(bzo*7m~4tSQkd zV5)~P~{SO22jbNVkZ0$Jz5zvCggw^Z*gZ~*v&9x(uvTr+-cQ<)5bZ?GLrb~wWZHyKdFtA` zynft3JxxJbi>`f{PpjMSDqg|`sKQv$q`K0rWCj-H>0Rp^8dnUQkB};PhZ2F%Jvn@I zdjS8Qd##-ZSH%_$PIeRgs5i2Ql-g1sC zO*JRv37x2p!ClPB317TED0Q}ba5C`Bi(nD{40rlzbJ^5gvNKtA?IHmy&HAPFv@p-a zFa%-A0fTEN9xwd_S$G^nmbPPU&FuD$gAQqq9ZK6uI5#a(?+*utrgeku;PnWere@J1=kG>im4#x)4aaFe&IHi9UjbO5m%l`R3WIiOZI9OS`D1$is5hFFlmgu zM(Dk(+BcW=Kv{!*n3^+Nl`61XU&Y>%2hx68`Bwn;+qimuI{9*+M*Utx=q--tcW{FG zzPqL$i&u~zn*4XG^>9Ryl1<-<{`D!Cy|Sz5d(RRiNRF*f)SlVCe==5El@~ADl);+; zHufBILg9??l-h+iUu8{L-rwID8qx5y=;c`IC&k?GY36H_=M`_=`aOh6UUkq$u}K#; zx$hj5*)9x|dH1`IaYxDCUg~r4#}<+rBdxtkp7fgar1KvFpd4EIYb|_cgww_I1WNnm z4+qoq6aDJ0rvQ}?Vqf24_R*v(VG^PeG)mml?O*?mvian0m>y*jaW&O0fTT9sE%hS)<*DoJB z1YB>B!mCmMS!_@eS*ACDQ01PBJuTRLXMaXP-qG#U*yIL%h#RnnO+87+&kl;2nOXRS zx3(Sz+~9TSj8@WHV0E+cPPR=pzpI`MU{`q zcr>zLs6L^uPyy(Vt2=^&i0HKCnE}~&*O_Zkk~UfB?y1^$iEITqEt2Sbr5F+IqLvsL zh279CABb&dM+9lGzaSZ_K2)e==M@h7l__->{WS18J`P%d&OUN7^NgLQid?@B-hOmh zquAY5odb5N{ik>&MtewVjTzk42!vSdCdg7hcH)!SdP9I1r17qjR)m^&F@tIw7XpBK zgaN2WYsYJ#MF!F%D-erxp|hZeNbSRn8vgq^06mUadws--)!*GKcmI4?P% znteAu?=b>h1TeP|bz?wro;7cO754V6ZmwC&31O$DBpNOaB}$qzXDn8(u?#R&i7?A)^pGKvDO4oxcVt`w$D@IN_n{im2l7vsUPLB`n<6&EOtJ_TjI!O+MyFsTJx8 z4`4pC8F>&U;mKEgL)tQ05_6pzOwEB?s(-TJMIar&^Y3E~5wIeay-(;x-EW+j?~*0p z9Ac~!jQT%M<`sPMGeW(%zdPArb}G;`WWJBs%Lytgg6H%_KBk9pDtSUq7%%VS*gFw^ zr;B^)u4{N5X4XMrX6%mgmgCu3H!zE99jV&I4oBDNPQru;n6qfb$0uFA)y06|KbiY=4_1Icgnc6L3p=b zJGM8bP(HrQZ5(*V9fbCl$0X5lkK@1-$%Npa-mPD}E6EpDGAo4~jzG-jy#OK3PILvU zZ@XPro=erAUz4A1F2BkN`vyLVzu^reb(_2w>^XwB*rCgMsYVldo7!?!^>R;+(cPuc zq}^cY2fWF=320$5U+wdMY~)9!agiFR^oxn8_oUNJQw7#AN7-#968>*f>u-|kk<`}? zbf7JaXU&Lku3?j!nP~A|2`v?mzz{$p)QhWj#Pg$4PX>sJo4% zrLbI$zL4u!Zv(2!t>sk$%fWO<^6Nf->jfaSlWKjm1w}q#Jo!^Ld+-df8D(0-J7bcp zzN81%`54CdYCCjJ%AU+*E|Zz7ckP^$ZpH2JJ9?%4H(WG_?mM|~40fq)(1qriG;r&> z%-Ab4^73A@21QzqN>B2fhbq0GLOZ=;j~;C!6821r=V=>UVme3}!h&o!3QC%vxb;F+Ny$pogS!7SVT6Oy@dAOy1a znR%!}Nsv|YYaq*c%H1&XPZ~^P*T=6wioLq$=QVrE3=7icbO4Q@)RKo$?pN{dePE~s zC3VIDNP(a2p9$LkX!9myO%2pu27h)Nh}_!K>Ru%=&xPkx$g`CfUl2WcW|2EgZ_=Nr z7Crs@@0afBox7*-teRpm_%Mh4J@`4<4J+oFgYEuP$4giR!uAGHcOh8f$QAE)~S0a5$|ZUbldtR z`2j}N{ClGgtyP^W_kP(ywiA3H^~b|=u^r&8Yk5T`(C4WM_o{+7#+8C7e*DV4N-6IM zeGhHdStlEvj)_hcB>f58RD@=eim6b}U?>Y(Ns!g-RohcAHuYg!kN7i10SAAW;pNfQ-=iK5w5*S1b1#p6xI<0icxd=l@g?k};X2|rOms4UNz5Y4IZWA54` z$ch?ii-hK(2J;*(*!#12-a_-R6@kbZ*ia6b=Qx{6*VcI|8NL0zzWCX$6xir>jM+$F zS{GVirP-Dh)YJO(#cchNu`vLMK(>?h^w2u!oJM!*JH5UUPSp=gll-Rd3`Ee+H>8H; zu2QG;ZKW-ve`QUC{$T^BrfE%n{0y4}eW9c){4SWq$}f2EEw3B1z(w$jGkTSa#kRNT z{!BAQ)o5sz*1mJ3SyaI+dqZC}Y?~#hGCA8-{p}RLWFf~`dl621y;G2oCXDo5Q5P#V zeakCM8&L~>5*c}K6#YKc>hYg=;9lkXU3$o9q2j%Vz#60icF_cW7IG_5{7fk`_89>M=uiH`szPe*?a~RO zV!6}n;eotIH@LD7k+9aGT@H4iakUY!z0~2IZFQ&^0`}y?@v(mNM?ZASG3qg_x=gA> z)B1{cy-*D7?|3}X)aJvKWwRo6{CvYY9oYqAUc@P>%SX`PA6s6+SSV!!2l9pQh^{Q3 zlSFXO^keRH7n!LDy>)%=cK_qk*sI1lgc@G-zuB^+mmQg1Yc0$f;n0FOqqjya*(Er{ zbkZXT*@B&VZSb^$7gI|&SWpryOgd3J@8v~I=t*Meo44>&%qo2flyd0{OL!J;D%=)I zejWBCLdg5=?a?4utdw5<;*STQKfV~jO>gJP3D3%iMH<^I^T3rwnbw^w#^5bH2yL^S z2;~6Wy#GQ5IN6EOq6d7%iS6@h%s_d6^_hOmZP zigA)znEw2M7!UKxBhAz^h*&KV^Z{DCC%sm1(AE>plY_;39KPCeY?3bYaNx4>`A{IH zsA=U+CfHO=230S$*(bUh^Pc75xmqS!F7O4b$P+e$UNIi}TJ&)-#n|I)@fi4%g z1xZ00T^~Q+mc#^1boz~Sg&dt_L$vnmT$5f`e`#yn)UT&i>TDIM%h%Q46~@FF;P2cp z{Nba5B~lTe2Diigg$o#goUh^WbX(6!@MuV{T+=6(zMDs7Xl*phAtPVgCh>&rf|O#a z)W*6;`$Y8uPb2c5vtmjcjP}B)>z07ZFQT zhcD5wUT_uu{)jod0d3q?2U0p)REQsqYo85*iQeh+!>p@+C@4k}-@Y>l2Ri$v8qiUp zA%zS-Q68bRaM#3VfJ_2*F#b1V=ewdN=|ErdGxSm9c>&PJmCv9*Lay|JYPTO0I^((YN`KhK z(t?pBCOpd)Xma|?K$D9-llv8X510h&dX%LBknOQ$-{5o}15NIGu8$mAxRNjUgIzvp zVB7Z+Des8RHZJ5L)~EG{DP>E99x4OV>P+x&Ula zIP3pxX#lf>#W$aB%UMd@yy2Y~*n41bwQv5*|6twy{k;oxHpKG3olkhllwa3<@foTe z6OwF&ctZj3#u@GDpYVoi1u(nEQBwOMCVnmf47;gNPVsGD^q~;SIUzg!&v0As`aiV$ zhf)5y726aU<3G3JpIh<&@>`)h5m1jtPgm8a#2+k-f6H~J+t#uB&El6gt~XDe<>r3C z&?0s?o-k)*Xg+D%zfYM_WRke3t4v;Zr?-DFC<%#Oo!hs2KRr2ibvCQ1VtJ%w=A&g5 zuEfa@dw-1|-ImdmG*JNhS@E@S*4NF&iAD?8Q>SowpWpRSOd_HfS$K7;;RPw)n@4tn zsFcsyK3Pb^9E||xpPjtUe#jR5Zi9jdAN90dJtxq^MuH5q+-1vt=Td)REbbwC-A62PRr=Y;2CyIW}i6VUr@+*y-gBV8z(gHV3Yr0W$oG zlp!Hxks>tA0VP2ruVkOU9z`#c_fl_}b<+gxIBe^gQBvH>2mN1ayc7sfOrTKJ*XRTu z@>_O3sD8AcpId~-Cv1G&cI-p2!sAJp-tqOHg<`fkm^O}xW#5&}U<_*L>}c&+(x;J- z2H1c{)rU7(tSXH1ltd~64`Ea!GPSdzcXAg=WTMl9+i&r88nnog$7}FGt(jB!JQj3CN}o2fwmn% z*r?V6@sYeEunPOcCHBtAA;P{HCVws7Q*=3&dT`2tkv>XgUY)C%L!(1bZ(zmtC z`^5-3IDjuXrlYd%x=~*jtuiHdoK?kN-jDaAtG#T7?by5x-WVy7LR&T!Ehu2d;=?14 z;|)N&)k|=mkXMY#iUuUb)dvyfwfYeU_A!WbpJhzD1owpdHjr&S>z@RRwnpnfFrm2O za6}(-$wy2FaF%Hw>)t0ylEP24yaW(J$i=L44L`{u6QnMQYw-NIA zq8i&B`ErG4U&y}>P5m*O%$j0?7Gg6{w6A$Npg!~ry}aK(9To2nZ5`=iFN{=M<(G} zfAdHjXI4d4v5m>H#OEG$S5I)yQ((GeFJ?Fe3G=f#^mm2vos`$sz{mWqF z7mgswuA&k9m@AsXhz&NxBAK1#0&zDKr~God77D0_P&L&zH)ZQ~(I^nwbnO$RrZ2hE z>w4r9YK|@aB($}a;V$3&cjeVFh211CEJjJ+t)4Q90o@A{unTp=VIohWy4AK&A@JD@kjyj@!l8#Bz^@ zM?`S6D*jIx=yg;Km1S4fUI)vG=u4ck8pmm8!>fbC!h~{orKe%^%zxo(2h2rCWzxvRM|bl4UVY}r%Xv!VR*rb)$`rRz=mOK`$cSh3$FnhiQx;DDzd_A>#2z*lWSPj!C2fh4iG9Rrk z@l8r?(i-xD_sdH7eOV65}6U$B}-)43bQBV^K zDXXwwn>7StTwG9mawPZ~rED8!x`1ha|6R@Q0(6goewA8UWRGV|>!>#E-lJVXc z31R?z;kKoUkY#cW!~kBd@7%g<@5uwUx5T-FO!^~n>6U|$rS0XE=j^kMAKc4iv!e99iR+@L6NLv`fuQA)yZ5#)yoveg-J%p{=n7wzhKO(7; znZ4@h7>D2^i2G0-A|x(hgyh| zQfx*CKn&-%D;e9!?L-SL{61K?UP@JP^UKFq+`HRlLIkwI_~K5+{WZLaM*^6!pEy2! z$VJFwl~Ydp%j)2dM|5bLCD4Yz!A(5tu736TlTn9`Jj??f;Zl#*x5 zJZWPV_}hw;n>jnP4_9VHRdD!&1a+D-qw9LoyFE|;DbUDxE`Th{=Bkm#EH$)58WxZ= z{BvlC{}4nqZ9ujDX>&UK>MgrPsZsL-E)Q#drNT$kh)CicpJn%Z-qjqwm>pooMQ?ui zVtyy@TosUOnZNtZ!Vo-S_<=f|nB(gX)4qLGyJ+=0?>KZ>B~XBuQ|>Ob;SvLCw8{+y z>yK6P^PIC8%pAyTPdUw_Yq?Pn{U7(chy)bw~6&TYFyVxClw=x1Lbo`kDaEuds z!DSN1JO>;@W|tYg^^2dSA&yZBb273=UFX`Ey||PQ>Jr!W5H-|M3EcFPD?0-&>{(WsOX zKSQ8CjB&4DN=4P7INZOG*mv8)%@2WvN9UTuNGrSzBHhwdx{_P2;(=6e$c>WcK-Z3S zUd7^9pXUiZhsC@^6;U46={weS{bI|5fXXrGm?(VNtlajOr@PM!N5TI|6R&TW}; z(z3nj!9^UeYkLa)Wpa+u26DmYn2IDutD7+7=_%OLL&V=*yWr2u8l0g) z1lKD>nYD&V+W=zL8evM=+*I@H;m|5`S9_d)CS)P>M_!0IRvx;1qmYo@Cq2DQ$nukf zthdQPWZBAltKl*#?tSvSml0j zE2v>O$wo;zevjQm56aZ*(v>9|f7z2gCqkTJ@HFB&VSbo1zYyVi^9AN} z@U?_Dt<&- z%4PFiE)toE{PUA+C#m{QmSyt`2Peoc%Be9geGWyM)Ar=kyUh0=oI|WNSK#GVA^j{s zbxwvWezJ7w6ctV2o*lWa={s4SJmNVnh+h6q+HVK)oE30*2lKTO(u%_X@2L4+_yS>C zemIIVnn2PC5#@oZ!CZJ+R&FJJ>NLBCT)b_L&HP-JdcGfnh#70m9$?LMr5DCoEmh2~ zJbRkN1A`AWL?zI)xtBR}c(c|t^*r_EC>2f+Cb}L<44dfnHI~K$ zLG9Mn+EWo0YFx%#BW18No%x*as6*JQCP`LoTYF;&#PrXsuq4YO2MEAhyK1&sMC>Gs z$X6Ok;`t^v-6w4gH8sBubHYlv?ueV~3eDsEV`>h^?K&08aa?{Qp5_L#G!+y=D&UkK zt|Q%y#cn1~D!GuC5$(-FqV%PcZ?n3MN8VxQDdg>xda{#jBJ>DTrh;?D=*|kPnzQ8L zz-Mtg`Vx|)TI*2qbN*I8frK%B;sU6nqDSl`5}%U;LWPl`;RkAi8&LU#9Het1zPz+i zs#spi&^)YbJZU$bc1r$*j2f`S3nti9c!e>~_;m7OBy}6wR9Gf0Xn0$*U6Tqvj`<#L zP*iMUi-RI&LKdU7ra8dYn=ZglukrgUyK}`XmuYybsJ(V*VMvHsp5U`l8J08U*qb8t z{L3hs=0MM`EhoQu8w;S&Qej%V9f`#+0v4zEBCw6c(@88Y;|EYH>Rn}aN&5=@INZh6 zle#GVxsRJ$@v)N?54~)tvePXrG#w{IEjxioocf47(`2&^@Z3!j1VWYz)PT6Q@Jbf4VPaSgHaX)lA7C&zr*%;G!^zN}pcZZ3?QcL4$| z4;aIFnqJ;Xx7pl8KE8!Pak+`mTeal|(@Y1LRF@ZpU)kLHi7-C!nA+BpvsvW=bcGtj z!D@Ow7L{+y)`lX#SIrLFVR;WeHnV`Ar#9D?8_}E zFRZEYdAe)|{Fqs{K`;Sh2E^#E@t*>>4!fy57pZ`R_quM$3>hqw0A6>#ytu$@>&Y1Q5S`M>yfEJg3;Re$wYDqXu%B| zrzpI;m2nyU0k3O6+bD8tkAXwjO1;u|DB=`P^=Ob}Tm0%nh!t6RY&Ry&9(7d^*m~&( zi-6~gX_5H!^*^^=18;Y5t<~polj4wsQ_=wX%edSsV53;2Tc5u54qo4m;6%!WyxX-PaC@l|M-`RU3c{pNf+# zXM;9cPYG~6uZuFbDpzj>N=RphUssmo)5C5gOzG5LR}nigS2~}yP+oU(KHBDYXpMe{ zg(jEVt7~Xs2Mgm?@h^jo{fj*3t`E09La5KwX2xyZ$EG0jg-lgm3p&VE_hyIe>s|8s zB%JN{r7~)O9c#TikmcUwG%Ss(aP064-=F;;dHiz5L<|YYGfEo?E0uVyFIZ$z6C|;e zY1@bNvgq*O+eTlAss~cDfpxRe6c-O!G?in!Na#GtlYzZ&cwcMhvC>O;oH@(I^(~oG z@4wvrlCUCG&+8A{_xi+D%>U)_M*AOmo|GpKuUhxN|VB67#tR>@aK>yYr*)HK~7 z=3W&CTUXN3)4StQ$gr=Wz8DpD7?r>`QMs1!MAb8Tar)O#I|0Ps@hBc$T+#6>3+n7B z51UrHFoH&|S>8+domvwnS;}6y`9FYg6`JXfwCNE?v@m})%N69YAnqmEQt#H76H{ew z7JJwL*G5%M!DiKPEK?Xd7n)NGUy4pr?)Shnzsa$C5)TtSxjNU!ux|!N{%9Y!0F|6y zx9OnM1|dZAb*VVQI;iYAZpqK72-P(k?BWMA$eCNkm547XFE(&?4#dNXWCz*3+-get z(9^3QL~D4mwOsCc4V-XGSsy<2}=ulP`hcDp)3O4;T;AmB_j-DN`#X-xy$5&2VY zhkR*CazOcJ&Z4Yuyw_6wLfoUGN3th2WaKEZ%Dv7Oqd0WQ8#9&Be)OQ{aHTgM!u8fW zSyYC5z>nPvH9UyeBlm0c0^Q&8cr6SMpsr6VPhCw1pw8(HL1ynQz-dapsH)$D_0P7Na+agF9(Om+mo4yfmpEvoN$l;9ITUp0&_I8;TjW&nn|LaF5 zer1pdTzoi<_Znom;BopGT-K`lXf#SNklsALOU_RgWLO^VR(W32TYx@Q?B+g;Lrb59 z9H5bd_=blqJTcc18n}&m<%nEi0LC`&nDno3jb^Hf2)%$8p4WP@zM~<3&y1s$hNx2gBLk0z>O2z3aEfKPZg8 z@*B4`Hepe|qtv=VySx6!(f&nkL?Sj>oX$80FER1-Too5M;Ws2Kx1C>i zsevNgqM2t`h(icW`OOUnFZQRgp}3#q!I=@UH`69?YK+2cnDL#8{HO@Bdf|FV6uUv! zOo7GnK|O>iXTZ~)N@F;M6FDd2+F-LYKk$GT!%?O(E|NTA(jwnpuvB~IDM&lbxm0*Q zu`J?%)ZI^1K1s8V0>{&`EWT3)vIyEijL5hIZ8^X7`%|(AsS8)qsgi0+*WAx<7DRyz&N$j=2p;>&kcZ>!z)q5>NelU z7>dhNhsyk$Z5@XEh||8GNWkP&A7J?FB+0XFGyHRa;ZHklIs0$M`G-9Jkmn!n*(N;x zxm^Fqo_|C$$&37cGl1s$VtDoaw_X7MXt8gm!FLD#+b91&QSvuHd6$=$1bu;_kyf7R zRUwacRV^JIO3nsQ*%r(cCiNNd_QJwn23?g+GeC~BIc}?+xZP#{8%$5qko6?jgfB`w z8bHb9T~@MX+w2=hB7V(~z3v5IotuyCq@qUqnO9AQeQ7Cz`xd6Fnn7O8^X}?{`~JJ5 z1yh%8BiGLYcNq0o-C@b4cWVGC#g?-82Uhf7+sJ>%-bs#sv+?R}gK-?|KnLQ4e8ZnZ zJpZ{;SNtfeq#|*o@h`YIn{Z!U37i)|td3py89erXuw`SC+aA?;q6wWD zscYkrjcmCtQ_UKHFuZg>0!=r=cZdCd|7Z^F|9E)$a09gewGBbBNB4CW=#uz6jvi!Z2+hFP55@sz z-Pj~KqWV2*5=Jll-y$0mz$6iio~qeTlI(k=y-0|Qe!kA$H*2rLGnY}fgfrrf_IMJ zI-D5K(EF0$?Z5oN)mCMLg6hw>JfY;IcP_{eLb+=w!v2Hta2TY}%gN+F{VXl~)id>O z1P}s~&6X=W$#?oN{kG$W0iZ7(h}9A#|2O-YVg`w@xZLDy=*y~wz#q=#yNUfe{MWIb zlL3ENlaZoi>-x5Q>8W<*N@nAY6I`^!t(aAb*?$Xc47U8pry>BDa3!v)a%ME#gAia0)zU zV9f^CUOsFixq_NCx7pmgw>5xR4V-wjl@gUoP!6R&zt8+%hF_$(c5!dK;H>KCssIDS z-{Nhm#a+B!h|lib+|nlyj!EjPrrCPdk@8?Vz9?tWpOnyiWvtZXN=_KI#I}As`_39Z zFJWB{z@Rk0XMP~#y+mATTXrXk2Bcj=&5PQ%ocNDq@z$X%o4aa50rE}bvlZ}}+BF}x z1lRn(VZm{g5F$#D_|fL!)tDfgHT+x6Uxs*Ef*&r)O%zTxsPkM)Ms*CZJzJ1PJi(7`(K!@UK2_Ku zU{;|MUL3pL=Lr&PHv9Gu6372w;3%h5=uQ6Ad_62hYQC#trqL! z@ols=dtC$xZeQ4WqayFKsx6Y{EJx_72Fg3 zsAMAQ>(swdouNNAW5mAo*O3&E+z2)m-3BZAfrnB9q?VoqkC`*YWe?2zA970l+XXQPAn5fl<)4B6z6s*E zdoP1~la)xf{kaU-kj1mJ`rG(i8jQ~VbNtG;y*{KkbNm>qF)2d|;7_VThfr+Wu+mCU zm@-W+G44Czw=>XZWvN!VS+!Rrk*0bXte#&fntL0f&kkaqqSTeG%3%vD?V(n^a9-(y zJ?Xs8odDyE+T|bFdU~ps;Nt@2gyyZogC<}HBNGz#bIJxj*h?3*4{eF6_WqTMl*Ivc zroi5Q%X;@k%-5Udy+{uB9h6u=qJ#HYK)>8G=G!oquk?UyddAj0w|&LQly`(SzS!cz zGn?RS3GOnHF)@}$0$)ezQiF_Eb-Rkh!6U1)dy$?at#2H^s3tx&PWw#g75ci<=eKuA zf5%P#m$m~d<3g2#!69Wa%ro0L46Q)I*<3ID!#AwOx{0GsNsBZg_jl9M?P3mkl#<|j z8rQ(oSMBYCXW%OP#u!RLfNdu0lf@xf=Dh)BQ&h5+Nf7DptV_cRq|!MZ&h3Vasn$?P zLpEi7Krm?c^;FxiWlrC)%R#g%Vt%9ajm>;~qup2Q4Kzz*e11D=pLQFm;5JeQoLGCL zI(A!{#~#=*^%Me0m~h(I0|v_@=<52EgkzvH7kgt<(_Y^2a-#S%O zkk6x&8}6=iJ!Z8zI@77X_gawA%nE`O2O>pwBp|LwsEJ;X@#Zw}w33S#IFGQdDDNC2 zMvaMG1O=|3b`~U!jjEQ~)EqFqnE4`Ii^jfEGne(!7O$6!4w|BabYyv_hp_n9#=TyL z7*+YbUm}p4$J2CbS4d?krt;50h8`UddJ-ftyIpCfN$t{V6SX6v+2lfGb2NsN;da`8 zrCS=v&igP4evP{H9EbBDmX~Y?6?q!J0~LmTg;BuDQGss=se7ByEx<|itQdb_?OCCY z$CbArV|_bffo$1DxsD5{%WOc|bRbSX8$fVoR|v$SLn55^KK_*oTb+lzD{VuJRE;08ICv3Z9+vfrNKD8wmtHY@`iQRz4V1~?(UHZFk0t1 z4}qD!JT`hgu}@|9A_87@Yi!V>8va@Wl}c9PYuLu@JRz%MH6VaaO!?!nv`s(<`@+~L zk^;Gbf?LGH2g@yGySrRZ*T1NRxhNCvT{~=0fp~B74rLRYa2rSv8kQlnpmOKh{SE92 z$MK%hyPE5D@V8tu=3>&ufQh3;qx$>1H||H*hsp|^bkTFI-$ncAq!6l%`+@wCprdg8 z2nHH5L|U^*8#zb1V+fLTrgKKhXIN6+?)Ha#4IDR|(*ZELl8_DpwX z?r)iOWu56M;G97s1nDIl&u}Li`E??MQ;qNUZ1!a2ySr^69Tm>AyRXduF#?*w-wF;Nqb)+GLh zD%5QK5U(#81P-bV&=ZQo8FEFYGI}b~3N1$PIxd zd<9Pc)a&YuKH~(|Ggz95;zo^9;JN}8gE$z;Q1u@!Mv0pE9{r)3RGaLa=#O+smouB~BT`pX=O;ec06!f;>0 zkV2Qgo+Dxk19ji>^3q3F14K~Ct50pi)es(6OGkvBP2kmSy#M{NzZSFvQUWww1Cbu* zmWC{MD`2~GTkQ70zOX4o-X*E3af-5qScg73;wlr863C0@H~m8M9=3L^7*t{7kf1uj zYaH!jJNLEuB;eBV3>+qACXTSuyeQ-^qoaE!5gf4YMk0PpFk1J}I2QlK`82R*Rg5LP@Hrpp1kq4s3cso z5@ln+I}3<>?ijd^p>~B~Q{*(-7utFoK-qSF;WV4KJmtEVq`Xxh2vkTpdta+SvPm=9 zxHsrlN1HZ%Sfi5lJ9E6gf=%bE!$c|jWQz#}$i{ev-j{AC=>JDdw%i5vF;jwQc>$uO zJezgduzvDN&BHpLA+!tbRi_-V1MHw%@aUz}XX%@Vq?x#=YM`>f6!pqAta;OG{AsD@ zb7XD^WP)=o6|vy9aT5YmkC9pa{xY~EXeXY8>NJONm3y`G_iuG%7}Y?z0sV8TK07Y} z&t_D8CN)UaC%sbb?tgFrqx&SI0PF!^FHttHpRbpYE9Kr!GI{Bm#4?P!0FfX-yFdki zRPRg0&#wV!y-Ec}^Y|_%ho+ao{4J99N!KncVQklEZQ_30huySCEg)~IbF$rStHDUJ zBkcmY@6=(SQHSDs>Pgo z0q@m&-U1Fd?1=Ykoad8qT5AOYdCej2bHORd=32pq`UdUrP<-h8^ z#qcM;0_+^$UmXoazrnyixEq$H&g$CakV(M(R|=fLdY^EBAW^*<9Uv2V?BoDmOclU&aYp3 zn{w^{;p{!2;p)COU_=rnqLUy>Nc13*=q1sKUPBO~M<+Ui=rshXTs2X%l^*pyROIao-?Sk?b%7`OFpYt2 z0U7eIz8{=`t?WKYC-VrjH;cpGr9eGIXIjT9H|M{e=K~$_HvUlv)CjVGAt*~q;7|A$ zO*#i|ii@|nRB!h?P+$e;^5Z2_ZRm%m3Gt=Oz;{xHf>H6Rj}3`@0)BH{v&Xv!cFfWM zgd{nM)kK}XJ$`uWstcTgIzt(J`c)9hyIRD>E=x5twDTCGB^Dr|=Sbq-4%M#Wb2*X` zp?>|`1NtNoXc3eGlBN@0zWURYJ&qxz=}7oXN_D`FM9lh~Xla3_SPzwfVA_KhDA10P zvBq@|2IAn7Q-aVEn$z53Af>n6iM9BYtX(K)wFvFKSPD!Q-o<;tnZcbLm|_bHLp}u) zJ58IR_LEP#$oBte{~iFuk9b~x=FUIm^okcO+ANvoNXQO8panfrP>(f79+)@}@w|ZG zYp?7vkg*=&=24uo{qkB%?1=ZJ0nt)s@T;k^}-7F-eXMJpBX~n7N00 zzjDxC0R7O-;szxBSd`_B1N+lS!-n*N3hrFZulq;!Va+|X6tG99U77qUU3b2NM_pek z3WOulGrt(I-??tICZw^I_J5hNxb{fxmXAGQDg7$*QvfA@Y^?IQ0ffR%X{_Mr!A<;X zpmHOU;ug2sXCM^sZFMMc6(tgf!4Yr^So9l$z!D5GyA78IF2_;W-s$P-VdYfN-Os@= zqM^-DzwF?z)C}iy33$6=x1#XQA9=b6dK!x}#lj>Q{P-eVY6m%9YO+WqDn-a*%9s{F5OM;#rVv@>es=2y=W&P05W#Sn1l?TACd<~tR4*v{JU zE||KIoheQ_aTyst#EjR1CMW_Fs5p9Wd34d3p&~lNH6{_)K=vAX#L=0X9GnSYSY0k= z8XRFy6f$vSpM(WUE9C|Wt>>3$<}n7PuF~1I|4v;22};vF`Q_+4%k~wKZ2!wuR(csRtq+}O|Z-QY6!U6tnZ=!TA+5oo+u>NF#ii~+b`j^ ziH60LmLpqh@DOvcO`980w)SHoIHyhf32b{Ac80kKJ2|RIz=bS~9uMf13g<(SHnX4Y zGyRL79;Ped z5OIae);7>0=09xg)@ZdkmR=l(Al?wUEE;`gIWJXI=9W zaXI-F)j5;3t|tw!V{Mq&miWg2bO7uxfC4`2fP{dBOODl`XA0R$E z8t*%yvKO{@Y`*b=!3vdBjFB!8?~tSpl;1mZXV@EX%Y(JMQ9F1;F47)q$e% z(~})F53gflyX_?o26z1;pcx>1>RayR`omg(Stk@w0)XlU6OnNmEHL^J@^#((Vjes^ zn6bb?gtO8r)nqZp4|CMwcx%}ABmC#-f`R$T2~Yi+b~R&XPmeF+h~)yLP#@w=FlIu* z14}mb<_ZezYai77xZbc@@U@I8(?Pu1Dum}jm+xAK5%+x(| z*yRcJjk7q?8@7YZ4I@aj3iYLU%)iG8oV2zyWJtI8aMZ4g#dX!5v4r{v92JM=V@RBD zpE4Gl&RBMH8Tv-fM{XYCBg}Yl7bxn9%}-{*7G`$0^F_CX3&Rawq})b*3e`uU*-;IIyjoK{QzA#ZK5XFAGLN|wphqpA>!#_N^Sa;>lnEaahaO)w0_)KDJ zv1gnlv^nTPi@Esa=)>L4{?MG69{6#r?(3dxou-|7o5?Jru)7aA&Fe#Lmo{+=7ASZT z?pKg;ER&F$wGVF3q1RHq$M+`SD(b3r)Q}4hK&yBR#|DvBTtSU^WfO109g0)yt@GN0tBw^mF#@An0b?ktslOzcnJA`q9BPDiG2l^oXAZrP1fKFF7q8-19rzuzVx zoq31H-jN|7XlIjMH-BA}k5@%-;uf0|Qv&x}b?Ls`wzYvDA>)k}aSv(uMf-HN#@*qv z1_ue!%t+)oNXX-;K|3dhHdebQ1^smV4|X=}$Gxeqpt&Pm9`4%cf}FFe6Arh2zw^iY zmw!=dkyO0tLY%jWM4L97Jjz_0VqWM_(FLJB0b{pFicc&XT%1)85>^khG7sg(DmnP!sYp8PnaAVe#i!>(O8UqNvQ6xUcM9l`uX!93CR@L zP;Tn*l#A+=2Im3sc0_ly;|Ou;=O8sB*wVL~+e8*qYu~wE@4Weja@D9+Y@@$)c!1R) zQio`m_vDn(R)(qM_MKs!Zv_I1dR4b*>FNDr%O#vc!pp`LLwjFi+bej!&~j9?SQPuZ zeB7pZjhRQ*7*f|~f2ix{-S|=`psv)sI^^%PT}oLZ={402rM)(8Pm+g4 zwLF>QT-SSEtn^s=WoDT`l;qe-pK6%j=HCdh7Pi zQJX=Hgmnwqp1oF__UEz3n8C*e)lNx#h)_}qLdKW(=F~XrZSZ*JdTZ`feV(s5TVNdc z;;8tTR~n6bG&Zo8Ii4dy*UQLf^7=cU?o4wi zY0E(+9Zz!i9&-7@!8baxBb#qbdq`1J1=SLy9A>@AE_+RjpC@aKuSag$m#AuOhzSHy zq)UBJ{?s&i#~)4_<60ccVZ$)r@ln-);%JXkcgv5~Fy41#qO>K_$-#-g1wOH8Hf!O@ z6i>nS6Q4o-k+ht7X9HZyY1eH~$k!r%pCs>ju&Uu;YhRUv$UKdet>QM8_m8A(i0zBJ4lAyOU-y?|Qyt z0LM0(TgZ!Q#BOVA8_3;rwS7A;+4xo^H`$V_T0TnFbhyep@Z)#i*+n4U<8cat+PJ2u z5XH@~Zm7`ddd^vIoYyH3@zCljfVNNw+D20J5I9B?C4|a3FEms~DvJ$`dM9pkE&MR` z6SJKR6?~6l`NoanW<4%Zq3rR4;<_=#;mUhtqh+p{jC-2{H$x0{x(v?A=}=kPksp!u zAVwYfF2QMXz}VLvl8>Z{c~UX2M?xlvmdUfVj~DM^AI#=E+ozy9}%CVHOl0- zbeoLoPAuf}-k4+`#HMM`^%CuWEj$imRDE!JZ_6;Lf8q%K#zL`YT{aFdO+(rd_~WBa zk}P4F(m6yXT&4-$c_l`ZUToU(^OA%m@+B_@PAWfY4L2EI(M)oQAcv(D2k9pJ*}Z-s zHm0A+OzMV%ri{|;ZH6ZHtdzEEb#3S{ht~|$T$DQQs#Ez{#Vhx{DM;)qKHN#XiEaEr zeLM7YR`G48Bms&zd5=T?5Z2yGA8A3YpuYE2Cc6O3@U!BKGjVTBVqKOZ!D7RW;id00 z)Ydo1_T~+hvh~m%Lp$DF)TP?a)L(swA;#%Z#!U7EL+sj(^Pp7akCP5*G>^KkL^#a3 zxX2iL`a23qA_}hBF&>gJ|>WbqGyVyr|!KS2!o)IF3uK zdc|r6Qkzz)u8tfxH==9j$lFg1s_Ze6%OY~))yQ;^%ZH9~$VKHZIOb|I{Xf7`jC6_) zmTAe8A0%*R53ckd@Ts3|s6W1e4dB8Cf(wKcaeoN&Y65W(-k;ELDgzJ!PTg|l>HmO* zAmt$%aBR7<6Y3-6=c8gu1?z9WSa+!8rj#Q{UuC6S#rTn_ohhr*@5W_)<7~I%`Qx9B zua!CLdk!6&O^;oK$L^NJSbFsv5$6zEU2Q2oahssaR!gql-SK2$IUOSuaM>AT&6cmp zW||w>x>!nXsge-5n2|0U>nBNaS>V#eq*PzbvlQ;|XKu1}-M?y9l*as#_$w^>k#bE> zChbFFezvft2kmYC)we4|;%;W&66<=u-e#VfuW8r3jeE^Qj^@?N5g$t$0_R?vgh>)u zB&`Xvx68>HjqV%rpFbf*tLyZ_ZD;4xyijA6DphYH9dmdcH%l@#;O=u{r2sYS1E)^8 zQdT(k8){AGYVofJKb89n-&&qzlRt700tn&sHd0Qtc zn+Nsu&}pK`bzWc9TqF{WR>TB9$+m!QSb0K8v-M9eDzaV}J{fQov8VmEp=hOu>ces& z8y$Vld-p`71q_dA7~TuOZ(Oi0(~_{CJMWS60t@d(zqNP}xY(5@bbX(b<<`Al!3q-E zVFHpDwVPPTbrNZ(i=J&Y+}OOUQYAwsNKV{n9v&ob6Ii zzw{1O1^D^9hyGjV#zbme~zkKUn^lEI*dp$*^x_@(m?R7fWW5q?Z=s7d1mIcWy zjjT5Dm*}tBY4VdN?aX)3&P`ElqEC)|N+cuZ^klZ#axk`?6NNoh&QXf$4GU72MOJ5Up9hPmi)+toY9&0gI&Ov(OU*$oVxnwR1^UMKo0r1Aa)>8C-~`( zBut$+6XP#7+uht(U)fL3zn;4oRB;7`|Niv;=~T<$TO~3t>U}S2td-%^WD3~lhuX#F z?|5G=_NAjfz6ph)2WUW~#cs!my0S^O8y6g%Y@$7BF9je#BSVO|WeY~{RXuf?!F8jn_q27cvH zP*A`tHJyq8k18d+on(3Ru(av`d6`4Ki}UTuqoR8^^X7I#?bq(5IutWoSO$lLsC=La z*dF%3x&XMRc;mUeSh~r%JWDST7VwPFFA*Fku7ZrJXRn#YUOUWs6)4N2Csn9bJ6JiQ z@EVR3z2SJfvG>JT>uY`3&yg5@)G$gMUDP1Vahwn@wd)3on&r*f^F?D;YK;4v<(42^ zH&4e#tTN^_z1Cv4sxr6Bhru}piVo|(39VFo?&1J^w(WRcu--uJ+4ZG1!^GhiWR(tE zcuk3XIUy1*CMrVLxwEd7q$8#3DY@YX+!e=1?b2B-WfLg;gY!B(@jh zVbAz!UHVUM3K&0rRk^o2Yw zysrY+cD`L7A%J%8PXn!hKzbN=4*4(7{X5*F#5uim;bOpr_kcV>J#Knzlo0m(Oou6w z2y<@gM`R4|Y0+J>8T>X{*g>#UfJ0L4MlUl5Lio-&f>DakYMX%X&~hwmmW&O;5w%b5 z)f^73tg+>1-zVEw(V&1h;ifH8>d>NApJbM-s;}%ZHk~ei?v@!N; zdi4@CS2kN#<%(>Vj355~{=0i4=#TamV`A2+Konoch1|K3z%GpbOZqrWK;r08iGqB8 zdhx$bDBU4-xQ58{Hd~XJ23{*YpHHhqNj{GdyZgIre0Mnj!>Db8kF5cgX=`WL{asiV zY2^s<;#=11FUhv(rw>ZMY7l`^!tUBmxYPC=H&u#5R?qnEc)W20t-X0n?E#}jU$eAE z8UmCK1Yn5@iVANB4FajvbubV?K|v9jp9MyW_#)}#Uw%xyaz%jL#ECn(z?*uke>GC_ z=VWMRd(YZ*b+Y zQkki7OMRHP4JyWt85$!t(=!CXTK zt~yB|rQn`S^9G1{=@%Z_7_Jffkx{;S=dQ8iTx`MCY(js%Y((M>Q-jQ{dfXbzAMKHh z5%1rRI(=KUILI^`w_o`_~uWR!a?`# z6jT7`(1At-kQ-G>_7nMknYJMKC+EA3q53C*WQiN2(s}XL$H^o!-%=;1+aw(3?pf6B zdKWX0`3DAOZnOj|aYTL5$L7ENK0%&Sp;F;$Eb9WJV<>TebIpiva}e2s26S}vf$X(+ zeLb+C+3Qm@?LA-S0*Dz!W%-A^*Ntt6MMOl}a$N$PY(C&m)BqFYsJKbSBupQ8{=O%M zbLI`bF1=PR-F$nbRI{-+wdspA+pO@1{15mO_kWJko;`k}q{^IO)ZY=e3>}ZlOsL&p`eGfc&ec^P+f^-% z@{Lc4HQFEUb}Txjb@7eNqG5_{FLVhN!(xQldV9azAWs@0A>y%M3Yq9zx=+G8tr?Sa zQD_u#XBcjtFb0;RYR@IiZf%OOVa#gp-BTf>UJ96FJiZ!G4s6fszyKFfS=8gYk#Q$TjAX0 zXrTI3)2d@=&Eyv3#=)<_?YnV)M`VJ9z(LcfIic+Rp%VZ2>w$y^y!UOFa-uR!f>v2Y z*eym5QEM#6euhA?kz>FcOmt@RQB5k6^K999Q8S?(?Z@H9$Xu{vh#ejk!xF{4G1ASR zX~K2z2fx;aSsdCou1M?!kMgg~c2|3J;nT}_3EYkFYhVsQ~Ncsdp@~5y-+@dkl`aX0j6VR|9_3z!k zuW)jmd@$jr#eK5n$<^CVpM-e!j+k(ItNhT;BR(!b;rxB+GZFN5MlWh^GLVeYxO=Z{ zy5UZc!3eEgPpXCUG@ht>>WLl7=a~?aoG(-AQql3qMhOhm7jGK1u!~rJrrEHCIVo*bEx&spB>(gFLUa zQHtKKDCZZWDO=?MW3ttXm-^LTZRwwudCzq|$<=>MTgZJe{bdFsP-H=Xw-J*fyn5-l z8NNo~gzAZ*9k@!@)3>DDob=`iwKbGf?%S*hh^l|Lr-RX>?b^ z75UJxB$#ArejYu=9oRYV9Ok$Q~Y=L8?8tgwZ@@NE)q2KRJ zoKg+s+IUQS9!`HIYJZ&wB0&uEjaon=OXdZ|sYE)Ib$$!sNZVdeVsD{MERMt@ia)F$ z1qPsdFmd|>{r&r*uGLmg<1KCxS97h;Hc1U+xYF)tcUMT*Lf&Y5zGKC;$%dZF!w1F{ zTYHN;dSxh!In~i-C4bV{_^4f3sYD#tWN6opL5a1i9X+Xe>ik^HcJ^jBK!!BEHoQlB zEmn6j*;c&`_|CPWx6Dm>8t||o|4O0YmBB`bKDkN1j3A+S8OCR9Aq{U$w57Cfo(R*+ zXsuz0m3T(}_@QUgoAIt2PZD7Ek}8{p+>V8nc1B4&*&M&ShvLOBu&2RCMv5WDy5O zd+;}dB|q8R#CC>e(Ju0*E%Zgp^~Z0<0V=e*)z)@htRx}h=fQ__=~G^ib7Dk^MmT$8#r%o^Dd~W&;6+S&N_zZnGUyJ26e*}2 zDAJg^BVMRczr*&40);7HJ3@@^(nP5)*Lv- zUcioj*4e-1O;aVH0A z&iLh9N(<^_`g;hPd{o@0@_mp5gAJ`0imK#p@l zpyg%)#9zU7ac8KJcA-k2kmZ?O6LSMQZFH8srXK-Hx8O^FsY zJax7Wu~stQ0rffG%$80DbmJc1W&BSK;(vhP;cr2nsAj0oaj%iu&Y!BL9Lf|!@0@Wd z=UBgu8eAEh6X6Oi`|zX#g?S?WZmnw3)tTIQ+SS{&c%}|c`{!4Dm;B9Zo-fXf@tP06 zOWJE5-;fGxHGC(KMoK!+&(Hq>w!96`0^~-_EG{w#D}$i0@{o$-x8J}ARVU9Z4mn~- zU;lNW;XoxR5BoPd<7$ljHK%#}EXy){92q)W4YKggl-dG#ng+o^q=VkX5(`v^+%9s# zoBc}RBJ9F_I1!^bkUcS;jM3q@4D_`Q&pYEY8s6(G{$q0HL;<0$j;L>)%?QJZ69%$Op{Sph`!hN^#I! zZ21m$=`2J&90q|JLQ=BuQzAeY>*7Yd)58hnbob4TLI?HHo^}Nm)%C-z3tL@FSryk{ zV`h#{q59TVai>}_4wK=sVDtR$w$borVrn>5qD5S#wSLEU8Y(>1_?RYKz#|`$lJ}$+ zTc7Mxe4mhpa zmD@%!dV(QR9fv9%gcu_aZ zIbmjCXC}$@M}R}4V$CzEM2=G}#bR#FN|zUEM+VEI4~mN2+v#SCr|K4!g?~)wbrZC_x3732OJF8fR1ahrdkl zFiuboO)RB}-oJ9^M`Y%M`}eiNRyHDj=*=pA@%)zT*6oCRTGw+M*|2i!+#`t{rQ3S$ z?23RPYW#fj$#u7GG|rCT1MJgyT+1lZjiiIqp!zU*p_93TO04*ARfS#kc&QFvBKKKp z_oIS`sOX_~{9M_&!fy^^zr zPJY=Fb>B2dd^lAQK~$XKDuzz{pf8f~W4b%dEp?xxz=Il`8*><E)>Sh0Z-%ej>KQ z5EQohgKUm_<83GQ7elmO@%^9)NnE2XwDW_RT*G%U+N^+U=@l`DK8Yp^Tr1DU@GEjy z<=f9m#r)U)8nod@NW2(?^pb=On$m1+l}nw=9|-LCnKUbKWc^k1N6bPQm*oWv)xP}} zBE=yW^)wU5)L*~xuZcVM^ne|({L7@L{N*0(BgAE;vtcY^A<0Q@F~+HH#X;c+2_;zy z)X@203wl+QOoB8tFVoT*8$TJ{T40&77b*;ePnF-`f(kj5CFr2aFa?XI(CflU3Cle? zoHM6vqCQ0U7L(sJa09bi)%bA@@(kr@kR6+{hQcSf2YOymy!&gI#Zr_&jE>t2sVPlT za``VSmq6ecVY#I%hb|^3@U!9;+&p9 zkSwUp+8d)(w2+!tNB~u}sfwm>FhJ||GkkJhi%<85^fKSYPyjD@OjHRiK^-$BJX+Gu zIhOL9dp1KYf78;RcxV_i;u)zHYEK=njRIo#HSxWXke->yN=QDXx$g-u@ z!_B>7A*m#y9cMmlFX-bS83I~aP0K1^*^Kiql>EANe$^XLB1C`aFJz~GKP)BdK(90Z zl60oX!sk=9k#70P;ATLid*MLn=p`>C^m+fYi5(b@0Z8sHZG{!QxaQ-`DL|MKHoc(< z3l#HALNi&y0<3FIvJX^CqnzdkFD4CxXn*Bo?r^9w%F^d>^B3CxdjF4>A2ukydV7_Ll97f&gg}OYe5v&P#MTw15j^kM5EJm z#B&ywyH`vu9kVE)IfI39_M-riH5HEelHX4ZrG=j?G3d|h06LNtj@_aq5(frf!0mkl5PDJrH(3|xn}E>w4PZaL-X5e_{l|r0 z1q1G5h|^Kh+uKZ54>T8n&v-zIWZky?