From 043910d5e3764d762bdcbcf29b1eff654568eee0 Mon Sep 17 00:00:00 2001 From: Tiago Duarte <103927368+tduarte14@users.noreply.github.com> Date: Mon, 13 Nov 2023 16:09:33 +0000 Subject: [PATCH 1/2] Fixed starttime to now()-1h Fixed issue that was causing multiple triggers for the same thing with now()-1d instead of now()-1h --- .../Analytic Rules/UserAssignedPrivilegedRole.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/Microsoft Entra ID/Analytic Rules/UserAssignedPrivilegedRole.yaml b/Solutions/Microsoft Entra ID/Analytic Rules/UserAssignedPrivilegedRole.yaml index 678d1e84ed7..a1b423d35bb 100644 --- a/Solutions/Microsoft Entra ID/Analytic Rules/UserAssignedPrivilegedRole.yaml +++ b/Solutions/Microsoft Entra ID/Analytic Rules/UserAssignedPrivilegedRole.yaml @@ -20,7 +20,7 @@ tags: - AADSecOpsGuide query: | // Define the start and end times based on input values - let starttime = now()-1d; + let starttime = now()-1h; let endtime = now(); // Set a lookback period of 14 days let lookback = starttime - 14d; @@ -78,5 +78,5 @@ entityMappings: columnName: InitiatorName - identifier: UPNSuffix columnName: InitiatorUPNSuffix -version: 1.0.8 +version: 1.0.9 kind: Scheduled From 75eb5a7e3ecd2d2f3421bdffe554ccd565ebe498 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Tue, 21 Nov 2023 17:38:40 +0530 Subject: [PATCH 2/2] Solution repackaged --- .../Microsoft Entra ID/Package/3.0.8.zip | Bin 0 -> 92225 bytes .../Package/mainTemplate.json | 186 +++++++++--------- Solutions/Microsoft Entra ID/ReleaseNotes.md | 21 +- 3 files changed, 104 insertions(+), 103 deletions(-) create mode 100644 Solutions/Microsoft Entra ID/Package/3.0.8.zip diff --git a/Solutions/Microsoft Entra ID/Package/3.0.8.zip b/Solutions/Microsoft Entra ID/Package/3.0.8.zip new file mode 100644 index 0000000000000000000000000000000000000000..8468063485ff2cd39f75c7ab7be51f7251ee8b8a GIT binary patch literal 92225 zcma(2Qx)wRfHW;of%7w{L6nX+1<6 z(R=hBG3Jb=C<6kD3IqfM3B(rRqV7qXm|;f=1SJ0g1cdSDS7S$0LuXS}OHorZOIu54 zOFLWoA5M0*mp)!j0P&XN-`dUF`Ra|&($cp?N+};@kFsM4i6=35m9#uH)s%bR9y?yF^PuYE)ad4#*PT~8vAmu}v0jq9Mk8)@we*oooN$t%cprGxw{jTa}F4N1H_#K^B)DdB^YAQ zCf~}?H`Pxm={n$H84{Th?&oCO@E5WidV?0a>YQqnBiNO(=H3;tJZ{ar{+F_qQEOp;*p7A4Ke9mcoz*Dik)G! z3Jl|@P>e1)4mc}1lfxrG21J=}8YqgVcHoJ(<0o1AZsN%&B8Fxgd>CD=JS}ljl2qxe z!BJI7sImYG6}h3_>gg9ov%;zXAC8P$OP?@P`>@!MJk(3beE!;CEan>(SY*cj0Qd5Ck^97G1 z`1LEF^Wv}4rx^8Adu*%l)60u3j6*|=|(0Ai0=rgjD*zzG~@8|t0I=mI85!2;6?%aOz3ld1tf_EO)itz4m?~4Lu?m{oH z9h7^@ihPsv=HyouM>pmW1(dzF4*DjIVCSy@U=2$%^K0-pdNPprl(`=wH%uFMjH}M9 zI~1V~o~qU_2wz%0FPjjWS?~eDI{{tL!Ui)J2&CABh#IoQ$D@>_T}^>ai^*yvx)o(A zgS^>@Gh`oN(NKrbu+O*Rv9CtbQM3(p^d=$u#%(~as;1XH(J5LBmDEA@d9UEG;naT5H~g`p?ae< zJjPm$vZKat)!@Rk0eI`Xu2$ynE9;2uUw(*fhs2~(1&Cwl?U9AfM%WGcC>kC_>{z&;&7XX#s<}Fa{JQS$RF{eVK zu?0bM>3&|Vv8Oi^y9rYdRw>hyBtrJ>Ygr#jAfS$LD2m8ZLR|^BGHseq&Io~wH;S?c zkqr6-Ar5cYXkc!4MktEp7$ggHErswPC2n-tEE|Zul_&MVT_*jwW$C_`<~s+ISiNdV zEu)dG@8FmSDBv1>Z<`%|HA0$i*CCG&!*jx5?x=SL?C2P0W}1Ut+knk;z^-}m=vDmO zJ5ashWo4U#$r-K@&Q`=e^qzMhRAV^dBNVpa^G7?x;_*e}WMJD_U--fBDl18=6~f~_ z;o@~cg1XarBBy79wo`&_NS+Vlsr#z&8v30^T%qGEwAk5`4siZ-<`wcb6xXh47(* znlpMkV48e+#Y16%jsri6C@+n|CTX#wywi|P=P(N`QNa}zEa3|DRGxs+qq8&YA70jI zwYDB90UB>&*FCWb`-eKqBajD7&CBOr#C z=jOTA?Y4j!i^}}IvMZ&Pzz8DqsU|QhEPR4$M&8LxC zi3wk1AeTap1kQj?5B*30`az1X&nU7?v_r~;a)umqCWv9)Y5{c{#CQ7CGR z(GDH;k6`Y;i&v?s!yl(W@16%Unlm86(nY(S_A^f%@Jty;mQwv{FiIK6FgV-5==J40 zd%D7KiFUj3jca{A7S`Lp??QNJ7J0|ik%cfui+e^))bOKW81uBgK@=uMTE+@t9EOhU zJUeK5lP(rfO2&%51tP5o5sLUtu%|0I3jGLnU$2^dtjIeoNOy0+8Ze{poA353`+0P1 zCo-AkI8>`DOOwEYWqfU5>?_Z)#XVTRBC9>QI?!>1a#xn5lQnse1zOJf8-g^H&TAFX zh%MbVbY-;4M&XF6(7i&fLolS#Ko<2V=w$&N`J(`T*SRb>LE+6SRRE*=_~ir1D2Bk> z?felNE6f);Thm}aP*j^rgJb;rXdbgMR91Ao(j$Gw2@#kpPNJtR4Nan_c^~dCSjYOh z*AnJxf8ChcH^!AXkgv5r2D9Ls(*YgfMOk z#{X%6SYJs>6MD4ny5dIzi6{7x%H5<-FEQBoGT#ZY*eVgOTo(#yN+HySOijD-^dhTh zf%~jpdYf%;;rdHDO3Xq{f2VYrqmQHyq9}eR(ET{{9x)@IXy79*3d8~B&WfCdD3?58 z0%%dZ3+xL*L`QiC&y*SUmoimK$jZdU!}&UtTOj=*{aq zt9DdslUhxSiA7oDFO9QrYAFeK0QdIDoyR1{#1Tua>3d8~1pr+h9gM}qyA7E`;3tD05~GQ(zj|^23DMAtssGX;0EV;g_Q@p^a1tC7QNi&)Axl18&wm} z9r(wmYEw*11(Io8vanWk0u~m7xop%+LR@ss<)zqn1(zH5+V1y%xbvO_WE-NY!o5Fk5PGkQcF~Jj_8(o$p#dPc1zJD*&{X6Scb6` zlh^G+@b;JT#||`2cu@omeHCD?%l?7Ww6RC$1Vm9B^MlxBAvk}1Bm%+4S(*kci(gRs zJnm_Tb#F+dDiPp*?p1=s%S@zNJXCZ{53YOB4^b{7kQlj&#I$jZ-+$_0D+s;$9in}M zfZ(BMfs+sE14oG|BM%5i8%Fw6{ACK>xtS=oQl*>nm4GWDVOh2bG9kA6NuF$Jbgc-q zAT=&aXh1OnKt-&XA79L;$W(CQ7xJX}d=eyj6Ed#hXQGo&UqxCLQ#9QZg_h+t>=2ulgLV zq+-KRGde{#NXYc)IcKA=8pcCn8A$U^DCeayLuijTLyJ@$3aTWMQo@V%Dz>Ri_{N~! zf)O+YhDGLli%2EGln8Yg5#yj0TgdnzG1CMjYv}4JWjgQ_5h^_bEO-~*@cFIp&I5tt ze!{rqdy?enM(5E7?_zb1!M1ChPUYYNiuJ2~|NNK_owGk}7_yYKNPxq*k<*nWR;<4q zA-!#Az4hsMg=NyYD3{qmN*)ozZvBX_GZUmy;mv73XSjjG=5W)%QKQ2OzzP7h-8;9p zu4+(^-a`g}w>XcnGS@JLpoJNSy1r_4XxB~aq2#y%)FDsm-yc%?+s0ctCkdY19xOKFyiH2x1pq^oZ zED74hi-}M7$>W=BZ+niKR)q1GbcDeN$`5IYqBL%S*`woPSA;0CnZC$C+8FPgcYueC zTTls2;xM;(>$9-NOSddn3?iz!3ssgJ;@n@{YZj4f!ZV@Jc7o)k?fZWq=eta6< zopb#&IH&XWy~Bd9liw{~+Wt};bS6Su0nK`s7RJVv|9INkyE0vxMLLi4CnRoa zlh{9>Ch_ATU%iq~JfoXH8QU^=72AvC^Q!|+`y5BPj?;2N@HTKW$D^$trvg)wQDMze z>-+gVLWL9>GV)C`5K|*e>J^#CA`5v60J&(Sm;yV#+^(VjP;;!!W}3Lv#fpz098)+1 z>);rn$edH$#~R+PQbImIQiw!$)oyOey^Ls)n}&`vRxpu7rHW2Iqv#GzONd#|kC3LE zfZ2=7ZD!sEi;-n0M%W>GEQ21>DR=bV^{aG8Y?h-hg^XeNb;&PmoS^j6tMSxTJ@s6f zYzJ|jFfIJ&Me}JfW5ztNx>Rl^{TC1g@E;2XZG4I|G^-Z$OdR)1jNxYDDzxN>PB_sg z?ptk@QqIcmHuUTN1~s3-#$?k_l?CcxH8+%h7UOIrJayJB(@>oN6QG><5Nf57p45ebB@F>2s)mEvg z2O)F~Q7eyM@*~yg0G|3F1eb)5rv%kzpn_VGJrTlC#Bykki{lpxDa%a9$r_}%#P`U2 zI;@F|$xaWZXoe`|C@R-2iX$wvsZI#j=jD++Ocg=<6Jjw!-=rY-8kcmTkVF@#5lt5m zr8$#=K}bI$OjIRXEFvoA0wOz+`x1w8EVONlOM0;N`;zdwgXw?uKE)oE;5?>uGaTpT9aa%Q$RPZ|<&n+#Ql03PpNPVfM=86E#Tonziw8 zwqj$qNXs>Vw6?RB@d-vikhg=`@>Bp+&51?qeC$*4KlFyKs}Y_~`g85=FDmDDs}Zi} z1{Z<`A7sp= zYuq?h_fnn$`eLNF%FO-c2(oV{g*IhSjDN#;b4ecZ3DFLA09)0mw=aIhk67q{vchVB zuPF*`_9?t?d>>9c(i;ZFQ5jA`rX#^_yQ`Ku;U$HMP7$-wK$aKChB{I*Clp3aOs7Fd z%NuPsPU@>XpCDR*KG=;76w+mm0Px~xL)6ek7X8c%WU+Z?be44+x%?gSt$uva!c`Wd z3qCDSq$UT{V%yiR2p(U+vjWzoOd?yNDU9LRf~W<*RP(uEMcy*C`w1utm}pRmpxCYSP^PM@pktgx*jB~gRJx#%_i#D7zIUuV zAAh9f*YO=Rb>}xSqnFDV(l({pOwMF$;Cy#>a^3@u7rczwdiPTBdoR=C*9Mf22xU*F z7OFlv;HsKF>v#3u6USsL&SmGWDdt)gNrh-EH1uIR?AuXcNp~~kJV4yYE$G`9p?6I{ zCGz6K958&lF<;S##giubVzBnO(J_AWLWJ8uCdRKW_1Mj_VolTo3spGK$z8}ip%Sa&PLniRS{YiN<72ySWCs5i5pE6iniy-wP(!edJjiU4m zSx+|nOG%WkjHM4;754?6m0_STAlohIyLS?z(^KKQQW;H{i>dWso?OLX4J*iqFKt69 zf#9fS_8}vos4lNBo<5jPt*$N(t5X31qOS8nR}Bf)^I`}LnboZ6RkwF2;Xlh%YI_BO zdfD1-bJVNoKLf-<*?B;r0$mWd^Qz4jj5ZvD-Eac~WA%_@Y|H{_z#2}+LJT;N`Wht7 z&!Q`W_KS^05*-{(PKOD|YTlUo{4~ku#QJtNKSxHqXkwz(-#mxkx#C^%iJQfto7v%T z!&6?Y=`Q4OzmE&XkZyJ7tq<#f>`OHFAM5!tyNoX8wdDGKd(sm}MOZmI3}rc^>vPao zmzDmNBksz?j7m;ROkc4-0XB_dA>MF9op4Q3*Xvqn;*nYI`F(Na`Y~wF>bGnX4OI~u zEm)uQq?|(ozZ*fZcaP`-bouuEp3*DIAnnMp6=Bgn$_Xzj}|my47E zEuk}Nc~n<|!*`BtaFddu>!S=Uw_M?qVT*0vmVVgv|G<@m@Iz0Q zD+4$)XVhkNw6m;8q4cEAdgX5XZDp9tJ>c)$r=*vnIr>m5X^L3iqE#tbWU(1NZ;SIBWs4iS5-sDDNUNf(75$l9lPrE zK)WeuDGRDc(3>cO-6e)Cv^X<3mn^_^FI(vXvf=c0`J=`W(~s) zs`(dmmF#fP$4G1G7cwK8-Q>zt(Oz{<#|jaCs}sC9#hb!Mn|1S=s2xcxA;aJ=mHuY-GXBo zvlc_$C=7ws`DrkGP8cs)YT~wQ#)cN@mdghtr^?%p)c9e9qb|TZeN8E$L zam>8B{vOXlm`3=#)6zcSUTzG#hP$omS=PP3*yP%{*b$Y(FO?1*FFu>QJ;KlA{K;9i`&6s2qvWSpopCMQ#4h+|A_T?%!L@Ba4Mh9JFi6*YQDK&3( z7BQ_L#ZcMA5EFUrr#?SB%;U{WUGAOq!I4|-T^3k#*#VAMP6B!g-++*ct~l#fO?C5E zBNHjlMfCb|S!F+^&=cw~S3#m=bf)-zJvzG6H zS&wTWQkk)96nX)AH3+6Fg(7IYq?JPdQ>>M2AP&q`>0;o%8rk+}Q2@*XZlgwd-Gam~ ze>o$}v&7%VDbUt&-tj>_!@ZMiI+tOaD2y?&m(9uC-afxO3lfC85d{Md{^p2c?L)ao0t;Ut+IRNzkS%JsM_kR ziMcG&B)9Kd( zN{J)1PVsNBzuN;Y25lN;_74@Xj}G11j?a%1m7k2ZL3sS`qBpNiYr81o!Ze-Gk^-50 zx+5ZcQmQ0)Z7`pEx=D|_(Mr|%NVx?5eK;nT@h@2?mzSr??=3dxPw=z25sIU_e=5I%cyaH&il|t zzWDD;tX_8$w4j$is@L_!94^=j+xya^{oiMVG)rY9@gFn9cg~t#^kxPJRHAy)Q=APs z@igu&y3oTl?#q4%N1}t`>Lyis!7={y`#GwAS#l!b1xJ$IRM}B1KRzf;mHq=C?0I>f z;!3N?iT7%qxr@u)d6~gQSIzn485yPGj>Q$DW$Vqj(j@k~*N}nbLXemXo0Yaj`_!)D ztHW5)f{EHX|#}RKe<4T=^U6vlY@$$u5aRj-_fOa3OreqH!XA1Kx$1r@?I)i_2RJ@zzF&sPMciK?=;FY)v_nbbpCW zIa&QY4$ZNa^JQ{s?GKWlNe0rr_F{&$XRv*r=+^U8)8Ux>t|rhIMbFUybh3Fz7@)DO zYaPE$aC{AT1{BC^tqjm zL3GU+mhARtFC_>rJXs@KSih$dkL6pF%W=9QOSHA4WawwCI!S%@E9Y1fP-3(_f<>@o zZiq~08;BPcgd4gmIKd%OxsYfW!4YMY4p8K=&H<>j8l7se$1$zCDpufVhv3X(9yU5| zLDoQ~Ry1}oVzrq9c=biHP&fKSwM*U-s1W1Ybi62(r-dRuj_HQef-&nzf`YqI%k2jl z6$V0#NmJ(<-qU0o%}ri3Uft9P*aaY)98_4HH#8mern?ak@F;Dx?5ytmi2Jn`>6e{J zb91T<^r-X(S#AIs`51GL1oKuQPx!A<)7}%$6#26;vwKY;&s}R-=$A0 zYtUya!eQ2rzHtp1Y5w_O9?zb6(guiK@O4906q9<6dTVh!?BdD!eR6rTb^DuQR99Or zLcy-|pql#tO*k!48}-}v(=jSy4ynqKsvzT=^_Us$;BgRtE~esE?LRYgc7%e&hFIx`=YZ!1!k?Q3|o?2nOJ@pBO0s)7)oGlqd0 zpq4o;gImUnTr-Dr55L9qT716wCf2`VICTeS^Ly3eV!_aTy|%-sAOk0JjFDqUbd7SVkI{MZnY{}5!xfYfwtDI&+oj7 zR!#Sv?UKzhjv+1Z=T?Y=5Ksp~fg{7L!Fi1`^tX`&Wzi2VTUdAPdu!IXrH*VT^Ot3h zp+M=swYv9|l?|NV&ni(Eji{#Xx5XFTppW-K*`j%qi;JZ>c__4vMApHu~Kbt zlF&wYv-^Dic2a_oNWn0f4T<_4Cm>^8IjY%Ga=bhJG#AH9lQD~*rPEq7BR}DUxu9a6 zLTAB$jh$VsF)ru87LMhz+dv`f``Dw;Fcl1J+aU4Gnby0 z7v+p?AxXdgEIF{a&{i*?DEYjDl5#+0#W zZ{8fn#T6H5<+8PME?x~Sw-ZpRhrL(sKUDMebl^ z-vY;Dt~;=6#Mu{7jEiG0_6q(+WT>!>Oev$W*d}R0@s0>7hLcY5WqzEAuJ)&n%v?H~ zj7%j^P8A`{n-cBWsz~Y_8aVee!d2+gaivjvCbri=)Zr@cZf%=FT)syEKT3m}7kasi z>zi_AO1gn9j>VErXUV0`1WWx|OhhwY#4mK?aIhiqRYnS-F4JhbIihlz-KT`P(_6lL zl=c&axY3j5h$8%i`G>*ZJIQ)CbYk6|-SyLt-W7WNWu3OsR5a2Af4iklVfk>%j0p_J z0PHxzKk|cLvZZeG#zbXI8DXGuwc&Q9b5#QnSnnu_{fG#u|QyTQqdMEFiQc9#d-|SzxO< zTK2qJxt6od%*wQ=sq)X8!7w9zQzoxQY|8{@h=NG&+>A6)M)op|u>ZBzC zWiEGXOkD%KRwic=u&y5iajH_#bOfFClvlKht2}Dn5jCJ7zp5%nJdZu@5+tWqHQpQ>t^1kgl;Q1yZ(In-#JUZbborSe=M4+>*fV?5(T%@(jY6_| z^xc%(77{?@`(h;bJ>jUkqpWX>*4diE)PK@2ezMcnTB!$*HGvbO?%3YQI#z-<5{dyI zu7V>RR($vF?^IraB%6(1orGP=%$m2OeE%+8g4o$86>o3dgJu%+e0MRm3%IPfiwqiz zqeo)A2W)6}()W4%)t9W5rl4EXD^6pv}pZFK(OUP9vG|iqVt^*VB1K* zHTifOwt0N55LeW6i-rF9Zmya1aa*~z4nAPCmK44MYzoqjiXnzhI5VndIveAM^&Llv z)Wk&Fk?9Cs*0BiE&L+nB_0M9EkEK)RAi3xN*@r=iu(|aq7W}Mc_7S6}x%Z-gZuNgX z;=yS)2C=j16bWnS-V{E7KMV5-?6F=u-E`z=y%ms!`MnlIQ7pjiiU0ugszG!p0n$I~ zRK13xCuV5VF4di|VU<4ue}4%m{(tN!-qIpCE%E~c$%n!LA^q7=v@x`_RWY@(xBj!K z`0sY&MfbVmhGYu)i{IoCo?=xCktQA?Fz8;&S`~ds+W4LdbupT%?lR5zDkPAQI2AD> zUKnCx@iK3JTJ_rc7dD`N?X#PqZf1d@?jF)BMjyzn514aL*k7frLIt{S(;?>l7VtWK zc<=Xt5aMv-R_}))-yL`z71(*`i0|j-DV>`o+nw%)BR{xyH}nqpft2$ym((4pfH#4k zmSUy#WQjOUF$a?3g&}{8VuzLU!4_lI%V!af@G@r&b^S%9Gqi6JvR$u0`+?vk0GFz_ zLl++~^8$qLQF*A_)K^eD@k>lXu@YAJNk@;wA0Ob2mY5zE>1Fu!ZH%NSXf+HedGClf{Ms0Z@ zN9LSQ+-ciXx0_{o0*KvT+Hxts59HK}w%)}sB`SjnzM8_+?hE%(zLF7)wA=LzZHB*$ zc+FYyK9K36RdK=TjN7!Z8yR5-`ZUBxHX@A&wPmLc??{}5yI8*t&7Y9&&*-(}zM)iP z2m~Dwbc^jsC|>Hz!|pTWGvy3V%)->E8hc=1|8^vx;~#OFL6DO_>cxC^GyXk|IVz4w zKa#tXSSZFyHtfgGkpNxfb~}UdhOj=@C)y*`{Waxka(U&6&;Uum%k7P`g?t+ZOWh?t zNfr_-XPrjqKqL(ofp9k(9z2>jJL-qm^1Ymk``{WOHda98p1xjZK(oHdvi<|(i_aK5 zD8b{#$=NDvrfY1_@nV!QWtSNBXar5R;FdOP=VoNrk&VIB6jO}A1|?I^4)WeL!e zpUnBmMu)GN)g0;=mn=zHcPyn*x20yJmBoqo9Xbjsa)ZK-=_w>pQD@(Pi$DQVz4-iG z?)#O`{P-M^hdbn54(dJ&)Ss6NVm(!L98HGiClqAv{u4mk@w${|cT&%!iN9GrloENL z4SWX%SoQiuqtOvw73R^!)aE&e1uAbNE!eTQ^}yNHI7dfjr1mjhM_7V~mxI-f?m0(p zjKsA(h1{g86_Qm@1+*2b;y|}VUucqsm^>zy2PbyI7@}`x22E5H^kzgfi1Uj$+JmrL z-6mdGH4pX%Q;6u}$6z!_v_odcRZnWs_YXzpgGABTNf=d!cs1RZ_*9nIOnn9v*wpW5 zCCXcdtBZbiF7H}GIfYhNtefp*hE^|Gf7DjS)v!x=;t{&~t3*sO@o@b_dqCx>>DCnO zA6F2KnCpDt4?!l{E3$Nv5%&|{J%pdgcVdc*#6NmHoeX0gM`f89@Nskwo zS6rDoG*qm|rBf^xRjSsMmKM`2>pQE_f(--G=$;3g&0$iTKSY&WG;Cu`4tu>lIe%q3 z?WM>elv;T1+(N`~AKnkH9evn09fdCRz3!?^BS^b|J!9{kv8w50|8SUcO&q;qwNp=I z>;yC?7i+lHS@PhzUfRyO$pX$|Wm_?tri2jRj`9Ew!ZXn8gGwBi^LwsC4oa!WqvEtm zJt7CB*WSqVDH^dbE@slGK3zNK`ljbM=%&hraUhnSl+rd$gkF)&WW4R_By=8340{w5 zXVjWC=x(8royzoAMLHZOExYUMY+gMJOq+%~899LKjGPs`817|C$alTqw&N5cmvSQq zH&^C<_2H<7d1=dR0EYLrw%XfTn}@qM6&>tWke*%dhr6pOt~6WF#B}5wC=R)^ zUA<7B=$s5(gctBY@fx=Y+|3vrJ^lAvA-Zi9iLPo=+B%2#uC8=8bZs2maHy|r@f`lV zB)O`|X)|9_Lp`;3aQpWxkJSdV^?WR_f=);4d^l>)eas-7^9Z3noF|~Z!EJ6$L*2@> zSJ~N-UJ}|He^Ppu$8)%5)!*Rp+{-c5Rw|Ndrb({kp<1~Q{Zy*ONb?=_ul#Z1I%P=k zwe%z*Z=tO_>QFg-rAy~g#K(RGTf~#vC%n&@%;au=61T(2#|y=pZ!ym&C4b6VP-v8k`Rx%alLdfJ{J zhWI903MBQFk)+05s^n+zJbJj!AX-jaAnaXRKXca3y=+_I2H-3Ir1ac8)U8i@_4y|y zeeI3+KPmbCNr^*$wGnNc{uk+>~3ic}&SEe&Z*2rf$qYFhPGMGtG9 z16L~mTP_7_vDK+%rVoatIG@EP1YFL|y3uM}(V_aao`;zE9Ux5EwgPZm)`_Y(Jd;J$|$wV_?>WV19@Mx_b02tCX{uqj`gchu9PL!^7ifim}XR7aM& zR^|h2>_C5v!{=N<`0!pj%QD!5+ppiQ2j-i<>QcD4Q0D0&1U1VjYAg@Qlj#$Lnl7>` z-dPdVGvmM|d&|+XkG5CHN-Q)*pRXOhLLY7P1n60<^=n2w@!)c>& zKUl+c(rKWN<=(T|*pYq3xXA-uwi0M|iEN$n7Z~%uz`Rub1t$MrU>1_Szcb=Kb^F_a z{8+LK^fzs_0sgUcFURu`*t60+kjL*c<@3f64_!cZ>oIua5X?6=cHtS*U+ML`3Dh32;=$cfm!{2K2C=tR=^H zu}lwa_czGP-ymQ+e}fQh;2uXX#}re&Hs$TZ0@Yx9n$6lF$gTKy(x+h|$N`=@YHZpA z86^Q!_Ca%l_Swj=sehn>p!R`HRa)R3qu@PxSL6eR#o(I1E12)I$J187lMjfSB%M_E&U#3F-GBsrX4^tLAlL-NQ ziW_bp?3e_tBC{tC5F$<%p)G5dv0XI+kXe1wNcG>&*mTV%yv+#uEn7lXtd*H`1_FBy z1pYlrf;SxOilr4c=|aHZ-0YK3pxqN4Yo8qtUfV7_@cd=8xW($MLm)M5D*Hb)VbcFg zQ|#_vnizHd(iHNyfd7y^>y(va6`Z&9VAHny1_B7Gw8eK$qPyErJIP;0k=Ubh-=1C z-!lX`p$yNmA;ee2dY9B2inUJYK2MI z4hbfx;s`a{K97B?0U+=KiBgm5BMjR7?