$?`4O7bCk4qZwX%=kd~+Sae@;5b42dJVr&F!T%mIsg|4Tyc@Mi}2!H&(SH@ zj5;MzSwpE|?*kw&Ia)9Rxs7kRtD##QZ}=-PFNby4eTzfxN5fntPOz7lfHfl}IeJp< zuBsHcD6ugJWxyqVLRL)9l6DEn;D=t_2hkMk!OfLxf0OX7liXi0lxC6Vy`NTkg zk8hXao%h=J4WSaqa(E%8ocBc8m=F+fs8B{iiSrUta8;O>f*BNki7-F--$B&2k^peQj=D|jsL#xpC>w^z{Xze9B7xAZcVVhNq6r0 zR$ulz^x>p(_co*5^%P)fMoe!|58!}78RFF)#<8DF8s|`vSV^)v>L~v)04;o046&O(Cq>xrhwfEX$4B8}j&tR;^lE`G z%7N>z$t}}wtN=9SF>k$`kU4~=Pi8h5DN@2VR~26eQj)XbJsp9vCIcm$>(C`UXu%3h zpCCQ{jV9VqDO{CC{=ZDzixoN5^2e;V!?D3(9gcYzEGNX<>|(pQ|Iz{&KxnFQk1%$b z_1wn*o;(D8eFm^g7KaB#EE>RRu^3;oe*r=(`wLW|HDGK$T7q|=FH*7tlwoIodgB+U zctNHIv{laH9}xG)05_??5WE7jaiAx{sx&$reAwF-^$+Ja5Gp_gPj>+*vydHgAo{fm6;RKb{ZWeT ze=GtTI*LJk*a$nV@$5(sJv|#6%@|Irq^=In``s;5=<}P;kub*-N4*;E1i@#%2O5E< zO~8(T5rx#Oj6Zq$XjUUJS&gKTI(g*H`ta=?XQ&GmnmNb`{z89f>7Yg_^lrDOdH)6k zAh)^#)J`wzmmWw7x}s=U&Jbv1ydW6E%w)$cSi@IXFE@DS`#k^& zwkO>bkA00ADI$dCZsUY{iGt?isA$B=hbM`bIy(f`;rF6|brCGY2W5g0XS6*iV*mFc zfU`+M#%1>dNjibG5Bo9NniznAk`wGw0B~s9kS-u<=c9B^u{O>{R>2gWeMD+Td|%@! ze{-|fZ`@0$zy;u9LC-`k+roi)pUCLt8t_4DVCWnFOBHZTp*1KYf9m=lYe0#F%8M>m z!C;elA^x?@3_~!_^B~MoYAB<6-aLaheMMnCC2~1LSIRc>%&K#-iuIROdr)nPmlNA! zYZc}&-P7chQPn-@o5zo%qp~Ys=STS_4XnoU0Ndo!LNP#^hJpUF6t!OZkwUS`ovNA_ zj0}op)nzeHX9V1SqII1+;+@gvCr<-__13b^42ed3Z6Hj)RH_0tLi@`Zz$!6YLrpc36se9*mQSb}#sElNYEl4Q8cu8#g6p!ou?Rg$y*_QzBHxS@+; z-j0X$dj@*X`57E{-YA_mFZ$g*R1C1p%EAdr3#-$HGz`rIWt7=e3fUhgOiu4c!sIS< z!to-eq(t?t0kd}c$cDo>MJJLq5CWo!0bFS)P{mX+7CB;kM5Mw|kQ)7rkp7{)&S+~y z$08luI?}!Pk>|uW^FAHc!1YaBI0Hm0!V30Dg+&60ItHd*`Hz%2UXdmfc&L{BI*S}9 zRIQ%ii$6fd(R`sMNJ8$c@D?dxhL^{T5Rl#GvQ!D`e_&Geec&8_juv@m59Q`DTFj2j z*lxpLS5;VI6XaV_MAq(H33#CPq$VrNSQSmIzGk(TAJ`)+)hkDxIOg}lB8uBh{kGPl zNZjRbRHAXvx(r^OVs*I*e(B91S43K+I5Vb6#~>RkM`IJ%2czD> z+T!6_?t8&q{uZw(pF&7=_NHP5m}jMahw7(H=bC4Z+dt-C$yIuJNj;KLBL&7PCpXw3 zsSn78XY{*$uiPk{TzyC`L$@g4m()o%p>xRcjUdbaWz7F$`AImy7rGrTzy`Kv4C%Db zQB009WymrqT5c#d%&gPfh`|_|RYYw;bLpL%e`rZ7`Uu!-=NEw6oSs5ww`Rm$yZesP zLeoJ7d(OgPpHUs4&--G~rG|BO{=iX+g2Az4b@Y)i3yFlZH14uUJg*T|OgjaIsOs$- z*6}>fK15v!Pq(ZLi|KhDnO{$JpotKnmMqX93?<0z>wATs>Bn@p3$Oc|trTa6H1iBy zPyL`Pa4}zdZpmIwr5rNMCprqVFVyBFeu2(!p+hfmN}$+l=G|1<>dND^ z1$+B}LC3Z1^b*_N0wCZU5fy#q%8Vt_<84fuh;>&t&c?lr6PeGLZO(ge3RP zGvH{iRivc}a}ztqcDE!If9SFvdxaP3_0C8bc|(Hti{7$iKvo}D1D=d9>edDNp1qUG ze0GFzM7(84w^@v^;gBmc(~MUlVN_6*S0eV#$@f+Efm@J7IzilPA$s+9n2Qq&!R&9P z1A6!Oqb?J2HK*=h*B#wWG-0XhFF**Cdd1m(WwxH)QaP?yX-U22)%{dgoDjW2_e-?% zOmhF=y@p0l9wXzsxQBM`ng=9v3pthEZkmW^l?z5;_nIv8rp0ZqOqVU79tH6cF3sXy8MEi?9 z5F<#x)4N7br4U_=yYqHSEI{-Nekh%O;>#oSgqK{xfX%xLe2S)5U;vk`^SZ1Lm2JebZ3B>djjNuXZ zq>J^1Ta&y#%n~3XG6<&@aV!BCWg0n1pXJ;t`?~D$x&Do_hJl1y? zAq3VOsUr3y{{^nyY?viMFkQ`(kHe4p8A4mrbIkhVR^)lMisNWt$o$s=W+53;)`dB(I5NN^5u?gv~Z{Qvan9&-1lB{=KXvK-#NUHP8=CL=@BFEkYjFs3xeA5Pj( zrC#qal&n)j#L4dp}g5y<&qbp|oDFwAL0$5UFkP;+_pPB^lI0dkGNLs4k_22`)1PYv=n! zlC>@m97tCcx>(PvP>GtLI6&|gln9)3KgJM?pgnvhsE}=?&Ct6*pt8~6u8j+>9C@>%E97_3}~%*0#E>*XG>fLlm<2eV;pFxQs~x#Ok~mJoBZzH z6;UWU6H&YI<65|&Wa8*2{>d?K80Z@%c$QKrY5Be4M zB?`9uCgV;0Qk2tQ%sSl2>m(#Wo;RFfVTt&zWdHh-^OB@q*rOspocH3OQ5}`H*n>B(XWTwRR6^7&z2X5rtHTM&(cvy=Q zV#%ex)f)EB*|?{>i)_tCwan$JQ`InIL`$P}PQUNGaIar|Cmp#&N;LuLi-emZQ<4($ zM|-ol^kg&f)y&PsJf$Xd32NtIi>NwwEk6f_{&RZjr!`1hjl*8QG87H7H*2!mgRAznO1TaL(h<7*Ub5{8Fd+ z+XgSnoYGcZJbQI;mPe-cI1oglMib^96K zUWQO;0Z5v#h(ZV8mHq^8bG2&U<2}%{RpZ(DY3?Ux{l!Q)d7?ssG22eM`QS4quKu#z zfEfXWe24;ds<#Y{0)}|nJZ|7@7~h8b1FoaW8p($lkpuK;BZj zp~yH_G^$vP_nshs)T14-Q~KhG5Luvzg0~Wl<|D9DOn2$SzQkqU?~?D=spPuqIiB&4!U+M%axAaMPZ0z%1dg82S z?E=quzr=ur3;*!JXrp_r#CVcH$LvS^efUQ86q=ai#~eZZ_E-vnFdhqjV=M4jYc%{# zZwJ(rupoQTBlEG)T_bR1;`{sUc@|1@VY!!jj@-8fy&ech;CSLvk?TlNGm(eg#S?jy z@{+w>!6mEhqj8I$Nkn+WCt>fk!EQM1VJ%Tv0W!%YM^^>~ahSw-zhibe{AumxWgc?R zs>IKr=jo3~{_lU?15x9FeX74Dop>g#QQD)_fZuYnKVvV)c&BPGW_>icu(&WUB4HB6 z-rt8sK5KkRC0wK88K*8XUihUIe#fzVt#i`&#lzNQuke#`>Nw#yKym#Fq-VsSpzdTK zZfhi$NFBLt5S!&wwZ1v4RE9r3+#`5M)JvSk=Yc}-4=yE2@QnJnhzMcWMd|zfpA*?_ zs~QCy^jrF8s-(pvd?4ASUJmwG2e!r0XUUf^Rxu|8e-VVaMd}=@f-%$T|5~gwaQkU)j3o^> zx6d{)lU~-Y9+f#4MUoCy6QUkBKaFD+*H5(bD+kQO(>C?+rgEhTRtzQmU6wn36$vt8 zO6f{lo?>WQ;s#*ffC%+V@t@7;wx%<07O-!ms(}K)XZBtK$m%xnp@u}R<&)T?DvZ!e zGX>Ky1zkMh%y()2CmDpMNIQ)=gQl2mulU+zq~i8`*GB{a38uJA!f9x?zx2IR3X2Cb zj22$4-CQq5RN9|lh-dQ`1z8gpWKEP=g1QO{4b3GR`-y70xqg4XpU0@jYuqyfKpN^l zAg#O^;oQN3DWFEA5pm0cEjd_EN;fe>sojLS#=jJo3M7jX;hte8^nrBP36ZivJfu=! zFH(xlqRjYbkD4?<+T9hALc{!AuFl{G=QC9+eko0gHiIS*-$Y%bRb+m&o0EKHc_d88 zq-I8f`aPp6xrwa?d$z(H$?dRby|%2gMBFl^^miFV4c`i@lljX{y`7JZ`H?=iYJ_Nv zim~u|abw{?XDHd|lDj?h0NvXs@w={F*ppsjzf95n9*8y6>b)*I0RA0nOre6EJvx$2 zk`YmX2aioOHx!L(C+Je+3#+E8Np#zOe0BK(A!Wq@H*^cT} z7sq-oku*6IrH9P56IbU7;M_Ppm#c~dHhP|#Y3ivXspFG{?#^%Mq>I2XX8c&&KA}qI zFV}}Dl|8xJY*`EVSrhA&LQd=O{Ny77A!5DSv_|1rfj0~ZMAtUUw`Rd#4a-%^Zj`TCTskfUIt_dM1?*iXt&+hI!^H83r05Vxm3EdF87!91L{ zJ??!Cj=FN3Hy+wr*i$MpdbvWJNP2rh5wR9I)1UO*6vSd5@gKBdF?3fAa8!bB1G4|G-3F&? z#QcCl%!Fxao~dUmtdTed!eYxE6zS>fRE#C$|hJM=gp>hwq~= z9pY;kAU#=~tieboQT`;HA>Y(EO|nsvA*xDs0d772&`kXV+e`~SCgj+i+6CyBu4K_X zrzi{o*KN)_T+u4p-GH{ZXZkem^H1f-r6Hd66clfaHtzdrL@Ao`_PySER6Yt`)Uz-I z*xbkUI&mWhCR@UC-HTeCgll}GxtvS;BEM~v&ui$NyFFxY7H8V@8w`5kn5*yZ%b5y$ zBw?xDm-yC$8W2pkS&ZC4Lw^_}ScDsie+25_X>wsHO38hL1o$5UyW{yKtPFelyfL?Q z-!&4FPA+OG4D{UA*!;iRivGtIr*^=`fehK>=0$kVi$@Bj2FwhaWhnE+akksUbZJ^P z^W6z%^RAVJd5MKiS@^L%?5hl8I7q&7fmjv2_ zrNY8y_2lr&?Kj9xtjC#S)=kGtL$?=uWE0lmq32qacl%w-?=mRmic7~nNxg<;p5p0^ z(Kp1bVYI9*Wwe(KpLC*W2L<6m@w#B|wI3Z@167+!fsfJ7^tkj-yCNBh*QQ`<7|aZj z<*-@(P_3R`jkBo_^-VnHW&{LxHdc=s?FD3_<|Ze&inGKH@}KrL|74g6<=$~gZ_;F5 zZjK|74<>oM)YyjqY^f@7;f&i?CW${mlkoqc?5*RX`nLXY13!W&9ZDZM1zPDz>3lh(x)Gwy2dhm++nEvG>RQKNTYA@e_Pm~H zMb}qJx_B!+Q~^H|yGwq(o#dLH(dTg)RgwU~;78HCs_k9j>LNy>(yHlw)pkgN=~^>p z0LL4vW*@Nu#r2Wt%(=E7^|;A>c}}0%Tp2|Cg`ki}%VI#FDa&%g0PJG>PPWc*h2k(9 zSA<^W(`n}Hi+I&gTr0-9%y#0CFbWx&VeW`7PCJ-k&YO`JJ&0xhiqZP6LHWnlCBmk@ z^wqTYm+v_(%_NsVf%aGr>6PrwqqCiXwgt{RRaNWDdC`@&JGuv=hSfsq!sC#!?@p56 zSpj#`E#k=+U+9;rzfSlvjKm3m)^AT0@O;hG3p+ogxoDcPJ3WGbC5qUWV*vb2BG9H& z_ediNkHKAz1>8;ZQxN5r!!PrcSRMKOfB)YtgJB^jLi-g1JzUIZ2`XiDw|&QT60&eW zd>rFT-v>oFjpc#duO5G5GHduCP}po;SiNKKJ*zWa>YF#&7hkQDIUUW(u2p6!(DT8* z?Jus9XiS4GX<2(DJ|)lVJp=J~3w!YH@_fw#CH)4M9N@r?q4h|JDF-6Fed873kko!n zAurfhv1n$tD7b%rcfKk*)%%iI#Qm3~43jtDQ~NSsfuLBvhK*mD*%DT_?Yx&rJI3~w z;(3PJL%mB?r&(U5iFft-)w}HNnGS?m11SMR*@~R+dRH}`mK()`{A@1)FEIlyhPr&% zx_@kKw=`GGhYtqPKZyznx;Y%i!^|AO;w>6653QjuqbI;|B)JaYsyT!i1wZRAj>hVL(4uZ(zKifwF&bE5=3!(IMTw&!W zWi^>{1+I&~{xZ~OnxhSSCkrMmP_fJ;GQ?A0Bp%)b3aZjG$07kd{OG<)vHWhORco-K z^BLd+NC z(^*<(*HBvSga`38U%Ee9a`bj~zWd~I{k|cGdM$vBP(v*2>_QYBuR-R#*UtX8e9He) ze0!(|0gR+FK2*-|!4zC@m>+R~di#a%*BctT?9cJFut19GqF?Tf5-*s+V%v#ZfTX$j z!J{&Lt?XAix=pSh`&@yNw8J*r0@E`+p~FEDhgRE-r;ci)AuGM>2&kr-x3}1soqYyb z^giA)W&3q@7pt+)IXHSYw}%0Abr$iS8h>UDiIKT&F1A@A|JTJOb50l>h`(Uv8@OA$ zn*TagtJPT(a6`Pz=nRXGT|Dp|@7t)f+0x|Dt4=PJbfnZMFnBqiB;azV=}^_~A{IXV7z|xpUMHSYw>ew?r}>Jee316^{_rego0i zudDf}xn4ay|0?35c4BFvsQATP?_~lGy1JxvHo1Q6L~C889nzJ5n-j*m5LC1BQfQI8 z?)xey07m%joYII4%yB;rWW{AMvQG?6#S9Nm2i3GjRwS_w4c+1uvSk38S`b-cQdBVE za*Ek9TAwzaD&OZvqq!^l#f-oiBCg+j9eEdpDi2{-4w}itoI=E|<_5Vs!{J*65{ZmdO z9>7D4ARpd!-!!iZhq36lQif`qaT9rM+&(d10}7xN)#xS$%Wn&D(T%6)Nyn`UB|qnz zymGsN&H*^KPzV^Pj8k#OTzcedWQ44&Ilh420ngJv4odZ`r)Fj`_~weNB+gm48y>4N z%91}`gK#cCXFpo&&)U^b8=V7Rg#|%4v)YpqRgSnR+Nj_`Dx&S9_~fUU7eY~J&Yf&r z#)}-U_|_tkqv!8L-S*;_F0;d_bA4tSvetF=6jBKf8iVwc;`;ge$tx`uZhx=`>K6pJ z=$e{P;_C3BodlAs?CjxBP_3U)2y=WZyz`SI+rj2E_9h*F@|GY02x^=$*S<(;nr%TD zJJ;KMd~XhL?M9b5)wvcQ>(f>QA4(-t=JAc60-FV2@W6M-xVW_EEpp)=`^Vi&!+xQT zl&!=8QtNN}r5NS%Jl5Z-YKX+VQ3#T8Ou`30%J7#`unrG??XTOTfjBij@>1I#?>?91 zebIqM|22aF<_JfoZ@pmYE%pgybK9LAEkidQ5|KhRW;X;uc3T^Jdznhp-4rt8cGE1} zA)e=SLXOAx>%q9PlN<}-f}`KmSd~3P|3XQAxBIPpL?+j6|Boc!YuHBvXNSgug2R6Y zcK$hp1H|@j0ZBL}XJ0E7ZCgf#MDb^)0KsxyDY2*4@U*WdsRTS~CQ(@>3az?rbFWjN zZ_0);n1DW8k7|5y*P;FbLl(gndW=TwfR{SFiwXis){kT$o9M+}=Tqy#QV~_P;0|(t zzOdi)-B-I^Z~rcVUXOSZyb^Oj2{cJS@YP7&p8`!?klBva*)&|dYs)RkdLPqy2AIDu zno&i$W&Hf9ocqbw0n>7oJ(22lerjfui|J1YAn^XWxNHYcC+#FmG8?cJtLD6~LKl^D ze4@S*86f`{oml4cJsRlSz{tJ`A6@QMXR!on^jAIK?j8gp+|QdSV3I;c>)A9E&q%{F zvt@olgUK!2jKo8Nlt{y+?i}Dsci>)^3#*k0MXJ&mSgHt>FBMS5Bok4enp9jMrSKU> z;UyL`Buc(3No4+vyT|#_c1b0t9v=<7Q5qqkqO9;+eibCSFRgs4lTBaswI@Ktp94cNk&g;9w*hIQS8mXGMJWD zZ9P?};G_|7N4?gbcrI^p%xX0A6zM{wDYbkG%a0MG#a$JOff z!K|t5BkgOpfMYDg@@or#$@r`mo$I<0TjcV$w5PNw2$o6!%U>j4X+0HUn+s(udQ%n# z_-lccakk@7aZhou-H8|MbPoY`o1O0B3JzO(N-fwNZcC0$Au^szM^JW&(ed54-Jcw8 zl*Z>!&15UmYxo2}_o#ssQ7hS4ioRVFgZW(bBF}pX?wt`k30!9P@%c#&$+*;mMCP&A zV#%FgV+9zBBmb-`htGKYm0_yj>}VH%K~V+*6=3a_ho^br*C}GPpNlV;RB>u z&I+TiC|Yed!J>k0F09ba-S<9+FO23nQ3`_$tsbQ&J0|WUIJI8qTJ;HoVJDKk|jVx>PcaSJD#z z%KK%nWHCx2_4kf5Ab-tQy~gZ3(x3gi9Rs-=-*{*a%%1CQxcKk$F(i-0~`sJNdO zLRKD~Wd?(OQkOKP_opB23EO`$GICToVyPJcj;I**qORWlnl2rxir%tPAeOD!6<@}4 zx4f}nsM7h7c4n)M!HbYC7XRn8a|j6NUzo4Xl>^k7QrGN$PI{|o7t-Z5Q%RO2KcNP9 zyHG>YH7zgtCN(5(M47YFET~~8ZvcE!xjUStFk0cIrQ6u$K3puI@d-O^Wi=Ege3U7) zI?y3#KKuA=bF?YdHwD`eR-|1Vv%upAED?s`N<#UpWQGoyb?ml}!3~$FutI^jfRVET z@(6W!{f+(vWCIz$l$41zk4ej~NjsU5+h|1p=&dO{u=e9aG%Pyrz^2B$$7`jB-18)h z^4)3}2dc;W8Ly767mt)wm=E>xN~Fn^eoIkiTVb1EbLiQD^lA~?ZOgxE zd?7gZIv!{{nlUTTWGQ_g5k@Ds)O?{b@Srj{nuK)YM55$pWu98)P(FPA-igIoJY;C> z1&*b&7#;Mf`)3pD#?FP?q9Ca~s8G-yGPchfr;&_-8v$#c!=M7Kja^jwK>dx8o3jym zwl-X8$URU&e^giPAUG`ZLS#0r=zE*-_1fz`KE9rxXqTi~ z=y?*mLW~Pm&lK)i0>Tz?u5a?Ad8oRX!$LCgz(FM&>5;gG7H#?VCVMb$wgq@!pou@D z^%5YG0-r`M4J;_}Q=kb?zymw6LMv3%)SRoI#WN+}1TPgl4P36AJ$cV zMOyFlqqFI+Z2tviU zKfg>bt#wqa>d~xtNDIWL3GslPM6W&n8MX!IPm=?I8uzBt`v6&5Ix7J7)))zB#n^6< zdnfMK^II*;6x17Ca;v2KZ|4YCn5mY~4X&SaaW3HMEuGm6(W^3aCsm&A&M~%sW>$!c zisPFcrfkSlV;QpIh39g{-wbiVKdq?ZuD)!4L`WCyv2EgZ_VZzVmCDTxEew#mk|1o} zT$-s0iC99`z~jdYQCi)r2l>`tjSo1|B6^L!^d|`n573I{n&hb(B{xZjsMftdMOKf8 zFVVOa5cR)Ge5yFWsQtG5MY3xn6d}Q(pB+Xv%C_{x&V4D|PIm(JEzqLt=d*7-gPd{b z6UqY_IEO}o{Po+RFVs|3bEjy-U0OABT*k*+sIfg`R(XJTG^DJ?GE%?`|D{L_r0_qy zs+nq@5et?n#>H36_;gAcNSuis7&RXWh&h;y_aol9c^H?c94peF*|jdVF=Ph!X)H%H~Bd3xN@WAUcbGq&)L%@>AI$&^P(zUuFk)Lt@uDh1uBr>u(}Ug-L&(LHmT zwf@H1{yF693G>vI?L$3^iC{v%1>q+R4#v&db?|{mU(C^AfzL8@drhP?wz;j1=|I1X zu52=3jy{xfh?L3-{&aX52G~p;+Rep11i$NpNsAmjmR^<1nE+`HZ&Qci__QrTrt&vL zB!2Jduksqfz#(3L3uo;sAd5ZzdWQSIvy8WHd}E9!#l4>?VUv={iOA4W%U1l+ zA6VoAAAx0KrTqE{18B5?`v!TPMMbwwP40oF_~7Zbv>ki|Vmoc)eH5Nh?!ic7h|io1 z6Er#TLGve`Eg>!I8aG_Zh3=IaW+Y{4uZZu4aQ&ZN0QFY+3MyfV-#?i5pZ7a57U|H7 zuu18R-83{* zeC3sPbGp%2oelEf!3rsh5|Y0G7)qyk(D;ABPZU~ zNtN2^W<9ML)?b&HX5$)gK8iQEuyBVrHYcy*FEid4~ZO|yhtzVW1II~~6A0>>4Y|)wU zeYI9!LV+{>I?2p>nk3C2jO)(@_*)P3wSYuL&&w$-zDLiRH=;X+TYMg1BP?xA4c@BWo8aT$#)uskSod zsKYvKu_&E)Tk2xzxIhI=|C?$-nmd%-O41>5U&F05e@;!R&66#-q!NOtO@;SFOLVI~ zTh?`bmi=@G!B;t( zr%&v56Bd6y332SXOcgz>k%p4!g`09dEZVb_zfDN<`XYV}3qn6t2+7kqR%tNP81qYW zCFphHxFcB@H0s}-v9PR)T)Qk@EZ>HM& zb6d~4zoebZ^OtWTQ)z`El)pCH9jl~w1Ljep>LM;_bEM1|JXTIVSYx!1#Qkj>h$bh_ zc_fi=mnczc`Eb)Lj4;-0Prht?`1Z2)3DCN_#`$DL66ieq>Idsu>8=|O#jhfTCBSYc>2j(=_`3Y1Awq*kN`5iiRM_xx><)O+NVCC9 zH|g}V(Q`j#(p5#xkRv9b-Cu|fQOoYP+oHoEE329VWcUo$D*m0m?dXFEM-SDfdN_t< zxd~oXgVe{1y(K+rpY1HPA&N#UGz(?HooudR^9Qx&V-|ux%TDfAryDx=u&||q)tmFf zJVoK9hwVvSlVi=_2*91+!zh_2Pgo$G%(j0xzEp;{rHg)twWF%a

I{wjbyp|Y#!f4$Zm={&%1z^4T$@vQ*qswBZs0m3d2hw zml$#mVs^4%qH*xk!iduMO!~5qhGWco8BuO#mLa4EvO8PUss~XIj1{t5o5HjkEQ3oA zJqCJb=S@G_Gg;ZvNi)Vz4a;&ryi1%;Y@s1l#uKIIJxDw*lX*h?@V?=dZ>Y`H3Sd#_ z@Ss+>f}H%_=V_3?|dZI^{1>Z%HZK?$Zu}1a0Toxue8TlRqlm zhh8K|i3XYs-3sLmE5_cwxxQgLw_?aSF;UFE_O0WYcj+A{t8qcS24|KI%Kj;@X3wCK zP&we*4?q1jH zujjGSRV9*dNHTl{!dirEzG5_gXS;dJzlT1^*>m5wsAIePZ!+K{8T@hm{p>S$Pr@yh zKCKk1aJ%|wag2D|3#{ZoWg@A~+?QU3%nFUH_dM2b{$29odb0=U9+#J-ye;5l+@bt6 zu4uYTtsCX+*p8AHdg{5X^=$tK2Jk<(e!#?JJ_dTrm=7dBlz5=LmCRFot}Ardrlvd+ zc=Pra#YWYM#^uXT1Q`Q_;;*13Z=M62gUZ3Dn>{%?0~bDJvuBoOvF!yfBJqG|80S?| zt3-1yZ_3o;@d6Ql&uk#rX$hRy+Gg=%ZD~odVK=XM@aF|RL1tzqQ@(0ha$?8tKo%F> zLb#=l&SJhn2Ft-Ji)+u>U~7j@U_`eNMS1Dh_P#Q5LWwHvhKJ!J>_@>NEArjeFbNFK zJt{G&^Zvs4E^3`i6@i~N)3qOVEqvlFz+GE&DU&fExehGRmlUh**iFPp|n{@VbpRo5u%}9 zcQ{rbV{PHDoH}1?*u+Bz?3v>MLXdspI5F=Nz@OQgP=DE0_T$-3V95%6Cc*Zv=Taul z1{`zCFFACP2bI(7ZH$Y8rIs#CazV1gg<+**#1=mOMW5}HiDJoM5XlJ*vLxia0lfpD z=>2XikJj_#d0w0w5{_#|$`^CfxLUNW#Dlbejab%wcn!#Vv({i@>F)_53k`DfQa!VG)vE>Q zt5{{JJ~VekR(jY!_)6#sWGOw+w#Z?XnQG^AGJ_rf-N?TURBi5MZ67X3-~!#zR+0bQ z9nBj^@FYf*N&Va6k#d|D&xIBVYggL3^QA38G3^i!Y+RpN-O-;1LM-EoU`r1vag)VdKMKay?CDG1QMUn{U=ko~y zo3CnXJjdrrc0)rM;Pq8%yPxyrE4*w>zM2clYGv-9Y25L$W2y*byZ*fmM~(E8rurk^OTPvc{$&vLIWr%Kfgf z^ghKyrFqN|to`_mQK#Q+^pP{2>COMMCtmM0{XO+&;8j8-S$t_%Tg1f$!bQFKjfZE$ z-qtbN-)^iBpMv|FRdG{X6bY%tKKQ0Z-$ceM?()0`!{V4+KG0@(vz=N-lHE68tNL}f zYF4gEx2o!T>z*3c?PBPx3~|5U(_>tJegF?i5sIC2#g^n!#;~VIT;$+Yx=jc$->;nT zUa?I#5_Haa!QXbDu_z)4@#AnG$05j%=u@eXKiRjS#`3X9CJ{K&EoA0NI8Vx~48Ijb zSr9QVrbgXF4m06k13D{vRnf=7^R)?l1}I_Em;pVy5VaPIWck*b7>VoL`;!st1PaB z@0+y8u9NMqd}O5bCDwjxe$tdccg<_H3!f? z;QHs>Ev!`QZO=~&*lmJ%>pX=nf4jY6D5-h$i1z-F+TtQ3lqzdPtB$`34b zIEoo$h4F>O@fWtor_7nPu68>~YG z@6&g>2+lqPzf@J1b-GDT`9@OG)!p0uJvRAUU0=!?4ugwWDMSGGml05fb}Se!knXJ z)DMG@qlMD=ls&nTjMH2Yn@`9#Vi&$I^7mCrkgNUC4#r?DPTj+!$AUle{3;OMU=g=n zE-;O2kQj11Okhh@c~xX5tiohnQ%?>d;ghAdrW9aW@3OT!&i_SdxIl|{EtqR$wvDQ4 z-;-6&tT>wN{LC08to*P}mx9;ejdmbbv1xM~V*UkbiRDe*w-WTw;D#>Zb#}*e(%n;w zF(vBqmz?iJd?WzLR8vcon{cIJ){GCsjv$E!iu$+ZYHSE%cs_Q@bv83*<~2AGtcP(@ zj|+D*7I6=kU)oq;)q5PcF3dm4({(E>%GPB@ z3a&MBjAXxZje054vzh_lVtPtz;J(<^!3uLGa!8d}WC;_JV;Z2&@u)_k=iKiuGlz3| zI7D%MIp4=xD4;F-N02RWpKz$BuZnv`ttjiKOdiOUMB$y+^X|2 zW_{o|*{^ii)tqETF&`4Z37ikAw+FFq)7Q!~) zrjOGHhdYv5p3b=OdR*+(aPSNU;xfE7kX&m$-E_<8ZoGiG*>YG3Kvb$30B|%-njc0*%K-6KXe_RlWR^{B-Vdy~S{UIo2G+3Im-J3U6#dqALa@CKO9w z!@b3POT;y+_l%x8BGF&BHWTxu3(Rn+T^P`D436g?OG_a7!Dp9qI=G=!LKMJjymITTq#~LyR9Nv6-(kuX*6* zvbAlKF%GYp^^M=ILP|W{n{zWAoO3I1;g5OA;Bv!*4%)fv^Zv*`{HA;dSGXJ_vs+uj zRP#%%HLPIQd7Q=y1$(0Mp)7HrD6xPC6JappSd`4AXUfG6+gu<$<6Mn!mm&i@Q+RGp zm=M-Oj*+8I4y}yVkYnsMN3hZl)*EO-_Y0veje=}I34T-j8;9iuNQ}9;7^#JF0qx7( z=1!ryrCqN%R&e9V`0VQ~iM2vLlMX)RhTcs&O0Nq|4u|F8UY>YkxT~MnEU2Uh6`0?5 z?y@E26G*;F&hjl?eNlFHjlcdc!&APn_?o^iWevS4$k{b#@Xm6}#a{Ft6ge{wzLaL* zzu_U#tgQGsm+cR$JiH}KgNN5{^v`^A#YQGN@7p4)hiETRR#~0{ZsnVcjsLNMc6U7`W1TXl`4uF-+8e2iATK0zbPv}YHEw*zI_r6q!jcXKj52V{g5lwGv_uVt*fis6UTk>{EDBR&P&|3 zGdYTQqF&zBgq-DuH?FVQq>>#TJ5`wc{MxdM;S6*viBNjf7aws}ejx=LYVhe$98key z>hxaeeL5%i=)j=f<#b$a3*r(zsSkxiboKO1x43VQ)l>C6{4DZ83gF-FD=RkGtQ3)IHx|-whe4$QjhtEdWqw^GoXd|CV^=KW##34>`N3@ zBM@CaYLWgT!$AIt6|AS9706rOxob#TDHvN7EsTZWPe$$F+ zi=?(qX1eW*VemK%&O59!_6z1sI_2XHW{k(~$_t-!cHVCi@;a>pMXD)@{%9BfTUl1& zCA#4?HdNbTsGfm%LNP8%sbTFrLJzeuxe4pT6qRD3k+<|)>W_(o~Yu9 zH4=4&N*Z(`imGXO0_j{{Bt4FPRvzrX9H~e#-(cCzsG~%a$8XVAfsdIxW1?BZyTi@- zk^V_asU%4!66=16H{}~hYqCgR9E(Q@A(Lb1dyg4utn!zp6bJ9IkgQ z3Y)}?>;@b~vGEUF_GrOk5pNE>YK~Xp^*OZAm=LN7sV6u@j~@~Nq0L7F(`jE2UI0JmE*8ogS~zj51(ITkvxOy*S=ZoLfAH_oz9y>kTT!I zJHj{$N=F75SFm)xqiF9m2ji8U8iXUM*yufr&6BZ=h|e3!icW~zSY>9`Tb)J?0dU_aHGXMvD!PXR02`YLbFCQ=ScL z#tK*CwfT5sJ3&}!3Fyz3!*M+)Q-ru1Z|}D_HPH9N&ftk|W_aUIeV)E2%b_KGajD{7 z-3W|`oUh~Vl<5ThrQ}-eq@Gq*8!>e8PzxqezHZ@dfYQZ&lFMa_6-tjdS`sT6;>WE> z8@o%LlxT9!HyAAM2x<0C*nVPGS*YFIsQW|${9X4$BOOAInuz1mZ+?0I=~^%&l{=aA zwd*)UlK=Q%;Jm>Up$;?2@fB4lNoi)8s{yG}i8#C1-q+t-jx2P;6i1hFQ0UcJxuMa%5BOY{6n#J!8!*#hMZx-BkLuV6 z?(^dvPCkhHl)gkn8}VMSS%FqboW9%iH*2F!2nK0aj<}v?xUj<5qQ0(QSFuyF}bXdR5>?9HX}YA67cI{}zXQQF(6VxwHu z5*J7D0FI={5DT1-|-wQx68aRKPTvwL(Q49^+GMJr?H4 z8o72&q~J?S*l%$Q_6`nQI1ELDiyK!753?AXx5xLoe!$lwDhy1Ul0pGR zwp+hjt9LqUW#=X)fsUc?YJ$RNI9cx9yXOd?=z8Vs*L;NN*0mKxg&Bo})>8kH8g@eo zB!+q@j7nmqkWjN5t@T>UOq$Dyo;}L}^#p)G@O_WEHsY%92zqx}8Q6S((FkR-RD`PF zFuCS2LeS9mt6FHBJPm5|NoThy9G!BJ8AtECC;A%=YQm??lDbcz^>U|EZr+CTK(@?h ztK#V|Um8xvXSzl$u#TXHqtlt?S*HQVG^SPV!YCQ_;b2{*@C8Qj-6IK-6cI{I)x~~_ zm!G<#M^as3H`V)K=$`nQ*}JREsQg9qG>`gO-x+S^@is1;a`w-i2grTnX7-mg)75NW z)#&S#4cvW=u^PwMNsF&_GulwUcM7<(6zkXsW>CE0A=a#{=AFy=$8@V)0k`z_@_(4{KYy91zi%UM z`u-PhGE;(3`suP4NJ!fEa3rlxv?@{-+#R&x;yuT%Z-I4527vK6 zQaEs$4P8x}w&Z;9`0ZD(A3M`k+>Xl&fuHKXUd$F^uYlFuNghNJ@$0f=*lHsx>u?Hv znpcUN28hG;51z=uzw)~{_;EHLKzJRb!fzdcl6hZN&kid(p8Y~20o+g7tEr^=Vxm}o zZd&3T7Pykcn)+J(2mrsEX63h8L7T;DPe{soTj6K`Xx0r!)3b?^Yr(#rx5rk3xx&d4Em#b=`k#n0Y*BbV*sbnq*PyRs$4 zFV-q?(fi4vS>MXaUe75fPIR?#@^HL5%C5ZPe0}x9E@B9}{w|G}6kR=%z~dwfunIN$ zBKl6URB~F4QMoovov;r#Z`Uc)PI({o3)0O%_nW;M$EQ$k)gwxxb#mV~g?2MZBcj=1 zAkE2@($3GKu-SIS8+(glF7o0iEpd$(;t#Za1}g)iC%-j+R4c&>t~j91CnDGjA#1hT zMa$`-tX*=5v$%%l0D2#$3UfHi<^>2Eg_=-4|8%6@iWjigFz>!}PXz%1^4N1`op4<+ z8K*w2?Udao6XS*1i6(_!bv8n9(!*>pZ2>Xn5-8;?B<& zYEn}9vE9I&RGziVGciFt6Sxo3vZCt%0vc+PoLz75kej~~N3|j2s?e&L1csBi-v15Qetrg>C6%o7xAhubo$`q2f>C|)K)6a5zl*DVw&>Fh> zgH;2B_57pv?+ve{>r+ARCgYt^zGjX{qg~OxULb|fq(Z-qzm}lB2w2!qT&>bC+DCDN7@$}MR2`l{x3rg?#`{l?xLJ!V^G9&Na8u?ZH z5kXkygPY0YjchlbLG9o4fS~K z81g)N9ux|-)-CQfw~@BvTaxYcrtoxQs57TWAZ`9QlQXvVFpv8$G8^;B)0y7>n)!$5 z3(7$)gm69%$}YwEMJ_Ahxt8vZDBKd!-|l0eR`9$EeVlZLNIUMg6Ge0yET(CkpcMr% zay<6ac)U2)6px2MGmY@kd%q$12QK{2LQyO0<#zvS3H-?z9GIBY6WXnt?aO}<{4lL~ zV!XToMHlo3>_2T#i=UdScZ+XA&Ud1jolZi3DJx#&6zbI!^K6al2YU|pq6wWgIjbC+ug5YqzD;ZPF%2`GZm;WBVh+p231#Dr z{Z-#voMF<-9oVC1*B?s>Ijc$XCN-r!F{u9b?YYc$ZFIC`d8qeUOW@&ln0dZLOV+&0 zTOZs>CL%D_dIUpfzaRP3D1MMEztUE};LXw25&lSH9*^XqtV_l--si)zi5Zl3bBZu} zjt?H&yA2I;otxU8{fYc8bI(t3NL(%Tit*FI1I5xP9$U3hz~efk>M0&uUs$6P~Ku+&0&OyQZ&?C~^2?UukV`m8B{ zVS>0Mu`~%`f2%-kPRYffs&C(n{*^!4Sb+?QFl%nZ%TtR_hT-!dn8c(?O~WGxNu9B4$m(36SEwZ+{>8leB=2J!iM9# zd%&2l4c=qw8tlf$`o~=zzVZyF8D-Ib z8;Ae$U~@kLj;&|V8=;}2jAy`Gzm+Dr;1n2;l-`~1%JV=4l@|HZP@-4z zb(2WIwoL~dsCSs#RDNU{0O>O;Xg@!T8mOI8-D(V{udY=i1V;Rtcn$5u|4;(_dzuX5 zfRCQZsyRybFRXXn7`U)Lk2!hzwYB3QhDwblWadO-Er6y@*9HeTr=B*k~kziwCj!nMx` zHQ@Wz8k|a>bwvj?V5-?BJKDSlRg46qH-NXpy#q{j)mvop#-^y^p{$R%Vo`V|v06Dw z*KWQ8<}DrHBn|XS#{UV*5%wIV{XLxzKw}tii1?Qm|3%W@uAn4C{EgZ5bV^sA#fgW=X8I{CLC(2}E>JlKYA-UnS?y%?ENma(~5)Fu_Iw6U~X4IkKR>Ty(en)kl z_jAp`51@6=6}_w}zCx>oMgEUge+LXFb!2p<7XI4=pR)fRZsk84P7xSxpgN8}`k87d zl_>|_vdv|#NsIXv%@qM62uOdd|0AYff9rxjfC~@(Ng$ zq^K(6rnZR)q1X7py$o!hYcL5%8*lL+1GEd$L6lmtS}+xo^-2?W&72Xpe=-GV{(73;k~jo^NfWg@S0$nIZ}d)OA0!($meX z^H6MbC$5$mmc`+sDAHj7Y)k)ZGAV#SMgW^eJV@^UGuYeLfV26rw(v^M{+UldRQ{Iv z%>UK238xWMzdy?v`64!K_niUNbAX7FK>sCsak`^ld9pRp3$(3|^Ri81>W$|Pr!ViL zkfUP1`D42t|B8`C891-r=q|vK)PAN_e>jVY;jQ$dtg&&1^Y*CDbd?pW)kL+dl~q9@ zq((`=dh+u%xfw-Ocr}a4>Mu&^f}QfSD*oW7x8ZEMHu3ExMRGC1XVOEK4P3r9is^kV zydj!1rUzD5B&GzuDwWebp%A@jHmCj2bd5&qeVO=Rtv6jLk0&ba>^#Zp%L^~BgyG4D zw^;Aq@QE&wler2fH97<+5I?lPQ>*1nDbZcJHpPhj_ey2lXu$|?E!hDzUOjlA@zW}g zOAS$TWAt#0Sou=d&|xfTvwn3-E>09DZ;R+L|!TpX7U z6K6bcymE49X+91KwZW(|@13)S9M-Q|iKl^SsqYOers;h>Z+K=|K+iVt)?>5Le_zyU zfB^HJ!8r1-tq}`-q*SUcrM(W5zT(4=z>H9s28>psR#9ABoboIV$;TvuCd&xO3$-ep z$M+!}2mz_SD<&Z!#ytfNUV(mG8#$4sSvdPzot^Y)IZ`R5p{tG(GuCagVv?4^)^rt% zAg$*d4ctH5vf}OI<}kQT(3dOo%k+q78#sOk^VeX`R-{nt!Sfx(iPPoCCtkap5V6HC ztprNVdrAqI<)z_fA1_pk&YA-J`o}wI`u3+tX>lK>;P`rvj*d)X(-t^k6NO;~#QyTv znE~(kZwX~CoTu8cHtAj+b} z?|HJjbQvOZ8`wip&h$93EFb~rreV|M{=V<~UqORE3*$p5;vk)(xM-!{#e zdu@$QDG1(z&-!MP;6ulwE9H6jijh7v*v3(u&{j$ZGt$6E=ZX9dOfQS(qN1*D5WnSz z29CEu{6aa4lYoUJep*E`%0$G?ole&D%cpv8KlIoNpP250Idw#KCbKncS9=*oQ>J)@ zR94%*dN=O{zq#TBIa6JzDBx*$O~La8@+D#`ykCy7=RLqe+%0DCUuP``O$LSRSIT@; zfngG4jy`KPu*IBAied6SRYB0oba*FkeF7ZE*Ef89?;zB6l{XR$;v@l6Q76r|N>=9r9%J6Y6)(T

Ts}=o@121Tk!JY=Sa;I@0I>3p|tvK$WBPEWE#|5 z5}yPW7l6U@Q%48si~e4m4`~p_bFa(vB$UGP&|pYgr0amO7Vs{aJ`Ja~V&it&dv7ZB zSgA=oxAWmDxyVsoHWC{u_&bA^tONWIsiY3xL@j%ZOTR}$*$1Jk|h2`EZzEJq5EJDTPChts32{hSa| z85akQHETWeCC!DS=^d*Y@>B_@Sh`hA_~%25Go;}bTDaxlMe_#qP(Gl!gqD>Bl#A5q6UM2ae@mMVP3zzg%vPUc0 zrJgYUx&v5OhV3g+(*^L!2nqYdWt6{{Bdyyn<0gPX7^%I#rxW z6?2?afke-_A_}e{({u*AX$7%)k8RHH$uVXJ=s>kU06vDHzBU0sFO$>DV0OcfAe`y5GOg z{r>!Z_g~-dKRxt1=XG7zbMNbb>y}|pO%}m1m>qPS)S+XjxNFlw#{l7>&;^&`y(m^< z8;afG7tA65<9Ejgv>QRe2hTqWKB@;z`@&`F<_h4{_Fq-7-jFuMd|dEYvD4{mQ~h-c z4#=xD<4!&SAP#*596#b|3zEHEF9A36sf}^YA!^{H$fMoN+JEF`e!Xm|u-NcAsYfz+ zeYzW8`_m`$(KW@khRi57yrt_^XH9ETIA>mKKrUd8Vx%Mhco=d4_2TFDT|h$9+kSy6n3tKQ0h`wL<~f~3Wb%8_2y0nN?u@1~ z2TTy>Pim{6a~x`bAc~g7K4=#7(gB>=yqWKKfEwVes(aDd@IQ(t+PD)y0=@d3_o@BOal@+%Cr$GFyxq1QJv4bJf*ko@z18 zoQtr?;;D};CGN`_9yv%{W!s)vLIH&e5ZIUZ^4Ryp!x4n!x1HS5X%0(E9z+}3OaCY` z2z@>EHbO=^WI*kt_~yE@taYoq!H(OUwIqk0<=Jp)&`eTF0P(2B#k7-P zgxMF@S9A#j#y1>k_F(Xm*o3qp`6aXcRvM_d{IT&O-C@S3#)a}7Z~n*37CQD>Ry5&& z_F68kt>_Z{clWYaGGRi)Rq~;tOYGm>YgsAnG8(RucNOzjK%`tz7rQNe#CsXas&L)y zID^KTw=Ga%krB7V4s(YPF{I9K{xgfx^HkA%5i}_D-1Br92mk`<5_Aa#ytgTm=bnnN z=5+48)yDuUUSRp)c34N)GD0bpcmFJdlYc3pc=S}bbbkBlVi^ly`$bBVRjQ+yZ7dSI z@l{V%?(D7p5jRv&Rnd3juxcKag;eujpZ<|*HZm9HXk=gvGRhhlbFc=wZ?-0dK&A#vBNj{$1Xv zw^xPs8hzRCOQHcmb`F7okjT)$k`!o&V(zLVqbkiDCKtM~RI-5uerB{lK#tR*=DFbDE`M zsLG2dxB_%KedJzLC&?Gk&!NugGFm&46zxOzDP}DmGyK&_8lw-J1Z}-#nv@{2c1qf5 zD{!)=$Xl`kiLKmom%^o=2tI8{hjP||zF`Abk9eQJ`z&s9F@2U8vW^l~Afjosob0hV zY#sT5H`Bx%pgU+YltRY$5eodqK`#Fj6-z1Ba9oO5A5<0ih>xz{l)33OpjcR4jAji{ z3L*|#z6(W0$a6Zy%Xf5&Y)i9sN_B;u2CjoEXHsFi@7iiz5P517@7t*O{hHkqSb|PV zI7gU5{&eg~W)VViEK(2>03q4LracJ=(>^3rom;7I1uFuDw-lV5 zL=l84CX~shwHTzhd@?h&GUNzIfN>jq9}->bR#;j6>^3#%eq1)h&^^VxWZq}{o9;bD%&epa!W~QK>tN+0l5_cNp+>v$k60(#<u3av@44eKxN@)KP>6j#U|`28x~u?b8+{f z%i_FV!NBO5UAH(ymJzMPNT%y2w{icPJKS!gXQoCNr#m)vM;RGE*%05<)$8sm!~1xa zC{99k+s;Dd=@J1GDaiTS^NNChYW#KYs?leF5c)<-T12=~t7FOL@+wcW9Q{L|7<9hcS;>d=eB=w#Xd>R=rjoD4x3LI2@da`sEEE- zyWzp1;=xZ_0PWXY-Z;JwzmFG`wam+!w#l0AzSQ;F(uPyGrlbF)2YXL{<~2j2za%$?NLg@n?A1ejrh z!8F6nc*f{c%i_K-D@kGww!mfn4Az+gvkPATkD7($)20T`!AztnK{I z3~_G!_d9cMdO&hA;ibnH$$snVn-g*`wvDqaeM{G*?PmttbsDkPo)&_;Q(9nQeCC>R zS$6Om5$npc0p#rWcUt_bUI<6hSGoGFcg~YjiwjoeTE(Ub7qj8Kn)Uy!+%Ww1&4A};A{ONB?$1T>bE0Q&doLB9q%u^QF?`*kkgyPD=rYt( z6HeaYq|+zFt*j&gy2*7)&7Q2`Kf)J_XDNUsj&Y`We6nrI@nu>ZJ-P6HH6mmHR^0NA za8>A=vQxCYo64AmXVz-$XxQ`9?Zpt7sD(|KsbLWqE)ugLk+n$Ys^=<_ISZ9DK1K(^ z!LP{%!lU$Xlg=sAfyz((3R1vX%pj!ZR50OkZ*q`v_x*EDJc_|rzWyYQ z@xzFY{w=wJ2X4Zi?;f;O*hXdFZzx-%Hz9*#;Kax*>}6 z1i&Z;S2UIN+tS0B2P=}lTS%-tE9|a|ajvGfRUDv`+(g+K}{M^oc%F@z{61=*d%%3$phGbjy6ZV0r z=l%D8@{j@|t;%)Vde9!dh|Z9wB3+lK85k0b0=_ALmaLlSalWjFbfh=30*3o6N?yjj z{kD6vYKbvQsD(sh*mWa9x`TgPi5R!*g%jc^&+XAOPQ|XeGUhXNRGp85zG?t7Jlql@ zvLUthzBrS&k-=(m9ex@IApH1znT~FU(`PcK;QL#u4C;+R5F1&Gz=fB#C8#$t4Yo^pxW22k{e1Ru=@Kky=~+#z==(KuL;Ll( z<3GfMd+a~xvt&-*tOPZ9e!Agw%wR_l#-NY=W&Z894y9J21KRIDRR_)1@CPS(Oozwf zlVrY~Kg9UK3p;F>P)mUr(Ylj3db2Pj4%r1+xXmmYw^&;j-(|TW5IMS)~;!d$8dGnR( zLWwt?Et~69qDil1hH>hTyXJH_!hLD#w`w6JM%&fwH& zJP7+G8me<__=sF7IZ740v;>#e)DF$vqd`IiV>KgH`j`XqRUdicHppp zJG$&lGKVe?&GjirN8oYP= zFM%?Brwy$48!pbRdur$bF77S!*yW&YV1=2d#dpn%mm))Ld2$Qf zy45j1lB$;0;IY!ns89$ zy}h)arAxHZj&e%b>do49Ta&r(MmZR{N`VK7_SXIK-=8R~t1 zFGo#YTpuLfP-!ZjeLVv+@Qv|Ip8lJv&cu!(&<}4ZzVUV2GV^nh9^o1}**2ZJ{52$( zRuf7$T)LxOMSa*0@)U6=G8mfVt%T=C!*n?zE+B<##T$ z2GnTXD-gMz;k-QeztNX2?a1`MvTw7IX`Hb$Wb4TuR-_$56@}lrc~=@Md@|{he52J~ zxgzu}@Q?i;d*L0dV1e371(YqTrT52YK~dkoH!2?^U+q^BPKmcXFCrlwNUf%ByV=nQ z;;Z6&iJr;2!+yG5N%vp8BIk(b%B{F4S(!7F6&gHl{ z#3Pl)w6?NLcg-fBxt)i;vb)}T(fUR5p(;wALv@|uqRrQ}0hmHV1}&ZA5q?~dHq6;= zIOAy^^-`Y_0wBVE*iBf@y%=OQb%N;-mL&flMtk zoyj6j{Tiv{yT=qHvdNw;XU>-IrQ<>EfiYN{1dsKv!_k2)RFp7Ds_}{7HTb&9B6WVs zOo>XR>5&}ug_VvlSC;yYXS~U)@5;TX?|ODFday(^G8k4)8}r%E+)CbIu(>7`7GsGa zx7=DxVN@z6R}+KOdW0+~_S6W37nQ28CO{v_$=iq}paVv4c3ehosC%Uq>7FCUkm(My z+rE+Cls;gz_;9U}i97*T)L0)S`X1@tsr*L57ZajjP5tXVlHH5~6x8&2hz>=6&##6C zLKG}zu^Fl<7o;d2XVYSjiEX`3Q0{CHL&fJRHLj&&O%ko!DFkd(s*s)Y2ZAE!r@KI9onm=)UUn$VV0Zx-Cy8 zXuSrYdKE$BqoUj&&iq9~2{$zP5&-#B;j0E#T+iaV8v*zTm`ULCVa7{6PB672oM)H_=Vl+H-4p*z@C$1&c?am z{uOxK6#Q;lPO1YI*~4VT*(Jedo|iA}`dGr9iWU`O*d1raIAs372-nC$UDs$3lVRWO ztrf%_=GeeR+*4mO3Ir|~l&^+b`p!)%#^?^}ecpX^k`D^~26ii29d@m@ zI+rFP(fCV_ENYrWrp>R{BLlzhBYd~|Y*eP!dUmOcg9-+LKLZx!p!WGt^<9gzQp{PA z>cBmfs<3G>*9LdiU)ul{0;oF12N-fIt#WdzvSKYOnOdvX`aqB|5*?Vj^GP|7NBtR?l%E<0f#AG=?+8V%tSV^WA-%N~ zv=b756ey!$YGVVy$48z4g3(xD00iTigeoK$NNPlPxTtNndq{)Vm4~C5Y@87yR@>&C z%ye39ewje4X?%ExK|w5=>DfYbwtP>G{f}C0)FI|nA|HrNKjSL3mE1@cP)*Q6Nmtt9r#-13H z3XqzBgZP<@D^aV+arO})Qg2_bBqZmGhee){1VZouQVX+5mdg#g3E`j}X8|4gUyT4) z@hV5UgWx^dmyqW?lp4Zhfl@;SHvsU-65;#6%gE98IF`?iy@C%+@vlS#i^v-$E$PQqKoUooQdGOAG_8z(|Y1dMK&rC9#OEG(TkIigy;6i|IS&X)94`e7$vz zGsU$pqg(BYI?rQyc_bV-IZt_Wb>@;ZO4e>g$Uqj%qF^AHc-)lBh9&6y2`<{5;x8|? z=qQ9-_0MOeDv*J+g}8=xm-)k2R+O9;egZfh^Z+1zNrwx>D)f!(uI{i>Rut;1ZPU}l zg_X5I$1|RnaZf>7u|l%?5y)2+_-|(vE4HL%?OjAbq)6WgHOH)1!SLfmZI`+0n=(ui z8SurnB!WektHIBJ%>&hL?MC8kc%nj=GF%_ePSL!7XAw`w|LfmzwhX z72iI%@Sw(Yj0L80cR!Lg4HyLq-X800^}MC0p=!{7a%nRK$gyp(lO2{n!>wg)W-D(- z)Wq90zK}iz9?-^DPWFs?#M(P~n5qu(MAYpmaCA@;jOT@t6t5;&p7W9*!wQEIEg@^` zV%HZN__`5{<$=97n8lrw^liUv7{|F017YH!M#K={(ith!H|_{MjNePt9>MU3h6>J$ zQ|&?iON&*Xgg_0DR3%q*U8A7~X(`sA8#j!dZtfgkGMbN%xyllfZiKy}`zCdA(s8&!i{yOe zN_x+*px1p`Hb?2}`4xrGONp-8lX7PUi?44HFo!rREhr061)dSA8!$>utDLo~elgEu zBW7A-_x<)zr_QH^-kisQl;yc4vbFGlc%!FU@hNA1x&g!UNtV0~wh6<*TqC(SBi3`f z$-s9jd122Hj+c!mVD$`-`o2tnxj zgT}jJb3MCnmk>`c>3OUVM117b%6~I{J$Qld=!Ha9@3*K4^&w@QJ?o{)3`z;sSNh;utTxxSwdVOOYF@W_eyd9ha&GFl6Zv zJs7uJ{IC$OUTm7h5=^~S`(dnJT$ry5Xoj=F3r)U0K&ujI?Z#gbcEsJY>@%R=pU26l zj&sn^AMsv?T2ERw7rO)+G&|4cw3W7aaTiS4(Uf#q0q zQ6uyy$XJbK>4SHAlsk1eAXgEXcT503uGhuA-o4*^MOp}auIX1?@#xS-P^mb5th2vD z`mWez4c9d)wC2b$Pk0m>8%KO~Se{bFK}%^;nOvjXamKKaEmLtRfyLMDqP0~INP;i( zI5%`D_RvZhch)pCeZ;J`jq($(OTpvo_XFk30*#_QI?{ci){me-=mt?&-UG@!l_+7%G6)k8h{& zSzgu!TSr)&dQ~^5CdqF{%%|Swx3&lrQ!e`|onTGe+|J5J%p`f$!qB>FrK6{;qZATY zGz(u_Mrp9c$ki(vq^M1_v=x~Xu3exVFf9K0y-_kb* zH~d-)7$KO$H7M6=A($yVXEql8LY5>x%WiT+gN$n3D6~BFLJS0Njmomv)O3;8uN6!Cy2cV+91xF7zcjPoeCXW<_0Txp;@l_u&%m}6-9vLf4orWx z9(~-UeuXO|xkF7#KIgN2n_tO|C{dn%m%rp&4J#{k!ge#uT0C5$NtGyZHLHMe=n}KM z*4bJ9X1k@o=Urwu@4yHDJFSN9qdpU9O*|~f$K)9NxKDxB>+KfpLPOP8%vy&iX1+CX zamP36b}2g!^y#Hxx87nuWjfG5ndLPFnfPLk591>!FoCXvDm=y1h;;8;t%;w-179v+ zt54kTC`f3@}zcEO-N`;n#=#N1$;2io2;G^-ad7a z2H3CRi#$7I53VKL-U?!^TQnsDc<#IV;V^A#IRG5DL(Sitku_C5286vx(pZEVV=!j4Tlg z&Ss)P&!3(K+Joa<$8n%NSZ}%l^_n<>a^30swqEsyG^X88hpH_c6#`)wWL`F;H+FZ;$4XMlot3y z6YF9*yZq?_7;+F&BL>Bb_u^iOM4-wV)e3vG4uot_;TbeCDo{KPEw}*_>;YA_v*xNE zc^YidjbJpymi!F=ZLJAhI>~sWz_G>QC8bh0vtbn@dNOs26kst;iwjuPwU|_Q6&u<_QrH#5E0++osEzRHyVl=pI}{IYpvD0gST&0t^;@MwrY&S;j(ln zF{Ezr)hYMXY&3_?^)^4lNocAd8b2k^vpBvZb2^n9*Z@twv#dbf`C_(x6`xVQFP8IC z1~Tq9BP1xHX%>On5a{wW18?5d)}A2j2m2Q@B?6l5&*U8lV@c3Hzw|%qF7+}6`#k4| zYVJiBR3M1_V4z>Y!>$xqsGH`xNRBFe3rOfGTms&=dnO zz>`TM0ww`_cIqiHy-iId`^;g9p_f8~!v23j`9GE_!aJjvQrsV`@HN$Sr}%3*TW_En z@I#+_?Y>|2C72ua%-yy8tLRqy3faxAoRaf1kc3V%e53R1&L!WNp(}9rsM)Z0?jwPpAB3);;oL0 zS&xWfi*6e5M5$%2o;5QTN(u({1?(VUdNg=Jq5L8Uk%(kf=|k$*Zd1R<67&mqu{JI9d}hmL1Su|ljo}@(XltYj+f8U7k!hZ;FL$g%I9K*i0s<(@J?~!^ zS^08&G(iBCtIoTU1hU4PMES?SjK2So`n71xzs#Tm1WP1_ESMhII}G|(Q+Amc_dl|F zDZuJJdX)L*t09Vp5fm~d03z!y@_l zvW-ptByNTQj6nEQFkKNC2e-h9r1C_>qROss*B|To+KBhy-G)6DwHTCfIEM!^Z>Iul zAs65nh6^a@N_=G9^9SBYSA&74x;kkncUWlNtq3|&!n(RNb>LPB7Rp*n?9QN`O#kig zYv~6^GGTKbU}}!p(B>={z7!Gx*EFNthh)K>M6jB0_F#x4H&rFvoBDh6yEf)sa{3>j zg7OvJ*D5?NgE6OTCEM#ykOD^ZIwv5$)wzjG4jIk35RqD1+9On=A2$UxF1U|9qBA$| z6WdW0uOu4TJ5ygDUHzIXGIj5g1bQVfV|v1p&NCy)@Yg&WJRJi}n1ZGv12AHG6->by zHHJ&&+iuuyq__kev(tcfsdc}VA|LFN=do(*2t; zh#LBkmAI0isYCtX5Fc|dG$c9jU^V=#WJ&m|S0@*d!#??LQ>r>eWnNw$Gm#X@u>=q161iJIa4E^_n4? z>yfy;BI5Fe-#!qI4G5Tk>dBg8qWyqjZ;|x^V{l zt|~V{f*O6{g)-OC-F1<*AT6nZ^*%6rJ+WyW!48|(M}7MKTltrRy{!n8(-}^8?zk@Z_E&OeO1Z=H?g9a>RHaN<5TWejD>DZY=S~{Y zoF(}S~ur+H1`$Wn9J4ZYJ5h@h9_dbjEk@X7pL!n zLDwB*HBDPvKYJF3JeX8YC3^jA@ZwHajpliyb~xf{s+)Cs65&hVlJ!onakjs}pC5sX zokh0rIWNNADSReQm{&-gY%<={$a#w(QK_53=F!MQ)}YrP>(@1oW-fAjXn1A11;R+5 zv(mANSHZIWQXje#3}gNFXdMSmBuh&6E*C@5FT`T8359g`yDw!3-fl3G!urlO>?i6C zGs;iKSSPi)mRQZjqoZ<^!~@76FF${&fEKSXT<|5-sqm~jJGx6#!~+?$Nm}%wfn;5Z znT^#8c1mUxck5gPDQR`CAHyQ1M_A(%yl+}Hr(7`L|7raf5@7IKj)ZGstKvDye2|$Z zjfex;8Y+l@s(*nGOih(Jw@IKh^pSe=&5P)leF;rieu65bK|eS z-B|arV=d~?QrdhGcQK#aCgsX}`8IQ!r{*?-a?Lt}$EI~;T}mk)snr^?gS9ur4xdFi z%y!68#xF5CToG=9X6DOi!B{ZeNUN7=Rv(SHLOYMC9B|Q4Z;APWZZ_i0U}?tf z1Pg7rSa#5tvGgQbuK%L>sjP{MsHOF#3t0)AAQ*u?Q-x557ccDY7*{S01l&NtmErd+ zTi}Iep6eS@$(8l!@z%KQU{u$XPt7TfR=pkjR10N<*OgX`@m$=c>;#Cu$f0^3pb26*2Rn(&T+gNZbG^< z<|q3g|1+zdo@3gx?0Y77&nX}(_wuJQxQ)Q&--{q5B)&ab*lCb^YR)nZ+A{H1sd7ts z-(W`kc*iU8$VB_!gfVF6N(NjK;vC6@EkWfY zp9Z!H4a@$T{Q<6=GKijtpZNQrpQ5`s#<(p9dbOOmn_J? zx%IB%sE8k2WA9T?KE#=W2=e>#M=>8!8QjA}qfO`Z`j8O0bw9_-jkik<>wNGXQ!=Lr z_x)OoHzt-~k|I&kjl(E_5dMe^3`z2m;va5^4>bVjX|%HFxdgVQZ^cO4S`XiyuZj~o zrv-C0OceU+w11q7^wk@MN7XeCXE`B$QFa2jnO6LWx95ueI=*ZY@Cs9YOrbq5tIiOQ z{ic_mpudupwEoKFCmkmN>*QEBP#%ID{oiKDKOcO`agc9-4^|1*)}}khiWUInhhXgu zjTh=76Mf&=Sin%&k)a>V)*k`;m-sJ9s!_dp#a-J2_5UY9Cag61$#vf5x};*&?>(1oRo z=c?E5K8lLkCybYp*9ZX}w)J65LO9JP1@U|DXJv4=_b(Jfe+`p-la5)>?%A6#aKi|+ zM(PwW?R{&JwHhgH$j}PrDt{MkG`LeBA;4&WOfEhQ{FzfA9%IPPMoT6At)q1%kB(K3 z@13c^`$#>N5DriIp5i&MsF4Ja!V{Qb1_#eaBq5;%V7AACZnguIdwFCeE=c8t;@-AK z3SJ{Y7PS$T=t%G2oB6CDV$@`4^7tb~36baA%{=t4Fi4nTouf)v~j^)*Fy(@nu?EB*4GA}}TT=FC8#k{o;( zQ4muy27ksruoSei#M>`E(rAo_N&)n-OGoXCX*K83V1d~u$BX_3TB7qD09;e@@js-L z4U$rgw>?n4ie3N^_}Aot#BB^}Yewl--@jv-b2y=b#76_r7svb#Z$l;!9wWZ|S#khi zs5LmDTYVC^j0-wC{Yh}bVdcB~T@452t_*++Zq$NC^$%e01f<8Y|7zewf4%V3O*eDN z_b2whlwJT>#sS;d;qTBV4N{KW??1{PKE7-Wq&wIQJJ6J(k3TY^C&&{0L)U@$c`$u1 zem+QGfO8};HpEGMdWUP&)w%$SdHlTUP-G?{A?by@aV#Wx|4c;kfD4tcvp@P{Ie?%y zAP0zh-0Ra}8M^rpobf9W)-;;ZU@pC``AHrcED1^=%Rlw5mqZyP%fBS?0LHy(7vqmM(-JgUl8y&m2BS!KVnt;zrtqS;lcKV$-!a(!s_Y36&u((l_qw6!=5 z6rwK3>3}o_8P*v@{uzzc{px2qrr_WkHrfu5g+Cw?(0`v70wksyJpF0t_Jv8}HJGJh z(i*yJ0;uBMk8`nVjJacW{}*Naaqm}zow-Z}WpfX&=m&B`&{bi7q;RtU#6NC8l&AtH zT%_?_-IG#pL2yDp$ym#SlDr4vB*>~Kv&sH2XzRPP1IH_7QM^082h0u8$ zS6)u?w5Ny1X=!%B#IdDktvTMMWk{p|(emK&k)s%xI7IZHk6~EZPkCRl$3y>*{-(P* zy~-6Y^rwZ|)hp5gSLTBEzbmo#n228DIR^%@Oz(TMH0Y&Yk8j?`ef!1ueo)LHF?cG$ ze{@EVpG9TwI}%G6uLYi!w1@w>m>pP5*kn%j;9}1U!O1SneV#l6o%A%(n<~=k_Q<`r z8yLU2GLS^jqe1w!zt<6OPW(ua0bKt+lsDN>d%Gd@EVp?VKKFyw*{32Vip_BXxlN*6 zw1&G+2#$$+)M7p<;@@2-B{|>KyEUS9{kgXJQV5LO`*zN!A0Iwj%YuIy3tXU{K)EO? zE^)DF8wkRML*u19gx*cR-{|xnWsmM@-Hf)osP?`|v`Wrth0FM}tva&FJBs)t7Z#HY zDV$pS!iz0cWn1;4w%i@pJF{{!LmB{NFr-R?dsMU@0+Xn`afQ?x#7UG`g51feLy?Y5M(+tZO3xb5neqNvoLgcZFi z+99uMJ!BSOLA`_ARDWNfV>IyS9II`YdG~Yt$KyA<5>9htbHk+>YJOwiY^m ziK(J_B+g!IR~4J%ces85tHHKCohzUV2BJRhjNNRc&h(7UP(8Mhns4-aG$xjnFBHbA zFfQ-$zj$cz7oNZb zlb=wXh)LTGACpaw#EAB-CR|POmfVw!CSfqeH)Z!d9O#7tj8_Y)#;BVkzw?Axw;60J zP!v*YY}wvSeYB`>rBS7p>$s-;dHCr_YK@%bEcoC(a1S3K=|d*F^c~|@@&uzXAHz$- zVRth-Bs?$o0;7Ufe>bWXk@XHFAZ3U{LS%)U3nrkg{W3A|Egs^D4YD80MH&DC=R$+B38Mzj*k1kK8==_fAmp zv-_T;(EajM#M-Jk_7cnZr-V3zw4ks}trPzRe=k0a2q8eUF1bAO+^Cp-xzQOg%C__q z_R?mLt`fI9v1A70$Qzqko~AFO{~m(ZQ64MZR5`NLrpCMZSwZcUYuvY>CSfj-tj$aQ_Y6+ zcF-A%o{r?u5ioHguL3iF!S@Qwq1BwgYHbFdGAv+c?^PUaMDK`M?*3|SN4u$(I4n;6 zxtJDM%%xts_0VGVm|!t(v*YKW#ZKaBBZU3tl+labJWG1NGB5OGMLY9vAfmB!f(LXQ zKeVW}kNF*Gm^g)!pf)w9T%-iSIa%zrlGDfVZ5_SZ^EE7e>*bv@B9ez~rUVy`EcKL+ ziv7tw81|O*#HoFG@;iDy%F%vv}5O>fn^5?*9FpS4uQ2l;(aNal!tL(W~Rd*n&N|a+}ThE0T!S*1h zKjqw)X~St5 z#*Eea3+IKpxUQSvy0jtXKUje1ygvxc!%sZ2`rT&&WVgb5n^zpS8GHj;X^!|!RgprM z$3CxL`^KO*OO*AxRFS~9CXDhV)?xA;@eT*{yU-{xiG2``$yZ)f=H(d+Um?_d<^;Z2 zxzXG{!^mQaZDc&Wy+Nv(`3_`hKD;>0VMO%G#86i|14)9~=Q!^TFhG3bFV4dlzy}!k!K0yLQOaUbl>EUM|dXV^qFhKk{0Y^;eg~khhpl0fzf=wqG3b`NmO!F2{XP zo*Mvt@7UPOg@#D`E#_d=rpU-kz4?y&Z82NRkMp*zP@RAy{(q9P>h}z9+GYk%_sy-w z`jS*3Gi{J1;s}!00+jdEe<0u&=S3<5O^$n9D(2TC=u5!%08MUcQ_le4^;QI$O!&p@ z88jz6cftamy6tRXw+WTv_pTYP0CB_;O1^R?2%DDlFs~fNU^)#j^ut>Hh9T3V0%bpp z+jA0tA;t3|don+H!+R{6j--74f%b<+g6ouWV)m6^BvStRle~{0@(P|WyLO1Y93Xe8 z7$8E6Cht{1UR>k)y{#)*zGoUo2UVUFtQe~Ca6)m|Xd!m7tMsi;bi6?;tOEcjYXYrd zOhd5^*)uft_Ew=e4Kh>5^JvgELzwxd`^=f5V`wYsop|a@QB8Q>!daM=V3PQti(Wsn ziHdUC!20hs$O}k=oP5H0(8PKx;=lcp+CCgC18tiCB+21w4>y`Z5(_x&Ws?nGck%1_ z;y+hn8?fC%2q4<5` zXc#AHykC6qt$imG|MmV=!hSogt>Miks%aD(Fu4lOkZJo36=1{j1po-1kl?CAK%4~O zbE@R$lakO2G^7BC$i8=IAgZ5}rNgac6~}W4`)LFW+>uR*TJGg}EHoSWNHNAgHlPQG z1%-NLr|Sn{Q04(JL|RDLqr-pQb3l9JzDz*#xOXD?`s@%4{74yDhES{L*2>P?oke`J z={CIA0&VIY2Tuxt6L|y3L67t`&qH!R4tX?K_K%@cc^BgYi>^3(1dZjJpYh$s-|Pm| zlF@0{(T>o$UVOc?;lk&D&-!*yJ2cSs;8~&9d2oSgYri*%e-M9@;lLd!!(4a+E&Ev$ zmzhqITXNp|@_6{8jY)lfsh#;WxjOKt=qXnIq_{CLp!lmV zpUDrN;4>3MaooXMXo}|miWe{T3Zaj3rUT=_?3$1E-Jb4__z&>im3#UQNFn6==2*TJ zF0K2ONLyhsND&-7_xS)o_x!*|9tX9GHzyvTd%*fhv^-go00$tbD;TZQ0o~U}2ane; z-Z9j(J4ur0mds^3+W%B+uJqZa7C@Ub)7hkhHU&+ZD}Xc<(pTsXktPOGQDaB%J40~Z z3jlV3Bim6PeM;=2>XYRQbZoD;e4p7lyAFGfWF{q%t1*kKsU@X?WJ^H!nS;oI$YX^M zJjYcWL9s(%dIR#vU&JXxBY=Y(z!P8CA)-It*;E^c$Ttf#oN~yk30J85{6bP;0G0p{ zC6SBMoFF3b>hhZY_4PIQaM)wIK$FC0+P!Lh;}NJDv_;vuk+^KHZ`bI8T&}_8ThYOP zEs!to|0k9wUrB&mfiEE)Z9uR-yYC4K;)1)CLj#TU&LHr(k*7h0%u?ko zdY5~lSpMZEl|jpTi_Jewnv}pj&9e&(E9Pj-U&VW~La3Z9tcK0QMdr7+t#5}($!L1) zCR~1?d7%nsmA5^Q94~pT`GMPV+RkP~gS^%=(K&kxkv5Yn0D0J-xSw5E&b9Usx0bfv zSve~1@d@ON#^A7jlF(WoBRwxQ+(4|rNqR?9KV#u|;wf&^HZ^XCkC9J>Mm9d~9^+oX zEn)x}vW&&QPl+AOm*u*^0VX(wCwLL9cDBzvf2PG2f96#3pg=SJVJxvB2sF#$mKTo2 zSy41q-Q9>B%tD7fR=A=YH6zH+2-@_m9n|b-+8r|liJak6p_k_HU8~~G7G!Z}*XtqY zTjR}d*9hVMNOvW<3yUcG?G<>$t|#BpMJI2VRsJ*VEi*w|^7S$1EYs>-Uxt75kUt&% z#kjvT4dr3j*;ssQ$JkC+`7|7>(I{&o=9B3al`S&Hh@2{jlPvD6+p2(k)L1kX2_3>C z#%zs_YWF@!?Q)Gb$F{GDl`MF6hFG9oGAb&xp@&! z5)x+7Q1IV1iIRBM-`%;ub|mFJZ5!?I5a!0b$6SDR|0x5NxQE5CqzD^D)m z|HTdy-Y57vpLI;(KgzA{r6No2?EFY%ajkuj2~5Xf@*Fa*TWUwqYKUe%)eg{|fpN=v z{Lh(R%N@Q2Ezg%tr6%#zfSZES!762|Y@uZBMja1FS@THw zymVZRh$am53CYmy$T;+&-9>w)Z$ViVMXujv>cvm5?d$|UZC@*2Xr{O%yop-yrR!%O z+#V!UN43F$>KPdxf^U}^!ci6$Rcka3N92j^@@T)3XN?-SK*!Y#!UhpDLHkTXNu}a1a0S!41BN zE=1;j(rdXEE^(=Ff$IxnZmGNHSn4AAyYZGe@wL}g068B21#$=##k$s(;^W7EWpcNE z=Cs)hl2$k-ZoYaHiTd2n9S`$1`XyZ#dC6SkEd>lI*0!fwd^eLxUkg0JGgCV3kkEg|1%6_J zvg3(^#$DMK@)O;>>_Z?A<{3yy@YV9)qns<JuK@GUSPIk>_L8qYVB)YdVhqSq zyEKV(1%_A_C_Ma5H@|MYwW=k+-%*nP9vC0Kxqw3+9*7JKpwbwVIsEqn&`aDTf=XjV z1ktb28Hu~VXT6(wh2p%8k@CqnMH2cqL^$@sHlsi=8H)RDTCsb|7s@VM!B={HH#N21 z4&EzD-~Q7DFO&p+-mgr_4YzKhvE0^7bmAoVf@$Fe{jC{JQI34?!s<9i7FQD%9yMZ5D zT$zLD#i@g0`oR)E&QEkN6}+!$)=PefUMUd0QjVqdLHmEt2M&467{xLjxUpebauPh7 zRPj~>iH(viyu6vJ$NV@u+gxk41X_k)l@Tp?-BfcOMb-!T9CBhcL5yJ)V zF%RuUR_ysVdx2D)sZX-|;k`Jay~MoA&;ptP;8KrH%!m|hyCgYv4Q$2j?Z_O=o;RwR z*ZNLI!0+;E17hTfjfp^qQ!-#fmPndIc}lSS^K^j1L?8|)Jdvyh;o2J; zaN#jIB@N)kXAIf%VB#!?N|Y1JkkOQC&+cyAp-M?~ws6zmETH4-aLNQbrKQmPs2l&H z*>gXz(>d4P{Tv`f8fb0WQ(&i%6DjTJ|51XS2xMAG8H1PmLxs-*9=!IP#-HJXFG0w| zV8ItxCgHmtqIC(VZQo5r&9{S-DaCjGWOrURz=AqLbBCfDLMUo}jNP6AZ7iWty{VZx z*$6Hjxh#~e_yin;=$;Jt6^&2SuAZgP_@|?<_A%)MJMf})GSCl61q+cWwzxEMC7 z$yV*m<%Lx|fWW_X>Ym1M!{BimQU%VHOv>V^_E&YWca+jIW*pzGNSDY|BmY!A`9NwK zlNo&v>e}VEK=Zh|c_lzeD>7BUVAh0gX~Z(&DPegmNvE?aHg51eCk*lA^{}g77>4gA z5UHiz$Z|`pu_%1!%4egNrWhazcP<K2s305W+H2TF$$XBX~`k(Cw$Y6#tg9FGjrYx>cb8G^>k_xC&C#6<5#yY zjSQk_WwB^4xo!xqSGRT)ZY(_7trbJj5z7(#L#of!;Q77b22K<;aV|yWRXVjrwbg)J z5W}j6OWze0uY_mvF1!|yzjRvo>QCPN@yB-_z%qu|^)mb7xKB}lesI6>d!DuyD7lUg zRWM5G%SrqhL@dfRsO_t(G#aR^%J>vf?_y(#C8qlZ2iNSw?*xnFmF3>$hazh5J>%@s zIx}Q1sg|EfV(jUV%RATf-KI#93%jDRWldoLoRoc*Oa9vKMNaCy*Vhp>&fjxALz;3c z_?g8~7B}KbDvhJQy3|{;Ib6Ei>}Q?0IPk1B;{9r$1w~fQ=BoTQ_`zVZ)*A_weO5(M zlKQ$*ZS{0X?j9>INwv<9Bn>_YG219d?5bRU##^d8j}RO!Nb)z1HY`)!YAh8G@Vty% zkYx|vX`29zALQ2TyI*uB>LT2gJSo<7Ck)K%$>OYaGh8Q!kT&n$Dqwq9#2xYG$2~1a z-E(Vg`%Y~XY*)2)oF#Z`^Z_hn;#J2EBAeeqe9g+hdX%~S2VQ@vi|6GPW;giu}xrBd-~7w2CN_%kT5bFb6h|(wJ6tS?q(V?= z(@hF9)5TdWzBAhhZ_3RS{gkSU zY^&qwhS4%?5=(`5gINa0{>>&>eY(oa;W9Q(*9+%{!;rgym1`nzbrtzfUcLu6Q*GL1 z79$mzUCemaN(vH9Arb}t40;P&8O{S#h~5~YE<`T5KnrT<0{7IE|8`XB1E)%rva?^# z{;Bv*dynq+@pGjblI}C`4?4U-yHjT=Ez&^x%G*a4QhpBy=4-+}p@_wTXBD<4Jy%%V z-ONG^Zs!h6u!t{vihbW6MD6O!@yJbc?o8=$yDl$Ag+#DKyKVQSojmcWu(Fv)p+1#7 zkp$SJtU4Bdx<)kt?5Y;Ag})%>$);hRU1jFBu@mHHh zVc!1qE+jJ8bxH}s9AZ_UT1w?S@Ao$5P4^)*O$D-m0r}QSbINnOPkcDRJeNYoZ75Xx zR`cXX6S?I2$NYU|`R<)e;sIKfW*HwH7gIuxo!q&-HRJDDpP%dD@c*#)=J8Or-yitX zo`g^+TV+s5sBBr=FoepUEnBiq$j(fjEXkIUlD)_pW8axV){uQ4+4p@LhMC`WtLJ&* zd4A8g@ACWW_xX#LG53Al=Q`Ip?{m)koI8BJSV@1a{k&RlpKA9kU2~kg&w6r}ZQoSq{^eA+@=Yq89u`+P;()rB3+uh1bP~*KY%tT+jm73BASWF*jgn(4bP4N&s zav)H&j?Izc)?SSljUNqtvfJ;mRYbbn<-g3$_inv^w*bc4XQbltnZxWZjv4BZ*?5YBG{sfi8#gY@5EqCQAf?d7YHwhd40S$iS724=f zA@t=dOXSijG&1OERd#=uWiIK@6|>zZJB`>IW3W7G+BVn2FRm=fx{@R`XrfwAnQ#ZY5#zK>f?2)0IVoJ*HpMu zh#(#Rc>tV?L=mDp;&WlUh6tJy1;dkK>9& zjvQBHN_@8NB{{k;gTvn(|EW&j&pw5<%#$)1&XhlbUNqRaPGwgD#M1bGB9>~PE!8X$ z3QUe9DMs+_U@%4Xz?HzKnF$nDY^NJkYZjaC80xVV| zChoKq9oCVxU=YUP)>>b}g=6v~OjNEwp^}#U=bL<{EeSP_sM!M&{!zMiMn)otfvS+k z+RD7BNR?&A5cj(&E^qv(icm2^M3R5PjW3~MBH~4B0z9;v1Jb&iHFwhI2?7a6S&ow$ zI-Idj8M|WHUr*)rs?K+AuBMc8kTD-{oskO^eFJl>n-N)g)jfT}*k$&mLvIb2%7kUf za*j|xW4v+>fdr3yoB^4f=O&6&aB+N_cjafN$y6opaa33Jcs!CzRd<>>xBx;z0J$o0 zbyrJh09?uWPOD|r@D(vWgbCS_K95`OqlHk4kpw9WuRN7j>!Zk@IMV@AY!=iG@5=+T zahZBW&YOM)>bgx;AHhawp)^DtNKsu)@pdy=-2rU}@Yr_5d6T*b6sBj{M10)bnGi4BA3gL$4+;_)xP+DJzg{yime3C96b+vCFm- zS$MpFh?*m4wsFxf)Yjj$?PJyzA6N{wgEz@897U((Zm7RMZxvf(@>H^WpUwpcP?QEy$3Z4B^n@cItJf3`FnIaaor_SEV)25N<3)3R)T7-(6ES z$m-|1A_AkwUzxopQnFZwQR#LuPma*7S)4T3>53uz6Bp$`u@E z^3_eN*}1ywM6HI3CyO~ttV-3AwDaS6Okj@eiY)3jeyvH%1eQk+MVIFAvckZTy*%6S zc}-&NDu23BQ*8CIFhfr8qRA|QgIU`5uX?j#?v1pj4^uj;5S>{=gsj`Ab1THK*y8C; z)Ak=yl1Ffoq}Rq1)-VR))xpDLQ5VoPBVG< zJR=*u_GQbW5wz*pxbcS2g_5NjQ^%G8pGtstl3!6ttmmoc@C3$^&VuO(4gT^HITl|c z1TiOq%(Vn&dem21F{v%uwsjO%H66`Lz=u7FuN+~=;|Lb!|0Or=CMd?6c(Z}g6b>$iKFn-z7C6o4 zby{hVfn324M&xD}%31WHHkSe6C&#+`d;Jy)(*BT?WDr2|q3+E)fWQ(|WOg#S9I;h= zULprJt-3BTx6jFfREax~FIh+{O%wSCVoy?zEDun@ZNxD+FTm5wX=2Vz(=QDLOw{W> z7_3M}v9L+|f4Jd`T8f%aY+%yzW5K_C5o?{vZU5{u!SbsD&GmI%df!4A5$Oy&B` z)oSWBwuNNHq(7?>HP-;1A=u(aU~?8v@)$U z%lhQz{G?{8i8HFp^~w4q$em2n<^DtZ>H(m|{hfF@#s}$G$CE2tgo%WMKu}bqX}7$U zjHt$OYA7QIgR@Eq4;Jzj%#O2dVlo>FPu2^QN{RXtgf6obYR(lglUNB87}=F2AL&Yv zGkI}>Bpcj~$TVVd`4*q7S4}IAv?U-6dRITtLO~+KdQ&q$@abWB$>pB2+PR_8e7w{~_i1XD#v3X}G^f?YMouIbvz6FSr)Umj(@spD+~Sak>$y58zqiP2>F9ZKSF`(;N#O)Fg@8wChNB224>|% zk$zMl>;=sGWVPLbEc!;9j?Hoj=SvqMTyFn5|2+I1oJM!Z)=9UiV#2kWk=%)0akgXi zN!e-mIk*nIsr=?>#PM40+^OF~Z!9PW^sWk@UviiXL;PHEh$_V?<46;911POslAx+ zZ-~9%sGakm*lj_dpvd%Q=}R-8b^4vw@<3xwG1_)*VsnU?vt2i#$$L+WE&}8p-3tu1 zr%#}hIdlwk0jb>*{o|B=Kdxg}Azk|xeT5wgbRL4YZOR~BYx%7jW>MGU5A3}XEQG$z zu6RUv9M1zqsMfXFr%hr>(NR5C-5q8i7#w=%v!Zqr%?sY{%o0EnAx_R?IEmURvwirD zw+AXJ1qd>}4B|!DB>zw|uU^(t=LoKWM zwcs#p(1LvK#zlpV5qosqgxRc^y`PwUcm7@EO6S@1;gv#F2?9t#D|h>YqS{~v7bX$e zhE4A)ajv)^VxfDM!<#$IBLBMlK-D}ak_&0oJsl_-F;u`+xhx3m*_xrKpsi_kxVhE_ zFwcrUZ@#|%mI?e*i%TlVJUQJEz)+!!R;8$Oip>3&@cXX35kf!o zJ6`M(j&C*44;C!uqs3*JG!Kj!D1HzPhABN|x(d|FG`XaB_Us8-0$Pd~oM?nznqSE+ z=4WvnYIInCV|+228eAEWw*gcb^4G;336NO7eW{S!g0U}NPUP~H@BGA{bGy8f(SROa zMj+O-zGI{JIdvUWbB&Ve&!NUmXTpVpv1tBijCOYmR)1+@J1JpD6VHzi&2Sjd^Khxe zCVX~OShx-we&4o#V?xrJZf$sPGWn?50d%JN1MK>83aQ1iWMp*y+a_v)$8Nd!3zF>C z8$$bdc_7hy3sOljmIw-T-7h94g|2#4N}LevaWKhzLI@(b~JT`NyhH_~~d(dBPG(YtW{n8(&=eTbEOzBA2PU)aH zcb1YF(}dL@`frHIr(U@3U&^Suo9k^TQ$^7g8BiX$MDWpe1%uUhD~%9sxvUJoxobG5 z@b9M^?3b>Pqf4Z|1Lb{>LK2BWt|mJS&7#ikgLAd#u21@bAs$&7sOjI@vHD5Bw7MUh z6pRa!#QNKBBofCa=%W2i@;8X5KGjQ>$E5Ox_gfHP^__xA9&~p-aJ78bz8l2A{ z@9}ctOzMmi!SPzVwL+^s&L$x#%(+2V86N>a+iajN>I#kGTh@)!nGn81mYz1YUb z0>uG+aeh)SiB*?et8{< zj3JntA_6y?R&%>@KHSSct%V;H?r-#BP3Y~Jhs4Hk(;wsyD!r0vL0K#MtecZJ+u{iB z=uFE9BW1zR4RGe}Dgc zQO?a!Yxp(wd6jV8L$JYfSl|1J0~>cw9#>m4+ADW#^!4uQyc!-h^&}zeQJIQXJNz-w z^R$5{3)U6)i{gEI4ZR_EX-~4Mr|snPd7gUkvJ4sdonKNx9{+Ur^V)mKi>V9$x(;=D z#m8@KDiVXq#E{|$mPWi8E=dQDTviV4tH3xWJF%~|Dw!ZPx5V-|nND7nLD=7%%(xOe=9uHKNaz-6S;iqq2M=)#9fY-^lFIjbI@NVf3TR?fB=%ATb z41Pd)ZQh6WS+d2(FZ?*xfH~sLW>DczF<9Y8Zcyo)a*)E3foWZ?Y+0}D+x>8Lh3wDt z2dV>f!zHyW2LJ5`#umGD<25GANq=t9Q9yB!Crqv2GB!&l#}?UH)bxJs{mqON`c58K zRN+hwiJmy|jCARp+iIV)nh+@*5zx_A9SokCa_gBnrIT!+XLf|1x!1m)qFsyF%`3E2 z*oWNMM65eP&w9EK6%=@~WQ2rDP($mA1&`#;|D$vnu_GxH!9!|_@7F9gLUWV;^`A9G zHV%PiN>MlT&j=E7;Uasx_!{3cTV3JUa_?2AZ_g4}1_p6QS9(T2QhVk1he{mYlpDh` zq}R#LgC>Ea*nk@{Pb7u+HF>iMlIABKHM3%-G<}^K7+t&7DgJ>&sR1y8Shwx&9VwtS zvXC)!)O$84ohoUy_e5_WZap%L?sw_&15Tvftgkw}$TCBxOYD0D^$9V=lEqX09g!AfkvPF3mke{sLjMfQwtgAny8lkDB+`Ei9DF|V@G&av zibdF5+p3Fs%*h4p6`l{tjlo zLS4>IskM7={S|pakGMe3+sKYmlHQ_A&ybr>5bf|b{uB)-)`N&LEO4KrHrfL+e1x0I zKm}wt{lhn>F&^1ws;k^z;-Fjg|I@9Mpj#ys?)}l4^ar@^Vgtf-)?yBZ?pwh1^~dMp80LsOBN=jS2T%kHIg<~hji&moZijk! zKk>d$u?tekr5MS~Rl#bu;!XlsOJ?5<`6rSjKo?$fAlYZoZRZMX{eL*PV&vq-T{{R1 z8~Z{d)Wb+`m;<-;AxrUOEwpOF`de-3S3*q}G%BHGgD+EivstmpSU_RHw)MK%fy9W3 zSCYZ@d%CgER$WZbsSM@Vs<)p>muw@14F%#(oCnKI#@>(vuMh>%F4*UWhwVUBRd7!`^5h$Ly2O2y8 zm+tf1n5}l2zrGF~Dn@V+vZ&kNZZCraesmUCu38s|0(8SO7|G-<>GC}Q$3{xR8~vNx z0^qR(3f(QagZcdPk|1HY4FJiXMY4MDY-!StZUxJw`a-t#43h4WTPm^F#VbjcY5Yi5 zGg#Wmm@U~J_wpUsd0Eh-a0DFnU54@7B))6+P5NhV)HRoKytn9MHC#uWQ9+`2r_$N1 zVmmh3t^m6Lg5VpVA5t3oYWscz={$#69(k^87q?0F ziqf^6FA)5I9BAWB8;hhSIJ>epjQZ*19{JvU^0VwEtsq;Ui@34F{(z2~cXE{p5znAi zUpez)6?()2BC|a4C$MWddR@&prkt+TV7*L>l|zgIhdp_hjLSTi`{(#|S*X8;Us7O9 zxAfRD8f-6+Y%NBL%(SH)^LkTxb)_NmVIH=%EM&E_g|PGai$!Uct)(-2-wbLjB5_rG zm%VoM0YNIndmc2yg_Q1SyF7ydwqtnOnH!iCNeS|-K_Z7^>?O7bQ|@(TISuRayqj-k z$@Ok6B>TQ?@T35<3eWdL6uUE7ALD4G&ym5d!(n<;?rC@++TSM?sGgds(G|$Y>}&TQ z^=qs*W(Ci^WB=S#!THX57e~4Mqp?f7XtmcrT<70nI-T1+U4VtNn9TkbRd!D-3|`N+Nx&& zZ%{KqNdERCw+|3pl4o$rZ^=s=^F+8;66ZR9&$S$!>sl*HpYJsPI~(%k*HB<<+j?4d z?2RisP!e6+_zLLQeAM0BwM%ky0K)5w_cSH$x*buJ_b?$x93kmzBq>eY+q}us|tKrL2X~<>t zwQL^dTk%nXO{2MgCm%>g9|vf$?#$V(zO}#fd|e9?_w4;Tux?5Cz5*-MWbP2Cpv10M zi?|t%@I_H|iw^d-mIW+uTNxf@DufhT$gPM*`WgdmWI;b;f4ZE6cAh}n{uaMczph2i zzxBa`=C5CR{N4gAzbp&Dgo~v;VX2dexCD8o#Ql-dyQ|&Lig*^|9F>+|gyCNaWssdL z1jqUI88=Z-knrqv9ceD>GNPhS^2`48c+xROV1MmjPY0>&7L*fU2lhTnhvJzz>m-}?q3G-j~VaS!OfLD4U_k9*gtKb~`!^bXMS>bT$dt$0V8(aL?~Lyd@q< z?|ru(pS2n_y8;BZt{(ktH5ZV?;3rL%G;$tWLCut<3-9HwWfVQGewX%m{#}~kyprDX z$0VuNt{gF7sZS_haWf1U_a?~5-e^hSUp_Q|t=oak11FpJH~aJke`j~KpQ{kqrE zfjUaCz+zzIr+xXcl+RH2ZIL)N^|nnrGL{G60W+ulHE1ix0BV~>6wc%$I*dtA%ft^b zF;(~;@80FzrkHN0F=^Y(9~9>w!BC1(D>~;JcA3A}`K2v5Am2J5rfex0w3f|}Xx>@u z>Uk~ApeN7Qi|)vrzY4{)+g0VUd^E^L3|0n!Ckho^BG2H{o9^P*>n*U=d$hTprdOtm zJl?_|DG{aaV#WON-?9-uKKq`OxTGLb-7tDw*zcc`LH7)?@A~?3-lV&B%$j()7ki;) zazd|g$G8|jAAJM%AKyfVV7+$>Db_dzXw8{-Yak1MaQ8HL`w`>*vT5Be@!XN&wGA{9 zhp(w-4e-CzfPeQi(dM`L)~nTN-n#ogT)DaSzy7tmU+r0WAa}g^u?O{CXMI^EPMyD( zbrQTq{qhGEb(J^KcPrlxhLzJx*Z;CiZ0fJ{{+mp6^0CuG&h2TeyI!B0ueIyHqQC*4Ijz>+SL~bpcWtILIR^qq06-#ax z=X(3HNaty0++r%0$_7!