>H?bkKgD{9(@R^*mmi5h)ZcondePrBlg$kL-SS>#|H*Sl{0GIZqgH<;x%ulEd z-#z+2s0d*^ybSuobjXf|EX067pS^&i`N z$6L93uQ7HF5#hY>0y==7bss$+G+lw_!K+n1Oc%zfNcs5Rr&;OVO$eAK#D%5pH2>y^ z^-~Q6HtBuPA7UBCccw+c$Id|Y%=O{FaKW_*~i4Q$Du zy=+-(?$%2l#A~K~n>yjlc4kVQSa;~d4rX?xwqUz*ra#@Ff;q7VK0ZPyjTwiBgAjwg>_)20bZMhX6GIOLYq$5NzuL+q=P-am(lI zHN(B6D+0Sp# zW)tUzp~BmC6(y$$gU-CQ>yQ}B;6Wjrq))?AeUHJV z|H?|7C2k^f;6sr%wlX>50qDJA^h*ImSc7SrZo%msW;O? zyKwqK_zItP;T{u=(tjG<-*>wy9m)3JF+d09_@oyJ$iVov-FzUXIdeDy7N+~~G6vzT zfnDu_UhM())3u8~&i)Hs5fM^#?LXFQV~6NG05pjf61LmIH##(C04_gc$@65fc&=LW z>WOLlxAOj63;ur$n}3R!PR@s)?gSi!!@k=e>*XZTbYF-9QmGf}_vwSK#!F>YlBGy; z!uG$G*_q`1(N%K5@*{)dH3-6HEOpJI3dtPlR`*LnZQ@?GXS9YeE5(b`7`Gp^+2`_Gy?hMy z8EvT~`{TctDgXEB$?5X=#PuS#ATNe|&c{rzoImeH*p-`a zoS!*2X^Ncea9(tetRc}Nd()U-(+j@a(Bz;rHX?Xqa%^1xv5_;ak(55QS&XVUa++%imiub*IO@52E}Qe|`xWLfoz3a{Kc;Y7{aHqrvbk)H z&11$*sAzs-(Qk)1v>iZXaOmNR5P-j43YTikJ7m~I1XL&$o2a=^o2!aVu zwR3A{>flw6Em`gyoSn$m$Qx6nj#E?9glZ+qG&ftMRHYfIW~S&>CxkCoXIX5zv?;ZI z=U(YJYhT`6*E#<&)ocrLtflT&&vbL7ZUx%8&pGTv9$m~edh1zaO&LLjORRR&Ww1gsQdlJ?!i6*VihlE!j?F~^kc4XXk0NW&&$4RS2xM27kh`51Bn*bvN*}KU|kg#8I>d%rTlG@GRL+W zwPJoB!8g{JPGeQJ#r%Zn^b3G7unU}O&Fk4)%IjD18-gJf;U4i-*7Wj`SI2!dk3(vR zF23r;xhIUjKc+2ALDP*)+`mg?ZrzUG>;O?6Q8w4Qy~H&0UhKsZcMC?$oUmuD9mib; zVZ<5zZNefxlW%}Ee+>>xsj6Tw{Q!!yMd#^a0s18r4!eY->^z|)2D zni{h-V9f*eIXhu&>Tvd6z_V4;SVjtaRd7ESfy$gwRB+W%R-6~>$AIGn!-&(CE)>*A zY~$eo3q1qug~#BruH8m#s@q5c+|S!^`0_dQ>~+aOWjo&eeNsOZy)WI1?OHTYYh10}DDh>Rt5apf6|F2Iaisf9v`5Axy1sCIYa8T>O`d%#w;vM#wN$3$QoQ!P^ zMJ&X_fW>Tb5c$DuDSs=^H1$GIE?`o=ZHD7>d&!%T@7mzm#U*__P6THetAooEi7 zW?jz>odV7qcjlL;Pjis)S1tpZSVT!Mr9jevK&=1j+>4qnymZXz7NP6!h^6=`!A4z9 zJ$d2BMVc}ueK?B!ml*t+1TC=O;MdP_ZEx5Dulam|{tMO->z_LW6TcK?KX*ZLU+PS; zjw=niSi3Y0cH&`cghog^qT$NV(C}x>c0qHuJY@)(KO3 zn7t7);Jb$>Z$jpv`MGj&Dlt=n(Gx&K5pS7!2}r5gkLFA+1|eJWrmK$yFt?!9%ETm> zO9^#6_oZN$;z81)kS|YHDM((dZY?iD!PUdDMU{Tw>gslT zcui6%*F92ePW)Uxd_h6P9~m+EU<#7nEil~>j-AvVAC;9}Gj zG^Cmer}f)tt$%xBxB4l9B9N@JaZ`e{Feu?aXa$@sIvVkz;QczdybDzLY`zccA@ zAvAOKQTl#3w%F?r!DJOjOE-4#b9o=9WpV4JaV(m^t6qSgp9*mt5X{m0uCKOhRHcRe z{{VYHgunS8~m-5&GfyQ<#LpP}Bt>3E8>;k}#gZaXv07 zKJ?-cDSgP)P*;%G|Hos6h)5ky(h3b@x z?gsvN?oHNWxulWCF-+IS;1U&SaDZ8h-{LkJ$1YqTKaKHd1&ex3E^}2I#@xlrt2IVX zuGKJ>C<6L+9Dn@r6UbJb(aKb89Aik^0}@$>DWOuc82Tk#;%(rZoCM!3ywPav>++?n z+bs5Y*Jl^@+GCe*pmB_5NnC68l{8YouFM-(CcgMLBVJ9XaKHLnX#DKOc-9|^f;JBCzLpXOfn8fn4W1|T#J^?nG?81Xw zqp8jw%o=+@ZP~G zX07872RgL$Zxdke0=~xiQ|RJ~dl~yvt84E;Q4QMEcoreDwR|AOkGFP6<{ay&=?WRv zI65_s-?g=Q#l5iZ>8yc$vzF4YtY_9a{xz^)*3k`?b;}yZ%LevJ4HaTpXXu|=8`lTA zn#N-GHP69~i57!OkUrTRU#=FjGy=i>cRBsltU+)&sv|d<83tA}&HLe&9 z?2omSrFBjYUvZUCUPJN^bLBD*vi-@Xy>?X%P&^@@Ith#Leo$j z_@j6}8O!#jk_8qEW_BtY!qzdB0;-958R6us8%)aPWf^n^-KeHfVPjTC64Zam;$Oz*vV%r?!0>ALU$UiDs&)m1_Btc!1Vi&__i~!5G$c@8K7%IeMV|N`dTgv4cx+u-5Sc9QaTc>?ORdkf$;p!4V%yZ%5%ad=YxWCLB)AM`y5bz|Cja* z^?qNq&+G5+(#Hz+^QwKk&i-9%->$!3f2mv(zm{J~4S$kd_>ru?QWg7+6fa_xej@sQ z9$Nk#d%upoUq@s7Ix74*@|u@5j0QFRHZ=V;s+B{Vkyrxs>iJ>poWQ!s>?ZydkHAbF zD0O|miAP|h2KKqOKg1)jQ4Lns^>f%c(G}=o4gZBl=-(jJk>SNxT_X_ zrH8;~8E@(HrFmv-q;XdL(bG9%HrM!Sqn&f@nfdjNtICeOnr^Md_EXhvtYz-2O?F#t zu)FG$b5ng{?x|19E%iybqc+_Q^$ED2Hr(y>X}Fs{Ave>f_zvt1RcM6DT&WL3rzo1(imE*!GJ?8JtW`w_PYk?DgMwm^PfrL6x@M@= z>zOLpDn=$Xa0ZgTj9bvCKY@?Icjr9*DUw2BmkI$(TSgF)D5+_v(-tYXjOO$ijd~iB zhu(Z1pX9cXFKf7+WGtX_vVp>7n<#pPZW4Iooxrvk-~}EV`FzdoE3Xf}yFT~@uGZMh zseNKyAGEFy;F3Iz;njO6h;sq{X~SbSdEpm4$JtG4|Ms`4aY)DS`rr%HMFL6jC78e( zreWjbwE01{d6B+9{p;in=lT*zOXy7df)P6oNQI%_?m5Fz$8-WeFx_zEnV#40m;-m% z4Z9<66xuFnK3F_)>&VN!+%}DB8{J4E>i_}}qKF*^18UFK_(sg>8XcIYM!Z$eW=_TU@>@iCq-N*kwI>sF=smM#i zZUNf~yrG40XKV?4gEb*9$*&(|R%3_oLM^z13}OE}Gk`@jU>4pS!b*AAqKyMzbWq8? zWdzqbx(@M$<~{r8ci(|{ULSl=t}b4{!;5nVgx6#rkJSy(#prx8AyiY*z;|Tng4K|m zYJO!)wlrg`Op%w1Xqw2kVl^eQht>&L7k=~e8hZp%ot(vz%^Nng{OyPBD{LxSUT5H0 z!?xKC25r+Fg`qhNhM{S@y>`FtcWldFXDYq`3A}~#_}7|_&75F-df}tbxLSQT!F}ut z{!W$)5Fh*rG^f2zD0giC5ed1e$G zIEiTUwYXfoljWXBH~*DNxX>V#x$@?iK$FJkztg7V-4`~^KWDc{;Hb`qD$`ijuCQkt zo2&xL#)Wm^d)hdT&RRS2Un6J?RZ@6VUBPu}1(IVNVSD6mn{2S((Ox=!fA}g4#;Ymj zMZN=3#Q%p&*5QX^%vFXm;39nr_oL?ufY8}Ak<8EMx9pnE_$Ix{TfLqaHw5uAyQ&&fF$y24v5zo5QL zcnIx%fyFYMiw|!XpmX~ocKmTlQE`8n-o5uA_KHMLM!bc-%{I51p^o_|{Un*iVxJTX zi&%<%>8~F{{E98UO8Wgw+3R1q=d*-l7$Gu?KNQRg-FgV~QjpRZAN}qSOVfJCC0j0k zg-IF>o35-e^f%K;5pPWKs)AkgDVnTsHLtw9Wpq^fx47_E^yYmz4ky7c%DWORkTj7i z^zw2-T26{y&|%EnKexNj;c0XnuTV!yicvk~81(n7uO^vWH0fQY(Wg&*?AqBYZ|UFV znWj0cXph;+@ATr0TEDyK{t~v(RGoy|<7ip_5tN4f7aa8`V3h|ZXy16NWkf|L^IhEW zSJPp*cu5+dHDS8rzw92ojU=j*^G6W+~^Br#rSp%ST4OFvvnh zZ~}54^8~cr1Iu$%7wqV`C>;+z%Zt>PLu^O!RQ?z{N#RHXD1-hpPnc z$L>t`i`)@Ky;W|oO+vd1T-%RwTV*S|QMU4%WS(}BDCtNdTW%mBih9C6DD)J)e@eww z*U(HKrVX@cm*l%Ofz6Cd?65_2e?ynXqw>>n(I_@%_NA<5`t9inRI6!gT7B6TSlGUp z3s8b6@#*-}eY8^IZF(9!E|d_qv=vX?#QF+m8oMEj#KA6#r{Cle9E;x{CJn{(;CuK1 z%9PC9mH`J#Vq^j3z|tafUE#~GVx&Z}vMU86EqSa*TBeKhM|ou%bd;096%O?lJDZ%t zA@*T8_Tv;wNYDDXCkpln8Ylhr4*2==JAV0cHj2tl?w`q=p+bQVl8J|ZlVdx7{5$;X zOL9j0k+kI@{^M#$KbPv(98S@w4-~xSDk4I-CJxhD`2_C z`|8H0;~DEx@!&ip<5=^~U};<#@Z7I`#2?fldAV8u&^C@Am2SQUtv!^e*@d=7b8E4<5?E$&h+xNBYAd>r~<_6jtsmZ)|HOXe$5 z`%zbS;a zN2(=(b;rxQ)sQ&(B~Cr3=kxgluv#1nlRLth+yOB@9ZsU*=@f1o;evSvCSG#H2M{OA z;#!&ZLk#l{M{BkFQbD-&Wb&k)Q{(~Vvr``Nk7FH_cg|{PekBK;avw9l5+B*(ybOGJ zH&3dRaV7l2XWsOm!iTd`5$05Wk4|RMOR&+viFQVuRO!7o;B{`W#7X?=_IpG4-r3%7 zvA}N;x`~I1ydbGHLbxr4@fmgeIe9(AGsgQ5v{)LOzPv0G-^;0Y8^(ON6y?~8aAu!4 zC)W1{IX;{z91PDB2SX^t*1)$R{0$7f@s@Yx(nA)e@8P^Yq#r=~=;Tbl_2opAPSv_1 zrS>SAA9Yi1X?hF`F28&#RIRYJT&-F4eU7cPFZMaMYUbEd2~;4g66#F>3em$dNt1GL z{!39JHlIcFQU~5DPc|vdKb^egV#*p^8n>4AQl><)XlW9a=FusjY+H#ZrNAdbAQLg# z#6B}x?PWci6iv0NuOAJdIyV}xzD`;+?YcE~qvsVD$Jxil*h>9ai(ld#Q zlV^(5-ABcdqv9~H$X&$6;Z2L7apIMK2RdCEGlzR*5|a49Kp}D}HoPDJVTyTB9OLp$ z`pAez#skP1y=Ov!*ticTP$xD@K0}P0F-%q3s@R`gLPoe zJz{(v=PSq8xng5OjQ`?sK}a2ImmziR_NdeC_G}YO09?~`ou28rLEr3l+oN{iS^m)P ze65f=VlFjQRc%&(9TDm)R zxfmqb*Tu0&6d}0CC+o)rB3(usdk1z2AX%+#MCbb5Q;N;iwe8UNLo?`lmg#!kk?Gk( z-|P;X{Zes&Xj$xZmPtDm`txNdo zGr8aCbo(PWGzVS)dY7)>F$XsM%L+q#==l9n+w+Ly&3A^$fNgYswt#o zNentmQwzcS56>>b8l9)qb~rt)w5rl9sl#EYeJ9pG^U#{v^GdQ3LBUdE`^@=Ba&KuF zLu^N~M{jke?90X0%3SA4&FmxSZ(`G~VYi&d!LGG{V9_5ItN1Q&!TgTDdZfrlQ_-C& zXPjyewkDf1N%ZihrYDZ6K#AubaCE0{xZc!O)eQRZdV+wzK-q03e1Glj=i!Q_$2 zZ_HfbZkLQxf~35N0_C-}Q zphd*32zW$8L6HiX^0sT0m(P3v&I#RG6@a2a4T`!@!LIcI&>y*VDeBa#0D9+|U+6h? zE7baejc25~6>4=WR%qAkC8t-nLfvt226YFn77u;f0!2{G3bh6fD>z20v;zM9l7g(n z9kgyRP;nX24hSk%N`r#3l?J1Ma&jr9#t~V07pwU)KE~IKU=}b`MFPKyWmY*111dkF zp+LoFAi3htOb}63?I#yVRN_wxCR);$)YmW5Q)NL#lU`Rfx`RpRXTyC)DrG{;Nx!icUF5~%rML~F$u zD(r(g(L_7)jjGrf=pTj)lBNa`g>SIp8cv<*$@+$jD zcv$*9c%S=-#=W;-``llA_ZQ#&#dm-4l{I>~Yu;z^2@eOId6vdYQofST>4M&oEugg{ z{=iY6-k7E5;kP*QB)4JjN~G&Q?)?pK$D12rdt&OuIb~q?-+$=YHlSJx7lLdhjvx|aB|AV_tGLs&U0W?3rH-s1KKu9QcGbV@>+l{|$E z3E`iUGpig=DUH-5BpoDG4>9hBkgkYbE$B-g#R-3r7)~6fER7@eo@+;iVlqeX4-=k* zGT9MH^s&ZUppO&*T+jHOJo!&05`-95oK4Sg_y$9CMGL8*J>hM zv(0#AO$wPV3Fl_9&vvIA-Ce-+5@n|1gVMV6Z<#e{v(AgiN$63#Ph1_>m8msD%EL7D ziLQ5-A?3e%0QuzIyJ-G%_=(sLGo839HeR=<8Ckx+HC;6|Dhz{EKg#1dzyB<+zh6Fx zRzi zro!IpTT{bpE7H|^^m4s;CJMi|Sa=UNlW=ysygSNB{4p`|LLQUhAspn2VIXZrec^kg zP5E-Kr{5c>?G4oS25L`LPrqh*1b*`;Ax@IDUn?~NQTNb#3?7v#Db%&gXl{UED$(0X zT1GK>Fxy420N#9m0jq&CILzFGrqV1mZFHDZ3X$Av z3jeND;Xwt8C|=m-l*WUC$>YEOpZ~}I_y7KHeIT0WV8X;gRvPt)Wj{f(k1yhSfG`2IpHa>bts<%HN>LdlEtDV7zE zqcF|MC2YfOZWKc_)$N5X*98B-9C8=@p8A3h6nuOK zy6~{6f+wWe*O275qNY9B|(@-jPg6+2K#=LzMU|m(7v8EQU%>S?@ z9WUe}g=)C^j*5?<>XLjEs_ik$TpD&`lW8>18&R&XcSqd2BR+R`#EJ@ES=&>QgE8xv z_Ux?VUdJNBP6 zVcJi@x{^-h9jIapO(gTSkm6#(qK|Ey&6Vg6WNS<*NLro>O0c>Rx5!k{Mq;$qG5w?; z$``2m$le-sQ*GSd8uU?3F!u(fdxO#j7?eKE_;!24(7j=3J;Ttw9p>H+b8m;ax5JF~ zc9?rR%)K4v-VSqbhxrujFca-(9bihSN<925>#)8Y9_M|36oup_6XOqF5+9T{#R}Bc zLsC9>W)`}WWDZR+3$0-UTHCy{zTxJYCYfs+TW)Sfxv7EVnx>ESj2a7w%-E!B)+0-y z?l&-Cj9$?y>&aSnk?UJLs@V{g`PIb}HI!U*Lt92=1Wuj&z?i5RWl5Au>h++G^=Ug# zQqffuQaW!)ne(^Z&^x;E_Le-6!;5p-ZnD4)25vpLH^+hnrC@zAT20s^(OgCRQ`{`s z_*tTE*@_E&$?&(%pS8a{i}(~HJ=Dr{-d~( zfb~dB7<={dJRJ#^V#*L67IjK8-WBb?3l~$8XCCH5{zIy_n|=`v=bt?PA^$PclZf*R<3EF`ia3+_hyVC694`VRQ;u5*Y>Ns^ zRh#=XJY7Ve;A6?_>Mvoj*BJV`D5-^>u|+-yK|pP=E(01*jIF&nLmv!GQDo*Q{!!a` z2_M;c6hVmt6^X=1Da)v2!Np$|<%3YA91yO9u5|A!KW6VJ1wpg310qo z$MBtgTek5lBB8u_Eb~AA$A9~OjQv5pXaM#H@%=%(;vime%+@_Xw=%+38iqHib9j1~ zttdp}m7a6!Yw{xbCNmA^;d-SShfn`dukKYf$?NnqjY3*}bGQtYcZSQr&bR?&9bj~B zXtZR#TbhF1l+Q$V_=7}hFrr{iURanPrJtLwv@}X$s>m$pwhBSW34_#FA`qoH>I#!L zf0YYkQBpd=PoW?kT}^KV<}XX6Fz3hcjYWWFy|CS=CtoM_v$a9!=WR#F*=a244_k>o zym9PdN{kAc>(C2+KJz(!PR2#18}^!8(hIcmmn|t36v1^_{Nb+^e)!3$9v&ZjYnlQ= z1@S$)IzovDKCW`22pHUJEB3JA9yZ*=hK1{msLv<^!{G+?u{I!X?*{&MwvKVPw~b-D zI|HdZ+XbGx8sKv8c-^SbTwy@NJ14ukUR-EdJH?ui4K(D23co@R)hc~mdh^apyBJMc zP`OA2@rZ(|jGH(_^^v46!e+DKi3JscY&D&Wt(*-Wp`4ZP(Aez^Odp}1A0GW7IRnw% zpZ}e_2hGj(0VsCGIV7-lvWFjFZMFAPW3CU^+g-^rFAQ=H5^#6y=JdEy>%y80E@5&%UqrNWBY@R?ec8$9|XT;s%LE`LlDA@I>^GKp484ug|( ziWHLbJ9?iuP6Fy-3Y-!K@HHd-@B;yr#n!S1;>>!iOu~~%vt#G7?(hyMstw~zQ%sk4 z#kK=|j^NB`Vyha^%oeUK(sOv6M|-7WuS{y@o2l1UGj8B6}I`N~s40yeWFjED_yu@zl)lnL#ir_X)c%9Pa1u(e|&wzH<0u-%~l;xHcknhIqd9HLhn;TubmP) zr%5i-57kRXaz9?)J;Ir`(I-vC;ktgDK%%xB`}+*i`wY_i4API1L0Tgu;|8r41a91f zUS)X4P5jHg*%aEF1&8b?O^cr0WxdJvKij<`t5nN{nq{t7&a0F63gkynASY%J88!0S z%40*JJys`+W3}?IFDN32M!B?si>uk{YUL(BM2!Ab&a4qjs(lTsV@4_jlG?yU;RD+T++|I|d zaAK0+8Rz7xcrjjp?h1C{^fF1l_jj>>7fwA=?{2xA$KRcvf_3)YY6vHh>FF!Jo1F@7 z=H?~a&dk5Sb~cQnkMZen5)DtM9?ZqXDQ%MMb@=jxI>LT|y?%Dk`j7u18(M?w5DvaG z4nTFFEJ8Qg%K*!~{{#v@1Xbgs!(=~&)sq!DJpQ0;!e_@2Y=ZaDLAKl%`N5Y=L!Yzd ziCzR-Ogid>Els!pUgo#`Qw*m&1|#$M6pk1k9)_HvV_MfWu{Y zuc(4@LV5>84=q&Y{17Ad5?HVtrek_?75b|M91s&a4_mDEAs<=uuw_hOSdTzyK3*PW zx*khh1`cT!Y+jC4U4H-^LzgUJqXGJIJqQJaEe|>P!)M;~pTdW;avA1ies4^o+vw$Z z65_e^%)?4lM-uQ#H(25%{&f4jxW}ITbQ%g9JN$oLVC;+}DNf!bi`nHjW% zdrn&5iU|@4yF#;bE$>3EN=2e#bPBrlFu+jy8E*ln{6O`g*bisW$5DJ@T+jYFS{c3v z&4k`!W_ZJBl|(KulG7y|+2fUeXLy(%3_g;magn46yAD7hn3ABa@~Dkb2oLZ*SRJL0 zPzn41vxu~V1>k@kPM}U~Abt@BInfWBdvM|=Vu z4q}cc-ylVAU;s-*F(zx=_Xf|)afbBKd7ggj%ZVuHswIj> z!c?zv$y6&?-KbJFU-yPrX3jMwZJ@UtR_BwdYOz+4$d;|bZ_rg*y$}c_T)~m7sGEev zEVo8SV;QW^& zA%VFG`{me!Qtwp-6#Kt={-yhq`b(0iU$C`N!Eh1NHAqpdS(-#8D{&EJs>dG`!&Y_3 z5`PNyMb2Sq^gqH%|EH4mftL|ZPRgmy-e*>*16CWik;1C@vY=k&+9K9rLv%$B$^yOZ z6H7h-Z?dlQx_>HJ)(?Wz8iITwdu+rCj!9I2>ek;ZqG08h5tuEQqjS7L-5T2wuf^nz zi&rv{HaW{PI{8IRnD_a!eA~2Kw5=l?5S4Ujq3I9CQ?J2lK6x>J9PQK(q!pEP^F>I%3f(Zls zA?2*-?vcH70N#sw_ZM($0A)CwZ7)IqW8v~JyMmp5i8|mB(tpGC(%u9IBsLN~wSm8> z%`!hc^0TLb)4DH-E$o{!KAPEGi{HtmJ(4^*nSwOjlBAO-8Me7s> zbP_#aIsOrHK>e+}^7AQNuwaUk$BM`T$Cf`nuE>YHTOA~=Dc*58iu2p8&NVwHD(4dz zXmOS(Hs8t_mMphdBlx(!wwW@QFZCX5E>)_8t2QZj^9m1oaiYG|H+j0dJDLD4to+tzp08b8f@_Te-I+EKwP75bXKTV|bUknTbjO-E7x<0s` zot`oim>hyA+E!AJ1-{c@bkUPlwmkXl^plA>mmdtd211&06Nn39^pqnWYK3tpl{&$- zg~X3%K?Ql?#BfJNHM~M2oTEP+9=-R>k!21(d~Q2mj{ouK}R{AY?&!DH&N-XzGC@(MrC52x?nXE|VgiH$g#Dfh{ z84_j|6{w2YMd#(QTv{=`fG0M$sH7%grRq)${F6+M+7qO5l7PreG2rsSVXNk3z&}Yp z@DNm>9K&|WI$9}O*E14CDMywd<5(WXnb_ME$g5fKwRH6pS{a7R`w(`hBeW+tvf^Xo z#refHgEeP(QhS3Lp0u&%3|DuIICJFZNk468(n}qv>Ji~tTA{`&k(4i4CDJ~q zS|!R>DfNm}yaow_h>`~I`V>d7sN=KyEJbqiV{rI~!j1!myA>SPu*@If{I4zqiba$JG>2lwKc(Lm z%Kun>;9_9MYeBX66A`$@yE{+a53I_&JNU|7G{NRAB_YIMf}9;cfq)<>%J#5F;V>IW z+B(I3s#IfmkbpDAdQU^rX{yVlx9&_$2AoBU5{;y)szSf0`o;lVFYp3hMEwDsQ_Q6M zK)2D*znhIg8jIU~XIs6#ZhMFmE+1aOf{M0Yb%%)7CR*b3LQ$l~1!IG75>$PvbEOI!_+||-62&5_rHZXEMCBFHT5Z!3LjjX#^qqDs96LvBT`aqX zs!q_nNnKe7)Yj5~vL^PxcG?$vV7n%;y+=rQfsksg7Fm?EaIx5)TDKZHRZyN3wl(0> zTJ>u#e$Nj^l|kh_jJhotH91E963svb1EU-Us6F_`K~(3P0a2aj4WeH1YgU{hqr?vO z9u>nJBL#SqqoZI&>|tI3%w%ay#_aG@aZIZXLqJVK zW3igexXCef4`3)QYP;Yy@hFNP4Ir%phN^of*B2Y3p{J*$_bNM?_HW3$cM{#>lQ@OR zDMamwEGPme>xNie z3#s7We>hg7v*m~o&{~bi@}`*687abZh#v_0Wu}h?AzK5dNI#Ql=FW@Zi1J_@<=7Vy z2Eco09*T@UJGDh>$(*(_-vP{_P;s7+j|DI1YojP?<$8t=P0hNZR$aAvfx3JRt@{aVeLbdKZwrbtkK()Sxn^=tt z+>TW1d!Mnr&)D{T#`dc9M^mjk+g7cwp(NN$x31%wRI7f?)$jS~*4umC`nFt@E?!<; zL`3JkSjEd%Q4oLQiga1Fp0gr7&*`&Lq`yPO_Wc+`O<=cCKOc|kX;Gn_hMqB|Q9w2B zB*H`pD;s?tvnXn4^Np_pGE=bjpXZ>6NgklQu6WBum8h~rW3C6`8 zjTckuV?`PVmRS$Ohlui&wRigGw?88dlkgTUu~Xv16->u7P?r<)S7`Lk`!tRgK+(I1 zI)Q;1D`-gX?*R3n9Uoz!Zl-@nXRs9=nuI=rUU15xAY%po`x-Q+(0}c2r)3ZW(iW0> zIa{t~@Xt65OVN#p)P~BZ%SE)pd3F~?%RJmc=`j-mOiF-B>zmL36N`Wuj+4%%Gat|v z7)=HMVc@g*GJUsHT?R3e=j4@6BtLYu1tLX=FPDY!|s_3YB_6j zXc$VvrVleax{q(>tU<7Ei%l;W#q;@T*c%Q)uh%y1LEkdnw%s=eU9W2fUZ*o~``vEW z9WvHNs|AZyLt|T^0KtC~HKhU5!HaRw!ZiS;MTp1t*qlb73juMM-NK_0Km;@BUk|@w zrZHwtbO0qP{;9ACa=*lBmPpseP|^{N#ypNktH1s2;SA$*UC)km5t=KQN(Ji`rJOp- zl>#$B4uDJ0y||Z>xR)zfIAF~fFUfp@i9N<}zF|z>!eZcia|~3N#P3<+X<$hxoqjUI zU*|YOi%}B37Q9IobUA!=rsnZUzJmNI^?UBjKw1;?GYAlg@YQ@H#~Ck`<5ta)QSJ`k z@Q5UyWb83|z9>Ge_OIl1#6h9`_A{&oG*W8L$+C3tRW0HeXXffJ;XOSelVJbK24JHm zFH@IGN^_-o`R}x3_x1y zH%14eAx(c~Evm`~fKzEu*rk`nqB z5gSm~VyA=png6~aq1`0UCb48iq)gCXA1xzJ%ee$L@zk{#_ELtSUWI_12Q&a5X6wAA z;P_uC-V4aAj9HQIC26rKh5(voIK22vmW`U{$qq>WjYo=@UQ8d2%0J^bn8r`+&|{9h z@OH2G%UbOgHp`l0W`H<;Q}1JV14po%`i-^>r(^M!LGOM8RtrZNRrv2%tU;KxNywXY z*p$8Zdo}YU3V^cwSx#Oly2!Hw=XgfU!&~5vI|*mE%e$jYkz?aGX9mb~=5b5(Je;j2 z6ZAGbrr%0ozf2`DuwSNcc>2aX)**!EQ*hi;c94QxS%BZtm}XN3c4RU#^CXp*v5*E? z!bg4ym$+kO@?f^4tegOwph3oE9K%edh>Y+c5h>8{VUb zx6ABY-w2SQ73I#ht*-%$G+wX1kB#=EwCV0+Yt!8gwCU=*SAG4M`>1ki= zwds3pdQ-LO?zXh)>uL!