$uf!0#epi%x8;G; z)_dv~*Vs3U0)faQ=Z8I2ZBEX&-p@*_!tBcmJ-1=Xdry6+efK^2V@Q4m?(+*~yHer~ zVNdwd(XC}aQC0HLrH~@`*|;Z}oLGw4ALDTo$sOIQ+^_buvGg>S?yG51RvDD_(zFoc z{(>{g<<%=KpKB@QENlAgQ}+B=ZD|+3nQ3TW@y+?qor{C?oJZ8U@&ES2td~cuaX4N= zsQF(7T7*r}EWB_lM2OEkeOOg*B5Pc4@~wnYE-o%Z)MR1gxHD&oLnH()J$db}9mMJ^ zhw@rxo<06MS3RS&!dhu!KLx@`E^nsGtkeqQF#d>9!C{tA$|>Qhk8h5eA(v*g!b9@z zajMkTn`lWXDsmhKKS1+eNpUXu(?h*LUGj(gD)|3mb7Z#?Yv_#(v#zD% zdIMj1%2Y8r%==YS&x3b4<4vXX{&l$_50S9|+0J(@Nu3{Ovta%ua(K`B+EZ zATlC+ysItp9cVKeoJiPv@G>VPIDW-m+8N==&bobHZzTRKJ6fhUKF@eAbv`?^A@#^m zr~maE^Ben+Y(f_?bG5ew-tERxGrdv68*wn+aqBzi|AlMgVvt|LN5o#~kz>d=)l$me z1b=5+JcRvX$aZdy@l&AVduF5um`Wyrye4x(5LxyXbX2lA*<#kp3+YjAIJ71hOJkx+l z6`0rFC=cW~(b#wz3=piDHr#tKc5hdpP{syM*W*AvN@?O&3T9->7FMxY!5Z-Q)J(OM zT>LCTJIgS~-&Yvn`EyJjP+=duJn_1}y(8|8*hc6bQ!P(jgRloHb7oSBR>zV5)j!95 zm&PSKa|S_6Erzh7c;winJU!kIx>#{@1}6$9YViS|$$iL;fxQE!jHrM6kwSRSS>UqS zLc952>rF0NsObzOjp@kEbl$;E))XKO2$sZB--P-5eoMRdMAB;?B#UoJJf57X>(?x~ ztN*_@Vf+?Z-zVby1-Bkwjb^6RF8F#l{(CZnZEsJX)T68{G&=yzWNfX!<%GB@cMP{m z{J%YcH7S5};e*560%dM&ezPO)VLklp&v!R~tLipG=Hhz!t5Shs< zrs+GYE5u*aFOMK=*LIc{nmNY9?C+RaCqV8zlWnh_cmJxxRJycRZu2vg~#(W)|0_z%G5;*YGK@{QlN2|Syr93<(XU=ODWa+e~)d_Tin62>AVanoT$o7Z_ZQMcTOd?AH zYh{!uRlEdhvuJK8NYRsvI7iTn_Y9tx3K4g83dt|~F!yoKs-W-L#GJ|0LXYxCGd2`pc#0Jxp8Qe+2qCK|i1r*D8@ zp9Q-6Xrz*;>s)3=O9i|lZ)^9K+m8aet9%&U1!CQ7=?4uF|7RuuYxVn(=4XS4JV5VfyNGAd5mR!}%@@Y*n2mOn zSFc@nv7L>PFkAs&dY01*5wYgyx6;bt534?naTvB@j3C4@A`W7hWRbv-I-={r8opUP*Fak8_cR*qBi#<+ z)zf#t@imay_wgfc93Sn(_sIUaN_Hy15>ng z-1n5Vm*v6aB}YzwQQOVq{pq#hO6qbAj2_b`-2M(qTR`eL@l)E4b5?T>gb^CfI#B%j zwQu(fVt!K-s1t`??1{$Mae{kq0Jf;0z}aV74$uRDK2BPh6{5LRWMtUw)y2v zu;6Q$6-SgJawDeSnRF>WLu*r!9}vgOSe$2$sitZjPi0BM>JLAkTZ)%p`+{>Em2H$} zaTH=&o+^_Hw^#CJlejXwG55ik^-iJ$iYV4!-;JOOqbeqYImW>G<7g!o6Xzlj5gHW6 zEwdd!*<6F7@0rN)TMd0Wz;aM2H}XVIm#L{b?@~pu7c2722TiQ_Mz5UiWmD&A*zNsp zMSwdPVWZ5TE_6}vgN%Qq;PVzn{T&Gw5QY3wy!!~{GdtAsn-Nsg87Ll!Kp4ISwQWx^6fIJ+C0qe0b7p|8tzSs?YZQANiG^Il_Nhbbvllf49s zhw+aV&gy>nfLgAN_fWzPw=G zB2B?twJER$G}8B${Y>O62C6VfM=OWX?f^uGfXKm@Dkm}JffSSNo@;&Lq8~I?ZofS% zhB#W_ymv=N2uOI29^{HVcO>6W0x>f{Vs9u2-xAX4`Q6Mag_p4wWEud6*w_yF|_`cxl zMfiOvTFc_$k*+e8SF0U1n7N6!1~@CibieT^DK>-K(YaEyZ^b{&r8DDEJyi+zPQ-*K zqh-DrKi_;;Pv)z`05|1o|Y0gq5K~(abJMeOSH+O%>EI(%{7{IJ3eTF|2^beJ#k@nrn zSB%N+q7` z`=0&1YX1!d%1s*>k1aChU#Il;Jy1fC?Or|sQeAE(bdOMz5i`BRd8}UCcEWL2KTaz$ zt@Y`mOC>oEWB(N`itS&b1{30TSpEItdyannej zuzSzE*K?mft+cA>BaJ*#QTt(5%osWF1Gwu0f5$yCAkE0|W1Q@t`J*R-{tSB{z4`ij zH;46#Laslv#Mv*%wN+2FbfhNd7|@ChY@aUm3UnrxF%c}p%|3B8PEQGhDLX)c!j?UG zb8iD&E;EsGa=m~%U=b&FWt)`-)URE|Zx|~c;!^#Tu8n(L7r_{@%7Q*j{7BT`!sFNGEeTo|&# znF3Aqg2!<6wELgt@=tL0xVCHeM<66h8fW^a)4^eO%UG|-x(PO`UE}1}+b21!42So; z_Bz1hV8fubifu3ObFufJ?>UeiS7s5}k!lp)3sQ~J5@zh+*wk=* zBepq z=4@01k|XD9=a#NVQX{Qr0?H2bkxFXP83DPwuW5deHIi0*;q7X`GqwlAoDu{_hY?+7 zIsx0BwN(jaN3+^Re@BHpLaHN$Vy7?SmL_1t$L2o$m?oJFI(%n0;0|~-l8{Tdj>cS3 zBbONaR=NJKqXE(!`QXgFEF@(|{;4ZlzbFHN@Ew8dNi-`!$xfMSxxz!*dLw+-5t|H` zR(L2Lq6VtkvGa8xL@7D1WwpjyI;m@;bv;iMjK-xxcJwzK8r>Kx;zgFa&k<@bfaJ_( zRL}$5dXBw&1F;+HMZqZG-i}>S>92X4H{l9&J84-_cx|yCOPWj$R=O<9B)lxAONMcr zo-Fed>^Y)CMANsB$G^8QMmj4v5Xp6f-fb>ZwwMpdSoBJj@L2$+0hjq3NmsWoP>RTd z^8(4mVImIECUO5$E-)7k2gtT+|9{xWEejeAd2`91g#kVJc5gnrGVwrjmhOS*WXyF0 ztK;%*wl1IxfdNDt{6{bGyN-jE%`4r7r+Vm#i*o(87?i^*YtwV@=&`UK z$4cgYMAT|e*FagVL8U*1U_ z0txUmf+umx5}c^GTqafp@nIi`PT3D&!eJ;>J2tX@#~N%umvbR^APU zdA9bR*iq%2AO|sT-)GgWOu5Cb)m+>R7Pb!WW>5Bm$YCkGwBP^JTT%3< zx3k|1{f!@mjl%`>#cFF5GL5~sQi%rae2^Is-H>JTQja}G_Dyq%i<3jEnGU06;qt4w zccZMDxww4r4p11PMMgYot);RoeAdM|uP4R6M+JUHqr_Z8XleXFoBRU)b&xnCk*Lk- zo^96d?z+;GfYRqjn&*5kNX_8`oH?$6`fzxbXWeKA=Lqku>)BtFNATyR-7 z)1`X)^lAUc&6Pv&FXIiLu|x}@Zy)1T1ll?LvnCju>A<^HaOn#74ctK2tT}@gy=sp= zT-|z9vGn8b-Gbth0T%N`jRwr$8A3k^9x7&nGn_TZzcmE;FCA|=1SFrV_Xbky^_w3z zQ*@mc8m2=s2wD90QMa=uHj)AYNIK*JgyW zUkzJ)8Cds}jKoes|DsV>5`#GC9XiZjV15vUn^f+sq`B~kQ(S%Ui{)$dI?C`0eAz4y zIl@JI!87=_V={cfE+`f!Q8e1yUrJt&F;^sJex}oON4PAC^pB0QTq>F-j}K=eP9~GW zWRw6HIs~kK5rmSc=`LsqX^A_U)u6(i?y=t)`7rCkwNV={&R2xFGaz&K8DOIHVe zI*~55gd(m$Crqd*31R&~wHxrDx@b$tF4F;S+r~`))6%YE0Up^tv*ddeaVJzo9gGHR z#PTW^rKs#eUu<_FK*--GJ9im{0{$beS*!EBKY zzHS!DDga!hY-z<{fCL?j>ri7_yNAPH1`P3&Mf5eOY`(f7H3b^NEwT}pb# zN|8Qhg^l(G59iqkR)67%&a&hbN-a@E^Dvc6NUwQtzNo(#s2{TQd&8~J2(ngb7nL&Wq2}YiU z!eI_fu1hv$0?qMWx|<6FU*JdlhJtcknOx>h=}ojLl`-3ldUku_PN0kA4YL}2EpjQm znC%=oTzt6Ck+Idj=4MQBD0A($z`6>pbYLk~du;6SgSPFSpFVx^Gz#ktguP*MY`Js2 zns2a7MNONUPIS#MQ-$%B9Ik%hOBp4(nyzi@*X~;*{O8pW(p)92gIO`$tp)^++X8NO zI#E6k#~ovy6`$tVeqf=%6H>3NXSUlvxP1+ZBs#`J0qMbw=3pLn*`D*Yg}yavHLi{N zu+veEWWqD{ahL*wplQ6ZgVfOYV?lI(H2R)8;m z-)R*Hupe{F(2f#AJT?ju-a+pKqL-8c;q&oNM|TikH=!!N#7dF?l&=Fx2~>bvhWxFW zSzHTXJFdf{&D)I|7&k9FWpB~w{_+^$c39xW*K-lsJHo5W+~A7M%7-A@sw5b3g(&N< zz-*T9c8+)TW^dR%X~4Q8dpW&6^y8Rr)@>`Olj! z#ei!6W=C?@RxcV*ZL$3|V1uyEN|WF&oZmNSsd=oGZo9sK+mWC`KwnAgPWosTxT3t$ z*{!sx7z_j)*CSf5B^ZT;^z05i2d(|NWM^svuznZ6g#UQU)E_4eEDK`62KwHAzN5T= zg!pT$&MIM$n1Cu_D<#1Ot=c0@0ULD__I-npCyKlNHlb-u7wFMuckaC%WVuk_yWX3e z+Xwl&XfIGJaZ1R%cQD(WHc0d2T}XMfsn2vTcP>h)dA_nCqN#6zA%A~v z9QfsH0N~&(8DLClq5lD@w90S>Y!GoqK7~y(I_k#;DaNR2{`{>iHpC{x#zhfSYqx(Q z*$ix#F1YjpXgrmzD*4-2;B1oLNP^bR_2X>T@Y>wnz8dJX`vRrE`1{!%T$uGc zz@#CkR4lfbiL1FpmOao0^%W=Dg1ZEL-=KAqCDR@Az`^aHOvDnR&-6I7AaMU5Opb^5 zz!l>Xk3xAIHx?S8@o(!*Pql!vY3U{dv27pU{C+mIk3UfOJ_-A$Z=ZZ|2PnN1@8|8v zLsA0ZyrzKSBzfpoK$ZFoqQM3c3I((Me{)09eBU4mKOKv|C5@LbK#z#in%q0m2=V~4 zH(d_?9lGGx>%f?cwPFO#@=q4R&tV zhOBD#^Qxl4;uEFcM8p@!K^?=Gk3tojAs z%O8{=2dJFhX*y}5w{oEnimyE5>BNt}x}d|P`azwpEmeb-^Ocgt{O79+|3>=w@!2nN zKmMqw2NDFu_%sG&A}F&UY@vNbMmGwzmT6P^e3+~BE*4?mM+t(g zVD+UEKTTHbO&2TA4g6=a@>T)jFZ_5u3bBRYL4s7xaSaEdvLlGoDEDxw(Sg^PxmfK1 zueAC_s(?iJBLA;$o}o9J?Uk>PT0XuC)Usr*XV!zidiDwVOCj{=Cifp?o@|4IzsOej zu}a-}s443ra>M<_VgGqr4rO;V%H+ZQ)~{Hh%v1)_fG>Vv|Al|k!yli0SI3cXE7M`! z-^Ec;ziGr~0)P;a* zQJ&RcX$PMH*R`jN`@M)wk6b%=g&6+Z`ZyUM$pFYOb$|>r5`3YKhZ}7Xp(}uSY=Sfi zG@sle!?e9#mZi@}HPZ&M`?pM9?S|~2qubK*+7u!}d}(pm^B?-{sM$;MNErMtv=#pN zm+#$$R_9H(yYXGS(|1pYjL|R#t#A2`ld2y#xmD9TmbX@Ov=Dm(fFsB6Uh+<4ddmBs zJq+Y(+;jl7v#GY2(++6cU(N^g1pv??eD%s<$SEC_1pwi8Z=f?T@M+;9(R(1=F8|$2 zK5Uk>R^R?z=(1YCsSVYP-`{po$!I|c#ML2b`Jv1DUid~7C{V=ALXb;mmS>*!F zfA_z`$Gh+S&Hs)Wfr}RRIP32~+rm&6B5iCLBx=dG03;o1WzIjK1RPQRo+~H8(z<>? zF98ae*FRum72wrV!zp(_FDE5{6>w96cOdQfI0l?>3}I;<2jTc-A`NJ^8U6vi94m5O z{SA6KX@HCJtVVWh_s)_E04NRZ9p{C_b^8p!$JcD7XFk0IKxyU)B|xKK1m$qR5mIjGjq7!0oXr#nzL4g#Kn1o;-|vb+UP2;F1i#U;4_g*X>u%fZ;?|39kh!Peck z|Cj~vAJzSj>i);l{>Re($I|`>82kqq)mgy z;pI)cc;00peGbn?1;&iD(M1Y*qb5x*mC`BYoUoLpSzR!aE1ghDE?pRwbBg0$PNNc8 z=zz-1yoedUU}U0NoKkm^0moYX0({+|`khCxc=cUHjorOR$3~VxQy0kmQP__Dokvpz zcmc5FkcI6qGMWm)wq**fFbH2Bgff2z3;6jQYtJf`UG-w2mXiBThJ(;&y&3EgJ{477 z45s6$5q;Y{yBdRFr9G&=B3bKO(<`TWIIBhBVALg;gHc<6qd&mpqR!r!pppqYbr$|) z+`~OqwL3wFbnx-ydJp&2259QO&JH{afZ6%o-+AsX9p+6#ybr#Fq}fe}zQr!-(C=@@ zP%#RaS2exL2|lLF#Qn?BUcJyX?APK~%Uib;Xt*P-@HSishQu;{eWiu{Xqetx8QRUD zT%W08QghgI)C~h-hBc{p@!CQ>y*S+Z3yU+W`aE`_$)}KI;gc83@i>LB$ZEvv-qpl% zG2S%OF+biQu4*3mwYz~8%I$jlZp(ZRut;j^Q5!S%kJ5Nhq_7`-Lo=_Ti6#}^JgGka z?eQ&|l*PMUM?OTHBVB3#Gh6c(yH}A$=J_18t`^VSFK05sGZj`B9iV-^{oH zAEjT(yZy+?sfl8*!TkSivXnP%ZDJ07;N-7tO!my{$gzcH*6{IPO6G+{hV*!YVUy$0 z>vYeqXfaxxt6{t%C3gZ&!v*F6Jye%i3UFkHgR&+afL zdAAGM9D`)hFB=mTEt+Jk>$?QKV+}$|roYrMN~5RY)^M~T+665bY>q9Ps4OktD| z?Jaw51g1i@YlWJhAU@`Dgh5^N)ZRCj>)5Cy9wFZIcrhBgNnYLiJw?{`RnxDHiap@4 z`|@P_vC}o%4(PZ4$pQ5}E+PPEx)*$zFXf!RoTv9_jEAD#i{j~1D}CWsI$b8%FFS=2 zCUz_qea=*Bd_VIb94+ry4KuP1M_$*U7Jtq&DQGf?xeb$ zW9zI>x==Vvi>5)9Q8WeG;qfXSIz?{j!)Nb<$}9KFcNy@PIp5ez5P)wIZce3)a>bz8IU&yssDMK~pm+RtziS=V zH7zxaw@mGQUp>34nHoH-ik3p>#(=laRF8U^T_6WV?L_AZ13{N+it)}RM;{sVm!`4IM4+fT7Ns{c09maP z3?#tF)7flhfnC{~2H=d>P#td_Y`P_f9nK3!^GYpxo80H}X6tSUWqvS|X4BhjDe&@S zP|@bi0U2!;#=`So{U&V$!~SoU-XrJDmJO$_mg#8emO@_yT`(=qlQOt!z7!5Wm_-7| z!^_RMSeFzfks#?Lt6`(;+8KiT5OnV7U7vGoErdc80p3TRzdZ*A?P@4gjsNh{dI#JK zfZ*O>ed}cazh0_C6;u%{BW+M}5GgEJJKfwQj~FT!#vN&vf1OH#!<^43x!*t_=>AvG z!e#xj%zr(sru#zD0mMj0Yev|*Kl}uIg2n0!Iaj<4?ss$%#rrpkoM`DJgLnZen0IbY zfRvBzW`XS~xOpNHdfkQ#{hesW_EF0#4!E(n5}TblVbE9!)jl=O4sT0zK9OXFYIT(n z$tK`g&ZI-detV=K2S>Yew-np3o14mY#M8Xfpl81`K}It-zR%yfjQ_QtjA(-W!UMp% zgdb@&0FxciOxV!de6uTzWrG2t>SC=4ea*QM$HA2GG}$*?JjFtwlhUqbp)~^9_mxi4 ziyBk(l+EI8EWc*1ldrt1TAeAav}v)R3JOBpc}c_n*AJA-!4cn=(S9(3hpxj)M z)4zq|ymEjD6g7Y%V{-B-xNoPy>>jSkvcgl(tID%t24$!un2Mg{_wNCC%|ym%XEj%d`+3O$vp!!M-J!scg^|! z_NVvfw`ZKklt5y6JM21D>9+YfU&-9mhTh$P(aY^P`VaYJz-xv1yvo?2+lr8GH~Y7qhjd#D((MD1f}9-j zw46;%xmqYA^`eJYoouAr1Au`$1uscJPJC9De~|Dh5s3k9v@mZDKk;#=W&hp;%U9DH zXt474qJwjzs+1_8PaeayuY8@76u`N3Q-*W_4SQX@ids*wQnkMTf;sAHUNGR{Vu{b0 zuXVsahyvkW?-l+B;R3cq^|`p6Ql18g1Q%=G!N~2%iCFHL>mn#LRCp*kq(^A0E5KM-qa-MR%|8T^DCqm%_oHuFn zj)*``qyQV!<1uP^4Q`Dr-X53DV`WCk25H)GkuuH<$>@Djr02Eqo&Yqfw(&Um{z!s+@EGtBSH7n2@Mc?p{iW;(DuGSPO zSWD!%t85^H`xsc{&9`z2Z)R89aW6 zNt%aR1+Q{cv(>rm->>Q~QxAqR`i5TYrP&H`E&d<&zA`S#t?T<(M-jmz2&j}wsica4 zv_Xl02}(K`AT=OegD4>&AQ&hOqNt>FkJ2F$Dh=aMLrBLE1H9`REJpA9Ip@Bg-}`=f z{e;)d>}&6}*Is+&fBiQm?r3R%H2a$N;K!11QJ^B$&{8QKIQFy#gu=F7oVC`63J&=H zxY9t+)DvO*3FO-L6Vqlx$BIpkUM5@U(!&VnULPFw5aGZ3NHXwCT*11l!_|!*?rPHN zqTXg)zMO9%yZa@xAw49x1CWX$TzJ;b!|JyeB-{U6c8=xY=0STj*%R|aFvpIMGy2Sr zgfRscd)G;)qyKyY##c7C|GE3XDC`%~Q^p$t)N#qDM^tzlbuB9Hh@#HbeDWKy8dsbe zVpTd&vuZuN`r#f!wBzBqrl9kcR^uuh=RJ+|&Rtf`Kp(zpWLJu>NnqSQC86Y@6sZ4- z-HYQq6;5tz-{e$w>z|Oe)4t~YZ`zywEqEX#b#5#y_;KhVRE)Zm5{uHJ@Ej*vpc&&S zgEfuOa_LLtB1z8hSTlSfT-kQZ;6giwCR?B<^zGp z*&HWb@th&Ax&q~>i>e#->V*7aXb##oWe47@Ga5fxbQ`VjNe239*H|5vBh9p~dP4rR z!%>!%0t5*JJq1v|?J8x`E4>q^=-_;wsILoF0yjkWWSx@zFibN3H1W#C}otb2zipj>DV{#)4Q* z%he}__K#~ycRptF;EcMmsFP_rP9ta^c5u*QfXnZSl)UMzQ3Pifm(ri(yH0Vss%l60 zeAKOBmK&gX{Zr8MYwC?K)JfGVmQqASPwhr#{;@e2Y1>6dp1DD$qyG4$seyWjNu77+ zn>Vk_i#`Q;^tV=TLTq@h>}Zi)F=v%Hl)fk(l?zNuE_sk3FU+MxvLgkoFDlyH(JJK1 zspQaXF+Gd|Cy~NO74_Z@CsW11%Q*{5`i=5^&YYKtK_Tg0oiooN#zaZ@PN7&A_$bOXTK$zIJ{wQm5JN^C5Ql!Ve zf&9U%UKAYSRQjk0%6P=UbT>bD>xfWpPWHG?dk}`V;?B`6yuP54c%JOI@EX&eQyHSl ztmuh%jgf<(5%4PUOif!mXdQaXqtuW+J&v=Qn^cJaIAX{KoOYGXO{$UO z7|%PM# zrE%r^5M<@{a>$Vd!a>q@U?f}_^}aCyMxH!M-_`Rb{Yv#u z)y&R3`w=&QW8Noyj_{MruX-=i+sI2)fH;_{GL)URR*7tHBqSb+f9oZM7QXqKTrjZW z<&mc#K@OtYw~L@Z8W!Q`4axTQ|%SMOGlHU`hNRrjC~&v41bsEl3XqkLCOi zRMW3^!sIO&Q@4+6|H`BQR}sWexOT}C5h9SlmxZ-<&%exrx{EBdSjJ)QJRSrVlY&c;L(AF;VaS|2$U`?*BDC zohNdox0d>;V5-LmHGruaCoqSA#JLJ={K)OMiPmGZeW?|Pq>1aWn5h2734tWYf6Zk5 zX<-WpK=#+P?8tY(4GZn_Nlrx)g%1**(~6E~%E-t_PS)lZ4KgB!AaY{0#88@}U5B#n zey2{bAv`7uma6en7;Ug^z9qDNy}-%$it8f4vDLdczmog;5J9?6DsbVGigRQM08OP` z23=LXH;k2E4riZkBi_VwNRIU#!*@n37}~XyYt5~6Kf4RMs5F^*hIy!wVjX+ks|03C zMjd1X!214{kp5lGN3{4QxG4Iu(w`{6b?;pS;q&gwK4f~bn~`K@SsppJtRhtjPporA zoIDHuwI};V(GI(-cAZh4@+O(&)axOJCbQVE!d;#$TdobyV3jy3whJy)yW^#Oa5z599*bNMAB)Og~H^rj(O9M zwNu9Hi*lxnMOw_(AbZsP%7BVYr@}+fJ%D44Yc5%kbx6Yg1Cir3oPY+QDc@UAY zvb*RMO8wc{MM8uR1AGQ|yiP7R_yhztCF-$@m^7W*U_Dl1z2HtQn=7^n{wutt8qe>4XS|0K!vJ{UWb~ke}(`HR<3<0mf~dOBltexZ>NY7 zLalQmY7XAm;qsfV2gG4wMGoL0x-SP_yJHNSy1itjQ;aIu73$&L0^WERiA{jv#~*@*)&!W^E#Bh%s$F zL3Dg{?*&%}-Vm+9^kzN?+fE-2=zGGpL)Hzf&}4Zxc*|Kz{Uf$D;LMFKpo@IH(Yw8} zS;>N>mfMw!!)5Cz-ji)35$A01_;A;>zCKR=tSIa3qOI7w5Yh4W5z;!;Sf@LxWW2}J z=t$0oj2jpqX>=MC5I!7I=DE+OIUjiVlXs_vGWW&9*ej~((KDX{mDJx0J~^AP2a|p! z@Zp4V?>Sy?J^m+GdPx7nS2K$QnY=jY8!sF@dC}!|fS`4$=QHIX4=x|Z9!Oc952UHp zJWVpH;N&F)y?d#?6{~rmqH>nY@)bi#(xa0pH!u~UMsj0uT=(Nc^$x^Re$}_?DYcG3 zFvbH{!<>5l_%;^?mY23O&$#1Wyh*ynF-430c!hys{EGo5uJ6@zoAEZRJM+FYblBcO z1}1JnUMFm_oyCPT!z0^v%od;w-<=u@FT1wd+DRS|ju zbP66G9zJ@*n|w(nPYTuWg4KK%^Y+AF2=K>>J#}tIGNf1h=Jx{z6MY1%o=6W}!A8VF z#{QXGa)q;UvS)_Jm8lr12u!P#vO^4HCbTNw-=(UtTw)B?GQ_!g8M}27spB-5uo`clVl!>j|5+o!Y|}&L%o}oUW>pf!Di&qa`R_aE4;j7)abF`G6GWdz^OVN6%ng ze0(C(2dq-^9!_XY+CPOB@d+k+658p4A^ZN;0=|-KnIffkStZ7I%vzwnJbo<~bv{nR z*Xd>Ifq32YeIXZojEwa}6fvX}sw+sRlq&9f2}qR&vTFdLXR^8(0gqe$@X!d8PT!5* zin4V;l?ma+dV9I2vvP9vLlepb2H##L2Bpjhgeo}&cYWRiRa&%~3qEnw2*z0w7YdsK zMr7q(mR=im=lV-JFGV?9aL8P|h$4+CUt?e@5me=}znCu!niumqJ zn86LHKFivhE8}S1{@V7D-d{YwQXHVy804Hdw(=8b0K#W=JtE;Cq6x_o*S7OsX~H{AvJQC4)w_sgH$oaHxQjXq5NE#&z~ zq9;+YITX+_@KSc9fUii^T6yJ5b|%1J*Gr1Y6B7jTJ46MgEo041X51wBb_~lT{9;6H z@&={(NdI*rILdyW^}vP;eP`B}?LsEjcMKpw6?Xm9Gb8bcH1U z1HTgU4LvZ%HY()nP-oYh3H574a@peAaW2?Ny@jYlltZmrJqBCZsqB#r*oqR)j^iFB(@~><2V6fhy zkH2P%^+AW1fcF=3=~lj`9AS#=p&c}czsq$Kta6jxtFJ`$S}Td>)TdkCil3)ei&Pcp z4F3^C!7lcHCD(Fo&X1%aZ>14%MVwsNR}_;w8|^yocsEh}0=`&|6oyJpdy{L#e(a4a zEj6qXWgbMHm>;mKc;T1bWC~r11lHeVMa;GTg<>^GSD7b?^`};TQY*cRTBpTe@Ev(# zQZO;%7oBCF5imHx_csgl`u^V?lCDZJvEyFpqgZwqrnCVPYX5~k{+r{QuBjJ{*5 zpdVDzOEZc}b6{*w;8zF;wNubvkrxKj+&@O17&VX|ydb8_yO+-oOqMyXHn@_P;H|eI zTz2J@LyI#7_lv_h`uNs@+@r)n{SB!hRVNltCRwBb?B(Q1jq7_>ZaY4SX-eOd0P zZU95rEyZ}n86q>(6{G~@{3&M&rdW@Rb%ZBp9rFAIoe=hXz@D$?Pm>R5UlOVMEBae4 zBXET&%9^4iw^j=oOx@)=xqUPzy%3hmk`BPq5gG{#!eI6ihkn_|wc<$o8_R}7iX(Od zVG6Tc`6A@d?Ys?Qe@*x+@;(B_GjN#KQ@{SG$h;6 zX_~+lMyCm1z1z`nAw}<=Uik}T&f`e&yMKN(xjy%YNQx|iRa$LpBM0;&Ie=aLgmTGU zR{q*%2oqb=zF zhys3<{&Fspg8ua&`2*FLJLiIHayEg8qOeuoib^>zKlfFw;f0(_2K-EuS(Dl#sy+}ar}mulDjTN z`2>*n1Mm_sgJrtbYUJ1L)PtQI|HQ6I(Le+k=r6&0fQ%Fs6(xk~+<^jEK-BE`RaA*L z1L{-dLloe{jU^15zns3hhVXl3d8H<;H-V{h7x++MlZUH03oe4aZ+GKKyLaxjoqe{} z$8EyrW=vakYQ!x6RfAGDLbeNa^{0Zzs>-K}1=p#c+=JcrV5=PI%%u{yai1efr$3&+ z_Dz&t=V84c%{3MUW&w#I<)IOUuDR<((h^h+K9Ci5!0*Sdo|j|F(Y71z$H=HvTqk{B*S|8)HRkoj`Q^4? zw_eyEMbbZYX6u-;D+7I{;GbM_r+F8mYnT(DecILeGs%!PQBZvDwJS;gA|2DX@<|5f za=}Mj7Q3+j!NUx)eSN<%j7|hMz8z&}=k$1?DIOBa+mg-kBm@nzSZrw1#{!ca(%&&S zjXMN$YJ2KOB6^4u51?ZGM6#k7c7tN24(9s?Pk=qG-27xe-hLQ&)G}T0`G=oZ`qT2$ z>jmfX>bwCaGDC2ka_6a`|8Au}2!)a$-GI7b3*SRU52i#nAYCPtg9K=l8Tl*Ecix%i zVte|Z)AlsVDymBEL(S;C{qF48TX(Use8J6~jdxqlTF*#bt$W9az4kHu)qSuEThA_h z{GuK{pJ}ev(r8j6ecFEoSG8A;F*$b_f_28*8loL=Fxdx%CAIS=7^;FixqO)18F(L+DO+Won@@3__`MroB@ZOo zWBZN<^?y*M1r{d&i%)pVPxyGpv=V~e^X{k?+!tsjgLt5*FXo;vq_&S@ze_zLs$=KgAC6=zMmiCn+L zQGkYjiz2tw``Hwe-N^$JzEQs=n8Fs#*?S3PDmtY@2H0!ix`Z(fil6vuFRXJ-h)6wV z*S-q<^3DJ1uuKJZHOce5(~1AP!)gpW%QoR>bJZ_F=ELXYUv->&^uPj#`!|r|=|3@h z`_|;-jF7oRGS3WwhM%t7@HIiw_12qJXzAT1V|NpHg}^;$-t_DFDffc&6Kdsl?Z3J>ej+zIy-F>#}t%t>l+>)I==$y!$ST81Lg`@a`1@$kKwdpgWRY*!7#{ zxomt`X}u|IF(cj_B)feiz$G$t%K9s&>ZR792zK4nk*L>y0n+%ztt-t*gpU8lsEDur z#>^B(#m3d1d0h*r`?025e0EuIK9bw@(~c}tN%miR^$J`5g;(!VV^D$k7m;zb1jt-V zzw%(E0YIMYS+EVhvHTB;cOM4|eA`7?WpEYp_gF0p9--0Iko3P%mQLYM%;P_P_Pvma z*nI{D6v&l(`eQJJ<^UVQ7e5rA8Hb#ISpy(xn1u}jg#>=04Xbm%ELM(oN)caWeacQ{ zrx{GlJRu(oW-Rh z;w(}J#F!V8f()0}rAYmjS2QNb!*1+3h7ww^4oZQnNZmMq! z+KIS0ZZz!;rm&{O`9XBXmgtZjLE^hW4u3P!0bvd__FjB#k<2OU+nI}Fws=vErI-uD z_D{VPe#heAs_0HWD@@^CvC;%X^4m3MbrcLqs;iC5o4K$z`K|ofBCU>vfL9^8Q=73g z*x8bvo*OmHS2r@RqzSU1!$^aEN~1e7#{TO0Y=ZATx^*jNNxs1kBk*NKs&(Y* z&mRn3dmUK;|F8pj1ysli9_ZXA?;Nbajf%b~V9D9(6V1ZZqmaU+#GLq7d8fej`rEVn z9uYM0$Al^FBCBJt2D2BrSk?HPs8)0?m$vh4$@!jV zt819Ks3`1ZWE<>}Z6I{iiBN3AE@TmFhYpYzaT*q(kgc-}`Zt*-JDDA2e(>P%j8;~s z0--TK$uJ+ei_P+G|4O8_IpAE1VID}NaB71yFG~5n_;E{Q^CP+7SUeIEU(O!tb9CM8 z)Jcspv~wzP?hu`bz^71Sbxt#8cG+{N%28mZA!4Bep;CfE8YPvGxP?GuE|L(nAx#IU zWTVftyiZbsqaFSvwF{T4l^BR)pRvOv$C3*?TPB5p6r{LLMNuYQye71MF;xDDBxUx z3ips+2lo9`LqAxF%w{@UlWU*(%m|P#R#WhHrTaE`Eqh36sPh(_msp?2V^Jl}@4^-g zA4?B)d#A|5D|S#FrogL1Ua=l|Mc+D8%2zPLE2>yOlk1zo>o%dKbs=oog*2J>CIn|~ z)nqvEVc+m&Jjova<%8O*J<2Jt8D4?gR&ouZdznFcV*hvT@B543Dh5TkZ> zDxSw@9HGLXA@PVb;^LlbK;n3Zu~Iif z58f1I-;!Zh+Q2Zxo3=D5$f|Yv(KUef-NFC*S0-<#E0^mmudRiaIu^d<;%leblw|!9 z?_{H%%4CPB0kiCL+8Xow#LkS2DyyiUcGX*_Fu;m=S+Q^5XxwMT{35|a7vX?02#Jamo27xWFk?{tHPWI;#EI^ic9dA}WON z<-&+M3)#6(OGR2p%5>9maXGdPV(Me_I521loy02Vj+qQ-QG?caHd?(zoDCRx5hS{> zU^Qvqm3H6nWsZEyt$I@L{6yLfwc-im_X+2G^pv8r)iBlB4~@onm4t~ENryAf@ME~V zdZlL%5!7FmByrZY@nCz~PNdH~MlKD$H>_fHMP}TFA-^cA&8sFI7g=olAkR)3D{os2Q zu|+fPfA@79Xin%Rs?=DpG#tLK zXKD6KlXQZv+IjpR9>^Aa5ZO(Q?_A0jM!Z{%U%gwtd9Up3`#W;yUOG3=`~&8iyw0=! zZ>4t(r%xgBahZt=IA+wCK@MMXJh8+bFJ z$@P;$gfKb#gv2ebbaYu3skzu;#)wttIdBV!!?i?gt{*4U@N~-3s~a z{gh!AchvBR>-5!Q-G3*{@NF%#6NpDlgpq8h{A6;t#;+cN7)`p$z;f&_9(1+%TeFEv z4MZo-yUfI5_LzNX=Q3r#cnY zY(nJecMAQnI!u+tzEr)2YMyP}Z(s9ZQvQLq8xz*&dlCe|XZa(j`IF@aZj|Bxn-}5~ z2{+&|q}FkWFA^r()O6s$q1!)Ya<4cbd`O&zM>eu%o%j>6l-Umv4B&Q=Iv*{n84vI}(8@h61gB z1FEAA**({PA*?GK12Bbxgla0;q)!C*k$_qaJJf4U==A*w$qZ**Rbi)+>$vg!Ba7w_ zKkK2h_mT!)RlTZgy$IpyU$-8}Si28Y^MpVvww0_|i$sAZ%?a0$F6SFQZWY3Qis|=R z1AfzJ=5}xoJMXC-E)KAcjc4z$_{j6B+YCGO$b71YN#kK=E`(xp-NSxO&5C3I=YeKa zA4LUUWZ62fWyWYfIw4cI1L4z>lt~q6C|%HhLKHf*Mo^_4w78Ox&g049C!KM^q?FZ# zT7%R_dNr=P^?!S>(s(Vd6c!&U3}BZ?JTXx4WNA~7&ddg9AZ_qFCx8Fr3gX_8 zQ`4a!9}hx4C50RseJq~Lkw|Z~OiW+^Z7Iunj@|z`i-kygV z%8bsmrvJp@Uu~IXaDY&#H#1ee^-ijCb?eN2PG#X6bchuviY^Ae2j~3 zt)rgLUDJkSKN)RE6SwGI6G6fW2@7jmq$BRL53ym|ryCFx7$Bx72#FYN!oW85hF%mU z<<9%SkdLs5Zv{>9%}ucD<{ba9f}Zsw`MM0WF7qhVfMTKI(+GA_Um3n_qCn6!X3K*v z$Oj0M<%Rxm#JU=HFXQ-&s5JA%JoD*(p7Rf^Ey2wC)wKvj+4&Mk5_6_=<(>e<0puf; zg$*{qbD=jNHy4LVs@z~(G{lU)ecD04(Tn3cW+QsnY^R1AwY!=OY|yr?uIgNVd4snj zXpPl$V{e%@*K^_Do%KuFGdS%>@crh)UAZls2#Xz8BID!!*sDHE5O8yOx7(4(&!6YO z%Yb9W0cyt4`ts{M5nD4H8V>Tx8obNnX&Y?~DRfz!Fu#y&jvBMubOt zr*)bjvss4DPi*{H)V<@Kh(~2X0D9eZCv!+|6=}1(zvX$MMzh+2(}GW#$EP?Asq^>l z^Vcx{CLVyCHw2PGz@Ne^bV&$K%J#b$n;>K(gu&V1LbLEV5rZ9(e-;#zp-G z;Scw$;?yM01!UfLnx3JrA{bq}Y-qTL#p!bas*E**TCLUUzL4W|s5x$7vzw1#HXmvJ zt*5@)VT(dH^V(JD4XtQmsD79y`xAymi}^5oJ-gnPUgxEhS(arParX}wlo!MsXJTyJme(Jh<#&g z)x6#k7VUo6viA{DnHd_rI2JvyZsZ@vIL;9Zv1~K8doHldSNMDEzZ`zy!eWBub5BqC zj>Q9W1_Y)rTc?{Hll1F!4qo%17MR2L6=hH%XvL3;18(DNt~6Oq@JE<5L(f>m2XX;y z&k)Vfp|o((l-ZYL2M{7%zDu3j?Qm&)cZh#~e9ss*{zkjh4suGB%ErgIV7I{lqajt6 zi^d5`_~?oERPHs9=B~oQzBr=h`H~r}Jth($mYA!cPwllkVzF4E(3t3O{&05@yG%xJ z$cf4$heT|)DUoLCsmdO<9uzl0Ivp}$N!DUx%6d=%rkm0#fX}MI9M~GD5G@1E{x;~b z+gn!p3u058`tIGHre+r#e|h}Lh#u*w&`|uy1Aiuw_w&AwdCFM6D=XAZa*(rM@(fyxnGp%P@%BD*Bk4=MkYwPVGc&V=N_sSn zivu}A*Xv`t`lVVo80KTviK!aE!MM%$tHW7W%dxt!DU7SuoPU{T@3NfFf6`Oo1dhY=(rxMHFVm2aHj}}`n>~ZFh7spj9 z=C$IyfLv2PxY^0rt~WJ8%gLvC|Y_ zp~yk&RtEjnY09$!VPIKf2<0SLyc@jO0u9URAXu`H-ztaF#W~<1P9E-6FyXv|gCbeU;7VfiS z1mjcRcX!(0RoE3+7sf`D)-SR)=%Mq4hL~gBd_~$KoeCB@W*Q)Kr|>Tomc48577zL%XB7skd1RT5zA9^>|P?b`0lme2ky_>E-*} zetg<#d%mPDg%rLD5KZ2S$+NhU7HzsZj9xKBETxf|mZ}CbJQ03!$M&F`R<6%OU>n4 z$_2s$30%2(hJ?{i_x%JLCA;}YHZq&0p-NiiLF5;qO4|=s?Z3~H#EOv&yl_UGAX*d7 zCXm(V`5FwX6Ns>2qF3D5ns9<;wvZsrI_=c2yfK!K+u=dW`27f72GzquclGW2^_1up zHjV{p+t|;{ZO83Xe<*f_Zc-^Sb@g>R1>MEqg+d#N0wF*o%h+wvy&ku4&2H4yQKEH} zJE<4?VT*lQxqjq&69@Fon5S(56h8Cuy`XtW&&$Ojzt|Z9wpoZ?hjFHaMYkw6EAQlJ zbC=qt#--`!ofv2#cJx^tVQ#d{pC)s$Cu2OD+0-Pb;^XMTNceeL$0bjhEsKl(5|#7r zz9UY9lgYio#*9_cE`=I})V3Xaw|0RM-c=wZvEMbEs1ZLP1010wVmZwpy;7Iz+w4Vwxx?{@6C*yiV`tQ1@vP}nNp zG4s5r=yIxoW0&ITkJt@Xx;w9TmJcV{nKt3q<+@v3E;|pcYGrcThH$GxHc z!|kl^N`(ZL9r+ZLGV#hG{gvFbGXm7a?o_=razaN6SY0WzJ^3~~^a}Dkj#i-gU3JXk zB#l@^2-uWWKIARp)ys7$N<6%n8nH2{$sPXCW*hB=4W8RfU{aGnu z2NSJJ&3eekfyTcqz3;-9!!!E1OCBS)qu9tTAFc7yfH0dj=}?MyDr~ao+6UjX>0gH`4RaYZxqVO<;77hDhpcoUh(r7}hU1+8Mfaj{BqUleuK>OY zAlG5nK9b1LgRY|bXUf46Pc*aX4Q)Hi9|q}c<5meimp6hAwYP!(s^F!fh`En5*i3#gq zWRW|X1mJP*qS4x7+dS`v2{ExW{!3CCfHwTc#8jA6mA!%G+QhJm!OX< zv=%1h8xltg+ov~m$p^~I^Z037mTWF!b(y!+YWev7zI=qJszm=|8{PN6K}XxLTxKlt zaOFvrbwO$+^cMQfkmsMNfYQ_XscO{z(&K-HOK$->E8=~(xr<&##MOZq6&BEgG~6#s zj|HU6g)dEcjN1hInsNJW?O1zYu9{PHX;BSzUq$47sMw9_hcX+Bii%2Fm-=|5q0n_I z36=H%jG3ar&30#>@BqIs(~9$b$*7_(GLW8nt)G9i{sf+%bADt#r?a3q;6NugG}$SR z)mgmVkLuOQ)F|28r{W4S8gx|*{Q6hf;cu>x0#gz(HjfR>}K!^g}cyF z(OFV+da;@R^j%^QTBf3ev!_u4zYVICD0MBa&wv>H63 z*Xn)uL@RA?=y7mMHvH+DLH+Rr%SD4q2Ndr1X2C_GG)R-@gNam`i+GQW%s3sUJJM*d zMuO75WkCHTnf{)Ue&;}s={ zU^jvjyjn2Z+@a~x0uPoNkJE;JY(o=)L&MW1Us8kY%Ma)UmZQ0g!(Ow(`=fRIih8t~&>Fm3JrA5ywFAm%G#YXe?Lo%k0 zjxElveG?wwbM%pbb|))Ia#I#5ga|%;mLer!@(DOTog1Re$j`l3*Ug%ivSzyTVkV`; zop;v)nDEj1vdma#DHF-@>45qg+XBZUV#K_WAe+lFwhkS%_~HOj-v^M!bcB6z<~6Yc;6>*%IgHVtRDdc0OE(CK>JoLc1SS@3iladv6; zoZW0y_=)hDi3ArK7q;xh)Xa{3Ulu!cDyeonr9Umt6UC>QCiW#Cx2wl^80^tPQPqVL z_SobA5i+MCw{;v*Ik#D2>kZsGe$3kaLu-HSOv#>@Gn>A$GU%U?T=0S;w8s0%cMBu&app?ci z&{LFUL7B(Vpzp;TyTq~85u&1qPpc@f#HVl4RTj+ojVIkjJwp!;rEPq@BuP@-15nd+ zM>e*)M;r|-SCuf68TSa(@I;QRoYStln7<-=2zLWwe1{YQMU57=c65vlKb5B2sKf=| zuP=7TN%5K_znx2eAjl*+6@c}yWZRVtOvIA@Oyim*fuJA}>1jOCvoU`fTR2*K>g9{93-d%5lI2Vr zQ^B@Jf_l0FGBa-$3fKEP*jmWUl?EKecUKsDRtZQaWzFO!yG$LzZsftt8oO7I*W`AL zJsS1PEO?ogD2};X{Xt)*FEX; zY{(rtOOK_)%nlA7!w+$4EY3uqNl&g>g{GZg;@dOABqAWa6gu9j&&H-SdKfZv&aq^I zE8cM}9ByhRzD<|Qe0dj%SpAZ5^J<15x5NI`Ml~h5=IU5A+g0sczly&z5Tj92c}^~r z`*A(@$si86B(-(~q-cX%Q*pq>%`z991~)`>F!f#OR6JrlP|EC1j~#7J{&X-RU;`Ro z=#FpdQspan$a&g*>k;=Duc7eVp>i$ZYrdSmB;M22AOkX5B_%)!mcql)rT?@A@&jD2 ztp!{;(zJ$#`}|0D+>;Nz8Gg7}%hp3XD9jRI451S{0g>Sthf9wU;>Cs*hw_UlpHe#Y zax~L#Tpdfg;%j8wC;}PvQh%#1e;HU{I=yQF6CU_s<~y9gk4km3@P+6Jt^Nkg*avnu z7t)m4v-U(xZ*$Tg_X*S1;ubN&r=~jw&!ha?^;o9uDiWVXd)I6~I6|edKx!FHjZ31U zmS3zaK;W)618m-SU6o%iqA>pk=A zjW<;f)9t|MJ9-=AAD_bf2MS5_0r(oj?rd0F(?1x#P%_y_e;OyQ0>|E69_&kDoa z-m-?+&MGk5aq(v|LC9h9W;3|X?{?4}91h=mG3ID7IAm|{ImK(yttPs_-R4ZdSstk; zQ)Id3CW-ZPOOVRLZxPg$c^AKrz4p`y0&D!cVj>fL{#Oak%>bDH?