$Q>eQeD%5lJYc74yPodt~E7Z58P)BD8khE!ZK7w=4+h`KL zx}7e;L=G;5(=iD;{?h`i_r7uUx-4_=Sk{mbtJfm9UJpxM)5#t^dn#cOx&kHwT>Q1 ziW5Bb#X{F2;-kc)ePNxML8h>g__7!apvyQKpM)pIPm^c}yqt?3QSmXlLSZkU>z46x z7TwSIPB`~)5~HUOyj#U9Zvyt@-jEQ;Jj(Jt zB6b7o-V=k+BfNkQqYfGUv%nr4_@whcSC@^S;E0!&AhFXhoY(oAOJMn2K{_U}1_7Fa z{kAb)#^GdyeH;--qg-j)9_eiC;<&tzDNFaU`=gK!|4#_|hLRCYHzJ&P1-Z@Ef^Tk$Q<2>y zxyYQmnz_hWRRLe&s%jP!FXb)e`1*jT=;0H$Xz|Y-Gf9OPxKt#IiWnxZAmSd*8L|p^ z$sD9n12Ym$n<{eeQKytD^w4?8l?Oe)!i(qNLrQ;QsGn^MstR(0NCCx}*xGVJykVq> zfSKcp=mnr?oV(l5h=-hq=frP*3{3#SD7sPLs)^ zCvOe%Qd4J7ASJU7U2I1nn*ev);~!Rgt-;8`8b((|TDs2ekgc)74k40SXO}>jo%W+V zH!#R8KE1#w$3!&b_X)pjJCRSYwRRJc^h`5&$wFNd*{9(gln#ota^WAjrq<%6sHU@i zDXOWLuzW$`1szx_b!E9zp}X)(o7sJ6xx7QAvVL|GtN5IvI9x8mg}QXkSv0$g(OU8f zs%&W-WSGo!a@G2%k^;>oQc<yds6zxihVm@K#^FobRTY&j#ln%rZ1FBS@tmx!Oe_p*wCZ{-^z|Bf1sdF>YVZk zn|rV5nzD(v{XCZMoN8O2y|?n-Te-x@=MC3p{g^1T)aEJ&Aa^mS$cRnvHZ6gyfrK&0 z@AkPc)pkPiR`AtxPc}b!Xu3NzE`?}jv)cPnKMBjP&SP7CbvCg4Qp1AvZ8Z&w`~?C3*K`!3(Ir*{LI2=uF43cRAq$49jUn~ z560b|P=hS?idrLuo`0vRFIp)fIyN8sV1E{^mc(jm3ff|L%x0hA-+42z4}#BeK5_FJ zfu4m~tdZ|>C+yiZOws_w7dK2|#^=3gT4HrYp58_GV8jBwPXd~gGRZ;&fF|>>W(CkW9;|mxI?SvG-8p}xKJaKi z0pc|FCSYIzh^`z!`Q2g_8hqWmMMu!{i(hcC77>d z{6c}m%#$1DJ*%h#g#l^6duXQ42^qD;!|TP{@D?5;_+TOynk^SEF_wG5OCNet;34_y zZ_psegeo*0DDPd#&6~MgCxjiNNGU)FRI4ler%6IGcr_f)j)2C+G8zRQpn_sQqXmfA z$MlOg37Nk)9GN8I@B4bh3nb<=m}2!PQ=3?qfPD$5|KXcgEMRF`JcCTo!i-1GlN9&# zh|V@xms-Y^4IWf=Mn?gOJ1_AkyacW=umHSH$X3-QjHq64)`WMHXm%@%R@(0G z>3ql-TpWq>Ht9uiFbd^@z=m9c$ao0jK&Njy+XT}m85@KNks0Lc1KyG1Y{BPOWdFve zf)6_8xJ7^sAB)c3d_v1{5oE%y!sQtcF>oZkp|VCqjkBnjKY5u+dM=rE@@&kfkflm2 zMdJwsDhJ=KDsO+-dc@t{K5Z<>1n#q6-CsT3Hy_Pcy|n|c`|=(Cskz}(gnAb~_QF{2Yz2hWly4Fb>!(GuLPYV3M^RK>7V(~Yd%Fm4$u7!u zk5^CuOf~S9txE8y#7f{66HVC`Uid9R3#kRvDnCVXLa{Hsh8yhy2C0}kQaJs{OOj%z z`f~XBb8esi@&yljpFhh~fB8}X&@(cVyLkHLXL=)NjzQ>JK<}<_Q&e{&Pq#ImDLa&g zX8Zg(d&Yw|*YM>LaR*u^#KtFZ>{7^1_EF|RR zZ6Ujg;H~isa;Od90Gn9x2Fw!k8%K6!!F$fgZl2TU8c#cuWO+*G0E@yw?{@*a%q1Zj zVB?_kfnD5u9?`+W1i%4rD;kkt6(o!XZahIiHW`|_lYNP&NanjzOnyF)C=_=dAeuNN z zvfQm~X)#_19h$B#Mv0;KdQlvbNDa0dh#?%r;0`2+14V~vSKMG8;T!BWiU10+iSaIO zfU*ZY6);{$k}VmlP)|})gbPd%jy&|1EGid-@L_d3)GCdpcP{=Aoo{6=RDPnE9TIRH zd*+`m-{9A5d+1@-)#lh7BmbP7RIkESp{i@S`|wDc-@-Siyr$VthY+06uCoT9;h85i_(;eO}r_snjZV_A&J(n-MN zVK@OpknzZPh*kz@I)Dt6I~Y}5bMIh}G(Mqr8TlLWrimzH@^0gDL`_F9#1U^Cab0Ym z6{gB*IO2dhaTYCcxt~IhvM^0E+StPh4PGu_w+Ka_<>I&l5dI_J*;DV=+;bEu!2|(e zUTP!q7R>ArRDR|CdIe3N^%0^c#KkEh%>5R5A*a(Nh;Slr2t@NJ^rSamu)d@^PUwNO zLtEIRd%}An!m8O-nm8636w}2DQAv^l)hT3IBQ$ZW7}-Q} z8Ac!W%uI-nSumORbX6vSPgMTFu|TCvX5PVg^Y2hbYNWs|au?0zz;*XYaKF_gxI4h( z#goW}eEbl?QF|OMlH2S~k@sDCyncn)_sw_Gls1FL0r2^)X76`f*=gUJ-)-wT=cd@Z zCO-)ryZ6{Qc5ee5TdlyXk4*I*6UQ$6*dE7D`(lq{?{Vy=;@G{d;n5yq$Uvh=2g19LA`&BzY)i2mq--R=;dVhzTGXPIYR46@dLV;MsF; zIEMQL!Q4SZkN6BRbmj#SmyuIysF;|-4l@bS&oL~8z~@*6Q%p}zX%z~Jd%-D9SHOPF zW7B~JfYLZxEl8FJgzV7boM8CM+#A%RDNVS&2lt~Lz7f4X(e;o* ziuSPAwgw&7w7dO|=?;6YIT(%tGw^)JalPKKKX9)P40H{bW2IkSF?r2NciIgCz$hoy zWs$MT_HrR&yxH`+G|BY!0Xp`=A6RDK5B{o7P-}(E^TBqEoAo*jT{? zeV=*yS(bJp*0|7z;us@QiNCG4lw{`0J`+!8{=%JXit+ zsw+|??Rxfw=YaPDws4&BX#!G|dPh>Pc~+A88cHRrVh)h%a@>L?#w|#`+e#bWLDX1{ z4ADPF_v$jMIc(A-u+qhf9^=c~Ow0dRy*|N6-QI=^dP9han(`-D{Gl7)!F}qWq{=&< z{v7I9NOVGW)!zWMQfoHq>!JIPiCPtYY>!%{eX&Qa_NY};QLFy8P^;~!pEiT9`WwPmx%xF1 z!{-NI4fgQWR^h7)Iji43uevygWMO;GNLHTH=jvujK&*8$reB0$=Rg#{fYO{7q)!LX zEXm9cNLN0yF;8(`lu|rF)u1|JLjR&?3i^NJ{RDY;sJBicND-q>U$#)r<47?B-=Xy*=Y79(h1a9 zB;H{raqX6OoljiRU)iYsTTdXaa5&s@if>XIxMM2a)ZuRlS#IcAQs0t2Sr@W^4T&KA4=R3 zll~BL*V0zh{PSWW9m$Z%Ny}Rp5ta>L<}h$_59FNCi zDYLHVLJZuBS#&e6GO|_2ftmYACUg*v)~6(&CAO5Had0dpSQ5CphP~nGALhckb9pZ}8Y~=U@Z4bFd}2bMTmOXW_^8aA(>Vd$@BCcQzI79PAM8 ztfOY!4C5SZh;ioX*IWUgAI520dysRRAm^KCvGgX?@*MLLc%a<@-57cI4pi&kd^p*R zz&&T6Q^D%9LOO-SB$FumNFl(Oy3LGM6XK|cetO=LC^%`xyu`bX&J?CO#>X^m$X$e> zW}5PYX7^yzh*gE|MSUcwR1pcmx|eSdHbe_m8XYmZO}~rnkw)PE5jP}FT)sIm&Y>*2 zM4(GsL_dw#B@`XU#9>eR9P$1`KH;;#$b9@MB0v%)jFyRw2|9jwwJ{ zHRa{cZ+~VnTw@Hhx|(_5S`ogS!UN{cI9>!6{?m#Ea*@{^K|}>vTKzfPCmR z#piiRfTH0L(=vPjEkBYshpg_QFpT$BqLe{>CaDyaKzv75WUb<@2?Yw z?1guKaywq$t%f*{*cwE-A?cLUX$(u$=@f3%;o|hoY6x7ugh7cV68(N6?YF{6GAl~Fh)KB#6a0(#77~f>GY*IQ^&rZ@M=7i1HH-NH_e^nR1NsHeo zic67j6WxAgRS_K;$K&}Y7hx@L5r;SUV~qy7Vgucp4a{#SMr`);4tA6vC`l^!=(v;6OUL4vrODm88sAAEg8PV zS7F0mMjz1EGvFKJ;KGK2pA3e%DZM9E(M`#{4Re_mQ$WX#E z`#y9cUl92*f$p4X!+(sX>2J;we_Q^HwEvR1vrou(=%>g6&9+_EHs8tE?tFv+ zlrj2z035QQ$TX_*ePUdNTfY&4=u>LI0^lAEd|_L_&(H}#r-X`W%xOAbvENfK=k!S~wKLQ5 zYp2Z>s_rU(?l%2-UxmSVHQl@PKEn*UjrV)C2ZMdMTP1Fnt~q=6S8cR&@BZ2l_t#w} zu2pFb3RBh=suO4=F*x?Ju7LVUw``Ww_ABX*zK-f>`VEN*BQW(>t&+uJdueX+M= z*xNBQ)s7)IgV&EXyf&J$nGHjpgPKMR`3CAPfX~p3!QPuOY{`t_hXrV=4LGU8LGqlW z@ie?!OhmXeei|?TxEgZ(-Zvh4I3se;+K?g7>a#Lrpkj_GKk*`mi4>QM2Zn^*fX3+_!I6xkn_OWBSlAc$Qq4Q7qo^ncoju1)K6g9R!Op*i_~+QGz*)`x^%1 zA_QfElwbgamqdy{g^zh`0ei*aJ|eKEOe;Nh0X=e;91~Z6nM|;T2JMG5Y#fR{Ad9segHAY6rab4GZ9*E0$A^+fNF|%!PyetO(GDSVk!Ck8R=l& zyMhcP1aOb@q;Ys401qnO(sf#tmYf5mfC!socxMKGRa=q3@%9d z%HJwL*+iE{?0yo6HpN|S%R*?E?P*dW{*e2`I#}`oc2~5-5X#X>ho7w&-(f2QJU$(bJzAu>JxDpBk3!0$T@-xMq9bRw~)23aW32 z$z~tzLlSQUaM_OzaM_yxTxyla8VYOsQ30;Puk8V@v@iAm*B;<%EWl-N3*cHy0kll_STF)B8%Cq`h!wv)8@B>zTz-tIL zg~pZeGs)b@w*fE7uGj8%3^FB*H!o0icn3o;!C^q~h&cMqF@mZLMYe!0WSkv!|AtBL|u1p=x zyBo_Jmov$i?IrEa*9(?-5S_C|qa#5>%@QzDFSU+kJDud8E_>RuEVrHh)4e_*u5CP* zA$h?*lyfCy&tKq?fP*#T(NUJJvoo;?03+yQooWdgno4m?((`BkfW!^6y7(+)N;~|x zAP-}a(wouF$i0AJ01~C{F(tOsL08mdXi3`7ti9B8Ghe9%)|tpYg^I3NI>)p|hG$xs ztNhE^JUtZyg{FgWycNKV5?=z8Q6wsb%1CDvKxCBfM}Wr)P_LYiv7Qj6xY#5dEt%gZ z7i4jzpigS97rYW1s@GRAAR_p4g4+hj{_OVZ0ie<;aJ_&gfQC%DA$^={ktRf?sZdi% z$)-ugZYGZyFr_H#WdpkAgE?bK=`$I)>jYCx;``$Y)@w-x{9Qtf=#wpZlCr0yYPO>0v=E?1?PWOW zK;o(ZG$jvYr%^HGZ8F}EobFZ^3A8V?fWU%cdm!-fqXs`+H`F~^wnxhv7XtXnq&g*= z&K_JuRY<8eB+p-tfGG0R!06fY|Z34mipp z_pAZOJgd(-&nXRIN)+-5U`V{hgxrh(6@sRlmJBcq2^{*v6VPmbf_XE>C@02vIt>HN z5;l3j7<{t`Hxw8RP^AQ{=7~X~$FR(!ESV_9`AAk%=FKOB{G*=S@oJcGK*FdHx4dxn zX}pL?UPzrZp=8>eQe$c}$>(`GTFnCJ^4StV#?zQdmdSMSm`pTDMjDv(iVCmO*{Fqq z!Wv_+MFyElmlk-x~uNfLoA- zJ)DkN|Hz*fM-{%2VEsiOB?!jfA*gpEJFcCb8GlDUb&|Ft;uvY(Lli0o>=z_{EJz?( zFWn^07&bp7u~kDN^qqu*&_^X`h){<@Afk|G7%olM$O}oI&%CS7;V8AT&*X^f_fHs~ zEL^;U4MVvXKri0j;(Ito-9;1J6fC7~hoHISa=6drxN#;&zGwePla%9GYMVYxR@STQ)uJuzQA3FOD^N#FnURe8T4y8z2vnxxSP;-N z!N{&cYo^umn>b+8sN&a`dk4n zFO7i+%Rd!+RBm$z2M#qYfcB&K7_p`NsT$CwcXxo8q}AxGq3#j}y*|>+cS+JkK)^5* zF-#jTOT~~*DXO zXY~Oxp|?y*$tfm%M1feRxkWgS7R%V2MsWR%P$7(8@Wc7i#8}QIfDT(~cER~h8a9a+ zjOj-pFxRt^ezP!#9CvyvD`;au?o?M+(7}Sgz`&gY7zD#sTDXmcSF?|^=w7V?&PK$} z30HxLtL1wuh~tv0qcINW_sGC21jQa`hKuwqohAqc(v)l2q=Z8+#;q`(R6&c&9&t2v#=)k#Lp!zBOD&mFT!T(5lKM(*RWlzRQ zc(X{D2?ePuD}B_mEd_VkQalJ|$5J~GlcHI-yW}_bP-ZA|nkN*-I9e=13ddXqa&yuv z)@0SJ6Kj{0Wd3yO7`C!Ir~v;m2^SIJ*H=tVX%|9iDq?9QTspfmUGaNiJw;z!x%+G26aGaK;0WqbL6=5=I_0_hc!fwwO^ylbaU1l|hOBYc~U96~5raaAQTK>oC zgB!CTp!%NZ*&7|~Bf>U5)v6k_gt-*MW{h{Zts7gkirx+Oh8W*$FxhXxJr-uht}Ge$ z<^o&wjddU0T)^GLTtKZ=UIYGfAJtr-@N0W>fwV97<^p?jfySB(xLeCCxjjAlhV}#Q zruGB52I{Ve&(MCLv$r4ElKp@XpeP8!;CuwC1LC3sSNRxTeCxIZvZOt0TY@~R&&rm7 zIIPknj3i@Yl6(;(CU^*{GZp<6LgIjDCOS{UPbLYJ!6Jb1(5!K24}dT*3$Y7Ie?BK|hjPWiFDsK3lxV_RS!9aUV$(jIxGn}@WK*3Yg9|E%mQx(!&me6~k z?nG5JR+h-Yq?Ukii|s(8|37>0!qhmDtbzU&4ZG(y%&`sT**&{V3=Q2q>`o8dhCX{E zh6zI0GHBaKgk?iBv%SClewkHLRY@g3kTJ#-u{#Y?y({aX{JzXgI3c6tvS1`F4z7s7 z$>pnYrfy?HN)PNX>cqWkSxDp^?V%!1ZC&068qtK?aX~II2Iwb-_S5@)Z+mC+4Qho7 z3mG>Xo79NONeOLqy&K=G-mceU>g9U91?)fS*Qv=#ooBS(>Be`|@b{>qGwAUg=31Va z?|J}mD9&dR1m2W65kZmEohJ*@<*XDC7Yy)oXFLC_k0yj}c zI>@DS7K&4U3s8nA3G~il25k+hSS(#55@fd=Wtl5aJzi0&qlAFv;%$oL5|zub38rlZ zE!Rx8WGv>weIsuk0LqoD&Ar7i+AIpHh4O;J_Q?Fwm1$WC)XCB^K5Dkul`XX`MNVqA zErkRB^fBy>!$iL*Stcbk5~P;gKaFq7{kZ)gj3AC08g1Irhx8h#rJA3P2#GjsH}Wfl zk__vOHN7sTNKY{2x!>(B|8%yr{M%anjbHEV)!+aA=j(5E{m;!w{%o#)TLG9p=J-j7 zRSsgV57OuhSqUjU>S1Gkm|6Q|R_)f*m|SC58Q$K*8|A8bRC~iT?NIakk*TPGD$z>j zqF~t@<1DcrCOC|SA0^~2BayeA8{1W~7{u8fD#H(zc{>pP8Qg0$E!%#R&GxyOc7FEI z!>H9A(2ei&4LSF3d)n|7J0ugSG|%}kP?Phl&jZzsXLBUjnmiAu0<(LIcj;Q;Qmngm z!C9fMcsZvv{1Uy*ziFChO`8AjDgz}*DaKk7Rb*}0O`tYHENWx)lH(2JF0rao>yk05 zElW|nQP#>gN?R{8Nh#@N_I^kZ^{hX3vfPN#8E>NrN+XMs~ov% zZpl?!(;`<@1`8`vsB&*=(vQMF zSPYnM_0ri@rqC@kyQYZ|B37Vhd zPl1RQ`L`4ig85l#1P7sk@-h_^jYT9z1slYG73egIK?lm!B)}5D0DWbqS=ST(d`PNl zgKMOI=cAnZ0Q%ui9CT! z=E>@i5WoyzrSwm4{cP!XGD5cC#U}iF#a8=-|N7)pqz|1x%XoQjj41RPLLn#`q%l6! zcw`TAUOzgKnI;e5*jq@(XcDw3$6qF8M@>SGVpINm3%qAwl+~bOtte~b%0Wpn+lOsS z`>-fdk>thv&`1x3a=s&8LqY2G`5PGxz$$m+q8?+FGb!#-0%$ngV{UErpDpe&sXe~$h+G8%bm^8&-jO`$RnGbW}Ws>?uy1ZM$;tL2~t2Q65k z1u32*poO^G&O-|hD8NAzw8O!*{o~m=^&NUxr`xIn3LH?dAOUZk)7+sG=zxOk$2rfP zE>N&DbD&_S3Q%DGYJ7m=Z)c`JL1}FcDA4viXl=TM>EoxmmT|ZNAm1M2Uf(XRr0I|+ zR3@nDl&b;Ib3p^FlEbH2(R5_VkwQ`I87&FSig7}!4%1bh7pQgwJ&%FBRmp}U>sR;ZFRm$(06V-N3B~DpjU)SG|AHgvxPa-=e7VM%9%GPG%+|qSTVx<)*Oexek1^kAI~;g@Wyy z8f0*gXX<6pZd9pkecZ|}x^e3ZRaV-)QPqXEuCY62QBF9bM`M(~KB9cB6JsJ-!jYV2 zAT!cB=4Bd?T&!Oh8-QFe*5;P3xN+g1qTj``bvn7%zlAn#N@uZj2EN-Z8%l?^iTIfg zZF6QheP@wC!~jw9T$ud4Tr(^-R&W(%Kx_rtNtS zZF6YbyrONdXOFf`t`V#V#=Wiz#uW;fbc9PaiKa5u5?rJF2=yE)v=xx?d2((!5Y=TTO1??y9F zWN>NmxfV0w`2)q24tl4!04xp3a(abYt^ivj&ziL%&K;g}hv(ekIV(4tHG@4SlXHhR zbj*qmot4{kakn=!$KBpk!QJfYln3b1-^>(uE3M7pZfYzX?&ff}xy9YyJRR;fhAOZk z;P$2};8rML(!Fu<0Jrru2e{1?a66Jvfir(AU28d+Tx8(Q(pCG4cfi{$fVXsU&cFTJ zsFpq-ATI5R)dH^gvZ@JOCNVRyfg4uaV;I4e)i*UOxFHodGq`y%gG*PAUM)Al?E!#NmkUSYWA6T)zhZW~wZ-K6+ip@2y@ z#|6aS)*b#fCH(CmOxWf`MzTH$FQYI@_BgD~M?bpPwe#ocO7y!lD@p$TaToTlyuO?( zPl~BW8-(F2dkKe8lul{>?z8mQgm)MtZYMu!Ttg%-gKLOe!~bK@3pjeGc$ciMuQlHY z`C4rUH{JN2(xsI&{+-0pUve0k6y5(De>Is>x6nXav8xLOv>m1))f2DdhiH`N_c?A) z;`L(>LrSn2{o0nxgUy++K7eiU((tYa-F|ojq2D7>G;FRKXVF2>@sYsmr!Jou>nbKq zt3?H7y@230P|l~I1BGY=G5NtuS3^5)CAko`yc||Z>vJ2_+kB+Oz5CT(K;dqa`gIJY zYfMHXcq9v~Q)P85^?K0j#l3nf#t@xFTWf1uJ6>HFmdQR-W72UTcreIbP)w|g0I*;- zOc(b+_B_9R9Y$e-uM|`}7NWN|=I~cGo9hPptn7Lle>;olneVsX526;HEcdB2YS<6L z(q`q)vxuLmH!Dh64KxEY&E{CUyTBTF1V!jCJ;8wzK!Hh2bA&~8$>91L>-vwtJL&tq z{%J_?hlg~_^y`NpqBA{cL(BgzYNv1guZ6c79K6qs*!9}nnq`RYfu`)Qokdz&+@ZL@ zFTr^d6w`X5h!yIa^gGOZiuXzFl@-nL_ z@zGvvz^k8L)z(&iTl*a?{e1lE$)M8-zmA)+$r;b0Z%UZNL5c#TU@f05iANk`ZfQlO z{FQt?_l=Z$dk5kv=7bkDRZH0qwd_Fn3EfXRgFpVb-|hDXfvUHr3O=*@q~itgo~%}| z8}Q0FZjOgQlq7Qq#Ow`$ltfvAn3w6lIcFzc(`Saoz|+(LuaRTN^Wm6v)NCr=k#y+Nsx{8nIjwPRgew)$Ls?%mFqJ_HcD%A z$c7pVhio`xV{Va+^=Tm+4^fX)#4XmV;ueJhCf)iL5VzQHxW)8v3+QDoj{PLr$7kag zxk6q#L}3cpLPHeAt}ZG>(H62kAei6=0*@-&UW=rjT)Jh*MW+{Ev!^o4eOhUXfGUuJ znYDUeH;%s~!Wt+VBm=+Oz4xv#TV6D{zJPu@?xgrgR&Q1vM4PJTS~D~x9RpFQ&qhY+ z>GV{1#s)@rPbu1k&o*e)TRvLH1IDey5a(f-80zfkUZ|GE)&bQ!l)rJ0Sp%F6gNvS~ z!_yE|ZlTJ<=+^IsYUFAjCKQcrLt}kI8p3?0Z7mauj0WAV8uq$(oc`L5(V8gkqZ|kZ zwKTzKke5Gnf{eGAS5IX&*Yz^#F)c5>y*2tHOe>9Okz9uf%C{vR3&}aqg!Q;wSkdaD zm`(-VNzM&?XH9C_yXRAdeX^T|vNAal66mqqV&fxJW_8tjNAl>gJPPlAcjRRdvItS5 z^@lO>fbu{Nf$X50`LgXmHr?Zmf{z=3y241(%d_}0Y@iDsTb9tEfcAu z%ai*Af>ZO}_ToEQb-8pG;;~kiXyiUdT?cW*(*|!5^e*d--cmEI-)@KEMrmnr+L;s1 zg51bUdX=n@TyGn^3-#`gdY^(zJVyOzORF>^r8y`lP%uWi79?(EWtuo(S_8vwyAlF4 zd#t6>u|G3Wt+}>FSYf8-(~~OPk5efeFb6$m&ymK27Ry0LS)>JkRXGYTYg^n{C1_bv z`KY!|g|e(>uZ~W{Q*q3uO&^YU3YZfcge0Hgw7jIz4_g{QUHA5J+?3R z{tBYouop*kl~ntI-i#lO4Ux=ljd>+FRofaZvaPR)^qD?U`um}?l%*;_!?qd9QWst# zgPNTznS7K^P4@igWM!^UVuuksXORvge&HDLKCb`tdG{zVakIJRU}782$p4l?jJ4{} zXLck^0Dh`GQvp96Og!#LS(aS>Q7%n>aL3VtjjfS}KFO!Oa7>j}bGS+?Q=>g4OuR93 zn0TWKOl(&uJ^=RFm?=zLTAPE3)mS)~*ulhe3lncl3nreH?zJLxyipZ8E)+27cDR7h z@uq{0rvx3p`$`rCVgKX%y@MdSf9a61DOd{)85g^{P>?a36a`Ycf#l-bl;C5?xpy;2 zu4>r$+iXgM!+?>fZhVQefFfB5I1zgdhwdUpsWL)(l_(hU+P^1lG-MQwBcyOVP%vF` z+!k7NQ$hNMf_GjKz4OYfwg84T*PGgF32~A2)!CA4Gtl9`3COn{w7Ovw$Uz$5zt91Q zi3HFF^?V_FTV_ALiX*lFL<0!RMj7vW{-BL)nvz;HOZ-!!yEd?znd-06qHllm#AKyz#aXe!*xNF#J!&bzuUi}(WBl7J;{04VVpamlJltqmMLLO3Cu}8{m>av_j>@34DIHy;>eIT$RE-&f5#Ky4g ztXaRaSJ_^rm*fioM8gPb8;4eMCvm%?`jAIaSWi%>fwW zt?GHSbE^RL@Ya|5VVsK;vTBfHSxX+({ndNYO?sX>^r~Ph-%=o&%G1+#u zl+Obs+nhN_wpj%vv#U@Zp!D9HDM(gYn*+(zSU8Z(fn;+Fl5I{4Bpa%WtcZMVRz<&dwbAzvaY)B8bJ5)VK0e9US4G{&v*r2}E6oGmmER_y9R0b#iiX3ENu z0Gkek|J-NkKlkxJfH5c>SQd-(ML_7-rC1hZgXKrw(H<}!-4UHw3VY;(&)biqgk+Y? zDp9Lel-xK8MkDP!mDTNf=^6x-7IrV-p_)Vs{oZ{x-g3W5c;67PuX6k0$ zPvkyU^(CH(bXwa!W*eiP++u(zMUkgpW!E$1gM0~uvN%d2&-HB`(noMvE}w3*M{5I( zl?Y@mp&lDb%k;4j_{);D7#++jiwtHd5Ar)vh%h;J_@|FXHo}Bgw|r`eYo@=}0o1I9 zD7gDSzdInC(IGL-rq}X4v96A@^_y5)t-XEPMvKWlY&YcMFwkaO%OPTi?eW_z<#sP` zyr~HxZv+G=?Oo>PFzj@e3ppEK0=YCPPn|On{9H_UORbT(G`9ywUJ@8%&*#VYYVt_E z_yhhFjnW?CS{EBAWXmsA->@Ka(T=) zTg15RWie8m%C}Nzhe|q0ODr+$s)n#zG2wQwUI3uy_!j!E$Ci$Vc&Kj)HGR5kxuH(~ zR*k6Tq_L(?X00F<+Th83S7;fF#hxww1Ste>!{mF6NZ$N?d~U#L^XIYL#+IdXeq(3P z4#+Mm&&_V`An4%!8N9po`6FeTR&!fh&T1~3WoI?FFwRxYqvz33K`SIQNc!=$ycXHN z+>t6f^s?5fC)RE*rKfN9@rI20i98~k+`IUfVnQ1_yyTPmMRw!}ny(&arL;pLvAR*b zk9*gCKO^Y=`Dgyz{q`;U2Df~$;%n~DKlSc?`&QCH*~&~6qAGR@k!PR~IgCV&EgxSC zQ;-tjnky|R-2uLRtFC&%?a;Dt@{gSLY$amA*35|kTUCewc9rr2fWEDn5(7$WbHo5O z7LFL;hyim;4A`0$G2lU9K}EvAR#n14p@2#Ez6B%7t1OoTm%c^5r=Y0}pvFlLm1!&&-x?!?`0e8;o^ zG%NVp>JEq<&>jTr=6E2;1cZ}Caa5<4Q1c;=s5trI3A{D0dG)keIE>RVBWJc-c$50q zC41$NY{Gg2j+`m`<0~s=bRp>Lo{RD1QbbFneF)>$yB7|UH>pb2j&MV~xP{f!Q-!