{F2qe)zYNI|RkC zz6I&L7%R+Ui!z)%ll4`J8qB(Tl9_^=p|*ItumFSsT|=phx%~JZ%Lr;)_G~Wl?y0h@ zn^S*}UPe?%OK~3hqp`r`)!(Xc`kI;}=zcMkpLbp12Hh-GAnRuAo-madc`A{WZE*-?*-veqPi@*P=pa{qj32;MB>dxt#$*{6NPmYCC!l3lt)IKVkYTJP zxfTGzYZeo&gPR?Un~Xw+cvUT{svG@DT$8-}D!+8=fk$<5UXdEo08Y9Zc9!cc+MUgs z^2ZKp-OVES7UW+P{q+*6O$8O$A!AUOqFr^GDkyIa7sbg?S=|be4J4bH(-9j6PhP}E zN4aN$0WRGcYYQp0ld5{xp(EpME`(ZRImU%DOJj`%axbRx>M}*Yl>Vv!IUqUw%P9ok zZD;tywE;nQ&{Q)ZXCOLl_!x|9c#@(kMtY&9erP;!0?WXb<#O$O_AMt+puV{}K}BfP zw!c0@Tp&*JpG-g&iTd3l?<0#$X%!A$VJK}#Q%4r*AWlZ^>^>IRL7I*?&7huVnap_Q zaf0pT?g~@L4QR9R_1Lmg==172aM)>++Jy|JpE}2#8L@wgMz{F>noco^06T;a9-yJ9 zp-*6fgn+5%@1aBDs@3gGhQipPxq1!HcKJoGMMX9*?`})IPQ|aDN`#o7TMgU*&u*Ik zc z!gIBG&3S=Gw-55zca$GFc!;7@1=OcYZ$P)-H1mh~{7SVyawil%TaY(!Vb47)3;>6Q ztR_oUmB02@x3u@~CgO4-HeqBOvEO0-NTj zrF3aJkM7NR7= zAFi}O+y0#y$`s?~ZA{Zgnd*+Hl8uAnojkk%`DCvh*Z^5}fW5vx=a^?hlX-4(>GNE7 zFXo|b+$ZfF?3x|0FSEvp?-w0P3Rsb8_xZhnYM3Z*YCWi5LzNURxm~rq=JCwGjq%aD zC#Nm)8f`Ua^Xdi}TPVzHnEyRJV1wBqX3Eyf*S}$p(uyaoS1@0Zje#2!? zaI(`EK8~V7m5|mK-EvH%^2b>yU3fk7dRREcUBh&0LY_LL_uR@OO(tF?9G}Xq;8OnK zDkZbYg}wt>&Li*PNY>UsuVUaCt82w~S#=MZWVMzR%?XlZH(cJRcl9nQUYFmZn~G`) z#HnoJx*c48Tj>?$0~HIK@Iu54%c7?)Vp8#%1$!Ea=aMXj>^ff9N|mjA8JS;&5p<~S zhpbnA1o=vE>lm;OK-?F6WP5585iWCF-y~ksA!Cw9U@EL_36Zpq`lRM`g5|nkUMd{b zNV(Ns5W7O}+%CFRUBH3wT@K!DbVf(!`e|x$$6y;NwAHkL_HTkPI5=CAj+=93Rx;~7 zS&-Fh6_1i9Kv>&y82Isejrrrbl&&HN_sqNJNZ)EKLHh=W`1XTlcHKQ^x(Y+J3brp= zE->A|*nX-uCQQgreR{Bh$jj%{P!*1?rI``MK_~!Vre{exAF7d`KwaxlI3m1kUPzga zTt|fwShiZ8@#5IO#~Y?~PspYE*vM;DWWi7e}+(CxojE)}?U!x$VDP_(djc`{G1M zmpBq=YypYs$ozoT=sxjp*Sk82)(I` z+qCJD8*uX<-9j+x4X#=UL_VZur#blE+2TU>qdCP3f{*S2Z)Q& zBI4V2HN=RiP$wTdSBVz6U>2I&+PnJxwC=LMJUL~$@=p8*%g^l1)T}_%LZzAc1ed;- z9oxdh&KTM8(kXg0Vla9GNF~w9iU}aAg%2(#31#784{46l^Q7RY&ImSdD7S{TS!veCQAE6nkiI$gm3-=Lmu(b4l${d(U@U1gV{WSwjHj)!AKTbRaGUTRYgfwll zW?`^4XTE!7vk3q`pt$qp)Ipbyw$agJo88t;ux)l9viGl{n&^E`boQEPIwWdu`3^RPVtC%tC9XShgLMG(~!)l4;y zyIkgJK2<2{VL{*M#g>=~#t5z7G5B?Pn5+byg1UgcWZSHZR?o05HBIHjMNhIH9T&z-n`d|mV7Ucd=+AkM7?%ce3NRfpq zPQ%@Wg!R?3aZGT+cuAu}ZR+G2YzG`;z9aS0vdGr$y&<`A>fBJCQQKf0DMtfGY zoo^G({{N-fy)` z@AcN4CDDBY2WkvGwV>Iefs3s>jq!CGU?=?7f1=4=9quFvE|Y?ugN37`GeYyPFQPiy zvQhZLS=4OG)hRh~D?kZ4@()mgl(8<4aI`YEeBZDD{x$5Ep5S{l@1vv*Mc`CbGFG7l z?~P2n#CVPPV4_A_IJjK*I`TN$L56kdT^iIE^9>q;(wuigl5M<8t$TerGI7>w&{g@2 zSa;+?k&5V|fZY5zyTce)kbAo>DNz3yHQG_{@OUo~5?tNFY+DN2W;plvTw;b3_kyDq zvgaQv6Fenq?5>5yJ(u`cNeKFm(PMR>B0Bv)0qiZR)N%%SJO|5M3d zkjc%4{~SX5x;7gC6O-M_9gh=s7tZ{y5ceKZ^CzcqD1Bn_DfZ*J{JMv|H6hH4HwLHh zNiMUdukFZcS7WP@mEvtv5QT(#>mX$SKspU)ar0BiP$0RCZv8s%^@;Vn0WbT&KZrv8J$UOtF*=oPd&4k33pJaKr6vwNYhN2dr$D#! z)272?K6+GW$1*$ujfcOeWyZ)H#L1lzeH1j@VsbUc+jkM3^Ma1X?>+_d8ud&le@C*m zJUV53UC%i}USakS-7A;S|N76oWt6XjHYVFd&9t{^*{Lm**Sz`^SBM1Jp^5l_k5%7` z>8rP)MZoW%t$%kL7=$~8{+sC2SF}D+xc_-kF;;WFx}=Kaw?1(=htuM^3wteMS~%@1 zh=K*2Ukb{Ui}+pU&NeO4IF_lOq@&k5jbOXzBV{DxeZG1${%tc4AIBZiSaJS(-3A)# z3+AMK{l<+s&n<~z|Jy(9mQUbP1}jC`2XtH|yRXesmrLec<)QFG{;02itP;!h2SR6Z zT4Jh+8?@M*u3r~j)*cQW6UZeQ;MYlvun34P<>DW!VI)Nalunw+xr1Q2Lsr0?WyE&! zks4|CYYbun2)@HaSH_?3@MV{cFhEw+Hz`trV>u#W-~ylaoj|5P&j4yye(QZsKTefx z+uMUpJBa>5X7wIVeFjVj5a{z{jbPFptJGk?#Vii$=^!UM0d>Am^hFYOaSm@ipSQ~- zr~gBtnn12_8)ja{n}>9NMSAij%q!{HVhigfgjTGH6zUd2*8D7Y;?NUZ*3q2kN!XNe?Sa>sjxM>fn(y&M+ZT@jMpPNT=z zsoXi;>kzLLEkQ*_)M>g&%~v3?N!K9E8p+ra*-9rPzr?3kz!!>Xd5QOTnQ_kg9L?^5 zZJ%x&&1uYYuu`;`f0(qm^rf9Dl;wPw*l5uGwREd*$R%#rP`+zJR^;c6adwf3nVs%T zywQp4b$xOcuQpz`mXjR4)OgVQ&Ia$#{CoZnd+!}jb^AY#-$_L(LL{p~lx*3nVTYE; zOhO`ik0WKzP)5d4in0sYPT9)H-cI)3^VkyPR5_R#b-F_-0oMn{Ur5oA1u@ zah9GsJxGRMeho@ZX87RP#m}7O%{*>;nmNV|wI;2}DrETs)=jn6n<|vcnc|j+W-&5{ zF7AH2`bD_qrdgL=t4f8k-U=prBD_Owcb8dKX@we3$(w|crCRwJk>pTv_YuQEqb!l+ z$O(S;dK3SK#TrI>oWp#np_KCefyGP@GE3MrsbMwSqSM8Ueje_U#JByO2xnuFA$S5c z4xPmOmVGjAn z2M!*>Nv`x1KgjRp)>%oDHE8TBJfYZCFgg}n-mam4_S0}v=nHdDxd?>zRJ&s zVtph1S>|2wilFM=$*{DE_1y_k)R5~ODS8&+(KQ=Z?0fopavMBuamGYS5;Iy&KeZY@ z63Kd)O|h~I)r@YZVqtRn=4sWcZ{hX^euT5!Oy9j;Zn|Xi8BbOxe8Qs#%u!63SR97q zPqO;+7jxZHWe}YOf~pCWK1`()j7G**j7I6wbdYC}*G1@tJJfOdW8dwQa0!~dH6Eue zAd#y#KK6VXo>k0k4qBtuNi(=9L<^XxmST3#d+4`bzXXQIBHl_q8~Iw1a0OL7-6&oW z&W7@q#&2vc%sIwgu^jgxp@=S#8SrPxKkIhkXaWAke14sLdtv09u$W1j$*(BGKrL@f z-m-6haz$$wy{?kD9TC*}+mnFIBv)m;mM&GKDgDl*^ zXFMK?>+Myv=cM+>n!i_EU$x{pxI8Xhq8AApQeYW8xxwrFyyi;?%%Bu5w{IVV(`}LI zxcN?W;cAC=`Jk_4=3;YglWh~;T4W*daXDRzhh*IPoMXt-P*|&KeDkV2A{2~Yxu2F% z{>-DOY@px6?HhLRi#`V4tlLQ?US{7RYTw)Bu_iE>#JusfcD#lWU%fDopMT}T-{^Y3 z)4p05!MD`CLMKojljpFHd8xqV{pYgK9`_Odv%#Qt&}QjI_y{SFVoNA3XpBfY0!oi( zo?H49d#ruHJernK1K@s`s=OVj5Gebgz>8|?j*!}3~F4K6qf9s*bUY4c$9L? zeCTDlxWpR5lCZE|J^36qS5}iSSRM$|<#BCYtnprM63?Gpb_l=F^R~5Z^3CJu%CM-C zmC-?j^kSV0QB6WI*U|QABoa1et54G8K0sFfOhe~z!g6{_r?dj4MP}*X7_aSE{X%<| z+iACNNF*Ay7mu>&$u(USi?t{+T}QS`F-xt$+1sV*;zgD|0LZ(c;&N(o)d9PRlL5(x z^d00ru?QOl&HSOpf`?*#JyE!q2Mkx4U=YYJ4`-a1(MpE8Ny2U7e+6IKi+NpFU-GG8OyenRR{$ zI;VJ`aIRYWLino%@22=;IFM+Y-sy^^A2>RI!bMD}m3FyD#m6Sl@E0Y8#=9vwO@7g9 zek#ImIY2Y0)``^2S{tI35XQ{q2g(VXx*!!W1#?Aa6|JF|lt}oIMSqq$s`HJw0q0dG zI51hgq;=iZug}zdvIy;yESad1_nihD!42Ox-y!YMZl*^swLTcyq3fufJsd3*{3sN@ z^ww%cS?^}P@_`5qP%``SZk(K}G$}(Q?}ZaLEr!c zM{p2ELv2SDTTQp(Q-3|!l>aCfg`-o}Ab`|^HoFYl|FU-egGbL>gFtsZ{_}pN$_yKA zZ{g%k9-qhnZ^NIEn1{pp&Ig@vTjV6GXib3KC|G}~?_;RvU{^X<2glesEjIHU)X;%B zJIzTmpR+*Y*T4Bzn1#6OULUHB2ys(d@99K<+zvfPrqx>cpkASkf0Y4XqkOT1M_KH|uLbGden|NM&~$C7Dexwe{<{Q9)MBU5o8J9(?Kg2&vN+F7fyzxDS?j z`N~O!)_ubaL8@;+tL8)DcZfvySAx3dBJ7Y=uP9F=-^)gaQCLz=nakfyf&gK01*s61 z9lrk8G(hIJRj@ljEbyrO$4#L_mv;rGsKSppxHL}Yjf7QbU+OHb3{!@oe6w2{#eLOa zL&K{cTExQFo=WUuai*-^O)f#flrx_+HHyHrvl-;e&oPxP6kf0Ja9@ASV&7`1#TMd* zd8+1}q`&ljp@uVy1T;TxZB=<562b0>S#7LZeIK8X{4kmGl0Ag=lWMFGSKLB~qqj!s zSf0T^376auGlLFoqu8?c;6=RiHPCISU11}O1}h~obhsF#R4^X^6}@z)ndbqGmGG6! z(qX@sq6z(y%JB?cRC*=5Q0fw(tOkHT_o8rM;-z$#QkD1pUszrG$L|A?F+~+f& zfQ?`HkY8eYp@<5Jo*xXxZ$?^u;S%( zp?#R~7}^tx#N7`*g#-^pO6Lz4$6D2M>NDatx|>Kt``kla;z8ZE@5Mtdmz@?q8LbXi zQ^}Vt&k9tCt2!xvfmL$??w1f`1Ek|+ka4~NN6^o0PR1^iy;6pNMVZ_B3#>>kf#|va zP%9Mn`iVEK_(Io;FC>$YRq%XIx@7~Ck*G`8t{U$R`L={cKBFnTcOM|82^Dwwv=EN)O?w{cqSAT18qjORcdu;f}3e64CBU5lua4Y6VGG#RMRJ4cZV za@mIl<-J-F_BVk>uF_?jzi0S^iqyT;+z7eHs-UjPx;^iN;+oUE|NQeAiJx|5W~-fnH6T< zPY&izZR~6HX6m=J+tqz~J83{?e+jgNOH@a9*K4B|KEc_kzm*80s**)~-HkzSCAA>8Mt9W82WyuQLN zeOPL7F|>U;9=aDJ@K^l9seH#Yo7$p6!dO^|9`F$Jc-*e8 zx0y%@k3m9CYpoa0H)xvzD`Ij@!cD*rRwVk-_jj>r zm=K~WjS}Gx3uz)5VR^!4eYZ+QnuJ`(;l3vNoBpz>Gr5a3qItJn%FdiP;L<+}0-*vi zdw(J%KyZn8VspDm1fRVu^f|?&)eKC|?T!ysy(ah1X1D&u; za^H0Hjn+Nf60=W}htu~dhRcPgFa9aXry3&Ib#>6=vE?(ME(2BO>fkhuD0^p=|CfCs z8D@ZRXFeBx`+dbBaUa8Nn2|gvJlZt6UJ5AkF9EArvYueI;E5KF z7Z+8S!8tX+r=|Dp>-6rYnGv}*9%tJ`j<;GkF(@xBBF*5@_l{*W3HcX`0N%5G6+p2q z#a#_gw4FUD?5iTw&FY4lnfJ;s9aTw+6)aVo0%JHGUV$2J5^rH*u~XUaD#H#|Tr_CU zp!M2^2gz>PBSj%q%^4wpoR$B1p0eqVR^MQrvRsrDokA3$3APF#=Tjjq%=P`Nwb|W= ze0@|txZ6eZ%^x1jjzQipN(PN^SlOK#-er*itAf0<$-a70pPao69j`L(-iat>FWJao zZ~G#J?{4x6g^gTPfx|cA=Y1}cyIzodJMt{c$#lIT%j4YA24;htTza$H+h95)KQk&A zSQ^)|mmlpJ>C_qv3P(^lt&?AU z78>&r=iJ77O+s>224;XPHMIUZi~E3@d(Tz-mS>zAK8QXiLrnyX0|*wT6N*<9^rCP$$JLZ)2go}U z0{Ew%Nn9NnM_|;WLFV9{&pr$Jh<^IHqUFqm+J0s_A*7pL=@>!AuVwoNI}a%=4I&sE z-JJ0Ia7hUg;jDTXVCI>*W4LC@&`busvmes(^=**ugE49zN(JKy#nUxO_!J<&>Ixgh z#`}Pk&#WaqTZ-a7B#gAX9-UuBW6-2^O)0Uqfw^%L~Y0f(ZLM-F-VDBkzXAiM||@h zWMLL}t}kE}($KSZc3S1sXS#V-U#ev-jZBSP4fgqZ#m0C%J;XLyMhAeI2bUQ@Hf_ju z#3b}t+EuG(ZRhcj*xZ0JfIF{SZhw;alt`%PsZAF#A^uH&IJ@it@tYB5)O|yna2=cV z!+6jJLNq5b*V;g{$j-DkyslOFkoXMgD)AFC*jj7Y2NO5+%mSoXuWvNLC_~&=IcsKl z6yJ-yTDu!6FL5VoAy!|X0d&s#U_HGy^w`BM)YVP04Bno}=1i#++1Ush!C+C+iEFvx z&V!p~SqD3HmQyyVF7-^ZI4^xMP;^|1rSFjBp1AF9w)<_R`lhMj(x^wtDf67!4}%f# zbtf#Gl05J$&{`=rC((uRgLa7KkZ`f>K!d4_m=@(Ci<8X7}@wTp(y9eLyoS zjG#%afOSV>%4wMyRe@n>-;co95m)&b6XRDA9C!s zH|e*@X%He~FB#Syw9oRm7|m~_^p_1f7`F$i!Ad7G+JrT_Jjj?TM&5h9Ga&?06z+jr z8X$CXXoq1V2{|+OO{fxl*o?p)wvQ`FVdwZ#J>tClfyAQ-SA96`Aia>+>cxu&n?ZCe zMjqJdj6pgzasG6jcXwXZ(*p=TRZl#NY;xWxLe?r@gStpT;QQ&g@lbWHqOSW6KWaD$ zz-hQAC81gOUCQh-qoFgpqx=spOHI)=9mo=0vp1M`Un2!Bm0QtL?k<|e4i5?(7l*9I z^2=_yQr4v?jq}_FZx3R>k~}}Yn0Z3E5FLD0YwA~;T2TTvUDn9=?)87|j#>c-Y@&lc zSD+0a7v43kZSmB5=FNTj2r^NUN5G{ZL*|+4E)4+6M@s!`Y8o|^WH{(^NoM(&3uhP6vN_}vdd*nC?lz_rToVtdcfhAS3ULoY`ZiC{zZhBw>2TilSW`-idpu35xDWd(1s@?9?BWJwY4hCmzgVDa|-^#G=vEa zK>sdm^WR5g{7IgPG5}lD_jtVs{-8oqO{7iI*}L)pTROGpDWF#PS|m4S(cM_NK*hwJ z9ge`NR$$fr!mLC)K;BOaZWVfLE3H2sx>W-OQ6_JCsz>y+2%O;k_f;diUvU3)Q?>vh zlLZx-C=Gm{67uJB8Bd_=pZYJPQZb`QlqlKmABh$ivGq>?UE^1nTR|LGekV373=YD zKO#`dmUg1cW+|Ik36_+NzfN-k5p?_Q6z1A-I`Y676ZbD7(Ojvt&Tg&r5wr;oN`ahP zSFWE%!9yDExYk+mF}2;GzbJ2&INYM9b;`{-({d6W3_OQRL0RpqHIe>2s!#q6zT2Pa zFJktGfwrYI+CK3#GnB^l(R54&_%dh~T=xC;0Nw%%-8fCvj4IlFb)oukGCF3<|MtUj z2{swbjYN0Qf&$;LR?HWY$kaxjJ>iQ_^yRW|*uzdg3G$U)%PBKrsHbTUlqj1Ft^*A` z4e?IuT8RgAEozJdIjjQ)xh~WoWgJbSk~Z^227e^HS@wo++V?AbjOXhYYu$U0P2T zKBde+XG#4GXao5#E6JfS+e34z7SwGZencH*7=Z?nc=5Xm^1}a>Hn@R5i(kOfb)Zn;=eGje zpIlLeLWQChFA1SSf3R07^iymrq%5GF{NaCiPJNe@_G2G7e^Hm7Li1*0m^V;@kK7lrAx{R2+U{$E5}U+Ww@}6ST%qWf^HbD9qrNla#CF&n zqtrnEh#Nk29|Cr?CJ0x&Q|p$_0Q$%K(5Q7%iZ>x!=f7cMQG9JXLV%(W12FZ}d8Kkk zp1TcYb~78hLO+C8nHNB<^F9{R_xLSXv~QO^h_iVfBHdDzd{2d2{BnL`8))1fXG-IC zx{witA_wCI{)9T!Q#9FSDl^yD)Y5=bGc(Kv?6d!p>VHWUx~l&r)&FwU|8mvsG8Kr2 z|8mv;Dggg4Dgds9e9oIIbOyz~^VA=D9AMGs%vyONqw99V6fbYKSRX#WY7j(tNiJS| z?9D!KKX$`lAW|E2NfKr*41p4zY(^jFP2Zxrnc2_8yV*Pz&Yjn zcq$yyZjNh$UjLLU_YIfg3YW`a`xt(1bz<lM8jDX)=& z!t zmqE{?T!Abz`Q->Ht77?uFriI$HQH|5`I_7#9<5aviCn)iW?Ch#YZKEaa?CFHnf_-~C+7d_viW4w4tD}MY&!xB=;(T~v|0@K%Y5lWF z#pZ}5qN2im1BG0{R;NhY+*v80cE+l3tGZcVtlw@B{@eeyj73EzPbm*H<8&yQevzG` zW}%z2rZzh2n3Gc;WQfAbEt$e{?59jo1cuLhw$(IC4 zXB&BtVy;0OCu~taNuJ;|k~1x@f)zd19?9HZ0 zS!Ml%e=@r5%eCFCL5HjV(9hM7-^D+ZdpnBPu)2QXBNpWiI=gtQr``1WWIsLhA6wl6 z`DGKR<)FB+AFdzFU%tGv@8PRl!?!=Y(HmJ*0nuGKaDRyXs;?i{vI;(Z<};PpDWzkI zl$?>6*@R7xdNXyd(*_+gDiyg}HgZdLL9-u_g}7INE8eST09cQ8&nI3qBc)z0|N8B= zrrqMY8l@?#ZjkDL=*mJ;Imn=O33odjArj6SD`7VaAZXic&9|oo*(AMzi!o^btZs1o zwmlYKEbAxszX#z+D228~o;{S|0);=0YL*sV@n;zdj4k*bY@C{p8kks`^@cB_o#j-Q z|8gx|gwcJv*1qvthM$S1yJ<7hnpgV<&v$Q(Dc{4qm(JQ2jB8nJ+OPB#%N4@A__K}e zHn%obO^h&y=Y@#jL5g-YV^}I6ETk?4PX-~+xipfzUpAJXtqUEq={TW(!KKt>g zg7$GDo(2Ez-TnS2TfUHROyJyI8&>?Yl#yo`jhErlHw1CAFa~Wmv&Aa9rD0ljiq0O) zzx{|U(RWGuQr@b%_WJ;%6MtB@&gfJ-xQh5BD5Zj1vsn)A^l~-xXPzw!M+|~~rJwTH z-OUHuMtah?52BFy1#i=-_SM-7CJ2VFNMCJHSaJ@Zcwf<2+>vnhy@bvpIxzfYm_}B( zJn#!Cau1yd^i7bk>731PtFajwDmih5!gB?+ENbE=n$E1HugpY8GTljjboCj5H)qk`S0kn4F@3dY7d|4rkT)^J9BOe>O;cpS zTHfncj&bNycKqRNWuC&@BL!5J;nLj3ipLc1h^%L`OxN+(QK^S}v}EalmORfy!gZAI zv>Xkr^e|KlR@6rr62%id-;1Ny%@Fz)Bo%oG?AkEWqZLK(48kKoWQ>Kb58?DH|4mA4 zf3_tv{0*CTwAuorq9!WkqPn7Ux6(|Z3^&bBck)3C+T=>?)mLYXbF42UjbR9O=UDcrqLTyo-JIAU4P33DQ2n+ri zwRS%XB0|jMnaaScB;yTSa#+dr(ynMsB?~;BE>E3EZcO!5^X)(H`rA<;uo--O_Qrme zV>Ul)&H7ecZ1AM0o(*!y3W%yxmbUIHr%YK%Z~MkO9;}Nn2%o;3>G-m9!c39!a%Lu* z!Q~NwtNQe4bAEpoP|bC{Yi>|He@0C4iDClor1dMd&~hfSl_7LtRMh{?DRh!6!i8m5jwxoo2uo~kTs^faFK*B8{OYiV-c2%xegRfIz=~XR z+C2h9UwZz9B&q;M63XkgE?YlI==Kipg^??CLzo;VD>Zzsx!f-r7?}ZjwQHIKn!$Bam=}DD0nq}+Slhocvp)Ps5w+vzjet| z&rKTD@(C-)vq}h+Zg-a^>H>e~tkPS;RGc4=HZ`GyHYS}Y&_d61KM1&Px-PiB<11`$ z6{^0@bX1cnvkVi?n{B-6q%NkF02BLs1c4|xy_ncu*Q)}iE}a+Ltd$1yk-}a@(PtL( z_qn1NgRiTs+x|&6dM3@X(uaWhPSs)QR?xpD?kx%0H^ZV?(X7KA7QJ%J^yqG0`gjrk z9#_NJD6UcjlSWcPWtfi_T$XyG3T4Z~*k`$N4f!{H_`lSvZ?Zwz7GfVlgFd2Ft@o&!sB(FQlY8Y;kPIisepYZZ{+w%Tc3paRa0RbPV@Y;z z0=gqqyWR2z1J*0#)yxNNi#Pbzb&0j{i)xH@2@)-Sobh-0u1fSP98+vWp0Q?KL;@;S zp&qC;*}Xe0mhv9RtNrS9UB*+-T^bcoj+Og0838gIplXj_5*R$CjsRb-+P)4W5D!lr z0z3ql@JDG+w8Z9Hnqg9QHTuF8VQJ?1;Y?`nT9TegVfA0nB>GdzuVqTM8&3DMN*>En zWv#n>%6SAbffV_x8-(?!=8CY9a!$jznVT&Nlrj}ACp)coKUf5v|7bV@_OpCVn;+NP zRe+rMC9VrOueX}jEANN}e@y|A^p(kvMQ6dE+|U6u7^D(xQ*m9S9Z+h65Tnp(sc<|IDH@b$+qO_;gda1i#5#iPg6gzMaJg zU36nr%G|GEAFg3rj79o$o@Nu6XvH<-KuJo_^J1 zioC~$`CKgOdu^t(@#lR%80DEyVh5+b@X)>OjeZ=j)I%p4CQN+l#8)tgSka5VzY;4a z_~OtH213{v*kRFe(9(pgR+W%o`h&OwxB?4T1S+5$D zXe{N1jJ#zmbvs9S`WPRp+Bb!S%ERbm@pfS=?W!;3W<+~I`z==EKG!D3K_9a$2GrA} zVg158&XROV^oH$zmUcr5ly}1=S{lt}KTai&FaT!p=4~sdryccNCDpDsrTSA!GLcnB`0Y$sXwaWwAkb@ohlUaDhBfnw>y8~1f zFRmW93zfiLD430;F9(CN`3Gf!VEnZQJ9T5smK0cSy*T{w`WUoF7XyprmqIS9u1VMSKNR+3BZ^h zc*8%~#FlqAdiuU1UvSi)>~IZbn{^PdLl@$>zZq-E2(fpLw}cSW53;Z=PHd^M=>GI>-vr>5DDk z>!du+@d9SjpxF2Q8eb92@N#BqL)1RAIvG9U0M@U;^W!IVv(UjOgMBoAy}s3;>kpxV zCF2otZF79WLb^ro^tEk(KE{01td+W*3Z3*UlF`a;Ptg7a@_iH~8m!2s^ z?J~HR9Z6wRg`~Pr^h_|kGC|@6i=tMvfa7wqvf>>r9oIXx{eS{3h!n$D-UBC7M^B^K z{a6Ma*Y?+t>nrs1yu*3QUdS^eJ^MOJhj%W|PCRpE1E`R)45%EL6a+lbcpR2=kLBc! znX3?cya`kst+yOI(Eue`-`PE91EJwC0S$I3!l#&>Y7ZNRbM+j4AaU+)j@C=LaKRR* zbK&ygDbePrh4^DttMFi<$&_$G^#GBhJkGD0N8k5Qar*4_El+($?xSM-;Fxhk0wWl+ zqTvxBpVT-37uIn!DnQMN%h9gRxU+m>SL}eK-~25GdU24%A56MY0w)&3Vs!*LQS`F( zhZq0koIj9}O9^xXCD|Q4_1;7S73~PURTM~a^9&$??n0t?Dc^>_yp-#;hrzD`ZmJzI zZ8u1XkUKVhIUEwL=Zyln^6yg{;bJOXD)KaFh7?&QznL@)2I3 zc6*5|p%Bo^z`kH=Np|p))=(&|=Sfn#O?06`=kv;;{}V8)fqEohk23&!yf&;vC{m&& z<5gI*zzOG}x<|UG1BxdVBRj*7W=C!S4w9PEHSOw3c#65jnk!_@8$p|OQUUZj`GXLk5k#H zG)e5Yf}S{m$qaj;U6_!(=2Qnc1K!<=+ulTARVSemC!+g1Lgt(20gr_pmF*<(GgELe zv|b@X0A)EN9v=$atDQIW31Tg6=x$s1?)z%%U2h|U-bv`VZ?K(ke(noOv57aYCblA* zWCd&yS91>^Cg08!Aq@q}!OXbvbVsse0F-|BZkJ;r0LmLbg05Q>L?4mgV+?b$n#6|7 zZMxns5+iy>%Q1|ytxqgO`Zc%yitI#faNCR6W+irj_9K)u>15?a=&cfTGX5N_U{N*q`3V2o&82)GFXARxvGaC3l*k&km8^1D z)IjjpD%gntfTT=banhew1iRq)01jWp#M}%~+s6@*0uo`%shkES>wGEjgH&un4zfYx zuebE+d2mbVyz7eKcNq)o{r|a5c5wx z3ld%Dn>}z}LJryr!-Z|aXmQ{Atj6Q>gBV;1no>V)mvxP9MFf1cFN`Wn=bc2{asy8= z18SHaMUNFp&HSYw%vTS9icQPQx;t`jYaw@vG5 zeY+rl+1oPc^)|7?= zt;UxbTNfYXW7u?7a+YhJqO^g}1xA0hbB7KKGP%_LCdfq#l>{$ru7VKPLGLTH`hC0$ z|K|4n{%p(pYnl=_@_TWH@_0#5A=x6JPXQXU^wKnQLI?NMBkem zXE-n&fxsRjM~xD^jBs47fAfs2zDL#nB6pY%O4vNBTf~~KQzntlsCgZk2ul6cfS+6R zcl^FvCymh;Z~v`WUaVJfcU+-?Z#<1xKdOhvymS^rqp_6@U&LkAn<4C-##78%pXn~I z1{ab{*W9?RnRDM>Gv6UGL8fKaNh_Y`C*OWv5w44Wv5NF}_PNbJErh)DCA;;JZg~)$ zK*eqpk~We@o91SQ*5SRKM~3;9{`bO7C}?mqdB>T9%#YvuRyjtt@*mZmEw(&j)3@InP=mIB)u# zGrQ>xg42g&pJep@B;*X3$7W=Wd(tXbzY=3nqK%%T}58Glx?~=i4a2*Kx z@T7z2e3l+vawl$p*ZuR#<~g;PaLnmf!dWo_!lbrB$P!%T>Zcy#$q~c{{a5Unfjky^ zTi3WqVcC)+o!snZ`n{sWnArOLu|T~wu8+Hl4&BpHhTprle2R!IWTdd{H6gpUPM|E= zvu;wx&HBmjM9sd3Ik$54CtFS0@C5>;ARSs!ug=5N7)n17yb**S3R)jJ#Vrl9CbG_G z__rU3I`nJdqO%gScYm+`fYO2zc`C=)cN0k~Wc~)PdqR=v76SIBs@)E8uP1l%M7Mt;lp{8#?A@T+M6&IFmh31 zc-kv%edxx7;YV8jR_ruw0xINa6A{^=brBbxg>tWT%ZO99 zEM!BVBN-}Cf0xRlWCh4tx*Lu=<@YWkM$lHHB$5}%S|r+Awtl1e<&9mkANm9dvp&UL1+&ErKUu7^?Ur_)t){};7a&a z2c*6Vbil*%vX{4?Kk*Bs1Jdp(u-0Fi=bPMz=wKysMBpzf>QgzemZ^_Y;*Pa! zp|u)sHbEbM6$kp{{7ifdK{37|3v60-xgPuNFb3fJ%ms{xzF~G~c*&0=Lfw~wxeIxx z2;Fb?gAyjru7@OBb2Gv0LUgbc!;PpNwNyYKxd`krcab;TJJiFwz>Ck87ENddePu7$ z*I&ADVjn={XGz%0U(R>~niv1;jzRx2bGw*7YUH8ag3e~s+NQp$-w0bz6a;H23EUw1 zB~$!{7Fg@GFS2SoT0DKhT6|Ol$TLH_*8DU~jBYm-3^k+zn&0n>^zu%Lm#~@nyVYNU`AVlhEBHO$4(ydHAFF$qhQtZ=TXvU$ zD~V5w@jH7y=h=^Pv2&_k)|0wp-N~5mlY>~4W~l+qB7R|^9FVW(WssN1c8(}RzQ;U$ z_Cy(B(w0mO5ciBp?R;C@_X?HM%rH5*FShk63ynu1ZfYTEKA!LYaP#bpt0fB)yARR5 zTOT%x@(T2T;cDLz3deSAKLGOEaj={?v|aRm1yMpXSHJl-h+BPy;yN|=?6>C30N-K) zs>Ki_Ow9n$42G7`XKoC?{=Wjvo05;*p?#bZ=&Gz^)<>C`4(W?*>^8V}&uXjF!A|hY z0=4bh(=dvC+ojsXi-*B^l9i4G*VIHbkY9$mVq3!R8SVNwZRwerBD5aMArDN&ORL4E zMtadTXcE~^tQmTdOc+$KZ7Nu~!>Q@QdfV{9pU!!)Gr*661M@AdBI@o%iN*)*dCFmzs!`Ryi7^yZriEr&QF5NB(Km z)xy^Ei|~N|NrkS-+?W9<+wQ=96!>4dN(^WJ16K)W8O`I!7k>JC(`nQ<@?`3+RPyY; z8JLREO1#Svu-NOKg)J9IK)p}S!7jwLf*Auktv6_FDX8@8oqHc}mN~rE>KyLudEI{v zHmj7ES(BBgT>Ki-^X$HEsJ>a0gYrfmXL}J7qJw)ja>-01)m{>oq1(eX+L?J{+6ALk zoU8pgOZRQZ>Uy4oX?`vhRQTHM7RXhhO6EWcnsOZ=@AJ^tEHl3aI_StA)ydD)jScCb z(r4iLHv{(jGlCu40h`y>U-_-%$Wwy>SyhQf979pN(qz?PTvzz17r#7ge|ZK$!$B8t zYC69Yw$B@QA!SueiZ%m~-uk$azU22^kL#*wT?ZU`1Am<3sebXbjOj(Q*%ph_i2oUY zX1$;cN8^S8LG!})4g(NTG??wlGq}Avb%8C!FRTA_&+h{DZ#NU)vQph+$%6qM?t4Ay z)oU>H-hBS~m{XoYsicUjM2HUTrMG8>DaBckKtBplX!Yizs^K^C3W@gkg|Pq^Toxg#sAoMmaGQ9iXUzS$;(q0 zEk7|ITud%g}HZ_~H-!UgP@hc)m>KgOn;SlhSX|eC+Gp8z$b;F3-Z>Mt>ZgD6-Pk7Px#WAM#V=<%bm00q z@*OO&TUF1em(A8{UD`+q1@19o=RoHsuFLWKc^3R71|m?$Q1hcqjrZHaHirTYf42gn zx`!tYY@RTtFO+5X0A?CyUW0k>{Mu|;Iq zn`veiHOPj3kn zX3}~jEX8Ui4JkMlfLr&K9UOwk3n%LkA_d!}q327G@N;^q)-Q0oD6_i?)Ew?R;zu9> zXQu+xoOAb~fFAfOclPYn56cx_@S_h5Gp9qNbSb%U8ynw40ozxh;CK(zoRgs;T|3mA zC}N=IeDA&~qXA4<-BE|F0exSEiIzX~ohjKoIDgDm5`kXbGlkT|G!M_I# zKcxRvaQG8Cto(SrohAUxq21Gjpq|S~Aje6IBM8n3&zAk>@9Wa7FygAmsPOF?7;elG z`*_G{jUCz(v{vF-C;-TR4T@&|3^GRQ>~|j?7Zefd>Jva?8yC6x%0KshJw=7g5|>XN z>W|)();$b!z}@->s6*j?{@_T>?IBkg;5JB~rAQ}~c_*d-V?SX@d@J0^@l0m3>;x$; zSz4b8w%*^WY|r@U7jFbm>Y%7S=MkgrI#1#qqRE5&P>AFRl@%1bKK?ZnEDmE(@7(gV zEYUi(7UKji!})UF4)eMsuTy5-}gQwu3*R3LjY38{N8dx>J~>3 z(9L)+o}eJ;URN|dhX>YhysoVc&xeZ9Aqby&x8dAm{(ajwNdWU_(2ny}eG@VcEw zlLYKY<{CK;G`~ZBMUW8yTI6UVf3zO*KI}9)jXeCJ?|y8uQ>0`zEATjv{QcH9p-`-J z&`Yx&wnP{JjNJDW25)N6iNHn^>MR9->B7Cx(pe^IF7Dx*EOIkLlc~&ZO8)PmK0yoo zUs(R|%pJzgC6X>pde0OvHXCGY+yosNx?UVUO2E@Z%*VhGQ7LmoE6ejngvG4PdO5r5 z{WG@P$(ewHL^#lhS6c5C(QJo0uOcuP*hy0eSv}OCA^OdU!NUw&s~3G-)^joMa*pbc zZ4?LnV^y&euCaehFcZSi)`ebXZu$8BBB{$4z&%w=G$p9v-k_P&5ttwGR$uX=Qw!;| zOjMw54bC@?uJR*XS zgmae^viyG0#M!OG-a7R)x9VBT%=@&~KFcxm@ZI?YM$^xyf2{k{Z^v8qkc3>?JRl&o z1>_(5cm(0%{PC-M2-}_^UUwraKAlvt1&e!RI$u}#3s*i*xAd7b<~kagl#l%*E)D`* zyflcUW7&xdI+BH|o&ygHf(TR*N#s`MJ(}BWy0sI2uCIyK0)?2K*p^(luvvh4|BBf^ z0*VFzs+qqvi0TK72)}vS5d%PpiRfG)07@GIl*817$kt9m_Dl)hJFAfo8X5PO7Yf|1 zC{q7NI6Wr@aB4LdxVaNfM9?Ar;HBOos62?EB;DbMBy1A#`T!$08%`l|(&kF;jk#4BC|Fs(sg!cz19@f}RmBKa;4 z3g6j=3a&=-B=Dr&321BPkg;MtW)jaw*y~Ss^EMU0wGf3W;ms#6JZ#GM zi6?0Gdc5rac%O^GeZHr^D~Nf=`ny8^&`&p_ z+q(2G0e-_o(t=0{Z|m6;K*M=La&twwBHN(<%q}NoOSb)R7Qf}%(|@{P4?o@lph+j*NtqM?8^;LP z@KXSPa9A|sz<$EEmG&%+G_aR4yK^^8IG!?(6m1<)`6rqo!LZ9%jYyM){NM~*zxina zHb>L%RsTKZ+)Bu_dmh?_%}`&tIE#D z0z0?=5|TG^qqze2AjA$qh+RKz{E&dyt0!;cFKblbT#|Z)s3{P@=6+SSoe?}3D+sKk){13 z3F6*13g7Bu1j3zG-prug^UZsU^bXD7#g$!c@WVVxIyxmylH`nCJQ39gS5FTU?|9?) z{}PcEoD`v?rDb+HY?QB zWU|gplS@nPD(y&@#;g#pXyxF(Km1Yx#|GvN`;d>!j~^1f<#FhfdHZ6Hr-(#V(~0N| zF_;jAZ;Hj*@N&c8-OaaiV;k!I=g=Am>+5fC6??)DZ*h|+{X_`td!-Ic_63{qIx`GT zSXA_Ms|TV46=uR_S%#6is375TX@E|$GNpdfe`Dj*d`kT1_>55fvA+77>oJrut~ETi z7RH>I%l`GH!%?EbIY(g0m&OJbzr@9M@0Y%Q(sq8`sIkG^8-6;h&=JEwZv3IV>1l1B zI4s6iKzqF%5)H7t`Pg!=3a&CgHMZex`B_L0v;8On#$zKviH!as}_O-+9wi(ipg z{8wOnf5@{8TjS|ajTL#0fQygZ#flQ=sMj>@9a^B4_PzaKYQ0;AA)%-{v`N@EVlt&D zc3i_=V>PS&oUoF=t^mgaend6z^4 z^%4{GK7tKet5V>UB@>riFoyarB z4yLdtc0OPI{!o7mJENbDU9VWgVEaz6PyZl<^}is|)&O%W6OFqp-QF*ONG*=ivCg<5 zos|hsxK5BSPg;r4xIPxw50()Z_u<2m5J%mW-k8w$A(Bcg$SVi&8&CeGmg`Rw&Ri4Q&j8fhHG?>Fud?kje2J3 zj&YNWOBfu#QJ*gbD`Qe^TChDcrp+v^Po843E_!4+BNU$H+bV#G3)twWY3i()q=Tte zxlIp`PY;gNA_yA54F#k%fhIe=H1oeC1M8WJ;ad%@}F4egQ2)d z6@J*?Uev$etS|ifF2D`q9G-7(sV_gNXixHp0A~wfSi0LG^{{wLeR{GR=z^nvxClut zeQ;%p?CQ$FAAja@_EVU7<@i;wf{Yl^z^AaMPX+jmFn)IT;iYXK3?1LP=rQ{9@w4Ff z$hTQU`yQHU%9cE`Q@C&GaL3(&+AxW>I#%BAZYRs<;}M5IGfKtMn`Rip)Jk(88>?%0$H2yD7b2|+qU z8l)SPlx{ZNo!@LYp8JU2&v%~p{l0$`n7yx=Sv70@)>_xl^CfDqjk!whtPH#$-n?>Q zH-G)Q1p=WtB1`0p)75Bz>E8bBa0>#G??3Q)PXQdN`%%|GbVMOR{$pIsmtj!MvjI;s zTaEsHqAd~kAqb0hbwOC<&HCcrZ`_1?ztf+A!xXb&;HLpZs;Ir$wH@bXFB7* zZVB)?RiqcviEa>E^jd!-04w}@1BHgG>vKJ>B_u==5cNkvbDBg#z!nXs%FNa0HT zpCbSiU4JlXro}YV#U;Hi1YYj-#rdSovysd2c<&OrxP0ML-db6%wfq62Via zz+*SF;kbXpiGwTAmPBQ1Ks0}%zZV-;?e<40GWWbxjm_DH;Bql8Aoqd?u^2L!0z}~g zfZ_wTdHaP;`x8`Xu|EAA3WzbrDFZdklcfgUb$vW$yg`J=oG0?K4u{yMom#T$ND87} z(FGHT{fCnL1I!TW12{%AkL1ePsrJu-A7~(8%Z=mVfx<~12nEy5j|+dL1`NIDa}9(M z6msNG&6CCQZdmH1lE!}%i>-4wscUE;D1$l|ElH|uPQCN~to8IF0ne6E{Mc>WTUFl! za&b|Co(Rr)9LVbq_u-+FP!pWI1X&EGQs#BI-9of*dB2Zv;z7B;F%ywtHh1^&yIVyb z;02=fE$L+8tukXw;#Qb{1_^}7je+FqX3^T6fdT)ZGWlINfuBhe#fiWP+$03zx@&GV zN37LB_Y#Ckf!JX)XkkL7AWpB51Z*W5$e+Md`7&4FZKI|2=beg! zoyO>UR{plrNAR6`jXRv75kg`>Khf#TpkuM)Vo;gOB=Geeq5bfr6oeE>EwCF=g%=))*vgA|os9tCVv`Xi`Cj%z zb1FaDfNV-PAz^edAu{F>rNbs}t_P(TCTZY4nM~01^t89Fmihlb`}1kMK^2$8z?d`jP?4$Mt*Z?_7an`|t6K)3d9e}C+?%1)_dnkSa1B1sKR?Y4 zhhMB3;!@A(|5^!X(YJ%yt&su-uEd9wlwKG?3%%(F*Bp#%Y*p6VcQ;@Ohttor6D`zx z4ZoLvlBv*XyfO2kF`j~NGN}dto5J~SRpU)TwaB^?!%;zeCJk@@IoZ#--7xySJz!UVd& z#qu!I;RbwxLOZB{FD`xD>&Z(fQ0s+n(ts~T?Bz)4c&&4JQ=VvUKZclgm!w&>#dkz0_sqBICyin;h8|V!VpbKk#n1*=o49)RWT+0kELhE{ z(mQ_pWMiFnbNbsvt-vdzzBDFvUb}lO((!zBIoF70tkmO%hfhR4siua@p3F>ATWU5CSceXvaJ5~DaoX_yBKf4#KH^{kygRp=`{Oav^BfyOpQb-#X97eeV$H($%`FpB^ zJdn_vwwiH-D>5Pm4W~bxZbz`DNFFZHOv*UKq-LYN+gjbt{aiUKkAHIA!AjN<$vD+eWuUH%95P125JsEcc{(T80mWR!2#dy94Y^mOn^4; z;r?K~F!jaLfkGAT5AGbX@_-TY=V$(46sC=NvOn$GdNS?ai^{fdjd8#}@s^(ALGI-^ zRpso@C{yYtw&+Vmk%P+ z=~A&rA7mA(G)Nq#ww247eXBSgiTVYVY~I4(1~L#DdUO6;idSa`)y}y0;A1LE%mN%Q zOtK&%v&vq+u>Az72!#DjRhSWS*pB+ikb7M@mXx`0ugglkvTk!eu0ERwWjG=-if#^^ z5<97@dhIe}`ewBDgcp_nTu1j%u!z?u#xG(_?sGSRTmGGU)enw$d0U^kL65EC37 zT{1SnUM2VL9{098h8v`V9d#0!wjbXgrATK*iGv|F45kCV7K8OosG2kB4pXL^2rSx zoO)7XS={o*?2hH?pa;yD^7VZgFp{F?z=NJ#pX%EAm~GimaK+a#Z_2xfq7g+m0Z?RPB>!=~!!h$f|K<3L-rQft3cQa8 zntc1iZ!