|z zXAsoLOR$inA%0j&{H&XEW7CUR*^%!x+G1-R+@~5KQZrQ*K4*@ zpU5D_yoJ2r*-rW_a|L=X8@KCimAs-|{sg_n_a7OeuCEo+6}-8w%Oqj);WL&H+1&oN zR)6Ey|M>mS*Wc>d@0(-%-dz87wltm}XHN2m7)}}DnBBKxBC&$PKctno)zh;9{gJy= z|1w@qM{b2ZxazY7D7<^Ga_7CEGPgrZ&bG_46H@f^&CE4?M9Z>?E@>LCcexiB>t2|| zv(OUHbGW&HCPepyF{v~Aj(i3WH<_3^&0XpQmw?bjo>4iWpNj1h;KXPSg z=I1C&xa$%2E4F8_4lq|ZHWFIM!B;6hHIHnjYhnfPjFG2&0KNS@URy9|&&Hg3Kd%G+ z-G~vVUw78lHaFF;8x`hZO0)1ct{<0!uyaqFBl?8xHBtvoss~MIK}bZAwq?2hd47jX z)|sk@ky6tX#V4|aUCXrThVP!Td>4!q+sZnNR*1G@5si}RHvew2=ln$Q63jOSgTTM@ z?{hgV^4Ltr?H6n;gBuV3%jQ6vLcSM}_R!k__3u8Bo2i^0nRikF*7mYA9YkgLq~{!s zOApt?g6Iy;=~vVBbM8r&$`}Kg&UhvUT=~dUhq;rEb4*X-?=URLB3svPnfd60{gVacSi&kpgvH*f}sg> zu?@7wkimiGPd*zeN>_XJA3!49+?vO~Q;SxFGZVGNm|K_hy-#v#Zobmze>N*BnRt{B zGZ2`G9ukf~Ql%Vpo{)AV#|U4-#{k8DTVvN1~Q*dO<6^3CCN?L}3bzc=V*)1|39N7^|UNq_t$zO$zp z+(4_w9E5{`&|wUxRI2pvMym;=nEaAtssY_1*0=9(6pE9@oY9`LA_x4Kr}UoV~6WlGyZ zGrNjiT_|Q3vwH5rZr5YGC_&co@jrIkLec3#@Qv>X(UXA=$a@O-P+k<=d97?kNGC8F z|Ce3-OQ#;$5|TPz0eFj$3LcMG41M^mK*RqT+^d!5ftwV!*tmy`e>$j`bhZ=?oD?oz zd;wSm7@FojCdyjM%P=8rYm0n-qNeZ`XWb54&A(5(00f^lK$i9-K#L$7>hLfkLVOZD8>U`KB8cu2 zMX#;ZDW$c2jhJQ{qv@Ox2)6qu?*d;ytC$*-FB3=gQO@ zUrS5Mend&8E0$aVVY@V+jBHYtle%Nc`z5%4N4rwdOOVA$&`{4cs-#IB)?n+_@O#S; zIT9Z=VC71WqgRw0*?WI4LI!nd4y@%nK^d9 zQw6)X>vkW2#qG=#yDzQHVfSh*9Cq)p`?*4{?+TEh^*fsD!XxkH(Ks{Jx)jNxZNTqr`+Ti zE7eQVrOGJiO-#m&zSj$rFI3hg)}2NkP%&fh{mcGm$kJpi=va)Oq#h({>?UesWq5dX z)jN9ok9Yg0RAb!nu!E%)8>D~>a%gZHUb2!xk^O`@iweC$O^l?Yogf+z@I#Fz&jFar z0L!DF7Ehzg2{{3oMkiMwj+l)QlnJcV7^(O9qo0!rhQ!eY$%|-s;J2=X85`$3JRra% zwKV?iZ0Q%Ofp^z^cAzXO`E>O8SQ~&QhkqE7U>y({*}IKI)yc`kE1U`#hU*KOKZp*s z3tz_kSWslLrxxsopcoN;gbghR-M(h=+6B4aPP-PND{J~HXAp;3Be?Y#r)`h1Nky;OT0fGQ-hxbfv_&K7z`UX{|$n|-%n`Z*|GAHN6Bby;`0wP|<9>utIh zWnC@wRM0!d?yKHetq68slWuYPq8ti6mTo2!;*i73nHZE@9}|=;N#{UG8U+{QWDHwa zA-^&{XNjkONL+$j0k@b%3zn|S{8zBXyXJ3F_7Xg8d zGKSIe0YELFV)zv~uryXb#ob^<3vkFd;itfFd$gRqWj$g!e?YP=BfV=-suf{;Ik-qz zQ`(1?n%;Azm<{6CFsdoRPy*?$g6@swUW6DT`V_LmtjWxorr(vB; z7SUrEu6S$ z-CdW>L0n=rF{tJg0+P$(c#-@gQ=h2Hj=kDI_CA!?SQ*1$o*(M8CEw?aJgI7UEB$#N+pKMi8=dj2HoUFV zvz&dH(d>hu=`sCJmn74H>5m|W4z8WOth1Lb0f2Sbd8)ATo7WB=7K7mc&jkWJjdRLD zozDa6d^2;X^Gy|~)2{7$0Ce$Yrch^TZ4T;GW8t7q2X)RZ)cIywQ0GH+v=tG}H&qeM zLIIO*e~X7`Zmc;(b83htWS-2<*b^$2!1>X}_SPQ9_dbo|?w7Ft!ZFR9uq`sCY3b?< z@YO8Ls3epqEHcIZMzP+dYvt~JeGq+#$Q)1D`Dt2Oxd75o!@{Mo4tFxdc)_NC-p2#X zp+{@X6N}7~tIS(Y<^B@I4K7&BuiHt`5?*^RdSuYI8Y5@j=bZJv$hp!uBdcmab{(IP zHLYr_6O2$63b|OhEW&Gn*>i~w#Fzq7NqQFpip&bJ02@felqM-bQ<4T60`(-T*Tt`d zmC9eq0#Br9_}y+Tg;A5BPs&H}=8k}j8d4ai$onL@qEd39rMh&!(Q1Wl$L% zCxh3_AX-N7Y_?@UM?z~TlJW)Bi07N>i!6*Ko^Hu!wA9YUQacwxsmZ;qu?+r`t%Cn# zi{L-z8u(A?68O)1mgo%IYwXF?ya4{A&#blLPqWD? ziM8G0wWaY|(bNO+r)qotZ&6j5^>98aI)xB7=2b&dk@J!OxzsreV_JY*G&^jaVlW|F z!n9+SWtYKqGvyQ%ZAgunu@A=SP|Q9%rJvjZ_t>0+92l-w$rhc<)TJJ7Ddaz3Io)K_ zG}1wHE!%yI&YM?$1IZ)Z4}1PyL!7I$5afl2w?#hA#eeH3q=$`y?kcX9sC@MVz+5-@ zpY^o^v|;sq5VR9bCCCST@faPa-4<)fW4v;y5!AZW;hGXg_ZPd9uX)O$YN?=j3?5Z#8on29*w8ImZ) zm4XJ3;8SQRi}SgH{JMCe0pmSIfgm2Gt_JTv&nDv zIa+KRQxVYeC%@c9|J;Q#zoR`HdsDV*&{#DEcNkyf0(*&1J}>OZ>zi@C!$F_2+i1a~ zPr|3hZRo2=A9cPmiQn4;+{VIg2(TCnUtK)-I3;3StL4+c(KSNbmb5|3_#oOIFDVRi zsjJ~JqJhVq<$m0a??6M)1`z0Q;WVpxulQf#YC#)5tM%T@x8?NXuN2_@rXqFaT^Fy_5NWw6{Vh*)W1P|g<*r~+Ce^Wol z^hG$~sb=k7?x-8uTjM0GLLw}5b4(hcHQ!?q2{%VG30>R``Y?4o!V<=x3hOu2%gq7Q zomf`yZuy&Rs*J-eyMF=kZfni45yfCQHsS)Y5zRC4$-UJ)qo^I`UBeMMp9PVVF!R|G zIX4VK)r3UO5{Q3tVpe%Uk3r-tugwuT)mS(prz3LCE0MFXf*(xeoEpEN8nd(5p$VCt z#R4YX4;PTx*>ud#M`Ly#1E|KYFP+b6ir7N)Ig4GjFJQ;#d?=suJwT6l_W+s1+R6x( zHZ~`*H-h_MRi+)Ex0x@TI13v8GVXLJWWc%bUZe3bCDT$PRn7~M(orHyt}Jq@pMVCr zNE|#H`o>OHkWa1_N7i#>y^&#ZDUi~s*%|omF>k+ z*_=~6Htlg_Hb-XT9~Vn3zg=Y8hKnWkyvb}9f@%IyE=`{QHV(8jHqZ;)%O@M#1)^j% zXHLm#R-t6sQMw0EESfW=WR=$DC|PPO93{(9vgVeO)to&g%YtuKq+vCy(y$5zOu7dy zAPsBX(XggP!+O8>DIkqd(7w1QmH$hpUzwt{(DbWfR~L$Yb(nr!0gGs1Bz@qhiPUdP zuX+R|^rZL`3X9c18q({Vej2VTLtV+!T$@e~CO!E;Y1#P*{X)uiE()?rxkHZG1)>qv zLDRu7#*LpO=qiBQj&P^LEs(J-rI|FIF@nsrkv_Eb^tc=2Nkk9G-;PKRTGXeYeQ}!8guh6%JEtq{DXQ2D0S86R3CUtMBu>w|msB#1nHwBHoF)vu}ed|2B+!YS$r_8O!X~ zK58`F%=taEQ4BSf8c1qmhC{dhKLQVZ>h&dM3_OWtLk|zF`n#xodMMudUvqEM**5wlBk4eg zzqfaAia8e`Uly`J8!Nk#zgXg!T7G-RRLyUV-jrgg`oa-U^fCH{&IUk7+qP}nwrx(%KQs4rSM@!$vEH>G`u!F=Z``Gx2Q5Su z7wV1v?ZgWlB<#R~kKuouKnzURKgSx~N5X7{DFfH{r4JT2wu-5*Ay1qmJ_h&>qLt|P zObiCP**(y=cK7nzp=|4cv8m|J7UxDX6vyc?VUg5lx*A9?J4jPT`Ui}bDkO*ehb}y( z2ot7TT3WUTwrVLpLIu4E+UP=>i~e!cUy!|EIf%F48GGAaoA=}isa3=g4wxqP)uwl} zz-g9wB}t|}4@gzWNO&w(et@-G>T~Aj7Q@WT#u8~!Gs2&>zSKUYffWz$O|BqQmBprD zT^D+MwIgPy%C}--;LXx7e5jATh{|r5o%7lrFtijcYSh>vx1S%u4A9?DJY%>e=Vp_) zu#x|?RR>-aPo&%*`DC9w0e2DD{)#GeGJG5cSCY-(jR`LOT``1~ql05Cs^gcR%P0fI ztZtgxO{=Uk{2eeUYv=U4^N?S~r*tvtyvHdZeIGJr$wFT-g!Cqd;co@S zBz#(8Sn9Rqq`A#N*~Ypy%~!#;pSnIq(yOMJF>JP)v5lyS7uO(R;A)agaDM?fFqq?J z?DXD;VV@do&A;!*7EY-IVDQc-8;);2J4f=a8Kqe0b<0C^uC`|6=A)+yIp zxUmT&u#X9gn1e&)<8Yu0tl4@ws6B5Fgu(mw)>YTk4?IQxabDg*aUB(dnAXKvUfyB- zS#j(|VXov$7lJph+0XND`4AK?$L?hk#MK?5U;XwAO&)#3suS2uzKa+5(Y?PDg@A`w zxGE{1U2lQ(9(`vS+N5(haS{iizTAbb7RIlcoCrR&|Mk}$_*DrFSySzCBfQBZP)Dpr z6KlH&lf`nLbRe`#<_+U+{j(hn5`l%j?uapQgkp}nN|YhhKww77&lHQJAVpXsEAS+t z836von|Hs0K6}gEfIiu%@mes?fc`^Cs~?u}d`;Qi;8%CL%KZ-|p1+Ul&Oci$QveJX zpZ!&Myd5Njd9_zeV$=ddPs$hYm02|)j_Ji_$c(BZ>MYmZM^|WQ0CGZ`rhLq9zBl93FhH0Gb@5PO*u3vo}3<7u~f zI2$2y1+lg+(!Xx99!}d@w6vZ^oRS^LQ`l()l048u>qZWsbI3s(L`y6QH2AUeT|5K1 zMBiMpe0NXNmpq{@^zA{l()g@lyADVXgYGMLpzDH6S{{NIlBl6Y<;^?v85Pr^*W3v; zeEksXTBvvft)7^T?q|k&Cv)Oc8}r-c!pX#OF{SK=@Y4Nbp(JVNagwAbs*RAA4$gI0 zmmgcpezsA?bYlasM=qhEU}?KZP1r6*Oj5N~@2*0v0hN3{;w1H_Q0#wc65B7ROS;M` zeBgLht0DM6k!bQ6HD~+HDv%#Sh?|wsOzXKGg#qHaMeFw7kKbq<%MM6L8+eObfGjtD zU{w~GdzwdQVmfpdR+q$SbcuC_#{*e#rS(0ccem>p=7Ghdv3I%rJ`NE6jd;R;h#GlQ zG3uh#=1a1+q=bs`stksk=jTopL$TG#k(CBwVsE};O*yifz_QvX`D0$amx1?!V=@L~ zN?JPF6<|PtvvRcB+w2WTnfFH_T^Ldt#9}JbkN!77@P-QIx8Z`&sYdoMLC--NomSd|gZ5K29=ZVtGDHKTR za-E_Qnzhk>k$noLX9z&85+-pwRnn8!y*XLLW+)ox38V(Yxm0cSC_lfZ}ZC@r`NJHHtrPKJwjTEsD+E;-$d2y!p950#>5;_Xp87P8wLQY_bL zAILCqsgnk*#4x(Ronry< z@(f$=sM5gpf%RrJNjfowri;;HasmPY@|kOMVIz+UGd^%@f@^Ta8)v}e~T z9h8nE+Hk*a3Zw7jazxheih;nNS>kQ z-;y(yQ%%ewXAaks4Sy#%uz`(GdJC*w`v;{PS&K4unOaEnjj34R?mhxpN#X}ShXaA- ztz{DNe!PNX$gwk%cC)QIH%gBU3MlODuUX2;t(1;=hBEruIu>tX#IBWwqQrKF6p?=T z=VNN}^ieBu;*wY@_f3p34xn-#mod=>pKFXNcEn`AwQp*;-%HI)@8(=kHA{YUnoTcy zJ+NHwRk?ds9&Tnj_?^~z;yIhe@@Ew22~&aE6C5=YBKM?3R~bT^;*&GLC976L;}QWi zjSV@V$tO6-jrFtypRrH=dg-VEuYn%4#eu=r8EpyA1<~%&_s`Q zDu7ZU<@g?cDyjnYvYNvB*{T5cUSZ6E188J0g7*GCFM!tH=jF!<;AI1NJ5>g_tEe!g zIylH$VX*%n$_I-EkF?{E`kF{*@3$o?f4u*UM^c;KbF0hoZvERB6zu#?q;cM}g6T{L zmC(Hq7_cb!z}ckx(*edzGSi+skX6tPWWFsS61EM4Hf+89U2d)^mNOMe)j3LuZtRD( zfFcQW7m1hPCjm;;OF!`!3yJSH*s4l%g@$vaST$^HR&a%?C@t1uJO+Cjy-ooEq=}*$ z#45KYZ)n5)Sz@4vyey8G^^Xo~HB*@pn(+jPC(uXP-~=7WsW4dMdU)N?`}{uK&VZC^2ic_ZXfN#nDir8>ih2%<^pOCmI4OY&`@@QR$b3LhP;s72kiBV(Xe!% z&>Q_czlm-~%Uv3WPgREGKt^{P%kj^VRa7{rXr&WOlDc)4<1m6p^Bp1}IQu+}3G{VV zOM1G9>mpp5;$)BGUyYfdDrI!^cG>{u$=_#SU&}|C8ZXXffVQsA!WT7jRXqVcaLtBu zrd0&)8(WzI9p!>-8+dR4+>Se#EwYjd9pA2_#S3FtmYfRaZKO9M<{2}{?$ zJ?u{p21(iKeWT+zblvX8gU`8L;)|qgH(V_A03puPg~TMU!?_pp^Krsxg`-^vdRO3Y zu4bl97Hdf!;$#`&Xgkgu{m=1=!@=|C*KF<^xhdc8GMM!i+c#SDcenS4nf|HM4c3p! z!m9CZLuKKGkMyht+chROg@KIYluGB>BeTO3tI?85;Z!Uh4rSoIs0$XwxY((RGEw7i{e`&$M3A=u3z3C`2nlm3 ze?wGar1G7n!$D**zAhk`|KG2d$OFx#1IO14(o(N}+qfKB7!EWZX-C+DYRiQ)4%hE@ zb9oDHe0XJkw-cvcjYq2~pzft7(sSMA3-)563=vcZmF4zEOGKbJ%q;!0*MpuH(!7eC5h(+) z)Hyy~-<8demgN5bCjco>)&r)7Nt*QUUx%&pP;|SrYep8wo;)ff4K+(pNuMOkd;W|6 znHHAc{;n-Iw2#-TF5h}5fONpN_-_4%AK5@G6;$OD@5DGRD?gM(vmW#whn;k!UGd2! z((O!D^W+s@(O((l4OLN`S>P38o_H{RLRf9{jT}w7U%dwf-5Rw6Ek>*lli9c zkJNR|2|?(zUdOmK-zNdf6e~1v%Gy~~JPVst5uAQ%u$^*14wBhu?4;9M?jqeAsA4RP z%fb?eC^~1>oE+yJfbF~Pgct1O=l9@+IuV*BAI5rHjoHgMlRI?-K3w|)YRbjiDaLp@ zk5sbR449tEj6>~Xvl?!!>UCMxPzNfxBDz5NIDPnwwL3(3=p^-l$98;J#lQ~}Q)@qR zeXBo_Xfd}+(}v83EC)fxCv98v^3{0gd(Z}whiFc(4A#8na6j?d1wTQEi1uQ|PgNg| zPC%fvx{r36R?@X5kk^rtV7FenRkg*S5Fb8#y%I*L6`T!BXf7XO#)-&ts{PLs4?^Cz ziGL3ck?*_BKFa742iLoaEJkXsaf)*HW%oI$nGp@Jup1|F$?V^`^f9=^hSzYFXN6NR zO*Zw7DlO6_iLuS_3{{;2t;BK0Xq73JLi&R}1`jxJsEp3K04#$3sHX2C#UGHJN_6_! zNOt0GMNFjF#R}4#*T^|x#qp(q^YT*a>=w4whq59(cjC3fc*<49j^=i)^%Yr{1rz$g z8gt}3nBU_T2<$34MEim}g`nC^VK&1_O`p_-7K`tXaaEf_<*INs&Wrvl<#Vn~*1Y|6 zeGW)*o7!}-*!GEh8&bvgJzeQkRFTF$SLwTq>w@DT%3?R!xda<%rinJE(@K7-gAUO? zv>dT5pS0!ZMN>!wxv}w9(UnSCZ#>G3oanQY8Ac;7w!iCjTwb0T*m`}QTm#uqUIlS+ zegK~ByGpBv_+_xHfPNV)>D^Tj#|e_vY?2H;35>^ZrogLmrojKIz)&bL##MW!K=V0h zo~-N}>`q>U#f61!yffd(jWNj+)KsA6+06h0)d~kFJjI6z3V3-+&=NdOU?Nx|_j`FTr`(NSu^;lv^npy$g`!B^L#gX1nTdNWoK9Bi*(lUhkgaf^H_Y-S~( zPjkhvExgTE_cUBqWi=No>IER3JGVQqD_Q@YE-*s>#|mc1J~!g98?5;2c}sHSMv-xg zq1p+KP!j{BQ6SfO$u;?nRk3`|*l!#jT8!Cfk*r!*YBm@xw)RW{YlR1j3C*w1Gc=39 zVfz>7kukEz@gA5191SN7&s_vQgLjavZS5__5g=f=(JwgU$p?vNKwx@i^^efby%Opf zsVs3`AE8X>ceV9$_e(~&^m82Ki7);j-9E5aeROQR8juoO5scSP(R_~{3Twj0KC`^h{Y)ydDO#wU|7f z+hpGC#k04&I| zb3OR(ZBnEljFYh?+EG&VzC_3p=;z@Vq6Nx*T9}oU^xBD=NpafT9atJ)eY-cM*qzQA zWXfeqmWDYxdx+$TCN;mUH$Gb=y-z35+<^mAFO*dz7@N=@3Dws?fAp%o*D8r0o5#JQ zPVV0bp7F`sD|@SPY8-jb0PV!cvU@~zknZ&)R?lWxfbP1o23#+pi%Ga{^78Smr1i|e zig*j1_oos#XJe7B%ZmSa?qY+8ZuXzF!eq8#v876heES@svHfP|{Qrd%IilmGa+7`N zk&g&$Wq9x5N8sOc*1O-P0uW7nq=}eXjl>o6jb?U*-gw|F#x~E&ET$xAPcVBn(=dGA z{bK@(pRhc9j=4918U;qH?W8X=*fL8tvZ$GdxXM*oTgsK0< zcmvcg&javM)28?p=paxHXuHgtf*vIcE1(`Dfe;Ld#TMc@dv@CMM_^+3=Tsn90e=Oa zj3iQ`AyTL^t)qJ=;B3d^#!2LIsTi!JpC{a!H2~#Max8ryzzUxcvttMS)W_}5hyBmb zP2KV_ZuY7oT4aN!;RRVpWX{b}$Qm>_EM5Q=dG|YpIF_h4$szPc}Kzw@6<0*|Hz2*9H>XRi$ zK9yxaHDm3D@|ZXPx1mAz9yb^`?b&wVn4vUToIo;L|LA}(5Fp!jmG@jh%~yTxV9bAj zT;g(r^m}0ADn_lkyHzW@7WNdO*fI7Sp?|v4IImN_#0_*|tMy4^C;oVVP;iq<0lf6W z1C?6ZHoKa#EU9TJ8_ub~G%l%;y$dRXjx(-efBICKiqM(S;8M4Z4aRG|oGd zr~6GpTD~cgR}@C^*EMVqUCzQ^+}~KVsc7>PKH#(3!RP+H!Fjj7%>H|W#h!2{gF6@e z43SweJstQ8PHu)Y zX$*q<@!6U{Vx%k|^BG#tII?I@7hCH5eqsS6%CsD}DwL_GES%{-L}y2ftI*wX3V%wm z5!8{NLA0_Uvy+-(+Ul&_o0&6nEqKIfk3PrIO-id!D^v=NU?F&P(N`;UG8i&$EGkb%BEC-%>aGL52I? zDAkRd{AgbHLK<$@lohW8zYDz|yD*}^1I8P!qHxa}d9`eE>>HW9=5Y(-1@U<+ox>)$ zF~4pFA5W8u#I}mNu5&f3qE^T@Q-8|26Bh^I)CEi)vjFYs%ceg4eZO*H*RCR={aj9a z6>PUjL*am+^RzYP3NCvS@3scLW26?i`3-aHtL7zq(yu1)0t%WM);^n%Jr}246lXo9 ztd2`=b3I8lB+c4_!6Ovg(kds{gJf#-8Ofr>4Wwwq-8WYO+yXgq0GcTGiHw^1PJ2As zV8pC!NY{LM8-aeXG#mp?96wv_Ttn%zB4gP^fewVIu7Jush9vyJ1l)YsnN8DdfQ`dZ zP`kPdL)G5qbTaC#aYd&z0SCIQN^V4~s}sum`LpRh<~YfD#ND__V>2ydc=OG)$x2H0 zy3AR2Gi}_XF6i531J^#tfhid=4NF1WnQ`0+ExY54>G_j1M+}Xi#>+}Ov{S-O((%|$ zvH^12;OElE@4Jy*v9suRSlnXfnax<@be#AQ-ojK8))HAmSpKJksiL3!zi#^x6<$W& z)oz?=57|sx{Y)afrVHc&8}zDxpSKUoFssu^YzVnII7I0eyyOxq`jZhV=hltv^;|{? zpQ2U?*e_5EYZB-wmPq_2`4jF0^yHJd-m`SI;+9` zd}{^TQif$v4Ulvg!Yc^EmCr|2VBvIokT7WRk*WF(XU}gDAx4THqjbQFuO>HKOxtLoMbpK7u!`}ayU*#F-Uq{8 zn>%%;hgV=q`1Zem^w~~S^7DUNoW>EVtF3qalzB}_VkJ0*6`tFVZ=Z5BTIJKEvdr~S zX~+^`<<*jn`3?|Q2zq51`x>9jiq1HP7Y65!v*OGA^0^|%(=Nu23m)P?AMay~ttSc$ z?T@M-K#cUKGz+KS$p(ftGpbC%1yj3Y#hi9dxrl3j%yziP)>FC1)_=^1H&p4$mYv5I z`ML91LP5PnG7ClG-|aftW);nFW3o(QI~Q+h(~fvfJ9ZHz2tcc7nO54o%)o{aPK^|NLoxrjm-3Yhbs++jjte5KX;z3<^?nvTs9$kEO~Nqez;b!PqKkJ{=xdJylHeE#lU@R41_F|BwqC2{yB5lw>!Xw~H9{IZRWoljHjxzIu z{-dt#8u~b?d{D&W(&C=5uFeWQ_-;BCPYN}cs!D8E%MpIN83x7=Wc!w{$ep&66aOZ# zhvnY@txrY!SBtEN@1)Vk1U`N;c#Wbj{x(}pcvW7`$!+jn)EVsSg&+Ezb;!jUxT zMLOv(=IZux$eJcJImu7D!F?Xqj4aBhpJ%KUmeMrKNY%pc*K(s3^TqjF49NR^m z=>6I>DevD#a=N99$9>E7R?F44ngh*#*N(fa6^M@3SonF#Gtl~#*_K7bIA%Y-sSq+- z&c+tkSnH%h^=jh`o4({f;))|GuYoJl;#bTOAgDQEi6YHbQo(o7M+}2`#l;$*>6Dd5 zGfOXk_N7;F@jhN(GJeHFN7k0-66$b}9Z653lwGqt=9Gz)u9E@uT|j5do@OKb)LX2v za&JC=@HA8e`s5@ggS-9`KNv9y7n9qL)e2-*G@w~3DSKidzeMF3((SM>P;m;CS}Qx6 zjwb9td7Nh+G$*O$oFZawDiH8MF=!l&oUL zyeJMTpYBZ3mXpIVYn{$kc2b)#$Nl5X)~PTgR-K-kw0MLjH+L0Cam9!DGC0w(NT0@SMZDdD<~s8-WQn+D|lSrcubnMx-P zHuRH-5z%JY7>``Dxl?Hc{29u#cpb^Rfa_aRY5Dv`O<`~pAFJo(&}Ba~d4h%UN?2d< z(E00e;m-y-n9H4qaPO*K%3qG1%SlY*dHk?2>6%Ptjv8jOlbch&c{lI>mh5}fc;^jA zayjOCJZTzgKE*_&d&bBjH(#|-!VhE8uf%S5%VEW>)J)%szwdRAH~ZL?27iqtqaM}> z+mBasF*vO&zyPQaXBVUSpH2$&x`xl8Hpq5x&MpdU;-cl6{$g0y%+2<-yEldl09R-J zC{De!b{Fgz9?ygbDm2bw^(888cn!UvpFsa|QffOET{mNI6uvR#n8vx z1MR_4Wgn&ax{;lCRMUs(uK%^W&y}zCw0ehE&%XAir3kF~@WqD5?NbQXShPdd z;N5t^R&Pl#Kp_m!d--a}BEi}E4`Sv5kQ$4`D06ULu#FemWAf5KrRh&J{aK^>We9>t zLFE%yoylVCIMq?0E5hSV0N(xJ>rhs+Z;uu1i9|tOSHymYv6nqs1PXny*p1+_h^0qB zUN?X+X@m$}z8{LlzV8*7+Q0YROAlXAC%YwEwMfrMjxunwuO}FFv16;O%4S~Fi43P> zr9zVI+J@7Ncw>8DJ_7QU2~){^gn|aivNY=L?{G@7MOKCDE9}q`GYnh$#XsXdsWaPG z;R`{c(81-&W%fxFu@6OIIa&Ha5)8m@uyEDp3Euy|Gx2Z34Q5K+R)& zVAS0mmaxku*FWJu@Y6s8ID^0yLDwWKM zfSIEBtmCq^P$q%Zz)1h>mryK54KYs8T!0#bF_gx2Vn$pS8@CU%GX?J3Mp#W%2m+V7 zJsKdHJzwOAxS!xdAiX!0kjZXfFuQ5E>@BJ=zn?#PY)0pL@}h+_a}l?kS^$YAwzjHs z4W=KTngDbd6>s}f@aewNS)Um-VkUO#dIpIwx)sO*-nMGFP3y#aJ<+y5v3z~|u&86- z=cDvDxjbP2F>Trcsw~Y51FXQ4m34UM13sxVrbJBqxNO{xsVQM4K1aB-NxeMbB!=c; z4KOjf)kaAZy&gXc*JHbo27S=q@a#4;50f6}a(NF?HZt!`*oPaBv$4Pl6v;QCADmUU z{W`yp4d^Mf37btc?j|T}QUko%B#EBttyMR%gC4DWczZU+ZDN$S3tSIstH7NOb)%ro zT=rxYr{P((lE#sdF{Fw+K=|f1;@I&z{ku-B4)^~7Drp9v@=-~kK-8}CClVST_SJ== z5?GR35eHUWRa zM72Odc6253;92aajP}WAKo~qxpnF;#BAK}0DULP4F3$lol2BdTj?|AXDAbK#m`8vb zMOSGSdB4?*hS_iR0(I3m>sS%I?E^ynNEPtcMsx9Jc&hM zcm>B)=aDI*1gd^X^S|)+>m7vK-J5-^2N{qU1uyndOULZxfYv>p&hRa{)0@iBB?N5FJY`rz4}Y%!kLc2vvAA?$d({1^zCgTPw97B? z@mVl?4e&Isau49zztUIQ?+YZE(Bg4HV!2>%f(`d{627eLwPMe*>4(Tu7YblKSFALH z5anSW4k3O>{oDG`8d?sTzC7E^@G1IMR9yWqiporqLGcTDcGdJI5Mo^AmmtYMYR3Xz+>^I*2la;;xe%UzO+_`rbJamdQzsDCZ(-9cHzt8irAK&|9`+wN{hf~RSS!1w+(Obo`H4Fybc0{?hV_fl zP3o5vjPPX;QDpzEw~xpMjks1|^+D(hOP{EjDoXTi0riMCAyYLsPN+ee4%a>qH zM|}R5rj1Jdlqns@qQ@)=td4&0=OEZ-Y^ZGPEmk@x1wfdvJC`qrD8j;4%pfztNn#(9 z0)FTrPS_zUd)uq|MUDYgT=j|*)g2}4Q$ES|lJjgCpXIMcXy>pyF5<^vNp3JmS!qm{ zaw&K2Ipln^7s#%Biq&Yyfz>8*1ALZ9cgT^^wEl$S_HVhCq6YQfAjcwcV%TiFnzzH zNp~{%WSfe{yJwXgq&US}2HqLmAiEA~a2;3~Dkz zUs}D?TJQYEkSzp_R-LX#R+okB1R=8|Zial`Wwai-zWWE6!3IJrJcwErE@cEo76o~> zU)5R%mPg%>x)@xM5`P7eR_{s}xG)+yN7Yd!^{6`I$28R&8lFa>5fO@|JAdfgj!5&G zb-nsoA?6i`HVv2V_y?y>9%Ot_^>}8I=P^06o0K=KM=YwL9?#f)jMAtE=u{4#SGt2LG_Fl-F;h^+G+dQ2NOF z?=q_B@ZY8JjF_4-jhqB(>|ogj>fbXBc5r=K{eVvKWkI4_{&|P`jGUG-y%`HZT@F z#NkU@O(P#FZ)6dzQ!v~kQ;9ZUZb7cdGMBF$=4YXtFLx=Q|DQr|i5jo!ys1E0I!whG z@pT3L=J4?FbX68n%HiX%_++QY$sp;!Xmurpi}PKmawTG7WDe1Riv9zsmP(s(%Vz2V z=)Qii8-ES>lG*@g7tkWV5JA6bpOx90oS)<=tF{PE4dEDhxjPy#Kl6SeNcTK$KG#k9 zanc(F2ol}JX>$LgPP_v$2&!ZQI>j|2ljKpY3KRbfx)MN9C<#FO)@Ek#!$rMv6f6)HwBs+EF;;6ASK^0QaZqy!3)QYFl(^Zj_?(ecpNQ3{3=$JsiAJ8OfmbcL-A^H zoS+|_#&|%BI)=pfp6JU&aEb{H24d+m{ZKI18s%9TdVXG8@e=k{aeX{~#U~ABzXpe# zdrQy2=h5-H-qUmi96}uIC(ag2`+r=6f?$)tL{(W47(?M#(F6K$BToqsj)h;RZ<&F0fADrT7gE z-&#>{5eIW{MBwabYY-yzlurxbau5fmH8hyCU@tsh9Mt(jPc*mU z1UXxU&){#)z={OHNtL$!Zis?TdUE1CtP`H-T=L9!d8PH{_2pKNnLFza&9L5$k2(?@ zf>OlRM!~opy?-E7V3(Mm+tTy^=bzmGCU{qzAg!sz={GY zA~J|K^8nspmLD~&eZ&vAh9pMV1r8IX<*}!qh9{m2rk@$vhZ}=Mb+Dm5Gy|;6waNUq zF4f)!29s_i0vB8tAL246ggz;cnU9Io)bn%7F6rfzOp># zp&EQCjYoO!9mBHQYZ_s97F9%GbY9-7afF=n4FRDv)2;xRcaJ5pabkz(F`2T~Udq%{ zuLz4gy?`BR#6Ru*8!42H0Z&m?$jF9HRapJ&)W*iwv)_mygV%t#I=Bm&NMlB~K|F0d z7DjA1I_l;c%%c5R7e5LtJFJWR{D+4#-T1`W{B2N+RE_^JS`#zD9K?e(`AQjjsk7c+ z%zzA9-tQEoBd`edUE6G8EAoZSiqHE`%8Xwt}ule#?rl^~Rq9>^c=N)JLqSL1+?A}fnb+-D&X7o69 ziH7>0;Mt3pPGdz_+_~-&+?Ow#Yp_2c655DKIcjNyNuA)5i6(|LjE2?qR>z+yN*r;A z#_ptv>=~V3;4Q#jkafV1afG5Rart>F7Di0{on}UNO$dzgZZR?|5?}=??MzXu#7~K~ zaBzQ{-GkMtRJ;WGA<+OGdG#>S#NSFhNian17Xn$B z>QeAQVHI@qB{EB0#ox2!eyM5sk-}1NbHc@hfyr7_L%*XyO!c4c(?x)4xy!NfRD!R@hX?{y5Z{JL<4i4W+G^ zV!PjmU!>zx@Lbi~TgGoQx5VA`6bVsWCXG;P8cQ*)aZJsxW_?v!OpDu+>m%6&tCfro zj(R^2j4GAVIZ^U#x)lFm(#6Iu_}r1r?? z(BD{1dg+Tm3j5Q^8nwoJUPua15>C?zg26|i++a<)oh+i%vo0KZJX`&bcZ%2@{CR zt%LvXx)Nx&Fq#;Vgq|c|!BAQPokJnyhjcToJ0cD4}MUne5qA zpqjt#ca1dwdWgY@GlPy@MH#L1Q+VeM-#nqGDHV= zb3C{CPj-2lpo1HAcAS-6xW44dn7TnSvmPOR&B&fIIVtx(hLKF?*C1`2y7FdE8=?ch%DGVJlJ5EaK`UscR&85If zhhNBqj}xplUZqT+QZc(x%;d}cqkh@yv)Mi3_OHtLD>wi};oBTTU1lcEv&Ep|`c$Z8 zb>YHnR4;SxXpB42Vx@e#rRz1C@1{NyZNFai zcTva4{G*fQ^%m}v(7Y15(J1Y{aUqcZ7#D&jF@5VFy#n_st2}4f7!44fwCmE8W0Y)k z=Hn26%ViL$mZoK`opGP7MA`odSQcwCdhbqM)eGJ5DdXXBt$+0mbh?tYi)41$p(HdI zsrd}TK%qH}7HvZTq9QFaLh_OH;8!!=8r!Msj&*AQ5Bn=5#JR=IRq4*a^?d%w2?;V* zQ0uY{y*2lOliyTLb7Npc1?!I- zjk0lv=olyrsqe5;!f_p=4Rn`*tp*;jO}SaYZIpi@ar|4b+I1jk6@s(+V?s=*}EWGeq6F z%db8$3qv_p86d>M4iHu`&p@uGNw1yB_Av)L;#>WVzt4rJ_N{ z9huAG&4D$Qy|$z<05$>m`UlMZruV1{nqfN7z{-Q(V3%3dU(Vj~Y5Gf_2-InIHqSjU zRXdfxWIxI$V1J~b)wmA9!SXz>&Q-IQ3YHvN>uxv zCiwA7SD7al;5R|D3>lMCEeX(Q-AiqwZex{cXRE?#JV745d`PFjYpc3@#P zvRp%4^l9hX`_M1?ST@~20{i3t=OkA(_NPzd6&(>ws`a@iFL6n@p|p@mmY(V>T- zVh<8R7BUf`j{u{M1Sh5HNsdatB~O+uAiL;Av?G)9bR5)nIW>l2D{8uh(&c%+2P1#S zooEDLL59{Vg!u_O6+rNG4BnRauOYLrvM|!y=$&Au@{kdaRKMzcukJ)r*?Cyfz(z_! zoCA4IyP)q0lwzKTwut2%jl^p(W0i|Bze5Qz+m}zqg=Wt z0I^cbs2>w1-|kJ`#}D&$Afyw3bSIV&a|A2>EXVN1{26q?M(eNGJlGhIG)Zo(Kr0+R z(^x2Ov2sE zNB#F$oxP7_@t*{^oH@{dPan;Sp1TX*&;M=#JYBv_(fim|`%ZXOi|KEc%#pOf#os+* zvIne{x(C_XEbv-tYWCE8M$IybCGWs&q)9C~@zSjt_VAsa$KoKCp7J=KfG}aAW3o?9 zGlYYUJ}H~^rdKL|HVjB3_%g2y@?viCbRPP;2r;^D-*#ZnJy)&l@3p_0BK=rZR?TsK z3Nr8J6rUbpI>pRY>eAW&XKyM1R;k2qqHx+zm_k4mY|R$h<$?z0w|T zQFNc5*9W96v57S@vo_e*2GcD{H8Xd_v4Mr4Zh2k6-xhMU%O*U{Z2}#SmP(2d(c1sk zg{DTXX~lnB=#sWhJ=0Yc_{H$d4=(d194pL4cOUW$kYD zATG?--HsvFzFII-5EMgNU`>%elDi?TizHjILnwXmr`_;s$v4-lNrA>P`w9Dja_Voz z^cmu2h0UKmKO=sbjix8&udHqMJBbtV#PN_QQDcZWYs9C+=LA!2{^WLpf&xZ8c=cul zYZe~U8)5QzCq^e*MdpAZK_U#nQt1-9<84Z8-_N9ZrhDa^>+dGf96^}7l5Meun~ueP zIs{D%`w60CfwAPWlJO*4=$5LGOeoR~EOkZLl)lTGfX}fWr!xu_a|zwcrlB{v?9>L3;h@yQijPYC4h~*9m)t`)3?JB|7}$0v1AyQo zpkuym^sbGtS^J{$1{9zL}q&HbX^uFD?0=Z|g{@Z+G##_Kw7#kGkvz;#^>G}+BF-z6X z?EwW5a4R%Cqif@lR6&SX8ae(KvjiuwR6~D9n*85?uY0 z^s^$AEd`jN7JMQ?bt{FeJ7WI1hDj)u5I$oTggSK24L=+jT=}q9!VDKi)6&PJ*_T2p zRVUSp-F!%H7WUn~WMC7OAnLLyO*905d9s&ZE}xEG&K%=-YSUu9H?{-9B$72=kDlMF zfSJ2lewr6R^qyUllz^TazLZSwI3)8Kfcd0xscfL@CC*Su6#}Y#O1{YG!ZYm2xzI(=07D!vPXmEfw6OF>%qC zNiHX4iVBCeb;Dj}|0AGd+W2lY^uMcdY*#hZ16Oxij6;rrbS*gUXKYYyc7lM?@YZ`Z zNp@=9qzo#NNe~0V`$REmja_ts0z!jed4z_2akkNU$Ob0rM=>Ab&#u|A#gUNjN}I9P zimP>snDbXxzf8W*!-i=sKo*H)o>3uzQEuW9u_0k8h=-V~YPs-qY z&vB<3d8j?KcaT$GgYHITyIQensKnaz7jCFFXr`b&iHZ2Y@8rexoKF`vu|cMPe5+0W z_B9?Ey9LZ7LC{>PY9Gq#!zLWU_TEIj>@l7@VjtnU{)-Ib#d5Vl+Sc0GRdhuLJeQ#7 zkQyi=Tkg}v9d#nPj%!q#2h)pf5x8rWU6)8P<+quL1dlTd&&Zh>^VG~)5Ta(SWqEb? zpDF-QJm~W%CAUVTJCUCOQ>(Id#ThokkzWsO;lBwr>&MF-rWA38jmOVtR>FE_6C9?C zXikIDYo;lWHpRbM3^jQ7|6Uylma0HxwD#a%aL5{h`Xhdw=VPUR@|EZVnIE#r@U~Mw zT-qUC9g6#)o9vOx#7JHS*;$q#s^!(FImu$ZxxAN;PrMNgjFtCMwvZP_$QX4(D86Nw z?Fe7ze)rhOb~lHUNBWL^r4H&&$+le{g#cxf9=Dw?ZK+gF1-XeNF8pXHL7RyCi=So~TtK zg4-A#W3@(6V6kzcz5~ci3`?=w6*aNLW@12%_&Z{?wjK3aOHudlA>)08f3`%Gf42O$ z3=D=E_1$p#Y$?0jiO1w`_SXqEkmo}gf}ERSeVvEX;dq!rZVWc*M)_4VPqIF15#Ng4 z*TmAf`?w=;)NZo+A8rm^NyijnZU^M8SZeaOC~UwQ)y7-3wMhPrq$%fFq^fiD;gtK$0>R;z=7L

HYSwv$LxH9V7ecF2@L zM&zB|l>`rRz;5A|c1gLfiZ_oWma|GfuR)LJ8Uhnl_@yU^4cI+NhU|qAjUVmNd*I0{ zg9R!Dn9AAPu$q&l)y(Kc^W^-!^+I>Hksgav$Ud))27#%K1Ko~4b216D=gdQGa_9MS zodDJ8u>g-swy%ptVsr1!Ew?K$Y!=p+ZAOP(JC3<9&maRob#G7*I&|*-T4aC{?LHi% zAXW1i0HnbW4buIEqBsqMpLlc+pI{fYma-E^y!7xOfNSG;!!}HR#cn43ied|FJQ&xi z@7SjNyKG(K-AsgGc?qy%AMU#+5pq}jAj0&b3-|$Wln~SzmOn=DN{7$@jzESpayS_X zv2mVVTrGm;1UFA3iq_{X1t`Qnxoe3midZ zbfPtt`Fk$vj(Os7>E06H|FCpUVS+@v7H-?NZQHhO+qP{?+qOMz+tapf`}R5aJk^)% zs^{8SN&bbC(H(qAMKC7%F5pDCu8+3Y|J1?6#{J zRIIX7OwiUN&C4nB4g)r|I;y`JaM$5yL3)-FqwYn(_ol!LxOYf+H|vxZATGRT>zyY* z!GA{c1mU%U_t#iG#58iLL!)m{ges0VlKEjLfD zP61fz)jEVIG59=5TSRBDB_19ntjl#9 z2O$0z=I#GG^*O4qXuS7I9oNg$_L(w$cBf7z-b!_^%2su+`k(2hCt3o1)5$y4(iwHm zfzYR@Y-U_nu0v0ORiiGKfhbB#Xju))-yRnPwGG#-{yZ~f z*h>#zM2IoTUaRE8B{`Y^O{&bqJ3*dISN1KayGhSJSh4Dyc)b(IFzL9-!Xz>%Q{UPj zNVu{BdeZ`Ra*is0^cC*?;D0fT!GB*w+g=BC;jhfCnSB%Y7aL;ZudsiJhQgtJ(Sbn_ zFcMb=*@dQ|k!<=2`Brbn*?CwKM@6A25*>=pocUk9f`#sQuW;e%ZZmla9tWVeJKCd( zLSIL2LUfr9N(nrF=~9zCuh%gyD0=2|2Npht{|sY6VY$B3EI+!l>;&EeNgzsbA!f?B z&Y7Hu!i;6w)You@(~v2Rs~Nu5c<;BJkGako)r&Chlh4uGOK;2+}wFPLV--sO?Z`a z-<(13c(jv%c^NGuC=il3SdzF%zzKs_mEj~zu@cRg=>45~LRkt0Y8i0n+R%uBY8c2V zpSl&)&?Ka6{OYEA^#Hgzv`XWi9V!u&+Oq8+EwRqG9e>Kp=@lGmNde3C_={wqn=Xj{C{jsm7`~ zeExL=YaphJhBbS!iOdtCRwmer$e=9P)+iPut)FWNQAl=Val1IkcgH1jnIc1jOtPf> zjODx1y2HXY_t@6^1q>o#^qChT`9ry#Rtl_dFxaT5U^G zFY7<#$$q|Z|AND>;Iu$TDtXa2h?N!z6Q#rKOTC}B5%wU#Kd$DJ%U;oskF8!gto_0+@x&Of*ls)Zp0%d#c{D}C zDFL|t>s3`oqw))b@J}z7_iOON;<+^pJux3CPeXAX#;Hk&k(;CmR4hj)P!VZ~O$mxj zn-8qXmg_y3)ZVs!Cd-57-oyI-^Y)XX_%7nse4i8eemd^q1g7Cw{w_s2@sU!RP)o8X z8IAYGF-4^}HK;2E$&(14VOir@PK*t|9>Y_Zr~=27d}Ikj*o0uxBhSqaaXu}3aPb!;J&S4geUk6(9yf_`iz9P?jTEqv<&NE(upYH3}R&C!Kv zQaJUqUNPx(9h93TrvX0ttds67WJ_%=TbH|m-z}_4QW368u=Mq`Y^pSlC66exjxrHI zrko2dWiNGl5bMn7iCl=S{pxfVffEmp_lWvudfKPW*BPm)aEwsQ-f}#&bdFQ}Y$Hmm z-Sd>%>J0t`zykVo$Y^4Va|g4Pg?=n?^^mn$ZLix&Qm9?rnf5{^y(=xJ?TS&>vx_7^ zH{EsrpVPG0nOrjmU{_4~mER>NDY}Q|w}w=<`Zr{D01Y%D3d{s?L%`I?Hxr)xb$+`Y7#&1|h#4s10Bd&BP<*-ZcG zRMpBlu&Zcr*rXlZ%GADIUM6;EBO6tvPHJzhOltohhAGl|BeA_yZhxYxLF+L^hKQh` zI!*3`$<(gkOy@s)zB$rN9TCc;?NoYHw+mUbkfBhDnTIgAHHtzNl@cOkUg>nm%X>*w zT(p(&rN|RR==^-tKV5LH^T48|ztcg!n6>Z#YK=^Uk`$_A=GJOYgtjv(7($=os0NUZeaDoEQh@#qqfGG#db>#8fd0 zbqkBo)&a@+ny~ekm~jDt?_MDCtjY5F2Pg zsbT6wa8jv$JchYe9_jl)nMn}Cu?SQ58m(#~cttv#fcu$vb!?m!P$YNB5!vs~OxSdz z;FC4y&%{&K!qpY2n%+}w#Y>q!BvfY#Kv#7vs=)-FXG z<39%7Njcegp2n>$s$CD5whNd!|n|1c5fe@=<(P) zTJd8hjOdV=TQKm9g=@0hgKX+g&Dy$B4S1rA3krI@bqTDTw%{n$!G|4z^7co_3@q)m zrX{qQp(;~$gl*~$^>nE9C?CZ&sgmlQU0q7yrvRKa@khfmChNC(W_~S!z;mx~`235A?LAaVWt`g0_%qf~TOs1Vn#=iR*a`L3Ukl?8kln$n{4V^f zAb;nN49w%>d>PuE!EeM1_@^TFe?D< zUtj&?F>E0jc1x7;WfHY5&V?JQqQ!mZzFHc|6EFPbEyagoy7nb`7>cPe30^lHCX^h1}qHH>hBr-%@-aSgE3I7hf&nCo;mbMNmsrsRFzA zPOU%}*w!lnz)QhDwt8#i6Lv2Z>XL=;$U|ZnzGn6lGW<1~S$|YxO1cMZ$fnna4jLc$L=Pw&`>Oi!rh8*2u?v1k-9of@p+np(F<&RF>j4R z8BkqVetxcet=%^`7LH%OP;sVn8@jF6QhjD!%nvxy+-_X*&R$Oyh)f@1NvtHs zBS*7-dQ{sJ2q2SoMVU$n$QO|%K_a9J6w1ABRj66D8g#pDK?mIuV=W3`p--VEn&VP@ zt`+v9#<1FoGf6B8p5{3yk!!Ne(Hly|tIiAs;gx3?bd!Ol1FY)IyHwm)z|)NeI3a?Z zrZ?%G$PwS$uCI3kq~OW~Jpgg70lJGK%p^B@>B%vXUfu(mPR=BGR(*bQ&mapueS;3h zUv8F?v3aYSXc8AG*w7TX-?{pniF*2Cx`^(;Yz$2jB*2I_1bE2RLaP%qEaP%v&5uBj0@(GuxRHsnuqR)=8!;vqlRNm?#c%pKCDKn=DTheNbgg4!B-~tU5)kX~gBk8{ zr8tfOJ?jVmusNVO?}>m2*$*Z{8Ts?rgZgGC9oauL0x&xi(1)J8X`gC%Uk_4m>>8%W%hYY%JZ}_B+q&s4?x+d|b;ZJQoRRY`MS<&$ zBS3ErI@d63GEjoOnM%>o-n(!`fouwm*SHk_&P&sklYj|D6bd53)}0j5>nK=)g}VVr zu3iqtYd>;o!lI0WMUBP9(4*u{`=$mFVRe~hAWMIA|*f z3fz&I=+zr(+EMJoK7@WQ6uZ9?T(Pxt$`}$FFA=(sUzR8Eg50$43%yd~PWSeF^|Ig2 zQY8AKv?t`x(@(L)F#Vx;@ZMyAzlte*@-Fkku?en4_k>4u%A0ULmtuGj zD#bJt14te6jcdhVMAp!P`Stx=^rz8a17VUTRtUz887=m5=It6ef9`$q|9F0S9#7jk z0SU@|b9brvJ|6?GI@aTRv!G+PQg+Eta_l)TNqe~RYXv+qNRT~b@m_}ykeS#6S-|Cq zz2R&8VbRasVjnsF6|}(G)iv}k_?~@L=F%|@TPI0z)Wxb6`L}nt zd3h|{&2cI2JUUwgFA9o!%PA9CTEHgXUIkxd#;?|EFx_9_Ec!KD%<`(RBu<&qh@-Fe+ zkz~C;Vhguo;*kqK62i<<-@^=lUWeBCx2$hq;kd7Yy91Z_8n{QV3YPFQzYY$*g5~(1 zVAbvG?0*N(pbuC%3TfY=`0t>qj5P;&Kk{vHaosn-Q!U#*!Wm-AmI+-3xwiOuIO2MN zLcIATZ67WD>+PT6itdNUgAB9>R^-3Bu{%B`C1KrUWi%U zUTTu}6nCuLFTeFZ3>Z#Zr@NB{Kic_uF7e>v;y!?*mnEo}^z@5e{d=4IJ-9gVT0fQ< zo3CCS=J+^)=0iETF|)7n@$s@(t4qgC-Pq+{!o+jBzw5WQxPuZw-a;9#G_Jl53Orew zxqLM=ZDcc2+1V(Fm`#8GBFmC1t>6l4fDu3W(6l_QhOECHEu-G4Yy4bcZkUOdo;Mkb z-j?FPH7HJ5eSFKoFZLsiq@VCYc1ZwNclY~jNo^@4REZbPza7Lzojm9(a8bM-1(Sz} zYe+#@bB4W-lLZ|6DGvyJ+m~Cpuwet59>C znVjtwCsXZ`ctTWxtnQjr>=yrPvvg46K*P!|?w5=OCC~W>DyJm_(@bP{R!n6_sVJy; z)E?Geq8zJT3EdXLCk@78k(bvEwmF8rQFtAFQSmVR?C;{2R$g7h8b!Ib)FQ-)iT(+3 zj2*!BF0@M|eA`Qm4_ZQMh|UFZ9e7|518p>oFcR*#Z|9u~Ii3EO7=V5aEk9_?h!I0* zJU9a8nvDbmqAE~CBwx;_iPLeE;T3_!4eW(w6fT@e&;;YtyL~}I5h;e0<$bHQy~)8HBA*09D}p)xQ&+BYek8F7-5S8(#2aw+w9XhE?qm)k zfCN^zPBy%Zx9oO=4WFzF0(tW%Fo8W(0dWlVgpM$xzTd)b?GXsUpvs30n4(`;Kt~XS z*pWSZ^DiOMn=P0<$tQuwNko0U=bTuyfQkVrAl9_H(Kw+YZS5hzt#HC5!_!T^J%)wZ zgSVfVLaaJ8(1i0ReMtMU51(_mFodnk%Qu{35A#Luu|al1r&OR1&#vUo$SwZ``mhvY zIoNm>JqR-MLUerz}v54AL6Mj2EWH0XZ9SmXVlN}#spL!Pa zC0^VrbeOW|00sOIspFsg6c_1$$XrB>%mTxj@G?TC=(%gRVW;=7G-C|_gUdBA&=5q>$4lej!{+?b#Ej8LTTPBCrtl zqyN}#62Y+GOZpGN z=Ex5FM}XUHge<~P5@KTblT5s0Og{@C#sOojHGios`D3tEM(4H)Vwo5Yf)ji^eQH*UxTI%=v`Yux3YXY6D{HFn>xFnk&IXaA_!k#(f#+A8J0{SnB2nz z-2~CRrH9n@+l_`&(h-6o_C4u>Ba*;$d*T9YwnAXHJP7Y-R#BP+3)3zeo;pnhrsW)u zj-gYb3-%)YsCaMyvpv{7h+%5_0dI*9W6Tj=eGTWrcB%0A>G z`l#+QSVtb6_x>9ON=j0aLL5sIAFj}m5mUlt>;{vg3 zq&D-uTUvm~bY~s?qgq~M`6D1NA}y22vmv3mLRVv6Rx{-wU~7^>`N7xktbGYfj64L< zOA~R#;4xC*eaYYu5YsjRjGeOuL!UBL1D|^gJ4lV0GbKZx3j0Nd9tRqhnBNbvpbxlf zphwh6b@UOd-L+7w)5`P9p>+7`x94-gE|wscnQ13m&FH3!{miw8`ag?;AB~t=X9##D z)mNa3#m^KGP{sGpPD@3-P=dyS^&?)3-o-)SOQac3wdxahGit#EFuQ{(J{_+6XZ1jY z!2E-uM@C#gZb?Co*GL^)@gfu6t`Hc&^ck+ntrRl*iQ9|(dMM^B2- z1a#}CzkoBG{Mf3+HJE1%9^|JY%`lCTj0e#S#U%zB4p%q^($ISoX-pAN1s3RW{GEZM ztuLG}Qian7@aEt|^vOj=$3loKE}f}qf)Tm*!m)+kMtTWu5HMzi=xASILiPFYS(-zZ z&T))k1Fco3GSR0+!*5WW=S@osqhXGk>YW&sTrE|!QwpRbm>c+wSAdjbWYnu!jy&7O zXH~Eb_bgV{>@jknsFGe%`6-!dLl^5G!g;a2>;)2J`JNeV#Dmhu2@wEbS8Zo8?d^Q* zY;C}S3A`s$i&sQMP%8mNW^W+KN;U8ibp2Yr;TZbZqU zJ_n>s<>=`$mEDrM5ERmu{DEj8pO;yfp-_Wa#3np8;r$cbPO=r>*Dh2qg_TKN69$qi zO}J=6R!Acum6YtsgsiK^9;vkMoGE%HZlG96S(rUbi(*4&@9W?`w`f_Dc(Uk{N{E{x z2Wbrz)#BKH*1qlMR+(|k48h8WZaAGxIgfu=XEZz1S+|d+^87D2d0K?Gm(S3}MVpR2 z#t#M392KUh%tJFee0YIcO9X@W%a$t!FD?|W=z_sZdGIt6Rfjf4Z(UZOHX-*?v|qrh zF{n_=0T%cS7gwS#`6+Cx?%lvYHq6fNQNv4RYMCoF_wrn8cmcEr8%=Cfd+T|u!`a{$ ztrav9-T#AY1Ii);73kK=6Cs~VrpdP5u7C_#jX>Tl9b8cicV4~|*m6G>={$g5;JyuG z6*h+PdNXhB4}OyyL0^W0!;OJSz*GP1>;*11MhpAv*VyTlO^3THrcLOQD3q)NL z8PGj7hNj4gX>uGY^pE`g!2GVw%;5M~0ZH}MV)zlDuU@j04!;%>DWN+W0SBj>!58-U zJM0c?kJ0%cB$a5PrVmPPqBr<#FwHIlGHnPw(TgkZ$IK(mYS=ETuwSQ#S%6xDrA2a& z3fmosJi&|?!C2zju=`ygQe)E7bSIu)h||C)f&x^9MsYDg(hwogtK>og1Og$lK%kP? z`W*IJa_8DtDMyyJ#6u%)#_m-;w06HvJw_hVG0{Rw$m0R=5du<-NK~5n+h3nTK!7=6 zRs)s`d=*H*T^a%b7DfFo9vizq)P#^>`KsZk;P0ND3JJL*+q0TR0$399LtDn)UK~({ zA4q_Y34B61@uV24bk>4xI`K{MC{P)xkqKh=>mYS$y`(ldB#E(EITGSDnjGKjsxiH8 z4+nJ;ZG`?3C-sOwr>9jt(^>RzCP$|NS#glH}c zDc(y`Lqc5Au{otZvZHc?4Ra03xZJijm(9vIs3xNF*24;xWme@Zzm-K!TUfzDEnEs6 zflB2;@&0<`#H!Y)WU{XA1Ba!Z019vg3&r0|MEMjC;%o2u90V){_c27DdHYMky+5N0 zQ1{8m19t&YoKs1AGNlig(h*5A34#* zpc_#6rNYvTy#>p}j~S9uR7_<;6LD)P%)$2}dojINS_>OHh`3W|Ec(Li{qO7}rvgoR zgYj?tMv6!^GU()^5&%i@8sIE)E;a?wxuthBe=(++ZO*T=*ht|aG{_`npf{o^TC(HMj6D*MHxD7KIL>TBi;iI6#Mr^-%8b2> zCz4%})L8akW!z=yfsi3zKy ztEO7YBn~zP8p{TVx`2^|SR$oI+>!SafJe<>DA07#)8#*2bx`abaP$|G-BD@Y*4>R& zv`gOgiSd!`-CjUw&kznp2O^9>gdP8?`lz2&{5 zk+8H**U+?Ru4QVm^iEacsb2}RvU@3p;o#3x{}Ea|-Gz6%D`=X&FwTv1RyriQy@P18 zu z3*t-}u=md?!v!myf4Rd`aQ?Czxz1RQY@Yka1=3DQ!JK(+&3VV#d znuBxGm|ybc z;OZG~sLlHWzbnH3?B0m$wHLr}vryM$?&P~M2(!N&K21IH+kfq(tZw@CA<=kP(uUSj ztb90y$bs(Olx5*2-^dD6-N&C7`V)JJn#+j6Ty@S!q5bp$1~>P~In8f$FI}8Rr*3lo znij~kiA2Y0=mt__4z?qo&IIeW(TK(=SJ6pRhN%XtiY20{XPtf>$+7@UX9IHTzyn6) zv&@fPbsuy^%CQHbb9OU7(AgSE@&oqnIosfHJ}{hCyL?