$9n2e!X+!u;^z6uEjvk#Inf^-((E<;f4Wn@^cn$;HTDtmZyWdb_PR{q44r zqH8tEqPCl74jzQQ1egJ9VS(MH=NtL`+0;*%jPB-KCwQqQFUT|I7!gWu1MM`WW`l;uM3rFgK|RYq=4cQs6?YOeHtub-_3iY4=<*GlSjFlfy!d5iM&?)9riO_8 zZI#Xk0|*2hmVUCPCn&&|Ug(TwQx@@e79-@>WDqxbJ{FzA6B=w$S@{aXWU#0%q1UCglOZda~igwKpQo5k{8 zho*^)?mEuprRstsqpyOE=Z^9hKj*y@`;0*s%+qh&rlUj4{Y9=0Mfl8FX& zX0iJ?-5%3l3@ct=6<>8)xeq;F1~mt8ceA8qkz}LO{mK%Tw)e&r_a!{AbAh<^N@BiT z!9(5}oQqcT+=zY!HdR~J{6B}%`A!Bx&cBq%l?8NV;7_#l{U+zkDkWX?xgvMDm z@?-8HibBZ*ZzE%p1aHi=5Za7_Q$;GChf>m(*s$k)ydUvSu!ZJ!EXOiW>tv^3cyTdT zQs$w$i*El4e?#5@wv_qwVhTehOU_uX_`#No-?%q*(`AH#GZ);&&JTcnVHI)Xh8Nj* z?u?960+8Ix6PU|i&yPfTxbcIPvl+pSUl)=i|AyamtMXUE+2R*hW_mt_^l>9kFk%6& zA8~gl3%M68!u<1Ao7x5v@U^5pDfJ{Gg6HLFp8XiTeKX@;oTpMmVIVBQp(ZUTH1@7? zp<#mbazTWK{gHEM_8}?kX~7JDUwx2;vu!4wvgowNmI^; z4RG3)D>hWHNYN{1YK6L#*!x^_bcnPtIeE$(Hw-bxo9Y=`xxG-6;fXBKP2=y+Giyq# zBT`Pkz0k+ea_g?zUFHgo8ZIS44^(IxiR?!QTYVNgmihiu?vmnx$6X)PRi^}8k1I5J zYUzj1$H76uCv}zCA(5>=fTnbkn z(;`8(3Jj^nF2wQP?Vw_C-BW1^XUrlYR=Mx`rLM7&sMa-ktUKSRoq2NEdg)oB+E`^q zJq{3sx6qMfl@Roqd0JBT!B5}b0r&MIQ4U)NfSqEA$+0X!taF=o_VUFQpKXcj7CF~s zq~FzxgTnD(J54e2B4<{T+_L?8T(a$PK^ftlfD$%Z@tW}K--Nw|(mW~Scs_?9AHLrHbHe$jo|Eln)yuD$KRj5 z1%rg=Zot+u<*Okzo!Hf(-3aT-tW=AoW1Tu<&zU2U>wbybM4aLY$YeN&P)d5PU}jB? zDBi_Xcj zw|#6h$Xy{(r_I)jwnOZ{PDR>PxaD#NV4$yq{u*O0%PC{ z%Emolj?vV43nK(7R#+DtPn!Tjz?(bi!hD!F$f!I1UfEBZwmOJDjG?7&U5AQBio^e)#!@*a?Af5_N&{6}kP&IBw-2?65;1A^tv1*nD1nQ{#U?zn!Xd|F^iX*iOd zp_gYgW2sVUA8*s~z#jcI4_Bh~!LHM@=bBb2NHbJ>vK7x23AnAjK@9fwCD}_D=Hl!; z@lO+<7L@DaH9WBRAmhs})9v)!ZT~nb*UBT2dv%%jZ4N{?`glXyIyMsdZ^i$ohKxT0=cEoR;l)8L2Y9WBnKS`5+}m;! z8`ua-u?i5lRo~~os5`oZnQ4Vlqe{-}K}o;0zEUhJH&}4!z3;es{E5|K!)x}_*sjR+ z#a69OX-fTN?!UWk|*Izr%KUkJPo8+L@_Y^rf6- zQgKm@gzGxg9$5*bDW=momR)Qg%9f?J#jv$63|+w#WLks_jdO7Y^V*q4t(M3*JD2xr zdQjd%LPmM526D_zJ`R7jl2AZBE}Ep@ki#I50jAoR4aGi-0ljbDc_y~9a`^eN#a7d8 zkbMn}<+B*3p8~*ZK7fv_dpd68H2811A6SiPCL&PLqa;FmCEo}WvZuiYK1|b>Yz6BJ zY%6{f?(KK*Uw_T9;7~*4u3@wbEj#49ORtcqL4TiR`FLF}U)M+IiSY8m_X-2D{lnE` zk+>}n%JiBwWn}TGO`_+!R)oY3R@25J-yV->ZHB+H>~z6Y-DSo6_yi)_5>EFj7P2`a z;jl3901D7%i^d&Jv9UwPs3P3|@8}SVJNIqb^wYDH()v7;?*{n?UbyhHmLX8R8k;)V z7K>oxs9Wy6(B(!g6>LHlGDk@mhGpaO2$fkppMFr<*CuFO*>n_4GkC-aQqV}QEJNs0Hn{ohCACUXl?g$c{qZ9UXa8 zYEv@6rC1%_$7#EP3gr{rQ`|Rdwv;UkX*<;|9grIQQuP>0%Bvrj;Yk2|gR=UiO+;s& zvA%8?4{$QE2!Xx$U@?>ZPu=?4)Xss>HU!Hb%Hwo0t$@Epq| z-)W0teEB{V4Nb!)vuYg2NlFGA9bH3JFz(<4vYp)lUab84=X*%OsM*9-mN+r1UqM*yVHPZ^I8nswDoF`<4$ z0)e1szin3Da~oDWv4<$ws4H-NZF9oh*&{)RHQ}o1Zfgv4!my>XCY@SxWbZ1oU<}=& z>;3>wXY-Y!!;%u$0TN=Ce(@ON?9f{gYIhl&dja^H3I8}vf#M+jdLRs1vqpI%O%z`I1#qiy4?&(7 zhxMI866C9~SGT*;Ubw8v50o;x=XwXAz(v&`?i!|&RWQ@y1hmd~r}|y;A(GlV>WxAA zS2@#Pa+DvQxx(udn4U|~D+wr1PFc0OyPkvt_)lDWQdXSD<+;q=|6Mv31h(s5Q~QS{ zkEHt&9^F&5IWi%~kXiqG_l8`1z3D?wqt$J*@)irZ%N+_*oBI5#qEoqdNHHL$$E&-h zDA4I2H51kFW6Ku_zz|3YQX#^f7*ez{q!H7}RLWbiothPfU;kV`^2_diEiNH>w+(wY zE;j1CpYqHn7=Dm&+bjS(4;fah#y&_bGXK}b7~@S_;yQc(eUHU^>dph~a(NOq#@4h@ z+Lqy{km-OiI~6@{3oIsx>Cx&gqNt^I{RX_ehg|2flezASsQmQj1Cm@{4@&0~eZGMC z-mlF3aeg@y5qYwX>}!%Tv{S}=dM2S7*N?iooA(GI1VkyySE{zGSu5XaHi-PIk5iu2 zq}0{d`x2_DIhV6Qwwc>w`6l-941!12nLEB!ZH4PK^slx4xKly6my#N?&VIzoA(3+x zGC!~De7(xgzbnIC(~*ZjvzA#WY0GFlB3}BpkE1En0-*;*rt8er8@roA+J>zvu7*!y zL&ssl46oFWx}v%0syls@21_RI#9#UupP1l>(`3c+mqxiMA!dLj$=^ z`;(*>?~>!WlW4;qXU!*&QvG`sC*a-Uo>+x-@Ts_VlrI&o7x;4VHg-luRB%9Su?=7o z({?X5l`Lg9TV1Xev%M&2i`vPSQL&AG9g<*a(S0fajCveHm;v0vSHlxJ^0ay_s}ot?}xppgh(*736d6I?yZNb&7viFJ7F(JOO-aw;h%LteWv3 zm<9O|poT6lH|AN^zv+d$5&NRV5Okz_%VSN9@J9bFEMkl0o^LDwu7k(GvXz(c1ui-h zaC^r9C#vQ1xtkXU2S7O?l~aYo8FmWtR?!-cVfQzW@~Th*emov_kT$Q2+kBVgdVu$d^a*f%NDSSE&83m5y8VU@BwX! zwTo%F^KjP*p2ad?nmenS|EEN8(*RO5&NNBV;tJ# z00y}Qk+&{V$DJ4i^}$o}Lda)S_=~#O!khs1cNfNm9{|W;r_+~s0{&PrLVg82nBbBH z!9Q6E=gCXJlN;9y+VIcTb531_jy_7R;DQrAI4@AB02uzFg5Aazz?v_P z7K;E)HU8)UJ^NU(u-lrqBn?Fz5C(B%FG=ueAq;pn^?@^~|38`X^D$=vcvZ$+v;C?{6zYGDGFaiaO zw0YmB$xd3mSvfmunz2`C<7Ng$1g_>n_b1Fzf*GrhGwB!VKpA$l(@a2S9+p!I#yJh` zM#h=$(OjIKuFewZ=Z4oMU06R{K)%7@!3q|cUv~zyZX4*Un&4w=Ecn;HA|bpM&3C;q zxsgCwzhDy<60*Jd)RoB3MvGy>DjlM?r>=%it*jP z(TvON)%PUySP&Y{Cf=ydPs8JNVTQ9`g^J-+*(FFmy|_GGcd)X%Lesa-24pFP?5RG> zgYvGJWb0Nus_dr&u4JK(J8|P;FDFWPfnWtbMtFcM+JixrXAx|9M7Hl#PtILF(|vd0 za?zg|av7B3W0#@8E>0}`0Zx)w>$hjc3-76g?1g=qwWe4ju7^$<2IR?3u{|82l-n~?;^RV@pAC|F|RLF3^%I% zQAuMLH>V5V+}*lqrE{u+%~2VDEPEJJlx)6?aoJSFoa)lGdN2k~K5I}KDPljZGqCAk zrVRC$KEq`$`U_auKzM6xX6HEJ*8iUzR)Jf6be0la_<&FkDi-PYm_j?!*2W zROlRPH#~#bq;Yv<+`F!>$vvU5B|$QwbrgE0(Z4GZ1%TGX5M`Ji{Z@kXtMZ>B1QC*c zQmUu~#q%Af?+f04ewhW8TPd|581@+#yDFpxXMh@YAZ|4_`}>N`!=?}Z1#0XZJf8nt z{?Fa~Yf>^``Ah^Ik~*vG9Or?`7?t>$%fUbR9w#4=jES4LTd_W4LlkAbG|39cF;4Fe zGF8b`D-l^Z%;BN(Uh3=u|7CVAI3pWXk~)8`=jR%A^WcoUI%9h_Aj^PdIDw5z%%Z76 zLQdCh6nL|0Tw`-*z8n+`pC1!$i-`I3TogAbk(DZ_U6}~ROIf;Z|5;9f4HheI$3MQ9 zAty%!yng7`!gzMVB`T3Wwb%WAq_Qy-O;+1d&&#E4%g2B~wf?3>(%-2svZ!qwDCd8u z9R{eK%Q!_O-t~P=*RF5~CIoBvoD9?`t8jDwL-s)Mw(PfR2b3@R#$8$H4(= zO!Q$k2vjLd^UTyS0!E|so_2qq(&k}8O30!+ImAq^E}Ov_4Ppkr8)qPgD4f9HO>pRJ zox9m^TYN5p?pOeALcL61bmk9uJGu)^1d$AJGzY&)XqxauRx=CLFt1y3)<>XXcRabf z{+K?hsOi_O_f`ib*OuwFzHZ1Sq>THcH6kAdPRHvZzwerV&->R39+Cq+LQEU}%Z&~Y z0$4~&E6HwZ9+&0b`@5=JQ6@uMs?o-#^q^Q%dx!JKCGitWJn^vX&363}gQ*c>Yw;JR-t;GFb)8n!r0zDUiqTMw_1BioNT$h4$L@|7M1OStWxvigKknxbG zO2?!0+|`}osm3ml-?=1SNXkGZ;}bnQ^BZ+y4-7&~Vx|S1=cC=bu`i0m8NJl*g7Bd} zNPO|K^~xPw>lrd`XpBo-jmt=)Tr;(9Tt`nwI{*W_ZLf3-$pYOHPzI`P;;1J zBXiPlO`i9X3PI5URe~)ya!niy9H9aJ7{8kJzw{E=eSlK|>_QyCn|xK|zCp>!-EctJ zKu!+$Dr1^gXL6a2yJIf>D+mm<4S;~vbWaF$4FrO&fxp`)j)*-5(x(irSlGV<;8o5- zy<~X!;C5%kCg1Jgn#b=P)Gaz+C|wn8lV$X&YPCv(@MACejsw@Q2Yy5hlViOb_fC!v z+RlmS$e&oR(%ic9uOOvgFbpqkcz1+c?$Z}^^4T6>$F0?#hciEdC@mMJQK!)99d%W@ zLF)|nziyqW4l=|M-Q2bEiv4rT$l0D5sy1*l#NN>NPRDl5BwG)>`$EX=BwwYE|yNqB}d=- zw(}J7J*n=Ot^M8P_5TjiO(fPQYtL9w3kVbu@4?KtE$0HMXh_47yHmI8^3&LlyFLHa zqpR8u2RtdsT)E=^d!xiz_sqyjL~Q8Y^%5&d(4m+Ds-)$5HdDpEPc~QpxbRihBiHD# z>Yzw9ijv94x8mpS<~g8o&y|y(a64b?VxIaY{l_vW^uS%<7;v_dKGjg&odCDqS zlurGxFu1?_WzM=xCMPHTPwjE=R`*jI_;LVR%urs3p0(TK+4cCj=#DtZBE6X{Ha?ocsAm5AWM>Hi*ZhQs79}K4mPoP zM57I!({`myJmFd1uQ>*!EN45p55@`N~wfOIO=b{j$J6sow(L2Bc>|JJ4ROCw&?ZUM4r z!~fV|bgnnckSK7{qWMKWVzybIlG~Vs%o<{?B8qlBiaxEU_@rFrE){=YHh$&Q-chl; z0{Hvtr2Xp7OY5{LtF-|V4{JCKdnp!eUzm>w%|CsH29ARK)3W~QoK=l>R?H&TlP9Bp;GTQa{04FJoqO5{H`9JRq_;cx z!FPQUc#@7{U=!Uw!^R+uZf8pQLKip@OR)nQH|%n}5lI_R4xzfN?o_Qo;*NC7-L&+bs4*lsjy; z9E?Fi$dn+=u19(OW@P;*U&Pd#ptf2sk$L}QGyu+OdsHkdnzk+O{+!;^bTJy$N ztmaErygniLg9;JGs89ym-y&K=lxB|&N8Rw_P8?q z#o3M_Gq#nOc$;`oy^?O69oFE_9QuTavn4-85+Qp&7#2$jN@UkrauiDPt>=C;NA4!L z9>|6}ABU|=t&+hs&E3_8%iq9GN#B9G;OtP`)(C>d-ZG5F@3#Yia~)b&rPr-$lXxXS z_6)YZ=&@i?0FUUl$IO?Xa`7{WdL06SDD!B>gLC-+_2tQU#LZG#bxRIW;mi{24HfO( z*G3DNxmaH|F?20|SpiMe5g%m)kM}&cR(iY9o=4)Ads5CYghq&->=vg9dG9WcS9^AC z&+g>EsC8V`E?IT2+?bZXqT2{vwp7{tD9~RnbBjrXzR;*YoO2AHni-RT3Qwa)Sl@Lc z$__VS>hDN2d`gzN^a9x|q}`_K!o%UYP~ji-Cu^bO*TP|Yeu z#%WV`5z3$V@Xo1Ia!y;UK>MB1!d+(W71ZRObdCCA(E{I?)cFXsL+jPPdbF6x-PXB^ z2el#_v&HL)9yfL(9A_mxH3P+0D~#0#bM?y7a=*t07>JJ@9zL7d@#N@NXEv+YjF%mr z_IRuGv}u0xhVAlpnLw|9NJz+I6{o7n$tk@J`!aCoY|&^Uj-33?FiA-g2g+ zCr@repJpaMM&^sre?lhUEM{uznuPt3PNTfI?NB=?lv%SHhHdof8f4wU!D%=~U?x_$ z5+31U9Pvq?s2xa6*RuS%x91@ok$7D^{9B*CImqPSU}AeLcn&24M8dTiJMOFZz+pMH zkwh;kLmONQXn}`%RAxD{{mQ>GZM?oy@Z=7ift(-nxBe{E&O6Fw+G_R?7jbEc`~#D# zqPJZ3!5z2Tg$;#de7y2$%rnYa8tP2N@AK*a(gAYBDN6oUE`vPRp?)N6gE(sTvMr%> z3}${Vt#h6S9#v@ROQ0G!(RSu(PS}_$ZBE5Tutg?B&FYo0gHw$#rCLy^^>c{&ZblmO ziKhL;W8j?LrZhKS=%J&$G{MZZF<*|mwt0fK#o^CM6UVgoqu5_bUbXyLD?NBnM z?E47VMjAaBc(gL{H*xEpUdG>kUZ!6-Y(7%hU~x~d$CT8!QiF!x_z}fu zb^A)$*eIC4t6gwjtv_MXppQsa275fotDePgA3QC0E!gx%6Qet1P*tZlI%$g_Al~1J!4=6B<)1oStqePMJ!LFh=n3LE zU9nA?P149($hU7sqkOq}xa#Cb@^Zu8L*NPji+IozL0IIx&Kgzr@s^ZxhP3!j_hIots8gM9S=%r^sj~>gvb3VOMV3J#``gC7d6Yl6 zF{pkCtg92=%*WP!TI~y79?@L3TF!VSfkaEa)x^B6)E%Z(X^`sWxJ`s#2H_hywOEzx zTaVV{d^d>uaM`&l{W06rNO@Wfft8@<%Vq5sm{7irDoDJ#!T~|ACfQDOn&4i25S?bl$* zz@LcON54hDJCkP9pKJPLkq|kEIS|AikE$T#PIw0=WA@YNtbevQ`5FMS>Wi@yy%@jO zNP~eNPY6iPMTJ}yQNf%l;|isIqZM8{dGE?|I+nbW_QXr8A26ZT6*Ec>Ha`}FN3*e$ z8vMdy2JJ$7GnB;3zGP)pMuUoAtJ;+In5Gr=vP|Py_mY_Aon_RnjbMHKJY7-q>A}8N z!pm|WG>nQut9F(P;>}2hhf93Z;@EmxLEE$~>%Ps@EuVnSS4;RGY@utrte%7|?=5Oe zH#!AR@p~0=A0QDQAtCo*+{qeJGe9Kk=^!!^_3a=r+bB5(F%@B%mz1-a2j8K!>tZwk zu`I8a+PFh}RRlNl>JxnCPX5i$RrH1}Z5$^Etm&4fozjG=e3!8bJ=^xTja8@A@+Wy^ zb#imAZ(gQ9N_=>)MRZw0dnGn_0QTun|0Z!snz(!vyFvE%H`#GK-h=#gCvqQ1aaUw> z7F9K0AxQ!~7@SYpR*X2jJ{svx-K(^$Az!uQu<#9*V*6OuDosOK(;~`bu=qPDCJSN+ zRICo_38fm?F_q_bv6h+EW?{X^k~6F%A9S0FaXi?>zc@M!$6DG89*vztDoxz(SFbY% zY4$;I@-c3j{g7`_+qb;Bi|JyXEZ(iZ@x3vD@ObS6p~9{)T`}i&9N%T%>x=!Zv{olW zbhSqtRW6N4t6xZXM(jPrVzq61>0r3#D}uWkr`7|-p%>DwR5%94tEGL} z?EX?nu(V`hi-FzxQ=1-s9NT5~QRb?p8v|c#dL*3$l;EiYDIr8Jwn?z`W^wQ z28*7*>gIiR(7tQAQli*hD0e#$*zguroyKQV^R~uz4*P{K5dpc8_lDA z(wO2?+1~85?7sdgQ!>gWzVrd;-iC)-w<0vcSDy8_RPLY9!hPavjxXMq^RGNnq|!In zoe$1QaVlaGi8}TgG}IqQ_w<{Dhh+@R*S{#UbhxTiiNCwWNONKvx<2Gq56h&A<{|gLgR949q62vTfOA%VK`iUd@20 zFjGs0ZvoFLQ&AE$%S93MIw~ymWYR2hn1ln*yyaDqb-12n1paQt>|ozUhtsO0wsvAq zwncVl0pL`MWr}l4h0N8et#s>E3$IMg)0jNtx4VTxjaTAH?o>FA8K}i`yF~NxzOPz8 z654LJT-|1Kp37j>-g~+k4BjI13^I~i|088On{-6)dxYk*e%3=i8&5wE%CYPt6?%ot zJMyXJ%(Y&io}?SHcIMy7TM5MLz2@z)VdH`yfj3@8M1^NDMKsH&61|85egPUjJ!^k& z8g{MTTn53Lx}}OKJ~gC#fThkA8RqZ$R!&F=RsAt5|7&*muY(hQn3BV*S9GhmW&X;! zyPqP`+r`o$(H9-$e1+ZFs>a^tD&(zArjz$y^X3r*ILcA!3SQLifSQ9@jlH*4fyit{Ad@)? zgGM0JB@u1)y<&8J4k5K0)mw6VVM{|d z|G6!4=L1lGt!R=v!=%LGKMIurC^X%o6wwmi9@BO^#bFnZn8l94VWdFk%|Xa$hI~Xe z>(aKY<@ndjh6*|1iiP{sjJktu1C|F{hMzQ2JY*}4md)fgVy%)Nm3`Uh4iFR@aonES zeB*|IaRGvD=%qg!t1vi? z9lc*Tu*q5tWWXyoSwnc;U8pDtM4R z(Qrz{a&PT+M!K|la_2Fo#A#|m5PzASNT$htV8{zl9g}6Y-JG2p{#kE*KRpNr`E;jo(q&S zO=9^iT>QImB8d9MVigMT8p8po-Q-^72oEq>*Y4ILKLFHQe>_4Tu1y zx#?BW5uWLHROoO|Ws)Bun-b_wx^sP@XA6?tnI~;No!YyYtT5lTvDAI6H|d1qyt3#r z2~dNr?VzrbR>pkCUV6j+FNJp7_ZwHAL{lhhxcJ?-yYcf~0RDGREI$knOmQSECUmHh z`*&0ceUx_4gc5VpSFDzep|GVr_1q`qJW(%MIry^i-EThMcG<|mVy!j*)sRxjQP-?K z?jk?0C*|y;-eDQ%(<>#JdJIWvFGiw4H`9a7{PpaH?H)H+-L?91R_o&7u4RsavRykv z+lhSv8#bQiIR^sZrH^R8tvty0BV^%AYTQ?&<(jOm7N3%f{vw+;P5VtQfiXX)M_}@ALb8_WEAo7t|3vPfDU6y#SEnoUehYY%I8}timQn< zPxSg?OB$e5F&wYX;+3{WxWBRxi41Vaw2=o_`3}pM21~l{-AmAORi0{#U{2sWSo0KV zsy{46b28ac3ji-8a9XXD*C5#`y-6phaP)@L8ZO?tEnaMXfvtbJ?V}@YYd_T3z zWcUX<&0GqVdZNXprNh(1TK2P&(Aw3F1tR&x4+JMpH7*lb-8O;0hX`tVEQN8z^<0`{ z6#L6m%G5=HKjYf}^zI7~pW;Uj{q??1p^u0g;YQ^33u82IjBP@H3?os4;v-s7%ZAN( ziYGDwYbCH`iw;}GHPcK4bo%0Zrv)WlWy&%j#I%5iVB31fl%g1t70=l-E#t<$(Fm!Q zjz)_6`R%p?nQu9pj`Z`{C!Tg&o_b;ur0O*Kg-2X0)?jRkt zv12CKt9fr-OSWvfK%O*4Y;b=KG)SHtf3e8G4&Afg5#0by{wXC@^!5i)?v`c=hg95j z;)FdJVKiEDY347c1n9|eh=^!GIx^V^SfQ1ahXf9rvthMfnBw0-E(;jVjYcx3?jCeS z^XZ{5L8m^Y^d7FF#8?3ro^~rmcLHM6&z`Nw-TH(d@CsEW3XOWN?+&teu-o2Vul#@p zo#X2q9+}Q@Ih?N9Tyz>6sN6O3>fF%~V&HQiSbKlkdhE18%3E*ZPAeDeLZ1}1#B`n5|d&@#<{W+bM4>-Py=^(61!7=UMRlJQI_GVS6>w!Lgi?6ZUW zb?@9!MiIPxSoJceV9J~D7|%CCYa|)+sxbPQLHQC++Tr>xs63 zYeiGugLIFVc@i~frDFpX1y833vXat18xJ)Mve)7e268r3+UyX-=Yji1#vG`003PbXh*Qy=)>JD&w*_%5R-9eIU~ zNy4C<1iU7Z%jIL5L;?>>t(Wz0@(=GqqK>~yt+qC->oKY}hhiGwHyZ8Y7NYxBMbHMm zxT#F9+%l$@B(;o@Wa~3fs#l=)J^%4n$5FhVO6G96@_tw+-PUj> zmUwjlmqx*pVRAESQ)mC%pvB+TZp8Lv zAyfOo13Q3k%WY}2uoX54N9YXjFiUn{tl9v z)1?v2P(4K#+Jlji-Y1;jt}~tzPRk%(kySt_cfYphCES3@z{J)pseS)Me3U9A!l9#e zEJ9D4COQJopq=j)Gt*><4@;0Ag7kf;tNs?jq}I(F=9fJ@JReeeARusTjV-LCFDS#J zRfo$C<5dmD)M2Am3y_uP&+HO5hhR&a14BdV>M&JUII}avaA+S-?HlUjt@x>LA0ACK z)5fEiIo2-LOm<80Ja{W;e^_;W)oImLZK2;~vmocNWDP2Klw>{~Bx=iPQ@Ju$C8%aI z<2v{H`GKvl|0JQ{{-;jshZqKogw~JHWL1h!i2|%^?h2kZ^m}!lEc>soNSA?jDjmV8 z658v-nkGkuV|!U^L{-~E6RytN854>*&W{b%%ac&%js#ard1AMZRs-zbP~6{aR8}WA z*@`~h&2_0Dx|NWP4O#IwTS0W_;9m3_Rrjjsw zPO)A8h%X~cl(R^Ivi)H(2i@#2Zfqq((^*37PG76$(SE|4qSMjUo#jQ2TM3CcCnvsk z)(=Gu;vo`tn=dp^4|Ec)opuYB+$le09>s&4zN)hN0U=UK{VL%qkRwg4e16RV{5lP{ zpLb|zl_PjiPHo$A{Cd^EH?hm$MS9Y{53tWa`v`HNoTbFRrp^HtM+W8IiCpV-T0zy^ zZ;5z>9hi2gh$y9DF@Wi1=CT;H_NMbxy=(p*t@cfs+&l4VmYw{XsG60B+3v@_w6DuI zHd<>t;>v2CaJqcK(Itlk4MK2nmB-CNcqveL(AJ--$V*4E? z+i=GArHh@u7wn3&)n;egd$eJek0VV?ksZFYZ_PQ{$n8pTNs2ey3}>9sV|H?Y8M0uS zj**&bTtg3gV=2wQ{Mr2bB#u!$QSiv+M}a|S*M7zA++YM7h(OLX7s-XYT;K%y zdLI=9D%EXLrt~Xio>Gu=$sy>lon5;?{_WXiP8v>IqmPbSkGZD8Rn1oM)pojE3BQ=R zYNhk59a*F8ImdT6*!BK?w?;c?BQe}L!Y4U@(odG)`?`%cJ&TNcea@k055NRDmKe2 z3z_SpK;hSpf=>xiA`M3lHyK6^J|L-Zu-Y3bI)>QS#*7ZL?B$Ui8%(s?jjO0liWIC939atzuw{s-(RLJ5X@eI+U$T| zr&7SeBL3u-{1??;hJu-h*h%DhBPpR=6wcd=m~W$^qH@i~D%Us@_O18EPKz{A(b3W6 zjVEgW`MzBJMJdjgdtXM#JlVlYTliPrX)OVb(V?|_curGt`LF)XQEsJRsqbknCv>t` z^W6Q75trPrfn{IgQ~&jnmaj(GSi~xfZ1X&4(|_GUDQ0nSoE;3iLH>;iJZm|cIqCOH zWg;=av*sfWl*Rwn;mwRV?bAa{STK)38Z+zf8v+X|Ef0?qs2Ho?}QJ{Wt!>H#oxJ!X`86Yfx zdj#F15uFA45f^iRdCa+fvLb>y>^18PyU%zG$W_>uym&r+H|2Q4^n8@DvV@yZ8F*Ha zaiw4QuLK5qr^N%F^-(8Y{leAO`1D}wp^bm3?0a_vQz_H&Wc(XIsBQrbRK5C#Wku7H zb9I$-vrt^nbGWkPh49`!7sx<5ur4W~5wPQ@Awa{TwMc$nmYdL9kjJ>X4T8<>>A%>cuei_c;<*A zu#TomI5#a;6EXP5bOg$+uuWf~8_}jx(qHAkwaxAAk(a*C#y@xJ%;duqWKvg0AwPF>+??ip5)Q zLFk@)^>6SFQ|X~s-OQ>r-X}2)&VQr%u5Y672!m66poaPJ;@WeFS4^_WL`0&EJ!4hv z6S*&IlHYmC!^b9Q=v4PoUXp02dT9cNszOHyrFo|uUK}4>pD2^z$F>zXwg#uFGMD}M z*9kP7AKK0ib4PnKsMFhDPX4F=M0R~aL1)EDMWvw3^yiZs)rpo6Y%%Q+O^Rm<9n1*g zCL5B7zAgKY$x++)8g#3J5cyJobfw9XpE#dvHJYM0*{-4%6gbrmS9`L@mmGXJ-d7zl zdP-gOfWEhAJ;RheEqIJPY+-0mv4~Ki*(^|E`_)mp>h<(#PO+2&4oGj-RmBaWWH}e2 zss$xa`u*#2pDO(|Z89E&9bNsTFxHS$+WWqR=ZFxSc%XQ`DR;Ygs`l-5qMDQA!`h|M z3V$>x{@DAOXaCc;B_N&(>1I>P|7B6{7^cRXys}-2Ry%c)^#=RKScO`bW{a+UV=dcf zyz;rt6w-Q$u^{H}KL?Ji`!{<~KFVDJ7t4LcM*?jBf7pBTa46gNak!^dsU)&QR7xSV zkTq0~P^3t<7)#mL?AuH#E!HGS*0O~d`_5!nLLsv6#y-Yi3}gJR8$FMiJU#tBpZEJ7 z?|U5Izsxc2x$bkj&iy(sMc27aJyO^+-CMWF5D6jK2j{TWbXB9~i@*Cvt8yO5@NEMF zx8r;k28;8)*RUZ526$dlMR2YGv4Xj;S~KUjS=p>@a|bO{JWndfi=X)?tXEi(X}*lh zxAq%AFGpIq&*2Ch&4v7*>uUHP$rzLpiMKl9khZP}(oH>X-d@$q%EsGJm*r!miIj&UIK#{5EpM9^H%?CPKvuv=`j~N)2zFJAJYN#DAXF~7pt8N&q7J2i~Nl%%#I5my$R!m~G!eKPAise!S6Ei+ruDz7KUe*rbi1V#A%- ztIDZtE`~C>dPjx$>2`uSTD2zry(cVKK69LyAQGs80g#);x-^>OS%X$hQp(|t%i!^pj2r~JtBPTg5UMb=VT~I9vBJ$; zz|NJ+9e74=%rYQH$<4-K<=#D=R^U#GkMn$(p*#5H25>wS!kGJjypsQB&np99n~cNV znkjDXC0z&Aa-~%}-pUCqR#wd`?B0VXc{fT##NCP2I`)%yB^3fJX{&%{1^Ph}v~l~!7Bt|m#(b5;$e5i z?L_Ef4gDmc{j<|4ZgR^DspVnd;0I3-9A?Ph63GG1NgrAzsW~0+VA>2mJ8s|eiUH87 z;dDdtssp#im5EdUK9u=uUVRF`LlAgxjej{RQs%%_NcL%R2cSO#u9b+FqTx?a{jm`; zf|1J?B)e`56On=cK$B@Dq%KjhiX_R`BE(P9O|tYhI?3yAZ$=+bm;p-%f1>jmWdW zM{B+``T>AmwHHWfdE9CkwpO~_HJ~5q+Fc{Z9XQm*{%gFHLpi5fxB-Y#XMj^B^mFV2 zz}Ly!0z5PqlGeGkQbo0A2vAUsYK4AMZ9uBpvzX6lZ`>R!{Q-^3_?$6%WGy_)zcmT~ zPF09OHRT195M%$27_Nl?pWQUdP6vQ~8-yjby$!)+61_}RDafPFOc6a!4i#|2x@GeR ztBqF0eNX!BZq5~sL5tb~3Z4Mx^`LJeA*r%x z^JeA;Uisl}oRfw@s~tI;pr2&O0Ue-_e&;=fSV4^a+s}Nb0D`5=uc9ZxPtt&AY=|9R zz3zNjT2>K?WB@x3|;gJU$rzVs!Y8@qG0ah9gN2n^2 zYX(t(H^au2*L{JcD%-rmJ7|NuG3_KlocGMQDEaP(;AlMpT zBc!lejSjp5KT!vCPoJ~p{7D!NUIQ_{Ebsf>6#A<5D0oFO;k3pIrjalSKc1@qnMW3eT9BTkW{su)vve$B?Le|;$^UX7&)6D z>X-v;`OeKLO~j?kf6okiO>~2#BH?Zf>K{SL4ttnq8TB zS17;dK1)E-Mu3HYGEm27(B<#`7Qr9#5UUAHP9D1J8~Iz@eZf(Gk5$TMKvHEMa;opB zl#T|FD#f2O9^grkC!zAqFwXK0Tp`O3{n`i^t3>y{bXBG^A%%5TV;f+b)Js736B1!R z3j{FjMKaEGuaz>LAcj}!;Fx>MM?&k zL2!C=S#JN=3@+2{|JP+WdH7 zA~*dE{{xeX%%pq+Pb3#oPa?bpd&BUm(tP~UlXC8Ia0$h!ys!{*k%u;yQ~)q;pzo_< zH97ZV!&QLoaGKL7?$CSy5=gf5su#$WGo%D`2DX5(3#9C}%b2y(g9Gt&U>JVNoL{Gnt}a}HRn*pK z0O|OUV}BQw(K)TT86EG*m;cGfBSk(BIGS(G?Cy#tJeY%ppq2R96Lx@y>-p1!~kL6sg)2j|)-r=X!s_gL`WrFD`O75@Xt zigKAqOR<5*T1#|mYTw5c7j$h30?S_PwLy+fyCO)4`nQ8Up@Jn7K)1WUq?>`O{#0i3 zt-voX8TA2IMR-GTB{&|3B21^)MQnyIXMs|s_SwNWMue{oMhh0I=Jx9B@s9S_g^Jp*888`d(@@PGFhzo zf}!>mxRUu9mJ){u=fh*J^TR2Ib;(wfAKb-L_l=mlIz9Vs+Wl_Mqu+Y7jOUm0c&=AAV9S zU+D7z@$XM`7jQzB`~S0SLiF6BvZg*?8kVzWR10_vO}Y#IEVnR73Q_-lBJ5&wQ5zop zG_>ibT+mYm`07S|!`$`igz#x54A7MhB@Eck!zYzCYZ~CkeH>;oy}o=@H$=UoyEW8t zU0g1P>W=s5HR`*S)S;q^il3uM3a-`#H6f+RWwt^ zq^#ixQIQ%-tx@J!p8cm(c|6hEYtV$mQ0+q*$IhLX#p6a+fn*r zzXW8jp)k6r|E*QyAg`O&MDA$TWFwv5jCo?z^;Ze$rj_I@7civ{9F|3Yv;tSd*%$qSJiSSrN4DqaQ3>O51Yu zSAQ&RQNqGg;XGYzAbUJ$ycpwD{*9>TpK%r?fXsOfJMp|}Flca}D$YwfA-j(yppuq# zcKq!!67K^vO7mfzI$FVs$-hR<7D~@=;*FVu_ zxm^+Cc=rom8jXz%_JWx0rThzB3g223_$wogc4jNVQRHrSx%OAY zscKk&E7yaKOdq!~zbUmoW=0M98nC)vuEWx=V#YFWSw#;uv*a9aRXm4P%Rwi%d1mv> z?+38%?1p68^H}MP?c>whS7=XiU0^D8y~}6yqPq$xQiiNB*ZB_(Y^hAoxWY+?g-<`L ztk_O1--~l92^s@8_Wtme{`#<=AH;5RT&Ja0!299RTtk6KZ?U3wHBx#1{sZtMER?OH zh3KzW@#8c6-^O0Hy8T62=B6m?855)EoJST?QJ-cQW(u#`J(9`m)8I-xQ!9RqerdZe zefrQh0e3l&tf=|m_}6>?{ve1+hCE}fLaU;0c~_(P(pUYc&b6b$O01J_gGlMM4Sadqkax!{#_z&xE^tV9 zUE#}rYvb9=b-cXcT0%huE!%K%SZBBFsm@N3{b!p9xw+RiYv%D6`zJp{D$u_wL)*|D z@P4|U_X$!AuLW2tD11Lo$oo9x7`GZYUSfDv=JWAEc-D3MKbC!_t=2ZLImaQ z8?H~}%-FaUKRAC3xu13T(ZRe*wc&1AYobMDZ;=aTrypXWXCnR){M^Jt^PYAb-$-No z-G(?&eJXx4(-C$o?5>6|+5_$ITKYRWx!ftSHQU8|pvb<)`2j~^XY~xipi()^+HQ2S zOy1t2v)3VkRj@tDNzUG7wkkkTZM_*2_3AcS<^8K?AT)p29kyCxV^W74=}N`6TXtLv47`>3-}xsp##jm-*e*Ic1oXIb{map5-<$25^tiu&jN>1bjc2nhVzD( zox1E8EtV{N`;?h@AC(V1nw_4Ni>N3{$j~j-Y!wpA&*qon5KjBEPhry*&KW|x)Q*ck zXG9KuVFKH$Lf*rjT!h^}g3wjIwljD&d-QcPr=9*?j56=1OWNY*{aO4(g_em_GrtEM z55hlu-F0T?{x2!rve+AbC2tlIIF6jT?AQ;*B+^WMkack#4Qb0S{vvzoUh>Sz z=6d(t-wz3&-cTM}K_x$e%RRMWD+TKzNe0!<`y9JM=_vv41F2Nz>>S)`0wi~1K*1@I z-B-(+@8ZX^AI3R|Gh4EmElvWmo>jN-6N}&UjZL_YJguBBIeDK$ ziy0Pj{N%?vG^aBY9XXGo_}rZnqyq(X8N651EkE)K@@gP+Q9{?fsx73_J{+->pXkhh zogM15l2TXbXv;tEG2wJ`B>tfEt0=0N=^~4KLIo5KVq*8Xzy!s?#RGLa4Z{}SUK=px z@7wJ|&(uK}(qgH!I44oiUvh<8{akuqyjAnK5dSy(W*x0JVKH=07j-s6F`wVbTUvi> zhQBy1?*T;ehJ3mgMS`*vsMbdd-&b>30*X4%g*X}i@HqVL+AMc?({=Go{pU!FXK%$G z^=@Y^4-mc!D}3YCtEO^)e=hp{Ubf+_XV?(aJyu=k9A1W}IS^g!$HyL?syL-64CKlk;SJ9r~$O3LSYGY6WC>05Ub_$2}Ao94NVJM=d6?A~GrU8~cht3)She zVZ(4O!gktnofR5*glF-%v5^xg|i=tz? zwsk6%&BEgKZq72agCh6>FVQ&G*^D44{<&Hs93fC|H&iR_@VR_8N{F3~FK2FF$MZKZ zuaok$p2I~ylvq1ZVglJs>fgzl1$sQQ=j4nVNk*#=HA>dU4<9 zC`a5u_I^BiER0wf=VNPn^R&2<_u^4T?fP@J=+OqT@SXV1netDH7l-X9+%#ky+WPz? zSSRw)wH7ufU|y55w0oV#zFP8mnC1D_jX83++bz_@^c_#uZTlGKu#qY1k>O>UqR+dF z{qNix(^lEoH}9&gV#N1o9a~ZZ2raltOq?8aqX&R3ECwH$RyCToyEVwvF9ANM zaBgF?kl!6S&88pI3A@{}?+w)p@ySf&iG_zjfue>Z)}REd%x-*Spehdz0JiNT@FM+Wo+4N?y&{Jgt(NYYv+Wv5qL3B5ao7R_403WuqNvZ`^n|Xw}JD3m8SS)(^LgvL~o? z%Sh2F!axwpU~a?ZS^JCo9)xqBes`tgjsJv**Pg0ev=+T@i}Ni9<*8=9_xKJQLymBP zy)= zW&O+G(-hr#*P?*n`sD0ZSb?_j@HM>8$Ed9`Y)iAHZ>ap}kpm?hfZ@|urLbiIkazgv zoI-SV7JgA#QM?HXJ!UU69={+~-f;cqyd5xdqvBi!F@B?to9}K0e63{;DOv}XSg2J` z!?4qiT*0}s0cm90X}P+GZZ5O+U9ta0cjx`fAey^^~yeSx84rK>n=F5c9MyKttH*mFb6%+Rx(yp*w@Q_PLcMuuruyd&#RIugT)N&q(7s&J)%L<*a%jsos2gB5!fDr)U~x{FHSVLUdD^w> z?*Vn$vcs(uB-{ZNGp*{iPA_k2qg+rF(v)z2qqEU*@Fs3r}XAmz~o`6kPYeKCM)drq_7VH@1PodCs4!MbEq z3hsiXjS|6*(=@EjAqV=y4zSpJ(0jW|7kyeQ{i)T~+>fBR7x2+`t&g(8uY=d}!D8cO zS1IJ{H54EcMNY4_jYh&i&1#WN1A4nBC^N-=erUZ`ajlZb@urkjzdALB0?S4S%kjp1 zs}(FYAS~@ic7|?nSK$L#1}dghuY+X_0E{QDCXxcnPY{;xabANfS>ft0ug)f*HMGN;SAaGB?)w3`p zzTcOkC1!cm4{5;5sou*)A#sT?u%~9~Qh8Qf`o!zqF_L$sg-6F2S?!H++ZapQiSDIY zZOgRh;Xj#faZxQBKCZhBZnV%`st`da(`_@SSaNx<=@2)9KB>>2KR@I+Yq7($>HYR? zG;CBhHhdBm(Y=-$4-iei7$War12I*zD;*G*k_FO=eOEEDPN z+VJY_ySnNubL#H85O|LXxJsgWB&x?dGK`hy{Mi>GO0ks@Ik(~$mxc0@dt5m2Y7QYi zVn=#uJb+fH109h{MYNX+hKom)7+PUEHleBYbPpXLHT+-U!d{OxYgh9M{)`86c_ zp?O^BeglK1#|MCuo9{5ObHNaAXK^iF*dg;JGmMS@S6STE|E(l*cVSSi|CZ!Vb!z+? zQfi|JE>u~f*52zYX|1VeIRK%4?eT|;G@a}dq~03chF-(z&w0TqruZ|uT~HS&spaau zXkVLHwuT5)yx!srasHf=CQ+$;ev~ld5}h>{<2loe8^z0-W3TKRMWUNA{;j=1+)c1L zWEV$fIlsz#R5%PJW8wu%P(z$U!TlN;P&ZOZ^DFI;cgLEnTAAypN1H9Fy4*&drr?I- zO2g0PmlSWRar7?0&hVG5Jnsx&WQ*s8|2_b-W^SykgrOPC%pxIOJg`$8LEgVdi&A=h zS!_<_M^j+spuVrxPTx?rrX)@Fvu59!e8qG%9c#BAd(n9Sj!;tMri1`f+IpkAIf+m zUkg$+a3)NO>FHw$*%I`U&%#GtN#mogyrXAo$4SJR-|9bI=}l!nU8MJ87Qjlos>6X% zByF+3plLIo#3i_vTE2m~j8V^*l3p6S!O}M#9{< zVtE~cWtMl@czZc+bgXF{1>(r0+` zfCJ-<)~poY827V#^s^Ow2mICO-71w7*)m=zRnqd1`A6A=+?)N&<$*p#z6Fkf^zl2( zCiSo9bOeEe{(i8<&Yb-FzaIGe!v_JV#}YS|Z%^+3O!@(D;N@xu+ZyldCx1-G4)X45 zo$OS|-*phQbsc$n<RcR9#iRqDzm zcRZyo0uO%wY1&5=@cYrX>*p3k9B`U#-fu@Po%Y%7(4k2;JjG3?CM#n zUkMb%5T1h|2ek3YZVJY=LV?^YvjCi&N$ailK?eX)%$G&JN8RIr=N_CeY@bR7@wyAp zL-mTUxASk1zw8<(2&y^t#mJFchnrH7P=0niTr!HHb&>~4a2@vEy-s<8Qn-ym0nPei z%kGgg`@VO1`oAywgM17?JcoZMz%(z}SLcY%XyWmk3iDEv=Q<+dR z{oCkulD6c(2Ti;ZV1?P5U|Nc7$UbP-S}Sd%(824;hrk7(u76Gz=sEWh23=36 zq_n`Jb{|D4G`o>MV6zuz^|jyFpWDF-+tt9SxV0kp!DJu6BI(R%-oG-#-54MoJiD)Z zo?;1LNuJzU4`>QXs)Ydv5^c1#C>r)q^F*PM*|uiEXeofmpy>TkK`Zfk`d>pUoXRR6RMthoIl`8{_hMR?9o2y z2A|gx0Pm($GCd7mHbC!TT4D3Jo@5lK{Z8}LLtDeaDOMc zq>}ye$D%hOwLB7hg|fx*5>(F&zA8gbpY^ya6}3(y z{O8k{e;+&zSqbq5z9;o$oC#-aLU!#bT4ruKIdZZ0Vbgw+51fyAeQ{wi2Y8Z z;JPIKC7|RU^S@)g%&*&^+)=t-Ti;V2!GAicx`sGEztafhe^z4FV{`jre%0vrKP88M z5y@crSm5W+?=kJSPNl=$9^VF;faTWg5V2RXHxzTR1G!Uco74W`u=2_&WtW=3e~*`H z_-lBQ2N}JhGYS9Pj&tV)n#(g>2=)9YNyEOvffHB%0 zDMoSn-sm+jehmg?>vdTD(CR;oI1flar=9lorSKFrKwYPPWcZBZZ)kU5VPv^{R?gJ_ zWrxAxdQhq{OxEIB*Qoq>J!Aq;LLN(lU{^B5LH?cez`#`Las2B7Qjt&qloWA+k;3{+ z0qZ%n>i|Vl3nd947{2@oD9Kstd5XMzzA4nJ%M&e0g_H zu!4Y-y|)j!6F~md3W_H|-$>Pvy)#8Xp#rhUB(~mTz28s(^E(A4il6*|f7u(+nSsK3 zl8C(rxpSfeRTb|%rT+~OG`N81d@?