~cLIbhc)*`>|#Ycnj8Up&k z$*c1^1@}m>4kWm_aZ!;13kPiwG&(|Ep=3ai3Y*YShyuMf8Xf>Se?cT}FuH42sKAVx z0T{gElixdNPK8M=@hBEiny$!c2A1e0c4Gc}Yg9=g%IMlaI)}+O8X{ltnpEgeI;0oU z0u&P}R;;aq@=`PbN2s&_`GMM?2iihr6F$}-zio1v>%exsp?X&x_>T0}JvSck%3sq} z+F#yT8eF8k{kyqk%1(zdh=(p&YNvt)Ro1G|Du8w)h*%b$qYYw~!wGV$u+yUS7>zLhiA-_=M5Xc-5J;xfEEB@l5f#_ z2SZnh*|}CvR2TUYh}rZDXKu5N=B3ONLn5gQGE!Pnt`9VI-B8v{8EVQt*zEejiUAkNFcQ>4~y52C55jQlBtEFTI*c8JtdVE zEvZ;kPp~wz&88-)QoM?%p;GXN?>7~m?`4KSmU(#NgY919psFrH3S)cS%w!@U zt3kc8@86F%t15?Mp<>q&z8=Vyd>c@Db35Cdx%|X9yYw)2?IbU-3&Mn_5V$47btkz> znt6Qae?FG3upMf#j?zBq+x&y!!9*UY1P$My84;IkFQDh%x2J|K zVlmSUm7$pByw54>+)+K^evartGo22gz~hxlpEEa>2*K=pFVDiS>FCner((Lq@440H z>?};BDl2^z##kM-g~_iH=|Nr8pU_RQ6qBi*by}EZB9&zzh0X4A|ERu{?6L)oXOF23 zOa+c=T+=gkPZvJOTIq zE>ap7n|5P}KA5d{ytMRwbbPF2=fp$VwvP^=dNeCvP}2k|{^+fu4cM$SZ6k2cG%!zO z(0$G0?1euWS$5h4gHZN}1W7#Bxm!M%$)i?)<@56_R$@xafqnGEu)kGhJ8QOL`Rf(r zUq_MV33jKvh34@tL}BG!6}imKQBO0iaN;B*_N3lNzTB;YS*ysPsyyOsEG^jwJXE^g zI2)WK1x@OfA;fKPJiTb;Ey1{TXcou`-OXb^ZT6MDbqW;S@MIbFr!lZM8V`O8utNTSuMR&t}5?j z)797vAY3;kaqOp?AVZH(@_F5mjMuuXBy~ zYQ5BAPCv^ZCI!RR_|IrKP~Jh+>~>arB*14QOr>mB?#`e`w1Y$q#EMu1;SxEU;b}*} zPxJ|unl>~Jp z5jJ7Vruwu!7}y6uoQKzS+~B`1_DQhFThj%TY=8lvyynJaIHTdp^^cFM?*L_It01GC z8WHUGvH}RyHKk31<+-N2uhdChh-?_C>xpsjE4J8t7rZhM%&jEj*xFmT2i@ia4oER8 zsM)A)Gh#(ow+Hz3wyTfaP@3-D;(HyZ?)`)5LN=EO?8UR%r3=}BXzuoh*UPAAW)D&MY3~df$ zE-cB(Qj9H?=Jy2N2AUa6@NlYfxOp-*B*pZ?-`qxab|GKltpOlkz1xhtCwncjNNv)0#dr+9@OC%;Jw`2S@*r+Mo-PE^}ZSTB4IIVv@O zpIv4-`VbdBp0)O}JiSTT2Y~zOvp(Jc5+ag1*5e?Lrsb_^(%Q0hD0Z6z{KB&=ZxD$5 zhq8-Z%Z+#cx|S>5FXWm#GE8{y$1$v6Q!oqk~Qn5GFjdV zP1YpGT#RaBaZ3|0%Xx>BHN%YyC2O)H%5cpd;EH9er-^2L!LcT~_|vf+5Wd-x$SUcqJx6?x8}hLvzuYKtc&62u!eYU3Nzq0hk(oE0Wm2!as45v z`T+kef@l%G#<2zOy57A=A~9AJx5gZ?sY>Xq{ig)lkxPy5)oDB`&-f|Jgh{` z?}|y4bl;9yS*Ve8OoiOtD~C+W$-v@~q^hlL8w8)q-cJ%v=4c2jeyv^t$v2{t!HJyh z*RFl|ukkapQIhnFCrj?j*@1Ga1CMa;DFeS2f{+g#y8mR67}J8a>Km*6-2D2%^>?GY zt^9#h$(B@+wvDv8n7;_l;C5ke-Gwp~P8cQRFHVr1XIQ?fY3fv-}3Do%IO?@7dZ z1PhT|!U`GAU4jI%%K6j-K|6%vfY=8J8y~GzG$_uceJ}5L%0MdOC&+e-@tf`JW3e|c zUI!m2261y2&Tx9lz6oktmGJvqDLX!T#YWKI8VkuaHqBJNJgF3YS4l~cx^k(NPnJ;4 zjv6ylTBAKU@$3UGTWcz4!4;3vgRP;~2D#cHsJD@PX6q0M4S`DpaLk+crEI3p@#OpB z?edBp0HEJWrPMT{C$i@ltdIAVil-d=#HE9H&fUz1b-WS3O7i--$(o(VaoW+UAg?yB zgBi`TWtl$X-BeGl`(J??)Pnqx%|`~>N|R%6s#1>XDydix%985x>ICMCPv><;yMvXo z3@e6Ssxc=6g2Ld3t5P3 z8ojIl7+9*}A5}%R!&Hn#jz@^J8mFj39)PLoz6`FYXHSJFNqBImNGXD-B3VfKQWfv; z>#=`QmbOt+!Yx03>CJ)kHv@~4{vQnZFNRQt6YHTD1nM9KrFdjkRAT>4ddLNK}{ypwo_^!9EQi zXFxU2_R94k7*K>OZsZL0n}}*_ZCC!Y(}^H*8Tak`R_z_&52#=8^|u!srnGTBD!RAY z2AUeY&QXY3&i@Y3Pn<_(H3zC(gd;C_n8yaLqIKxID@)3{I;t5TwB-;uQnSmNn%aJs zE|Ew~S8pD>6a&8eS`2L_@m^it_PpQ{V(bxQrq@_eNM%)>&7g98B$r71E6rn;?fcL4 zL|+(#gy35)JSgVyi-}vAe*z76w;U|6F}<{DzmA^EevH zwmFW+x~Ufs2~Dwkm!!ax5M(}2;>=XL!`CKf zXO{DhB(-}o2v9e(;*}*;?%}psnz7Js?|3_Bm;!(4WHjJPqbX0eyZ%hfG>`fbC}`$q zW-wis<*7su)HJ4~>tH48Pi$A#d!ekzT?8g_n*em30#b>a4ObM}t%(xvkk-}uv^k1e zaD-mGkcO}}PNlNd4BKI&WNr$fqp4d)F++eUft@j(@C8$VIYWR7epL#T-KwG59=BZa z28j9wp5S!psHkzLCG7U4>W4j|bqx@CdcwX?tVH2+7~>BIj5Cq3UQH;3LaO#McMv6G zGH4genTSrB0lx60oNWO`m8z0^ZR>N)H^t#PAgjU%0y7K;nc$F0AZgqQ5L!qL3^CCKdz~8~d~r|k z2$8rQ?}h@mYYeon_&wp9dZZC)e!R_H)wDN1(2#z+tYzp2cQB$5Var%Wi#;}gj20QYK)TBC~r?db?#ZjGul-1>TR6wRQH{?Sr#^dvH}oV zoWr-Q#AddVxsnBBuwy!FH;zgAYFrG(rlO>1Ec7p*%~Kz&b4=#<6{+UN+jV^-*%aD+ zk6QF>#}w3gX2!MQv77-j-w+{F;FBaKa+9z`)!ftL)tniu5OGF?0ks=aK ze^qwqFU^pgRoA~Qo7tLU%HnH-``Sbv1eM0=9{dMo@>bBR#h0Ii{MrzeW^5! zvZeB-%IkaYt}($OrM$C5SDPg+(KKd?sx^(J&MlDst1(NorMN5qU)HUHrV$+4JW)1@ z5S3h)TLUQC=A4@)+J*xyQ?zxQrqNQxAet}y2>C zv*~M-L#zo9X+s?pm=iIXBVLUtHYbZVY4+DP`=15%uU#)e)J7v?#0@FAR z?VyJVtg0>#fBI$EC9HcZQ3(qF`v)WO`BE}3W_#+_+4(*W4(K&V?ph3Rd~oasmyyB$ z>$(_(q8FV=(8=c^%AO6C8qN_&>i@aE4I(Dc@M!(52V1R8%#d~DEjx{5)taifbe<+l z^Y$~XhY0Ej3i_FO@@kd5ojXh7bFm(kIk~Poq)bqZ#u&WC8@*9v-nhtsFJ&J1VpO;K zqnA9MzCicAjO6a7{WxbXzBXLs=^{DPB%s%P)n>{gS# zC$lGz4+klWm)l!-KN+FPl_%8{X-B%#)zYhH>*MMD0Q_`=o}E4I*5AO@!I8+mKmV5W z^$Bd|AI?0RFZoTMGify@1j4K@hXFX_QBIy)8NK#}D6WR;54f+M?0erO_`TNV1mdqS zJ?;uxaiQMp$J@V2GEkUC3sF)4=fiJhlyx$igeFBJ{nY4*_hG8wd)X}j=J z=Fk5ST-L>4dFK|<3H5yAUEXECf&4d;nUDH?2ipS!IIGs&E8Y-tbQF6yXfX%;nys~G zG&8fY&EB3a1IW= zYAK@n+&|K*bXI1i%1sTsD98J`tuNSSYtv+s2Zr3WLLjbARXI`f@O-1$p5Xa0-h?f+ z(^}qpR2%T8#fF79kNugboW#jIH0bp}Q2Cf>US__NiU$7CtpHn$RO^rASj#LZ!o?soRV5MP0R>a!|wvvfJU z*XRM|Ceb1Hcs_P6Wl~(H0rpv)S9?H>(uCZo6FRMjf@bH-Iwx z(Er%d-D(P>2~@mqcD4^&NJ z*K>-kC4wGc&u`tF9Zem)&;8$Qoo?4;=Qe=su8=y2oRH*SOUOcV5ydv!)40~o)*GuEY+T-?02+;Tr1}$Kqz`H^-Xc6!<_7GZ zD+@=Yj$*Tzns=|cA#2n~#78>uiMm3PmLeY0B@$0-ElnFi)L!GHrulR!2hE}Ig8Wp1 zN)t6zl?z!~SMSIqs{cyv>XL$x^a8$^zreCtG`;qZ>ALp@>Y84ylge}S3P8}gxGvtV z$LaD>%H`S-*4NI;|DfzHoE@NU-zG&Sn*5EdLJJq-^9ei>yj$KS>&}vx!j>Gq<6g-* zc*groadBnj+?Kx1f1>{T%54N@;B%UbqNY|&OB*_G-ZrVF3Efi|sIcL5JSE>dnVIEH z%OF;$5WIz)nRQ6?1RJjsx0?m&aw2FIdw^4{RpvvFw2s!{MZE*!L>Z1nDJ|N1ftpZY zv@DKFxvHOwLeXRcGNtAq>C;WHgcr zWQNoY0xEOM#y5mhjCZ^Y?vB(e;+s_t+DBjyw2W=Znu8mhi#UME(KIqM6lj;pj2<@o zJOT%(ZNR?zwz3d?7`s>cWj^SYj|WGhVz6L;E~hZQulpU!LH zZVdA6VV`ZgQZJ%;ZZ^czF5ZV;f28h-9AB6ly)c!idb;5GlXciL|KgGUN9ktkU@IK8 zvN=YVD2p`SMn!$Q3Ja`~1_+tR?f*pSvxL}FBeuwwWe?6 z9Mnk_>Lf4Bj>~MsZD(W23aLzL(dTJMwp@~nLx+OqHtTj8O)(RnI?JWGNj-Tgm-$J( zbX|FFJE=d`f4LW>HF04GKq`k2CI2CS_V6@lA%4(0Xz#FGDi6_>hlXFhDHUkqDbd<{ zjO8gwK3tf~)Js=CnFw)fbXKa`r@h*BCHN@6y&(5F>~H~fL>z2e#ZW@{vCmGARk5PT zrpf$7ao(2JExvfM+_GfhV?|P*mpU~4Y$;rW7W5S}+jXTjMe{ajDNgFu^s!%uL<;M1 zJUWS{zQ|qcHydL~J_yxGUC%6y=S9VI1H_Qj z9^EJoPIqUQ;qmuFDu})h0Tri0`z_@`5sr89pRqToelsw$#-G-Ja0^B`TpL33GPu#7 znG*=;|5gN{6Z$3sYN}W1Sd9Iyqp6aApMPDH%&b}^V%)UO_=O9|4yU;*#M03v=L1$N zB`xDq>klpxW-j<>%7Qia*!hYiix{BUTPhBsDCL|CxWaz0@a$qAv+!t|GY-|-){ZmG z?Iy|cB;?>%!;I$HSGQ|U0zWG2p}$M;82=S`GsOx>(;q)KutIGsI;?os0T>yeG#yTt z#uVPU2RS7cwDzWK8)JsK@=fI%60C>?Gm-Ue_1}LJMS{w4PoKD6*Z@}{f_EXfvEB$? zmJLhxgsgPPd!OY*yWoMA?x4*;0g^jNU&`h>>FkLL%}5TkUbKi;0VK+NQJ}@}B97w} z$vmy-ru+HlST?%;#BWzOm-Fb7bNFtg0~uLE{-5KphRHsBl(mzI)41lT1LT&*KTWQS z$R|t^nBm70DXK0t4G2Pusm-Z>ylrBsy&W!P@ZsjCj0kniTg&i35>{Hz4lhej)Xhh| z-by~KW|}lAl3@W+30_HO=>Wdz0StwjX3T@T%uBjn9si!UY`wTX!BP^`WJ`j-RG0Dx ztT;>O!gf2oHB#IP7=T+*#IQ0Apt2TxZ<$)jVoGsNeCu9iW#8@HU-zcs`>k)s!^zzU z7RQRmebhKl#vcrOPCpkErKdn{-j9`WpHds64(;lz{xv^KDkae@JH^+uwYh8e)%=ut zQ`4(LKwn)cXDFMljWjmuzG3fw(FWh*Luf$fCAl4f+y}0iBK(o|iXq+);LS4KQo!BP z{ux#NJD67AI&S4pcE(SMan!{U)4KXGUmi6>+qN5x;1IBYY2U+iq>1L#n`6CEerOUs zL0!qN6ty#3+pH11jDA6MQfJOxXa#tO^IgC*h*@yJdsOh8!Hq*3ZYRL{Zc;Xe(pwC@ zZ;r)Emv93ye;CYt=U;$g=*4#?qc+t;48UPKtjL;P=PXX)7+o-RTuYnvPdqRcDu^+? z%K5c9F^%_Y%Rk5ol|>t?-NBO&E=&IH#Dnpldj}s}-XIrEQe%`);CMnJyj>6l^NSLH z&bz(!OyZbxGJA_ju$<2?;^Nzovn5e0Yy`Lspjo=fGTFL1+B;w`=c?)SrsRhqo(r^J zYrv5kE5!0*BE**71l#n~4RK_c4|0)4(?Uh{!k^g~9xB%Oku!lU`~GdOq`n*s<6PUI z9uG$Z9l6Q?HN~p4!Ksr2l(Jc7 z{wd9TD5LIPMBq`J|NyAVl-$kaTrGPzG0$$^LV%L41| zDkY<>hZdG{iU}XTzagR(nuv?>vis<^v0szM1(w4p+sEi3fuTPAmkoun3g&rUfTJ#dwpvLrxqPN^1)Heq~~n;&k_W zA>c0hF|&ofp1&`t2#sN;7c#D-8)x-mM(J`k z`Tl1_A&S03_)$r`5jiR<*1c&BMS4v?7mt2CUBL~eH8Q8We^cl{zj28rd~slj28 z#m`Ne1{qB!6vYUyhdZn{Y*{S-8!c@xGZk!nd}B(88HSa0DwebDK#n^)NoVXbUht>> zZAmz1<<4U#xNhwLDA2M$$M>+nMjX0O_~pff)Z@K9l*29|lCrKKR*@enf)y0h<)S!LIY0nJ^uE__)eL9opUAE%-_NbiI<-n*jFK06>auP0=5 zbrJ1f^x)n|>nT4p?nl+_eTIsZHX2ZoQmC0VjAUNG&6BTfJQ&1Kb;9VwO*6?m$I3i| zg&h;}w7bi0h{=3^&>BAX94aJ11h}}VGSlVM)opB<6cvjYTMP-6io$PG{G8tjItMO}*RE8> zDR94&HY~-$I6T*#fw(0%|YbUfkb5a_K;jz1WOkq=*?(BxLH7TcYjS z(QBLt!zAJgqQU%!M{Nvc7czYJ(dLBLrNJMn&TK*5x%?8~lv@5pqNMUH#%qaus@5zs z6i2+1$uz;%0wg&x_+$w5Q_7O9z^t$`!piS5kqA-v3XZa)j5sv~cH&(fCk=iS|0TzV zWrOKk@&VlFKh&${=kG&@hoQ;6BZ#a^f^b3cR zM(%J!Te_7-c`K8tzv9h`E`wZ?h23u2nOuU(A^P794F%baG!NHI-Ca1zyN}wU4E2H4 z5L(wFbn2m>8n;KNGNw8-%8 zeoy$OaK>1sw(jt*orfLmI#^!_6h5FFgC?j>9D5i3;uxWt`;B zH49pmwyO895%!)U$g@GfoE=0452ly4z!kKk-)(k`SBq{B_vM*L8U4*Flh5iisQ^;_ zY4qqv1eWokC}lp{>{ZrN(}yh$n@fEh8!@EC6#XH`V?ADqNpr#bs^ZCwFWH?JIBWYHP0?07UCmFnK{NAog(%=u`0@r zHahUEkW+eM6;GE@-lV}gCi{yOGgC?=htpD=sl1d>gj(o2k|YoR#bI<)Ta&}718G(l zFWvd9AUpGLYMz&2djHKXTj&vOlOE(oE%Au8p^HJal3H~*LLcMVl%kn`ZFhk`+4dPIpWIzYT>dxG?+Mg&B3qe+ZN`2yiCnD zC&*^;#N&7ol?V+8e3umOe_6MKrq1W6-DjFKizr*1b%R}qZe|=P_zU~GfCn9y`=gr6 z3!KwYYZsC~t$~B?JwA-;?~(BJ89gR5y;oHB-_dJ7$>i&r88{f+qE~%BUeD$%NFi&l z)gMMl{!5E!U~w1dLCo%$IRy}boZhb*!*40%0jYz8C{K5Uf~la_1QIqkFI6Gc#F3#x%`z(GV}tz1GOAa|OUcfs^Q@xiS^S z;_F(SyU1ec!6=Ho$4OQqKs}-RhJ7W9yblR!;(bB5{9k{MX8Hz-7TB9jQu0j{@kUa7 z9*jvJsN@M-k;Ndhq$Lg=2d8CeY;(y&V^;PniBeX|4!J76O`P_ z8N|j8oF)x>t#tXGlBDDi@k4nHIq2<$kcV&xr!kg93m;v}${k{}OoTRDfjx1k+;Hqj zTC*nhL4=e}KBPRU;#|OY_w7&rqLmea=$`KvDSIPH9NDc+76 zhuf#26q%%4ba{30teq?^t`I?r%F3s0#(N!elF|U&`P0bqw%*6UBpmOnP~s z&ZK7VfKHoyF3xmC+v9$>GNrxh=^^p@t zU`evgz5Pn%LKi@6qPyF@N{&mNr|NJ3mN6@N@3eGyvB7!`x6`VHWZ*i_cv1d?b*{%M zzl(YJTO$LLRbske(*0y&4(&to<7%lgJ#WZf93o-1`Yu>ur?j`g0l7p_L=H?@_x5D2 z8nuz>j*S&ypgTP@=&dym$0SXpL1Cf7TbvYRw|BkgM(3}>s20159%Eo@CP_uCnJgQu zR9=`U+frO|WaV4!us|e%^^HwtHWWZ?B8{hrE^DZcFDD3#A(=PW?>%@r6B?dYP%@A6 zDc27r^hmirlyk3HE8D6JCF;7MEi+^MK!44Tne$4^^@4Q=3x;(->DrgE(6ezg0$JER z(@S%M`Z&Ac=q{?$j3#~;k1>{zB|IJA)qh~Zh_e`b5Ts2*hx6-(lUYP6?wsSJxz=7# zs$>jOf)0EQn}>BY5U)A2Ti|gn!-s}?R{4Jf1ckXgg^FFI>k>roR0OhL?hfZ}U)MJF z2!g2RzKg2mj8?LIK`oLD(3%Utax)$cPUnqNuEVoVQr~03d%}_XZ|8{fqkb#dJD2703lUodkXGt$~o5t3ont?BY{n^`(#aAWUe_q z`Nq8Wzf62rE--s60rC%n{VmaZYhbf=JyAR@^2R(86JYgZNo4a8FB2p#iu<{9=S5LO z<6`ytl&P#Kox&f#C`QI>4~7$O%Y#Gl2^$5HXGd!6#RWJiSt{ePNH0qfA}a9t^zA z3{2r~K)7asDf!s$D6j*(u-Isu<8t=6B~7)m_-#K7vSoG~;o>C!63=YAz5+h@q|2JV zRlpS-eUgZk9SpWzvB!lq)UKDc5l2yE$U~uhj9&`IO;>@F62p`G3Jjr3ocRmxj!=_9 zPfmn-(p5~|P-uCQf?ETiO>z8;1}<~N+=2#fx}3PWEQ`IW4O4jL?3@N}n*aZ|r^``m zAg9aa4?1RbA=Sk#YTz=yDJTQ{j~O~}LFR3f_=|PATu@Y4aeS<7_`jI1MWADUeN>kn z+?P<7wPp(ES;VnkoFGG%N8plBq|N(_L~^`+{;#X&({#-cBFj71eTx$-1kkTX_o9{7EMX5gR7Mthcz{5#Oc+>{|lQ*#{f@a1}MM# z)C6viXJ|^wyB%F3MOnnaj`Md9!VP(2+Dpsvxr@ZZJjIt6N+w--YLQqhPZPx8D7#v* z7+M45LKP)h(jr#{!KkB}Th}&bU+^mnXh3u>ZWLp1@U`jjZqU=_vt38^r?saN4}4sG zqgu;qFWeOl+_qP<{q)84$NSQhBx=17DWP{6H3E0s&Mbk?+ijkA$DI@N$ya2gq`I;W z74+cI={xjYON(;6CT~!K@BOOK;qs3TE`fB5=M`|su=<@LvT`S596kP7o%@dm z6fSS+b&)fUrbHgi%e`UN7w+}s(Gi(`#yiuSV}OE06QZt2g>4YQ_)A(|gW96P0h!2G zk+3_(gXSZ3m%|BzVeWQ(&*WDO%$H6ST?l{p9$iCRo2;Qe?-OE7g}}I?-ynH)wRLU$ zm~Ud1DKo#nX7r`MkwQ>$q{*!BqL*o^lV6-~Fae~>6g$Qnq?sHR&S01TnNZf{<39kk z)SG&-^wfCX=MPr5M6pl__+^!ci-RhR4)m$KrgA7?{Ip!gXm|VGevK8GfA>{QuRyXg z=$A~Z#GpU9T#-1u>`$ew+w=k(Oij7peZYyu2z$!@*f5rl(dOh{sR9=IkFEwHzp#1U ze^J^}1P~S%?s`6!f};{&e6p6}Q?@I$2V-3$M~=d2ofo*d#+$F zsUTlIVyDR_?5YV;V89eSW-ul+YY2}v%`X4_Db;t1fb@U|F-X92Mnj>Z`i%K$t9a)m z-RFbiV^Sjr28=(`K0*PZUsn6|73iE?x8C?H-*3ar`vqcoHl&PaR!VJRYMDQFET7Ll^On4ECvS~)hQeh zQ<1p{Ri{v(ru2;Ajo7Y6my6(cBZCXhds53NH8|NrbKQ8l@Sn}V4fmFgZGh^BKD;Es zh)}t}YxvUArXip^VX()fNQ4%Qkb8LmIbKL)s*pU45Xje1VA9NH-IS?anK&Cj9szht!X4$<24?$32t7G=xpBD3{LX z`{%TDy*^j-Y|rK|<}pT_y&0;@A|#*J9>;jjP3V6=fw#%{dth)!whpp|yK`UJp=ol0 zPv?FgEy-VpJFfm#?l_cRSF)_#NXR1ez^i3>%!MO~2J8*6Qn(AWuSD&f)wY?DNQn}D z+qU;@xtV9@pe;PqN-&4Ic4;6e`1Zz@N3erU7Woi-bM-(sTTL&}CR3;S7T&?2VPJ z9MBUW^i!8_ntgm!Ys`u%yQ9*w(LQG(tL$ZU;&)g42089;S6D8f)%jfbWwkks zvCnKEr5YY#I*9%ykP`g4`A!E*W4%h?%e5(N49Fxle0+-2vFMm&cF-69^H+2O&Q(7f zXU6L{vrWa`09Qmx{Xs1$A3{kcMpt0p?)C|(f;OJUo2!D>Y<8AAOmwVg{$KB1n6drO zLq&1|ZT$zAjUZyVAy(1BVUN-zUQ+b-%IW0cwQ2)0uLFEt;he)sPWKy63Ul&YqJO4U zD!68pId1BIw&7CiMey-Y7>+^%V?4Y!zdn9JeeMLQdItP(xAL`m+!Q4yoPKEsBf;Ey zQ4GatN=oJo+W+u>6UGnk)_Z(X*sDcGp+_<7R7jEhPuyjhk z>ErwU^}fwwea#vjKF5e@)%lpvG(Cl};On|YLR%GDb?fQp52eB_QYLR_DP(tb9pSR# zeSJ=g#;a3CCsIqO|2Wu$20vPAtyDx&inP)pU(+>_))x3P?#qR{h9R=UcvHH_HP6fq z2u=>tzfuX?7-Izb0*g^q($P@MXGJ6Blva;-?ZasYz~SrDIi}?we{SD<&rxMxoE~oM z*mbBV&-6!=SEITG5jiP6cWAC|Rn7Tz7yN21AUqBpLp5y^YxBacC^cjIc_!atYed4s z{;c_2zm?fdrg1hQ2L1)oX<`q998ah&c9Zdzu#adygVr;sdwZtYw_afp8?|X#d^I^q)@u8??N&?D>b|zs%)f2vEvX?Pi3(FZ}86 z`}jX#)Fzq6|6ztcA`%MEDB=53d$bu6lDUlWW|*oxs;;vC1*Xqt4E!JFe;bVX);^Zi zSqGZujF+d7Kgj`BPeQ_5{of(CH(2A}@jvFoGsO>AD#PCrmuWmM5suF;sjb(@RyHdk zrMjqhbbd*H(t!N}BPTy5uIUfvz$5dz9h;0R{!5Mv0#r!y7h?o!x6V85JfHtmoao*u zLQEt+XdD6F2{j-ZKkV847;}-ZEa@iC5|oI^=P4Jf?p|G*u>t?mIN~aIUo6=4Tci(| zW2V?0SxW>iOF)-$QW7%}8E3_9CkEV)WbBohjbFo!>ItjAgc(Kd8&ttA_#S!J`)njf zK3xGCjjICY1^5_Pr(#jw%1j+{Gbl5B;;RwKHgJ#{7Cq(pWA**H{ky=8I&OT*Jgg0@ z2tvteSk2DGA0!odSU7wbd>9xQWEkEEH*Ig0gmfnc7#O8T7#JdG?|*J)APW;$3r!nI z3ribE8&?}AM>boqljDDrT(Mw*7ldJ9l)^AzaQ=g#5K8S}V&kY`;oxi!rTS+$0^(m@ PaL_#%dMvSmg|`0>zP3f> literal 0 HcmV?d00001 diff --git a/Solutions/Microsoft Entra ID/Package/mainTemplate.json b/Solutions/Microsoft Entra ID/Package/mainTemplate.json index e909d823b9f..c3c6b078317 100644 --- a/Solutions/Microsoft Entra ID/Package/mainTemplate.json +++ b/Solutions/Microsoft Entra ID/Package/mainTemplate.json @@ -49,7 +49,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Microsoft Entra ID", - "_solutionVersion": "3.0.7", + "_solutionVersion": "3.0.8", "solutionId": "azuresentinel.azure-sentinel-solution-azureactivedirectory", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "AzureActiveDirectory", @@ -440,7 +440,7 @@ "analyticRuleId61": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId61'))]", "analyticRuleTemplateSpecName61": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId61'))))]", "_analyticRulecontentProductId61": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId61'),'-', variables('analyticRuleVersion61'))))]", - "analyticRuleVersion62": "1.0.8", + "analyticRuleVersion62": "1.0.9", "analyticRulecontentId62": "050b9b3d-53d0-4364-a3da-1b678b8211ec", "_analyticRulecontentId62": "[variables('analyticRulecontentId62')]", "analyticRuleId62": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId62'))]", @@ -547,7 +547,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Entra ID data connector with template version 3.0.7", + "description": "Microsoft Entra ID data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -926,7 +926,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureActiveDirectoryAuditLogs Workbook with template version 3.0.7", + "description": "AzureActiveDirectoryAuditLogs Workbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1014,7 +1014,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureActiveDirectorySignins Workbook with template version 3.0.7", + "description": "AzureActiveDirectorySignins Workbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1102,7 +1102,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountCreatedandDeletedinShortTimeframe_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AccountCreatedandDeletedinShortTimeframe_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion1')]", @@ -1219,7 +1219,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountCreatedDeletedByNonApprovedUser_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AccountCreatedDeletedByNonApprovedUser_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion2')]", @@ -1336,7 +1336,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion3')]", @@ -1450,7 +1450,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ADFSSignInLogsPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "ADFSSignInLogsPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion4')]", @@ -1554,7 +1554,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AdminPromoAfterRoleMgmtAppPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AdminPromoAfterRoleMgmtAppPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion5')]", @@ -1673,7 +1673,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AnomalousUserAppSigninLocationIncrease-detection_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AnomalousUserAppSigninLocationIncrease-detection_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion6')]", @@ -1745,8 +1745,8 @@ "Application": "AppDisplayName" }, "alertDetailsOverride": { - "alertDescriptionFormat": "This query over Microsoft Entra ID sign-in considers all user sign-ins for each Microsoft Entra ID application and picks out the most anomalous change in location profile for a user within an\nindividual application. This has detected {{UserPrincipalName}} signing into {{AppDisplayName}} from {{CountOfLocations}} \ndifferent locations.\n", - "alertDisplayNameFormat": "Anomalous sign-in location by {{UserPrincipalName}} to {{AppDisplayName}}" + "alertDisplayNameFormat": "Anomalous sign-in location by {{UserPrincipalName}} to {{AppDisplayName}}", + "alertDescriptionFormat": "This query over Microsoft Entra ID sign-in considers all user sign-ins for each Microsoft Entra ID application and picks out the most anomalous change in location profile for a user within an\nindividual application. This has detected {{UserPrincipalName}} signing into {{AppDisplayName}} from {{CountOfLocations}} \ndifferent locations.\n" } } }, @@ -1801,7 +1801,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AuthenticationMethodsChangedforPrivilegedAccount_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AuthenticationMethodsChangedforPrivilegedAccount_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion7')]", @@ -1937,7 +1937,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureAADPowerShellAnomaly_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AzureAADPowerShellAnomaly_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion8')]", @@ -2064,7 +2064,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureADRoleManagementPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AzureADRoleManagementPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion9')]", @@ -2183,7 +2183,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzurePortalSigninfromanotherAzureTenant_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "AzurePortalSigninfromanotherAzureTenant_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion10')]", @@ -2252,8 +2252,8 @@ } ], "alertDetailsOverride": { - "alertDescriptionFormat": "This query looks for successful sign in attempts to the Azure Portal where the user who is signing in from another Azure tenant,\nand the IP address the login attempt is from is an Azure IP. A threat actor who compromises an Azure tenant may look\nto pivot to other tenants leveraging cross-tenant delegated access in this manner.\nIn this instance {{UserPrincipalName}} logged in at {{FirstSeen}} from IP Address {{IPAddress}}.\n", - "alertDisplayNameFormat": "Azure Portal sign in by {{UserPrincipalName}} from another Azure Tenant with IP Address {{IPAddress}}" + "alertDisplayNameFormat": "Azure Portal sign in by {{UserPrincipalName}} from another Azure Tenant with IP Address {{IPAddress}}", + "alertDescriptionFormat": "This query looks for successful sign in attempts to the Azure Portal where the user who is signing in from another Azure tenant,\nand the IP address the login attempt is from is an Azure IP. A threat actor who compromises an Azure tenant may look\nto pivot to other tenants leveraging cross-tenant delegated access in this manner.\nIn this instance {{UserPrincipalName}} logged in at {{FirstSeen}} from IP Address {{IPAddress}}.\n" } } }, @@ -2308,7 +2308,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Brute Force Attack against GitHub Account_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Brute Force Attack against GitHub Account_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion11')]", @@ -2422,7 +2422,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BruteForceCloudPC_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "BruteForceCloudPC_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion12')]", @@ -2539,7 +2539,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BulkChangestoPrivilegedAccountPermissions_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "BulkChangestoPrivilegedAccountPermissions_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion13')]", @@ -2664,7 +2664,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BypassCondAccessRule_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "BypassCondAccessRule_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion14')]", @@ -2789,7 +2789,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CredentialAddedAfterAdminConsent_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "CredentialAddedAfterAdminConsent_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion15')]", @@ -2903,7 +2903,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationAdded_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Cross-tenantAccessSettingsOrganizationAdded_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion16')]", @@ -3024,7 +3024,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationDeleted_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Cross-tenantAccessSettingsOrganizationDeleted_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion17')]", @@ -3145,7 +3145,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationInboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Cross-tenantAccessSettingsOrganizationInboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion18')]", @@ -3266,7 +3266,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationInboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Cross-tenantAccessSettingsOrganizationInboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion19')]", @@ -3387,7 +3387,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationOutboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Cross-tenantAccessSettingsOrganizationOutboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion20')]", @@ -3508,7 +3508,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationOutboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Cross-tenantAccessSettingsOrganizationOutboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion21')]", @@ -3629,7 +3629,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DisabledAccountSigninsAcrossManyApplications_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DisabledAccountSigninsAcrossManyApplications_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion22')]", @@ -3752,7 +3752,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DistribPassCrackAttempt_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DistribPassCrackAttempt_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion23')]", @@ -3875,7 +3875,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExplicitMFADeny_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "ExplicitMFADeny_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion24')]", @@ -4022,7 +4022,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeFullAccessGrantedToApp_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "ExchangeFullAccessGrantedToApp_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion25')]", @@ -4087,13 +4087,13 @@ } ], "customDetails": { - "OAuthApplication": "OAuthAppName", "UserAgent": "GrantUserAgent", + "OAuthApplication": "OAuthAppName", "OAuthAppId": "AppId" }, "alertDetailsOverride": { - "alertDescriptionFormat": "This detection looks for the full_access_as_app permission being granted to an OAuth application with Admin Consent.\nThis permission provide access to all Exchange mailboxes via the EWS API can could be exploited to access sensitive data \nby being added to a compromised application. The application granted this permission should be reviewed to ensure that it \nis absolutely necessary for the applications function.\nIn this case {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}} from {{GrantIpAddress}}\nRef: https://learn.microsoft.com/graph/auth-limit-mailbox-access\n", - "alertDisplayNameFormat": "User {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}}" + "alertDisplayNameFormat": "User {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}}", + "alertDescriptionFormat": "This detection looks for the full_access_as_app permission being granted to an OAuth application with Admin Consent.\nThis permission provide access to all Exchange mailboxes via the EWS API can could be exploited to access sensitive data \nby being added to a compromised application. The application granted this permission should be reviewed to ensure that it \nis absolutely necessary for the applications function.