>`L@qihkPFK*I&4I~@LvM6=7W1I)Qxn9)B6EA z&E&5Ef9n3+)zzZ%uV8rx`B;~3J*Mz_%z-a&TrJQ1^Z8ryH-V)Of>y*MHCF`5rB5vo zV3BxNLyMmL`}JJOgW!baW(sVjz_C&)GK#Okd(D!G$^ccn+QdYP?l(E`dbwMk`3^egETJhwK^O`!msgZm0x&$EucaXOeyHOA?CHs!k=pd>5$#@1`B zAb%1B*^nmEY$uR^FSQ8@vR5YLtPvk_R98hz4YC&dq-?3kQT_rASjno3#QsJsuoVEY z(>|5r^r3tp;L#0*Y%hxJ+B#6g$^x14jEHOo}6(Xo;WA$VkJQq3m3jyl~vTDB30u#J8aQ#F$_OV|N`vLtR=Sr^|+C%1bnVg^&U@9W}X!fzLg z|7CR0zg3`d0`pM0@K>?qjnF)2FkGna_s>*CHKUrLa&r)=N|L5da-qFU`xB%#bXYg~ zNzTeT_7`s}0ezc0@);1;Upou)7Z+@#9TBL6AM=j>4e0-9h|-!x#eJaREN1Ptx4%2L zV|Br_9o;3;qOLur^U@YjLF-+5@PA*l|BDYPBD;NEhguyLNCo#bv-{`zvOU-r;+q{p zdftrVA76aD+k-$Llq0FVmUzdfmNS+n^lIsI{GFirVb>@qFB9`PL#+pKLACakU5G>C zq&beTI4w*^e%z^IS_DG<^;`eWNtUPP@pP!8p8v0WBrAu`&m4G_`(RrsXoAzVnCO#&!>Tp^bdyhb9KW8RYbRi!toX8IP*CvjE?9eZhi^Tu_Vaa7-d9S`u z*tH?s9xGJ559v|fRn|iA38khkH8hiV@!_X=z21RNiZNU(gSXD97Iom!+e0Nutr0Yp z7H+jlG{yc$cUVHWUx)ghY7N78M-V5si6V-4PmtPhhn7gUj4g+c^M?V#G?(a{{Thse$G zFUD0Ip}A>wq)yQiyrU6})KCg~-$(8;t@T`fIk`k!t=L~&vJmLVYtVERtu)`&GZO2? zPrn*sGo`adW{NlsB8PvdF{}-Oel^eNpk(3X6E80>WwfndI0)T(uEgJ=AQDZSxD zFcjs8B_BARD>6S6RiX(W2rAi!bRPIpERn@@kPv_`5OO6ABA7G`p(I5tIAC#mzd?)O zFE;-PFgP^qS~y((dY%@{BYd9IFqyQRyh<)ci~X8SBH{2Q9b zdM-rn@RYk>C392K32!VVSS73$VKZSo$(StsSPNY;vCqLFBn($T%9Pw!>w={&eR?dM zX?CKGg>8P2qlbfi(Xq>EsRl)gnG8+R44U8Nf-7c`U_EOoAzCn43C~cT?G|F&fglvq z9B3Md3A)9qZ9gozs}4a51~WVkLC41VC1?jRrG}RCMBU6nmd?q%i0y`91h+5+Jbb3; z+Cz6|Sh+Yo?)tz?lBMK+&zUb`igy-%9Y}sKYRNpN@F6f7oTTH}hFOC3q*kIDIx?nb;t*4nr9i?MgIdc&V2epzyI^^v z)oyKf_am@zs*le^;N8M5()T>>a;X$6y)JWLAE^zIt2>-RW43f@4hAQ5oyhbOLe0N~ zY3~qmML#`Os)!;nmc&VtRCOC-eZunUx`;GhmGeOQH~2?J=vY}3t?_Tq-+#ll9$*L_FMBq z^R}xyBo`VazqZVDU?!*}v8_V9f#wqPLz9T5d`T+)IrsFSteGON5x(Qcn|iz|xMJKoIeV!GMN>{EmxnxG>@PW& zZMiF`kXV0Jj@Ha^MzJ7Svy`)IOZ|vLD5|=J zqB9px4Nf#%^L()HkasT^S0R!`5)6ueyfpD?a>;F~RJV^-W_p6#4JQ7zzY!g-w4asG zy|AQjh`?`!9_a}TJxl78~D<6F0@obOmy=(U)??oPzJ}*sA zf9?F{EhnDrAdMF~d}Wm0L(Ls|eCwaDBkz45qLRh%+EVSIiZ@FO>6diSspx149t%4s zmY?2&ah3Sk?lR#t5xP)_4inJ;t^{B$abM{@M;~h7JT3k>L<>1=uYV^By;gL3&SD5z9Cq3L$iJHXx$GXa->@McM zW(}SqTn&FYLx>_jd)s*VzRRK!eHafF$xFVh>SpuBe(=4Fx2Ey6kNcj`6roJ4qVLWG zHPi}=U7ee;^h}InRe#rl^T`jY3rMPco>X5?u>15>(r=g0tNL6n3m)$Uj)=KiL0Pq8 zj|=hL!qXj?6KC(7_jj8`IG{`I+U&TpF6ul3`P7~DEQa67)dZO)aRVcn>*GRy%rXC= z+P6Xi-s)z0!>T`r{lLC9vzhwd?&O@2*K|iSy{n3WE@fTjG^;>EYg+Xb4in)2S2DPpw-qaIH=RricBh*_LOu$j+@Y zqGES=%2{XM_}NLA+e%=NiX^vC=T_!{KK%-BzP#Is(YJMj>P@&>xViH&gsi(vaknOW zAA$P7Y!*8IlUP0Ml5+76LD)`URSO4TB4p@puml3P}56=_?MP`J}YPIJzCPnFL&fDM@P0eI&{PsIaP)^RMN69$k%jN zak40S1zZ(Q{w}1crH?P{WIJ%+Kx*YEj0Hw2iSryc_hPJM=}JRbyL?ko^`Wj^>@wj_ zHD#I^7X|h*-3I797<=@q#@Cge&XSR6a%$;Vfq*W$0}0YNY4`qQcu}Q2^GLE* zcqaOluyvUBHwG^gVxVEUe>R(yY$z!oRyp)F%FB>2#)x7QD;f#J&boCewIfD`Td=+k zg-GIdga|r=Nyy&JdTBw1orO`GST~3L+T~-O-IDO#{u?6MhaW!ERzCizTb6Jn>}=YG zPZlm?$`&7MaUGWMqc_#>$mb?yoHDGn!TMl`2QBgjvXqpA@LGU)G((oPwTm zD}~fI4KQ%%T{Q5e5YPChZDxCzq9LM9S1_Ob=M5zl0d8u;A4Yd?ti zN_OXuWn8qj!golX*}X7XX|pQ>$IYf*4E9h*4)N1cf5LdYa(H)D=RzTmcIF~aZ*>Gh zxBMBnfk!%P$45flq(jqmi@WF%)i zfG67K)dp@T2GVUS&K z=9?;y1v|b0R?&hWU9rx`L1de1wIl6p+q^XdB=U9gp@Ee@((ONe_(BED;iY$?6xGOO z88sGqe;o*W|KyVIoRpIl`_kv2-q;XJUQBcA5UcRV`2vFZwhD07t*IR{@f@&dodpE! zLI8qRIqp479Fdh)`Pwx3dVBItU$dOz7s3N&5sZGk>S;%OiF1a1WiVDSO~TaFOK4)z zx7U7F^^VmM>iF9cDs`qr4byTL8j<6j1!xwq&1lQ(eSLi$7sD+_?O#K}W!)q4wY6SJ zyvqRvqlzKoJg$B6R)(wWO!bDD)-Z|Oy^VE5cgtp_Rh8Ls(zl^&BG~a=OH$S@^9CU= zRpp1iAFHdynOwG~UasRga%k(A3%kfug@B`IBm28$Rl4;Kr&_Ug@hP&D}YXh84(fyOn zf_C4ZRKBmakSnHpQa~>$+=ukib(Lh%=N>X}Tt2h)*RG|OJNx|Q=$g6SU%l&i$a^w@ zj}cezRdiI`T>r_Eiw}Lc)xwB8;0vsQ*b?gaM6i^ z(eS%Ag~k4;u%$SrbI!J@Bvf-3eFUjQwHiHAP%qasH-JPOgB*q_tQn-Aqx|L#%$7XO zz0f9>mVRz{Nnr*)jT;gUncY<~e&XV@h&G7<33aJxT%yee^h4MZCm6y%R{Qv(RW$YE z0~@8m%vZW!^=p6*QjxWG9HI$55Tg3n^BjOnRYh|xie(|Qj&9lK4R~yBBhBtSS2!Eq zH162+Ea~d=B&FwDuFm(WfDO}Mm^XzKSbP>9P#utHsdy`0R~f#* z_9Z6iwD1)23ZGxO7o)>)z_@r<6GP?VbdWXiRF_|pcGexNBSTr$P5Rua5mUVy!KNq8 zg|pv)LS?)uVvHGj;)Zu|2(ps7+1Lh#=xjHwWJU;!JVNEPUe?qVM~5SHKZh^M1J^Ua zvBLuCOUrSIzEVZQx*ue3`IP5W7UtuW(ZsSbL$e|_76PiEKffp{Lc?%8Q11;U~ zLl+_kNWzQwV=rG*zj?;d+atrqi!o$rGtXCG#XYcOY)cz;!D-Tr?X`^;60RTU53|2) zANJa8FH;6&nr54rg@0k1*dfz&C{~%$Gy#wJxjlNGL-@ImRY($y0ml7a;MpFqntTRnh=96`Qfk3tc!pmDp?ACCYtM>rP-!cOBvcqDiyU z{@Q0)N@PKVdFXX2%NG@k{Q-*Qe{5rK8gR_Q#rqwgU6?3T&0S2PK@{ZZUCw=za-ESbg-^*Yli) zom3<|bT6B6L2_X%)Ui#BhPT;(rRDO;u7$xM{V+RD+wIS8^L%I*!nw~?IKcPV42mrNc-#G}w1*zgCicOha9 z+GFWU`PG$aKAqp~MBEQ-d;oRd?CBJ^_=~u2$Oc$6iDP!F2gH9^ypwa#4xLa(Y>~Mf z^|^!!*-20VH}xfy>wqh?y7s3VoMRR;z<6A{H2cZ-06r>e|6VpOAN`X>hCDCLB-|R* z(j2XI1O0-(-gLwun`1-dy-w*@l$nFjtNJDHDAI36Wb-4?U{Up~XpxU%3iyvO2U4ls z(x9=(H-jF2rT5)eeNU8KYN4B)t*vcYTFe!Wg_>tIlc$R^@;~^&UQ20Y5-Rx>4kon{ z`+_*1-83g*uh7XRo?V)Y*&eMDf+)l%g5#Q2pM{7RoT%`EnDBE4qi-b~>Q()H5d@`9 zMj|6h<20d_FkqAL%?rjG>^e@I z68Sb#j(jO!WDh5Vn#}a7Ug3m^pxP)^b&ntbdx zMF-Wz-{gm9-k!fc71)Yi8MAsr$p{9Nlo=44f}<@bEw#0ID(gR4==rs&&$g< z$ep-V2(I*V#N|6oFwDxgT)Eg-(|CTI%6Zb-3UizWp}!(A<$lX#a?qR>-Ah=o=pr zuV=UtWIv6!N`QwWP&e*;?5N@wQu*dfOi1gu=no1>Fp+_)sNWTus#Z|RiF(X&wJmRW?Aj6TIfz2)`z!HA= z+{`3E*9D-PT@T%svB5D(QBqkyg0e{>XFwy{=ulP&uI9Q?d}vg4<_M0P>vgFtan z4yOzfw(gfez%FpP$%#C0AcJo!)NiGe_tUj2`@syy=UaJ%pAW`C^FfxUalClH-mteH z81IB`i72+srX0;L06N}|>;lEy8bzp=bU$=I!f|!20F-icsOX5t&E`5rbKAVoD zjIzx7nrr9U5E_t6b$6`GQGCZSZEC520iJHGfF2*D0Kay=D5(1dZHyo)8|3{ob91Y# zPIVHDHXr4*G!-W)fa?^-PX~NjID7L1sEz5d%K#BLc?}@G=_tnL7vk_5x+o%e;!!HO z=(+!~_fw3kvAc@{?5Cx4w zv|~&Ho0-W7u+F_`lSBmB4qOYqR3!7}_d-MBKV|`dxApKbK|_?*JY}@eU9gFjecQg9 z2be|f-f$9F${PyJnR#Ri*qs3Ix#942c`HE2(}u*lalc|WG`@~`;{K_%SOQ9O(tbDh zbJH7D9lOC+L+5vn-Y|5^YpTd+1W@;zR>tyH0DRdxzkAM=47MN2V0k@v0}#y{Kg!qH zxfXnIpk8isle)vA@Q~XQvf7AG7)@i13Cp%OW*HIF=QLy1=R|Q|LZ+*DYuJ=J)@TIT zA0m`Kl^jm9d<@ZT>!t1v_Bpj6nxeT*yD0sh_iCpN4NkyEnv6nhU_pKMYY0UK3`E2C z-jKNVY1t`|19b3wx6eYsnX`!D>S{yB?jo_if-_gSFf`wMUaD}Gz2+A?a&mczV)B5HT+H4<{o&fD7RjOguxF2BHT-c|MML)3-Iz01Mft+vQ&0KKc@}C% zLJ9>rC+3rkn6oFmg7SzS4!}k(HswnI8@boLz1ZJu%X3=ZRNJp-u+#gxp624iv!7Gt z{IZMQqbopN$`Si?8!I`(fQT|~u26iXre@basdndE>Ye8;iZz~+p^j!wh&x@cre9l@ zX|!;2XlaAVufk(M8Y4e$0a>@5EMGO$Zkhb~IkzY1)aaC@AmJM`8#&r!LgVfV1cneg zO>qd};??e$HZyi4sE}zTFFZ2k^Q&GWGy@{^)jGR`?@2`6MsWvm3M*}qhDOc4z8MM9 zLQH4H2RrO6#O=S*D!7<$rD%I5liGtwpfj|&7RkQ6_hAn`xX>5x$D0M04&spn>b>tx zFy7W!GuXbV3m25ydL?hG0m;GbKF3me3b-c9eUMRhyYEh(M>4ffW%!9!IM_SdU)ZfZ zYG49t)eb9GN?f%fGwp7(PLup9UiTfdeUmeq#nNYqUQE5x_9^9zakFK)MqAQQb~Ux{ z`VD!lk(~Z|q;==7j<8E<1MOU(G*7-I+z*{dDNS_n3qsvRGYLA& z3weNjcN$8OceF0#^;G%6CBt2NdvbeblwMR=yG6%V_#H@{h#P! z$9AE-)q`APhLgWij6EPXP1C>&tPgnBN3r{)7~Rcx@c0!Z>^T^pHD6VZj-YkubiNow za?5NG5mpj4gl(49s7zuEVS_6Vzc^Pw?K{1pAG$8=_2o!@kYn@cSQs^b>qgR7u=Clv zJTZ>q1wWvOJO-E&{*aYoy2IwY?e9h47sd+OLiGBEJ5<>T&C=+KBq3s)rh>`E%x>A? zP_93o+u4)!-WQg}U5*>+(Xxu(cJMJ!WnXS=bUVNr>{fFM+ZZS#_)T#C>VP?N>aW7% z9uBzRy!Y;MJN=sN_>OBbEeNv**@iRk@P(1;P!+qHZ*?Y}i_w)X_OEwxp*z?zoiZ9_ zHxnPDJUz)LT)*jADOl2o+r4PFZ$_P)@WeUe{Mfup4=9{OGBSLDJW0h1zU1Ko7~Dbc z_^~?6=iIDBq-I1Sf4*>XVK1zs)urtjxDiCup>xAW?f@7w3!CHl_!E`+-LkunKx3r8 z2tbH`0!AlYYO`wDdV1$)pkmIp~5YH#%1KG zOkYz-vQL{uK~`I;Gt0ye_EdthXD~e)d`dW;^rGSw8d+bmpxy{?)-oCM|;4b<*9Nk?0O66vf zM!*(X1IfkPpTltS*g6~jqHGZOXClxQ;GTqG@j$RSyKJPr_e&Pq3X?Ga^u?cm4^HGP zz0i6+xPRB`J?HCkKuQr{=(N=XU-G}sQpHg$&?Spn+?BX2BUiRK5PE9 z@g|qlJfHz${?MwQCzTk?_W2ipdj?k2F7SQ9$(W}D)xEy#ieu^3AjKqb`8VG2uSu4b zv>CIQMdm93r$r-UV;>P4gUb6(I6dn&97xgaSMR#P0(;Hz8(AU2h_0biiDj2UijKsZ zr#WHW%AUN`rcttrZnoW|G}nngz`!m##c@ivMARdKkWtoK?$rk>0iM*P`5PV~^A*ArDuzy`M^t!A5{qz$+5jJhGNtsvd`RkIe>>-Mv7at1!Q<)UEhAuV z+JS`x70<@(I-~^hQzwyIdZZ1l8lif}5*~PXW*nDTmzXAmy6itcOZbLXX$gVF$hs{M zM{o&aHAtoCA~*PqlgjL%Dwk511Zuv3+Xa{SkIPy3Wiq=ZF2{=sl4P1XLndK(}?it1PQ_81oHIuFS1wvoD~<+BMC}d9a$KU zTFqms6UPJ0y%+>ltjgxiEz^Zy!HW( z=GJIm+z#LAhnX17F1E@g;zPY`Gduq}#GvvihY6cg343;bx=An69k#7JzcUwcLNn`q zb^KPKaliT@PD>Et>;AlAdPw>PR^!GTp;5JHnjnnxmb}TD3a*sY*$b)3kLmbwH&jPz z9TRcksLylqyxl)z9)kEsg4uBlLh_`cp}~=#Q;&$QgNNw1;k@2PMTx)@qp&dww|--T zYvwL0-RB5&_kZ5lm>s@fKdvw}Bc#u5V7Kr4{E7aY`8<}x)Cy*)>KJ$kDHjc6YO~1J zYKONarJ~u8b-MExf=Ii4i9?l=PaO(yA9^24&JIOkv%UD9Y-4x)Kka>YRFm1(w}MzG ziiIK|;GiJVhhD?jKt&KydJ|AONbiZr04hyHiXcT1Q3GV?oq+TjI?_T3z1IW?koUxy zxfkM$*Z1E0t@W+-%3oRJ$$8G%XPg#rmz>XNu=b(y!e0?VE90!w;xQIN!DF zHQ0BMT8_vm^bMOjGM;l~UVcLZ0_HEi!@>D43B@c#hz8wgtkxD7g^Vsyvxya*%d%R} z&@6B?=S8eFhM9X7Bg9J3z4yYu<88V2_*GzP@Ce>|u5DV4s_c=5=KMh&tGuBrcHMWn zPC#EOC@959N%||`_`3!ib(AzsW7nE;OO7I?hQ|A)+s!6XgEh+1^T(12lQYAL(CxPP z3LFv_%b&=kzoyjzz#W!CdzLqsQPtPQ`rr3ba_dn7o2ohMOLf_jjS1JODZ+H7CHB87 zu&)}cl6rcmDZBxGL6+jmHGQ~p_gOL5YRRO2qJklNy5A1fz$oo(#j-I+j(H9vz?0`j zFI32wk+}hgGC4;q!hXYl?(tE$ z@J8A1$!KG=W9H=I zJ6YV*h=_>1jgLGSB%zpJs;9SbC0@k5pAm`eNiW;aTyY2~m!DT~g+Ah3@mvuGOP7`> zWIs|#V+3WQEYcHP9zqbDoKxFJf&4nLbqhr13N zr3oI%k872*EH+q=Cse)opoUq)Kv@(BgYUKbhmqoFrfH>Dnz$)$QI!dxn{V+qca?=E zQN;%r!tyU84g8OME93PU5i9&AnWVS{?S!~D9kAApGjh{-wx$gPXXoG_nCJTAwgHrq zM_<=<5n{Z>tyU2D0R$;eFFdf?#1&W?gD7oauTAk;tUG2-Z^J~ouo&wElH*`%)aH(I zd7kS_64)rVst}l?WB&Scp0r@zX4UEJ0UccMbXxJd&LP*XGXE+ZVcuUf#6`awv+d6s z)Y%!jxY4hF3Ws)Z$$ytTs3_Z|CTAWLM7*ArVhetG<$={&tT-OhH9@x+Pe6kXK;x#> zYzz>IsX|daKw`)*Q?58Y80nr?d8`!)&2|&`T=Na3`rvJlO8?=}8`5q{W^&#DUhtw+ zagtIYB%ZYm?Qr=EEe-{nz;$))yFs+LFR$hitMEKhz$SlmOw(ib(Bj8aF1-5%(gadi zGWvP+wL~SBYE@uj8IbPjZqxXnX@ZA!R<27$XRp=q>C{|k`qltp!?b98(C2Ay{CXb) z<#<20x}HO{?rxvBhj#Pxxm79imUp?+6hX;{Y#BzJ`#)G%$X>O?5u))j9R2Q_4?uXH5F2%z9#UlexOm8a#Z}vez7?UyX z!b`ov1gc`13eoj%9;Q`*QfTLS2idKXvkS75#rkk~9c7&KJQ{|R5bJcEER+`S_&gU6 zntUO*^os6=h*xIZs~>K5VPlNcbHC~)lXxZQX+5GujPr(e?q~J<;hL%#D<(q0%2P%$ zE6rD4oi7)kgs^I*HHu033li}-Et2dRLw?Ma_cZj51JtIF_0$Nzlbg$2p6UI-Q_^CG z=mrw`Gxb(6O zF9twb&S>0cB+;+`G;P1gktN`+{UiLf^D#zwZ(fPkF7MFR(Lk15sMY4SrP1fdp-JzU z=7Wv^jtJ~i*PQ%`O2Bh@+8`(lx>avuT&qq~`-ubKM*G!S*2m9AR=81w z{QVZ0eh|Xw8>4f>Y0~q7vieBNd==sS3b)ddJ@3j|S>^Wg7&V-SSG;xV3W~JOb}GW0 zn&(Z!F0H7kRQ6)M9Aq||FUr0uy9*5XI|&G&p+@FZZ*k4jULS+>q(oZi?wmWRHDf{C z)wg!L#3p#&j1!oVXi1y=^*TQq^VHNM0aps9aXq=lV9VNI%@LTVF3Uob&#)grXXMTmn>MC< zF82-u;Z8ZbMh@1b6&8y@A()U#;9JTW$hkiYpt6{!a6|wR5x0N(1~1MsXHao!^@Tu+ ze^8jpx>rhiRW!hhlf(sc`OAPtbj;;J5lJ>z~}yg#g|&Z?RMQDNpF;;>yXzZWXUL45q3V zfFz@O3lu?F&&x9Q=+o&biPi}M<>RDonVoC+y-uSVX%cNp3fXk=q-pvFeK_)72_P*} ze+B2-t*%o&nY?vc4mYXNIg(1x!kyZ@Xm(m8qwR2SM@p(wLiZz%4_#{0Qp-7Pt3HXC ze*Yq_IV7RPbr$YYr}GY!fW2|186fP63Y&tfx3Mjp1;;La)34+Kh>Gt0Kze7Z+k0p0 zZD=uIxm#{f)LL~w0Sf(u!0_Q`m^Jk6+*lk-p`yM3E2y72ZDTiOZd$R7g0QuT zqZ961r;<0)vs^8X)9zXyV73hkPCB*tQKP6xJ<Rppi(N6F!>td?6FH9mL! z0%VC=!rWlZZ$}r~>3j)=$jOSaBKAZQAMj41vNuzKiR&kDlP=CLxb(fK*wbu-)$UJI z9P{UN9WlVga7PS;huL(L2J$#pTtYUG5+kznz)$tN?obH@85BTivHH zHh_zC#TH*u?*>3Z_Yl0#Aa_|=&dkT_=7k=<4O+uibE4z_K>S1@#be_f_rq~2=0nf0me zvl7ppiWY`pRS^PSS~9@gNylJ&o#A|w!r@|K?GkV8Co zZnCb*`WZTAjqP!y(7ma4V6rkB&ljUL?N)sIhsyn{X>$9HzO0>BS+@qhqj-3a3aDn* z$k(j)z+^omSaYouVl<~`s?a+l9gQ~%B&id+%Qq=600NHghmuK&%UD2$c{j@nPs>#c z)E>XrQn2BdzFgB*UH?s&4U@aI#z@CJ7jg+UG)IPWGvPudIQ;`&P zMvr!+gA75}Rps7ljw29VIUAon-envB_Ojk(taBOvNvmbMkGuuDlA68{3g3^aWc*g` zIB$I-s`HrgNmB8daOUQ^p}oa}Gdijx^MsO=Jp1aU(R$2>X;qQ`HpaK6NKs+P;xhekZGHmoZkltY1D{hAi* z0KQ2a6Nz*^Ew5S-0n>B8Jmet8GlzDWmlg8B&U~>{sv%MZ?e~1=iT-9e-cff88Y}_2 zf{|EAaA7!N`a0BVHH<6HRi;zV#okKH%iZqIitt?2pR1m1~8?BpwK*q;x z+S8EKBHqmscYr+j$jd}>JM1M}r(jw%T*~WE56DDqT~`|LT;?a&%6o8kb7F$6BFmh) zy3D_X%cgjA%yl^i-JGP76V?$6(yD~)hTrm6XOz}pLS*SdM&oOudE_Li{!x0oi0bL< z@YXVaHurPR-HYK#{d6S*cDOB~RxYt{$~FX^R`f<^0MF*0#aQRss4QLKb42c@oWAzG zQC#w-SjlE3D!doKe~aU8d1d3eilMkQB-^$`=Szw7-XSY117|BE`Zo*%)Vrfk35C|(|M&oh*HPl*7pXl*`k}Ht`TG-#Zfg z$juB*K^Sy$;b94G%-x-7Axg;Ds8FNmXEC%%Sl)85^zb`o+s9UP#{gt%KT@6p8Gis7 z%tNXN?l6iN&jZcl;;3>VNzXL-gu7(qVB=QB`{|E&YH>j~6B7eqOwM-1Y82kT@Cwon zpnRh0o4?xce^N%Bm|z*cQdK~bcqyMi*tdZ%8`(PIYRcj;vsg*xiJ5i@ke)9}B=C1~ zfuNru?V%MMZkhd!5J@reoiz47O>AxZt4+>zQiu){NAu$YVJgy?6xRjsmy2!jEDRyC zSTnmpcv^vl=TcjIP&vf$5>am>8c23Eh3M|60DE@%@t5Z)iI2h51wQ)Ly$A&xx2aB2`Vok>kCd*0`R48ed1-b zB;RpX1rzLMtuG@Rsrkm&z1iJAc}75D;)CFJHU zq@bX{t5YBnAz*;scj;(Vq%-r{_XRTM;j&SE9@61}ZOz`wkK&dC!(dF;Gvj3ibjHR} zl0#eg^IW%sY&I=QN36yokAJ)(4iz=D7hA4BbSIG+$s{Nlvp)Lk$Ce-iny6QeoAwtv zCaMtom74BDC0|=OVl>D(O@)!KZi*Hx!uN({zBEvN&(y!x@vyeLLEx{3J#v|dqz*il ztF07W1U;S5!sIa45KOT=RymwA94C??HkC{P9Xj!BW|XnzF<@9GBXc z(gt3fH`lj3cjNNoy>5Pb0>T`75jX4pmoWTqz}Vrb>Gzeo4HJPDei9|O?AYKjm#>-k z0GcJB^_;U)p`$8tf9?0Z&D}t6-7sSiB=+9{B0oWZ;yf~5U}JeQ{Xy9$GfSNlr)Fop z)>Vt;B4Nmt=rqlm?;G`-83_LsDE^-tU;=DRosU3B${SGLhCXpr%(V? zpABCAmtot#BJ=Ki6q|}o%cp~i*RNZeFm$!{XrHKqw(0aP`wpyiwy+=<8^1H`2F}cc zm(!?EE$9f4dmC_!cgczOn@~9t=>4d|>W1$2R;y)!(dq99=KZUa_(uW(HM5+|l|aU$ z<^D7RlzciRDGO|~5mg{-x3yy9ea~7e`*+4B=ixkTO7tv~#Yxw|Rk@P%`>75Nxd&WI z8J|#bTbq*cS^uA4=^x5FP~Mh{0zS@HxZ3vs8S73~67P?eb*cQuJ=zcKzk(PuQsW;W zBEU6TkmpE5J0cIQLFdFR*hmVS?!0-MD~Jk$rvo)TQ}!nwlttkOQ|Z&}Ef$U9JThnBEFxExs1Wnt3ft z7J06xhrUu6WH@ley85g?o?OV1mnlNUE`JhYkbGp7CV zt}SwTF0>zBIG-mJ=jN`S&A-*D9xV*qLQY=yogrg#I3?b5eN+NuK9>#Ify*u+)Q;4( zv_t%-Yyz!`hagMZ7UQA355@kevXOL*dPr&x02G|qQ^Sfyj{3o)m+lgHOMgSRo2R2+ znDZ3*HRalNVnQm)kM!wLS3BC+j?MBmgn^PBT>v^QHHb3`NX-q&rurooU2>m+>?-aA znV`?cQnv%|2*(6T|AAenP<{W`xYf4{Y_ZaR09TjZ35u0`cgnK6fh_G2 zPSe)`)-Ip3^FAr6aG=!LYssh@R}x@31vM*tIklqO7G1dJhC&X!Fr&Vf#C=SozV-@o z>N(W`&l(-;T!)nOv9*Ftu_&=(iMgDdaVnlqf!uxuHu>8h-$kpDAGX|cgBw_-GMJJ0 zs@54(RDHzyx4S-oRnaS%gY8_eS@EE+?^r}1E5M89HyB5-{ z_3-UUkR0#K@ZDYoV1mev{%Y(F%Xk%joJ)m!pMZW`rb|V?FWpZd_|Vxxjc~8lw`@Ss zL4zHu8@p&UT~Fh+I`8{>JWG9;VYuC=T^`s<$)+N=sMzO)52}QATL`I%N6WGExV(78 z5xIpaiZ)J@S%~h(af{t6i%gNjmo%nnxxT$s2hBW0G%{Vr=HFNkz0u4tu@jPSrN*p+ zEcNdyXz;fH#y{#H{9zjZm(6>77>H5Pv0sDBkDPSNOleMk)2v9JLQH(DG~mqmjrJO& z?EP>?)q|!caAT!cGTC{pmq)V?-*!Ds6=ap&uk5?0a;l{T&8nfN?Qu5r*2EhJSJPxY zTwp|J=iWmG#Q4{5wNzdFGPfidX2p|<2H|CxoGd-RCZn}=z*9nQFLfe-?EO~>)O~T! zzn{gw!*wtf0Y~IJTj?Ftxm}V`sz`5T?g3RDea(;8nlK?AG-`fFIYIbu&+BA;>F#Vy zcSwpn_qsnGe(8L*AoSDQ&-T-^0gc@j0LwF5IXkISBEy*`os`!MO6gr%` z+{I2yH1Y`zYQ|Tw!V{d7!E3ndJ(q_6C4BQ=*Kp{6yiUv_pMi*&GDL1gRL+ENMO4lF z;@t{UR588|u$>|ozXSFP93;*7sk#F|NEYbaC*bmD4}+Ti`)^A{Z_SKvd)NeUQI&-h zA!bY!b*!?z?k0tF6ujtzE@v+`v}G1#i5hVg2De`0=w8=2!BiV;`b*^MJ7t~}-k$|* z^2VO0eAr}qzo2LUcqG8JY}hwkfz`wH{-S<_K+}GZ{rR=`L!|QD7I52$E&SKqHZ{Ku zl^cT!TSA_n7v3~yjMh^UT5QaD4RUyIq=bA75}^4`{PFMZzU_m-FUStLDabY-!P*L1 zyPLqIkaPSg$8Pb6+|rIcgQwuo&~v{#o?&Eow^w79K2afrJJ%HX>qrj|K^1LVaRpnR z?|y-!n=xm=4QHgusiS%pueQ$g7?22DQI@qz*Kj{A&zpBd)lKKBB(#u)51>Hqqg(`^ z0c$-a!~?rL?zyq;75*=(k^HmHz<*xk#QzNuSiRKGTKuPB@{jAf5nL>WMA_opV~rZV zhd451rKgW-Duf5#Y%+xEp6W^d=`U1o*!#^sW8yKxl_aFq$Nkw3p0{V*ha2NY_k>3VJ9Ue}~HO#SyUw#ze&i6tHty{}s-kF9?*K z!Yn8BB$)H+EK6Pu))XSkGncpCW0k35P<$xJgj~~hDyv4_uQpA%5KUJsWpJHdFh7a* zlV&LDX;VjAI(nZ1r*hn}<6W`ZtL<9yoH|>VAG|#uQni5yf^j{=U#S#Ws>D-jfsc0^_l4~kbY&|5n6J%dPPj+x!y(YgwS#K%Eho77 zml$pr<$-Nla-MI4_RjsLL-e7qzj7nn53tAGhjIr-X(~JTuW_Lq=57tdq17&MXw51Y z&T4Hw?xlh!$f#-3oJGMQpE#28LE7H)AeRnhoY`e#JrF(A`YmbY7z_7RSKBLJCVJ(7 z@i&k;j6KAFE`GbvorDPzj(j1L1>Cy5-~~{EFcH&;z?^Z0j;YpWY+Z*c5Jj#0Wj+>c zapDrUD1Uj;)PgGujjewj`9*8>+zf41NL}#ygCiL5x=yveEiEl2pSF{HfO_#{Qm3dW zFUHp^10Ru_;}{%=zJ4D-MPrLSKEiC8ge&dBH$XbtnIiGTQh85^c%lzUbGuzEOKlCf z^tBg3kEE{>d-DM@@>N6oQ48j5{-n6li>VH8vot_;$OH7(#!nINXAqDv7q1G|lNF2G zZXJeZZzl!EYE0DhutvMNEUHYpPT|2ZYG)(zz|SV>Zx&Y+%+BC90o=C%2GU~GMT(Zv zb8;^0k%@phqfE><&I#TeK;2Nhs|a|G-fi#GJ$p{YUcL0oZBjn?lTR-a>r)&Y@Qfr) z6tsa8qZV3>}Tm<2&X)Q9v&Z#4)wuvz9&D@n1OUfK1#TIik@bF;)=y3 z#dqREp|dV%*$ly|EnFXch^$PeNKy3s79CUV{+k*4p_Yx_>XM)v1I1;vHlkMU(6)#1 z;4V7u=2!1W0H$D0!oddtOo6fHKp2nD@$g9d#6E~hgprg z;pUW@`}~Ai2(Q_#={s5)vwhhX)8+^+nV+5erqYRbp$e>AG_vZ^x`W1=>efjx!&^U3 zv#``&;0Kv;jg-||QftJU@YlQh6t4Y@j!`9=IWaBeQGXJS^h|?g_`L%;(9K2jX~dc* zJHMZ}=07uP^WWo73T`ouR2cLeCJl zp1l$Av!V#LIvd=sG2VRHIZfu5pmtQlaaL{$VUWEXnuo_STS8677X_jq2*#?35RW@d z2B3&v1jvfv%x$8HxYVtY_p-(IZ)jMD05!tp{Id$S6f~^R! zqwt)7u4SSD4`qm>KE)_D1`%W$7k9@=f}F^qYCICRoDw9NzGQ#?YzWTnmW(08j1LK& zc5Ut70P@*yhRDMpQLj>|)623Nje=hBTyo6Ht-dHcA6(7)GXGQkRMF2h{Vsi) z&&d!CCT__WbC=Bcqt*ySm{Z-#^ zNXyGVs9@Q(2gEg=p(o~3rX-TlVE(x{MKKZ80m_v&Q*f}$7}u;K^D zsbRc>1F*Uec8%)OB;D?F%MQNP8>S+2%w+&-Y@Ta?&RnRW_kC6a{-t}k`vpsU%(7CS z{Z_bWb*Nr>g;O#;Ib$&ms$ItI$N_-S+hgyVbZi1KKORomSh-sq?4o>%BhjbO&*$_D z38Tovs8*_dYGXCXKj1d5@mw;w>+8EbUI`9*;j1?%oG1FCd`}YXXd5qS+y|G!p7W=> zHRtk13;K9`U#RC!Y<72RB8rFEoDSTSicdu3xb!%o%*?HW@bme6K+CP(h-AaG<)&E-gqIA|I^9BsQk7>(rY3)#$ zQT?Yn`eL{2Y*{w(&GF}q$R>jA{5EvvT)o6YWTA(1AyvQi_3PaisE)$epFMlXaK`9G zLJRE^CQ>s34gvhhttumV$p@_fxWw$#T! z8#23$lIy@}JG<*^#H(OxI)2LW*GibgFAMhOi|rDWyO_{>=xDRV&oY*zjU)GX?>!{4 zRXG9*$>t?@zo|>Ikr5rKN>SyoW$Jdd76}H0SSLAc<#3rgqsP5 z4|Pu^WrE+Ot&(cIEv}Zib)@}vPoc}ehMJ66mG1g-1-!bgkl=-{(<8@wC6;m7cDii~ zs2sLp)rr-_)TmzwJ`yJ1h8w?|Vb4dpcRN_KoF~D~#I@^dbddC!<`sr87r%4*mIOq zqTNVp7*|@{Motdy-gF+J^z}+B6)I_23lqZNEp|x63ue=n9Zj`kE~L}+hLSNUY}9`K zN@;z6jySj6UI}|Ck7L!A-Nz-Dy3`vvq&r0H&zf&ngh|g8@r(wYanffif=Lxehz5-~ zU_S~x6Q5-%aLa){2&f2vd2x!azK!Nno)z>iA-gdUkB|HOjhXBv<2%+Y(fX!RkdA}{ z1~*QaZ3NWzTC>!O!bL);-iCoR7V)v=L{u#vR)=#iGqOfMWam8%xkDp!Qc##ywK zt65h2x%K_kaX=up+9mpQ@PCuUqvTU(JKQ_}r;CFc`^gS78Y zH?M5vSKX#2#rW-fub|-GAP(|G7bB9j8*1*0-ZonDiuX9DAsweL?BUmICQ-1 z5Js~zP$*I#I@J9F(pXMR&L{`Fw&ljys7ovqvvd3%DpTpgAv2bfC8AE3NuDS@Or;xQ zpd{zIY$XN52EGeDl}4A$A#Z3(kyedgZlaWA{>Gp-w9OJ3%<5k^)(N6qGqO)CLKACV z^wK|op~Yg^zcCIiadK}e9l1#-XSmN($W3sriCBv&bzfh6?$>2Bb_feY@q=b8-8AqS zQZ%pk6$($Gd{up0px%00Q{_QyW0aqfXlFaedAv^~n7YNN-~l+Pl1uuc~>SrdT zM@d3MLB_oXO00o}nZWCA$g>wWp89o}lN}84nFfsGTz*{@X9H4IgjzWw-0lvMM74=o)CdR^+g9!ltSoNBLav_=wX zUfM*(BI|Ctv1B~ZBeUqcp1%T`^>{k;3Xsr#*P@&Q9#)0+XSAk~CJ>n^4ZikAM#!yp zdx#GZid~eGxS+V{f4)j)qj5f|Tp`#dZq2~ESqC9!>zBML=(o|< z)4B>ugQseeF9-0EL!d(5n%Y~70f#DDr-001k5Gqg8j+=EZD1IVKThgkLq^H-%8H7H zv#xKrw7$ORZ)|(!OY(Nt?ZJiv^GT+J%}byNK%Jb2zB13cDGCmkgQdNnK_bpySUp*V zIHFY94|;t5zy4U*f}jiH@JKdook>+tOBRl6irZq>i;B4(8A0F0tav_6FR{Eqpb8WN z{_6#%Zm(7DGcsST7T~14K9J`k)$cqLyfRrhf8GBustT?2#cE7@QmRAnrp}^DJyx4mr`qh~=&TahJ{Q$G~9q)nv9qk>DuXa7H3VpeCpfz1u zF0`tetCi4H6hGD!d!0d`DH-Gv8XI+;vxW+RYQUshwQD86zro#oU^~Tb1S=vY7RSlS z*;W=~+IB;nO?f>`v50sU49E9HWI(R1%t_C`g(2O3iuJ^>aof&F%XnB~*Oy(RW9sER z;*ihi83f+VEiE9?EpZN{-jVl>qY`d7z}F2i$v z+WaWF%3O(vSIXY{@-ZAg`?6skhT$g27ZpMYI=X~zfy^-c7M{6n>DxGF3a_=Tip!|vP4MoYymI$~!IOn&OqEy&8sL(3oI vC=@ea4v<{hVTJyuul(QWlariN^8}?cPxjoBwHMg~{;pnDzLa*s@X`MOp>yft literal 0 HcmV?d00001 diff --git a/playbooks/malware_hunt_and_contain.py b/playbooks/malware_hunt_and_contain.py new file mode 100644 index 0000000000..eb7e2f484f --- /dev/null +++ b/playbooks/malware_hunt_and_contain.py @@ -0,0 +1,456 @@ +""" +This playbook investigates and remediates malware infections on the endpoint. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +############################## +# Start - Global Code Block + +"""Malicous file detected on endpoint""" + +# End - Global Code block +############################## + +def on_start(container): + phantom.debug('on_start() called') + + # call 'file_reputation_1' block + file_reputation_1(container=container) + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 5], + ["file_reputation_1:action_result.summary.positives", "<=", 10], + ], + logical_operator='and', + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('shutdown_system_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'shutdown_system_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'shutdown_system_1' call + for results_item_1 in results_data_1: + parameters.append({ + 'ph': "", + 'message': "", + 'wait_time': "", + 'ip_hostname': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="shutdown system", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="shutdown_system_1", parent_action=action) + + return + +def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'create_ticket_2' call + + disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username')) + blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash')) + loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username')) + shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname')) + file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', + 'file_reputation_1:filtered-action_result.summary.positives']) + detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username')) + detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname')) + + title = "Virus Detected on {0} devices".format(len(detected_systems)) + + description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation])) + description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems)) + description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users)) + if len(blocked_hashes): + description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes)) + if len(loggedoff_users): + description += "{0} users were forced to logoff:\n{1}\n\n".format(len(loggedoff_users), ", ".join(loggedoff_users)) + if len(disabled_users): + description += "{0} user accounts were disabled:\n{1}\n\n".format(len(disabled_users), ", ".join(disabled_users)) + if len(shutdown_systems): + description += "{0} systems were shutdown:\n{1}\n\n".format(len(shutdown_systems), ", ".join(shutdown_systems)) + + parameters = [] + + # build parameters list for 'create_ticket_2' call + parameters.append({ + 'short_description': title, + 'description': description, + 'fields': "", + }) + + if parameters: + phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_2", parent_action=action) + else: + phantom.error("'create_ticket_2' will not be executed due to lack of parameters") + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 10], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('join_filter_2() called') + + # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed + if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']): + + # call connected block "filter_2" + filter_2(container=container, handle=handle) + + return + +def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('logoff_user_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'logoff_user_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'logoff_user_1' call + for results_item_1 in results_data_1: + parameters.append({ + 'username': "", + 'ip_hostname': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="logoff user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="logoff_user_1", parent_action=action) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 5], + ["file_reputation_1:action_result.summary.positives", "<=", 10], + ], + logical_operator='and', + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 10], + ], + name="filter_1:condition_2") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + return + +def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name="hunt_file_2") + + return + +def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('hunt_file_2_callback() called') + + disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + + return + +def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('get_file_3() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'get_file_3' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'get_file_3' call + for filtered_results_item_1 in filtered_results_data_1: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'ph_0': "", + 'offset': "", + 'get_count': "", + 'sensor_id': "", + 'file_source': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_3") + + return + +def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('get_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'get_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'get_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'ph_0': "", + 'offset': "", + 'get_count': "", + 'sensor_id': "", + 'file_source': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_2") + + return + +def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'create_ticket_2' call + + file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', + 'file_reputation_1:filtered-action_result.summary.positives']) + blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash')) + detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username')) + detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname')) + + title = "Virus Detected on {0} devices".format(len(detected_systems)) + + description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation])) + description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems)) + description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users)) + if len(blocked_hashes): + description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes)) + + parameters = [] + + # build parameters list for 'create_ticket_2' call + parameters.append({ + 'short_description': title, + 'description': description, + 'fields': "", + }) + + if parameters: + phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_3", parent_action=action) + else: + phantom.error("'create_ticket_3' will not be executed due to lack of parameters") + + return + +def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('disable_user_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'disable_user_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'disable_user_1' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'username': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="disable user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="disable_user_1", parent_action=action) + + return + +def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_3() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'block_hash_3' call + inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'block_hash_3' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'hash': inputs_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name="block_hash_3", parent_action=action) + + return + +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "binary", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name="hunt_file_1") + + return + +def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'block_hash_2' call + inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'block_hash_2' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'hash': inputs_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=filter_3, name="block_hash_2", parent_action=action) + + return + +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('file_reputation_1() called') + + # collect data for 'file_reputation_1' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'hash': container_item[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_1, name="file_reputation_1") + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml new file mode 100644 index 0000000000..1264b08be1 --- /dev/null +++ b/playbooks/malware_hunt_and_contain.yml @@ -0,0 +1,22 @@ +name: Malware Hunt and Contain +id: fb3edc76-ff2b-43c0-5f6f-63da4483fd63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Response +description: This playbook investigates and remediates malware infections on the endpoint. +playbook: malware_hunt_and_contain +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "LDAP" +- "ServiceNow" +- "CarbonBlack Response" +- "VirusTotal" +tags: + platform_tags: + - Response + playbook_fields: + - FileHash + product: + - Splunk SOAR \ No newline at end of file From 89f37444f4f875b17fb2bb851a534ce1eb10d3fc Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 6 Jan 2022 10:06:40 -0700 Subject: [PATCH 25/27] Update msi_module_loaded_by_non_system_binary.yml --- .../endpoint/msi_module_loaded_by_non_system_binary.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index aa7241ee98..cebbcc8ebe 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -19,9 +19,9 @@ description: 'The following hunting analytic identifies `msi.dll` being loaded b In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.' search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) | stats count min(_time) as firstTime max(_time) as lastTime - by Image ImageLoaded process_name Computer EventCode Signed ProcessId + by Image ImageLoaded process_name Computer EventCode ProcessId | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `msi_module_loaded_by_non_system_binary_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -53,7 +53,6 @@ tags: - process_name - Computer - EventCode - - Signed - ProcessId security_domain: endpoint impact: 80 From 049482c74c602760a40c58b8e52d97d6c48c0c45 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 6 Jan 2022 15:16:52 -0600 Subject: [PATCH 26/27] Fixed casing per request --- playbooks/block_indicators.yml | 6 +++--- playbooks/email_notification_for_malware.yml | 3 ++- playbooks/malware_hunt_and_contain.yml | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml index 4f4e9e3bdf..9caf9a527c 100644 --- a/playbooks/block_indicators.yml +++ b/playbooks/block_indicators.yml @@ -16,8 +16,8 @@ tags: platform_tags: - Response playbook_fields: - - DestinationDnsDomain - - DestinationAddress - - FileHash + - destinationDnsDomain + - destinationAddress + - fileHash product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml index 8d7fdc35c3..a6c5b70531 100644 --- a/playbooks/email_notification_for_malware.yml +++ b/playbooks/email_notification_for_malware.yml @@ -17,6 +17,7 @@ tags: platform_tags: - Response playbook_fields: - - FileHash + - fileHash + - vaultId product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml index 1264b08be1..fda6970320 100644 --- a/playbooks/malware_hunt_and_contain.yml +++ b/playbooks/malware_hunt_and_contain.yml @@ -17,6 +17,6 @@ tags: platform_tags: - Response playbook_fields: - - FileHash + - fileHash product: - Splunk SOAR \ No newline at end of file From a8e2af5782d6ccfd4aebfcb1b6003cc3488ed2b8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 6 Jan 2022 16:38:33 -0600 Subject: [PATCH 27/27] Update docs for upcoming blog --- docs/_pages/detections.md | 2 +- docs/_pages/playbooks.md | 3 ++ docs/_playbooks/block_indicators.md | 46 +++++++++++++++++++ .../email_notification_for_malware.md | 46 +++++++++++++++++++ docs/_playbooks/malware_hunt_and_contain.md | 45 ++++++++++++++++++ .../2021-11-18-loading_of_dynwrapx_module.md | 4 +- ...cess_dns_query_known_abuse_web_services.md | 6 +-- ...info_gathering_using_dxdiag_application.md | 4 +- ...22-possible_browser_pass_view_parameter.md | 2 +- docs/_stories/credential_dumping.md | 2 +- docs/index.markdown | 2 +- 11 files changed, 151 insertions(+), 11 deletions(-) create mode 100644 docs/_playbooks/block_indicators.md create mode 100644 docs/_playbooks/email_notification_for_malware.md create mode 100644 docs/_playbooks/malware_hunt_and_contain.md diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index f4eb63a047..816596c7b9 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -60,8 +60,8 @@ sidebar: | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | diff --git a/docs/_pages/playbooks.md b/docs/_pages/playbooks.md index d0354aa223..eb535f5e60 100644 --- a/docs/_pages/playbooks.md +++ b/docs/_pages/playbooks.md @@ -11,8 +11,10 @@ sidebar: | Name | Detections | Type | | --------| ---------- | ----------- | | [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response | +| [Block Indicators](/playbooks/block_indicators/)| None | Response | | [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response | | [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/)| Response | +| [Email Notification for Malware](/playbooks/email_notification_for_malware/)| None | Response | | [Internal Host SSH Investigate](/playbooks/internal_host_ssh_investigate/)| None | Investigation | | [Internal Host SSH Log4j Investigate](/playbooks/internal_host_ssh_log4j_investigate/)| None | Investigation | | [Internal Host SSH Log4j Response](/playbooks/internal_host_ssh_log4j_response/)| None | Response | @@ -22,6 +24,7 @@ sidebar: | [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Investigate | | [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Response | | [Log4j Splunk Investigation](/playbooks/log4j_splunk_investigation/)| None | Investigation | +| [Malware Hunt and Contain](/playbooks/malware_hunt_and_contain/)| None | Response | | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/)| Response | | [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response | | [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation | diff --git a/docs/_playbooks/block_indicators.md b/docs/_playbooks/block_indicators.md new file mode 100644 index 0000000000..0e781251b7 --- /dev/null +++ b/docs/_playbooks/block_indicators.md @@ -0,0 +1,46 @@ +--- +title: "Block Indicators" +last_modified_at: 2021-01-21 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - Palo Alto Networks Firewall + - CarbonBlack Response + - OpenDNS Umbrella +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [OpenDNS Umbrella](https://splunkbase.splunk.com/apps/#/search/OpenDNS Umbrella/product/soar) +- **Last Updated**: 2021-01-21 +- **Author**: Philip Royer, Splunk +- **ID**: fc0edc76-ff2b-48b0-5f6f-63da6783fd63 + +#### Associated Detections + + +#### How To Implement +This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/block_indicators.png) + +#### Required field +* destinationDnsDomain +* destinationAddress +* fileHash + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/block_indicators.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/email_notification_for_malware.md b/docs/_playbooks/email_notification_for_malware.md new file mode 100644 index 0000000000..ebd1df6037 --- /dev/null +++ b/docs/_playbooks/email_notification_for_malware.md @@ -0,0 +1,46 @@ +--- +title: "Email Notification for Malware" +last_modified_at: 2021-01-19 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - VirusTotal + - WildFire + - CarbonBlack Response + - SMTP +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [SMTP](https://splunkbase.splunk.com/apps/#/search/SMTP/product/soar) +- **Last Updated**: 2021-01-19 +- **Author**: Philip Royer, Splunk +- **ID**: fb3edc76-ff2b-48b0-5f6f-63da6483fd63 + +#### Associated Detections + + +#### How To Implement +Be sure to update asset naming to reflect the asset names configured in your environment. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/email_notification_for_malware.png) + +#### Required field +* fileHash +* vaultId + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/email_notification_for_malware.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/malware_hunt_and_contain.md b/docs/_playbooks/malware_hunt_and_contain.md new file mode 100644 index 0000000000..affcc75d0e --- /dev/null +++ b/docs/_playbooks/malware_hunt_and_contain.md @@ -0,0 +1,45 @@ +--- +title: "Malware Hunt and Contain" +last_modified_at: 2021-01-21 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - LDAP + - ServiceNow + - CarbonBlack Response + - VirusTotal +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook investigates and remediates malware infections on the endpoint. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [ServiceNow](https://splunkbase.splunk.com/apps/#/search/ServiceNow/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar) +- **Last Updated**: 2021-01-21 +- **Author**: Philip Royer, Splunk +- **ID**: fb3edc76-ff2b-43c0-5f6f-63da4483fd63 + +#### Associated Detections + + +#### How To Implement +Be sure to update asset naming to reflect the asset names configured in your environment. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/malware_hunt_and_contain.png) + +#### Required field +* fileHash + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/malware_hunt_and_contain.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 5a5c0b0274..8af72e4340 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -25,7 +25,7 @@ tags: #### Description -DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host highly suspect. Why is it needed? In most malicious instances, During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. - **Type**: TTP - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -58,7 +58,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### How To Implement -To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. #### Required field * _time diff --git a/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md index 449de0ca88..4a1007c03f 100644 --- a/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -23,7 +23,7 @@ tags: #### Description -This analytic is to detect a suspicious process having a dns query on known abuse text paste web services, or VoIP, instant messaging and digital distribution platform to download some files. This technique is abused by adversaries, malware attacker and red team to download a malicious file on the target host. This is a good TTP indicator for possible initial access technique. Noise and false positive can be seen if the following instant messaging is allowed or common application in corporate network. +This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This is a good TTP indicator for possible initial access techniques. A user will experience false positives if the following instant messaging is allowed or common applications like telegram or discord are allowed in the corporate network. - **Type**: TTP - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -56,7 +56,7 @@ This analytic is to detect a suspicious process having a dns query on known abus #### How To Implement -his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days. +This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. #### Required field * _time @@ -73,7 +73,7 @@ his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please t #### Known False Positives -Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. filter is needed. +Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. #### RBA diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 2f58ddb93b..4c8de317fe 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -21,7 +21,7 @@ tags: #### Description -This analytic is to detect a suspicious dxdiag.exe process commandline can collect system info of the target host. This technique was seen in remcos, adversaries and other malware to collect information as part of recon or collection phase of attack. Even this behavior is rarely seen in a corporate network this commandline can be used by network administrator to audit host machine specification. Better to check what it did after it pipes out the result to a file for further processing. +This analytic is to detect a suspicious dxdiag.exe process command-line execution. Dxdiag is used to collect the system info of the target host. This technique has been used by Remcos RATS, various actors, and other malware to collect information as part of the recon or collection phase of an attack. This behavior should rarely be seen in a corporate network, but this command line can be used by a network administrator to audit host machine specifications. Thus in some rare cases, this detection will contain false positives in its results. To triage further, analyze what commands were passed after it pipes out the result to a file for further processing. - **Type**: Hunting - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -75,7 +75,7 @@ To successfully implement this search you need to be ingesting information on pr #### Known False Positives -this commandline can be used by network administrator to audit host machine specification.filter is needed. +This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed. #### RBA diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index f1c868f3ab..07637bd0aa 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -23,7 +23,7 @@ tags: #### Description -This analytic will detect a suspicious process contains a commandline parameter related to web browser credential dumper. This technique was used by Remcos RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos use the "/stext" commandline to dump the credential in text format. This Hunting query is good indicator to look further for possible remcos infection within the network or possible compromised host. Since the detections is only base on the parameter command and the possible path where it will drop the text credential information, It may catch normal tools that having same command and behavior. +This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos uses the "/stext" command line to dump the credentials in text format. This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. Since the hunting query is based on the parameter command and the possible path where it will save the text credential information, it may catch normal tools that are using the same command and behavior. - **Type**: Hunting - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index dc36fe0040..1bae69e6b5 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi | Name | Technique | Type | | ----------- | ----------- |--------------| | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | diff --git a/docs/index.markdown b/docs/index.markdown index 60f02392ab..1f87d60eab 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -28,7 +28,7 @@ feature_row: - image_path: /static/feature_playbooks.png alt: "100% free" title: "Playbooks" - excerpt: "See all **23** sets of steps 🐾 to automatically response to a threat." + excerpt: "See all **26** sets of steps 🐾 to automatically response to a threat." url: "/playbooks" btn_class: "btn--primary" btn_label: "Explore"