\nIn this case {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}} from {{GrantIpAddress}}\nRef: https://learn.microsoft.com/graph/auth-limit-mailbox-access\n" } } }, @@ -4148,7 +4148,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FailedLogonToAzurePortal_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "FailedLogonToAzurePortal_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion26')]", @@ -4271,7 +4271,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion27')]", @@ -4397,7 +4397,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion28')]", @@ -4527,7 +4527,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailPermissionsAddedToApplication_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "MailPermissionsAddedToApplication_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion29')]", @@ -4644,7 +4644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousOAuthApp_O365AttackToolkit_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "MaliciousOAuthApp_O365AttackToolkit_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion30')]", @@ -4772,7 +4772,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousOAuthApp_PwnAuth_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "MaliciousOAuthApp_PwnAuth_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion31')]", @@ -4891,7 +4891,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MFARejectedbyUser_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "MFARejectedbyUser_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion32')]", @@ -5024,7 +5024,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MFASpammingfollowedbySuccessfullogin_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "MFASpammingfollowedbySuccessfullogin_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion33')]", @@ -5141,7 +5141,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultipleAdmin_membership_removals_from_NewAdmin_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "MultipleAdmin_membership_removals_from_NewAdmin_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion34')]", @@ -5249,7 +5249,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewOnmicrosoftDomainAdded_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NewOnmicrosoftDomainAdded_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion35')]", @@ -5330,8 +5330,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "This detection looks for new onmicrosoft domains being added to a tenant. An attacker who compromises a tenant may register a new onmicrosoft domain in order to masquerade as a service provider for launching phishing accounts. Domain additions are not a common occurrence and users should validate that {{ActionInitiatedBy}} added {{DomainAdded}} with a legitimate purpose.", - "alertDisplayNameFormat": "{{DomainAdded}} added to tenant by {{ActionInitiatedBy}}" + "alertDisplayNameFormat": "{{DomainAdded}} added to tenant by {{ActionInitiatedBy}}", + "alertDescriptionFormat": "This detection looks for new onmicrosoft domains being added to a tenant. An attacker who compromises a tenant may register a new onmicrosoft domain in order to masquerade as a service provider for launching phishing accounts. Domain additions are not a common occurrence and users should validate that {{ActionInitiatedBy}} added {{DomainAdded}} with a legitimate purpose." } } }, @@ -5386,7 +5386,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion36')]", @@ -5503,7 +5503,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NRT_ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion37')]", @@ -5613,7 +5613,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_AuthenticationMethodsChangedforVIPUsers_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NRT_AuthenticationMethodsChangedforVIPUsers_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion38')]", @@ -5726,7 +5726,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "nrt_FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "nrt_FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion39')]", @@ -5839,7 +5839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NRT_NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion40')]", @@ -5952,7 +5952,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NRT_PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion41')]", @@ -6078,7 +6078,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NRT_PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion42')]", @@ -6191,7 +6191,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "NRT_UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion43')]", @@ -6310,7 +6310,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion44')]", @@ -6440,7 +6440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrivilegedAccountsSigninFailureSpikes_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "PrivilegedAccountsSigninFailureSpikes_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion45')]", @@ -6569,7 +6569,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion46')]", @@ -6686,7 +6686,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RareApplicationConsent_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "RareApplicationConsent_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion47')]", @@ -6814,7 +6814,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SeamlessSSOPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SeamlessSSOPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion48')]", @@ -6931,7 +6931,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Sign-in Burst from Multiple Locations_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Sign-in Burst from Multiple Locations_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion49')]", @@ -7045,7 +7045,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SigninAttemptsByIPviaDisabledAccounts_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SigninAttemptsByIPviaDisabledAccounts_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion50')]", @@ -7163,7 +7163,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SigninBruteForce-AzurePortal_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SigninBruteForce-AzurePortal_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion51')]", @@ -7290,7 +7290,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SigninPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SigninPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion52')]", @@ -7400,7 +7400,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuccessThenFail_DiffIP_SameUserandApp_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SuccessThenFail_DiffIP_SameUserandApp_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion53')]", @@ -7546,7 +7546,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousAADJoinedDeviceUpdate_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SuspiciousAADJoinedDeviceUpdate_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion54')]", @@ -7625,8 +7625,8 @@ } ], "alertDetailsOverride": { - "alertDescriptionFormat": "This query looks for suspicious updates to an Microsoft Entra ID joined device where the device name is changed and the device falls out of compliance.\nIn this case {{OldDeviceName}} was renamed to {{NewDeviceName}} and {{UpdatedPropertiesCount}} properties were changed.\nThis could occur when a threat actor steals a Device ticket from an Autopilot provisioned device and uses it to AAD Join a new device.\nRef: https://dirkjanm.io/assets/raw/Insomnihack%20Breaking%20and%20fixing%20Azure%20AD%20device%20identity%20security.pdf\n", - "alertDisplayNameFormat": "Suspicious AAD Joined Device Update {{OldDeviceName}} renamed to {{NewDeviceName}} and {{UpdatedPropertiesCount}} properties changed" + "alertDisplayNameFormat": "Suspicious AAD Joined Device Update {{OldDeviceName}} renamed to {{NewDeviceName}} and {{UpdatedPropertiesCount}} properties changed", + "alertDescriptionFormat": "This query looks for suspicious updates to an Microsoft Entra ID joined device where the device name is changed and the device falls out of compliance.\nIn this case {{OldDeviceName}} was renamed to {{NewDeviceName}} and {{UpdatedPropertiesCount}} properties were changed.\nThis could occur when a threat actor steals a Device ticket from an Autopilot provisioned device and uses it to AAD Join a new device.\nRef: https://dirkjanm.io/assets/raw/Insomnihack%20Breaking%20and%20fixing%20Azure%20AD%20device%20identity%20security.pdf\n" } } }, @@ -7681,7 +7681,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousOAuthApp_OfflineAccess_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SuspiciousOAuthApp_OfflineAccess_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion55')]", @@ -7798,7 +7798,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousServicePrincipalcreationactivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SuspiciousServicePrincipalcreationactivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion56')]", @@ -7933,7 +7933,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousSignInFollowedByMFAModification_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "SuspiciousSignInFollowedByMFAModification_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion57')]", @@ -8039,8 +8039,8 @@ "aggregationKind": "AlertPerResult" }, "alertDetailsOverride": { - "alertDescriptionFormat": "This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.\nIn this case {{InitiatorUPN}} logged in followed by a modification to MFA settings for {{TargetUPN}}.\nThe sign in was from {{SourceIPAddress}}.\n", - "alertDisplayNameFormat": "Suspicious Sign In by {{InitiatorUPN}} Followed by MFA Modification to {{TargetUPN}}" + "alertDisplayNameFormat": "Suspicious Sign In by {{InitiatorUPN}} Followed by MFA Modification to {{TargetUPN}}", + "alertDescriptionFormat": "This query looks uses Microsoft Sentinel's UEBA features to look for suspicious logons followed by modifications to MFA settings by that user.\nIn this case {{InitiatorUPN}} logged in followed by a modification to MFA settings for {{TargetUPN}}.\nThe sign in was from {{SourceIPAddress}}.\n" } } }, @@ -8095,7 +8095,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UnusualGuestActivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "UnusualGuestActivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion58')]", @@ -8235,7 +8235,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UserAccounts-CABlockedSigninSpikes_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "UserAccounts-CABlockedSigninSpikes_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion59')]", @@ -8370,7 +8370,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion60')]", @@ -8493,7 +8493,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UserAssignedNewPrivilegedRole_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "UserAssignedNewPrivilegedRole_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion61')]", @@ -8614,7 +8614,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UserAssignedPrivilegedRole_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "UserAssignedPrivilegedRole_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion62')]", @@ -8631,7 +8631,7 @@ "description": "Identifies when a privileged role is assigned to a new user. Any account eligible for a role is now being given privileged access. If the assignment is unexpected or into a role that isn't the responsibility of the account holder, investigate.", "displayName": "New User Assigned to Privileged Role", "enabled": false, - "query": "// Define the start and end times based on input values\nlet starttime = now()-1d;\nlet endtime = now();\n// Set a lookback period of 14 days\nlet lookback = starttime - 14d;\n// Define a reusable function to query audit logs\nlet awsFunc = (start:datetime, end:datetime) {\n AuditLogs\n | where TimeGenerated between (start..end)\n | where Category =~ \"RoleManagement\"\n | where AADOperationType in (\"Assign\", \"AssignEligibleRole\")\n | where ActivityDisplayName has_any (\"Add eligible member to role\", \"Add member to role\")\n | mv-apply TargetResource = TargetResources on\n (\n where TargetResource.type in~ (\"User\", \"ServicePrincipal\")\n | extend Target = iff(TargetResource.type =~ \"ServicePrincipal\", tostring(TargetResource.displayName), tostring(TargetResource.userPrincipalName)),\n props = TargetResource.modifiedProperties\n )\n | mv-apply Property = props on\n (\n where Property.displayName =~ \"Role.DisplayName\"\n | extend RoleName = trim('\"', tostring(Property.newValue))\n )\n | where RoleName contains \"Admin\" and Result == \"success\"\n};\n// Query for audit events in the current day\nlet EventInfo_CurrentDay = awsFunc(starttime, endtime);\n// Query for audit events in the historical period (lookback)\nlet EventInfo_historical = awsFunc(lookback, starttime);\n// Find unseen events by performing a left anti-join\nlet EventInfo_Unseen = (EventInfo_CurrentDay\n | join kind=leftanti(EventInfo_historical) on Target, RoleName, OperationName\n);\n// Extend and clean up the results\nEventInfo_Unseen\n| extend InitiatingApp = tostring(InitiatedBy.app.displayName)\n| extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))\n// You can uncomment the lines below to filter out PIM activations\n// | where Initiator != \"MS-PIM\"\n// | summarize StartTime=min(TimeGenerated), EndTime=min(TimeGenerated) by OperationName, RoleName, Target, Initiator, Result\n// Project specific columns and split them for further analysis\n| project TimeGenerated, OperationName, RoleName, Target, Initiator, Result\n| extend TargetName = tostring(split(Target, '@', 0)[0]),\n TargetUPNSuffix = tostring(split(Target, '@', 1)[0]),\n InitiatorName = tostring(split(Initiator, '@', 0)[0]),\n InitiatorUPNSuffix = tostring(split(Initiator, '@', 1)[0])\n", + "query": "// Define the start and end times based on input values\nlet starttime = now()-1h;\nlet endtime = now();\n// Set a lookback period of 14 days\nlet lookback = starttime - 14d;\n// Define a reusable function to query audit logs\nlet awsFunc = (start:datetime, end:datetime) {\n AuditLogs\n | where TimeGenerated between (start..end)\n | where Category =~ \"RoleManagement\"\n | where AADOperationType in (\"Assign\", \"AssignEligibleRole\")\n | where ActivityDisplayName has_any (\"Add eligible member to role\", \"Add member to role\")\n | mv-apply TargetResource = TargetResources on\n (\n where TargetResource.type in~ (\"User\", \"ServicePrincipal\")\n | extend Target = iff(TargetResource.type =~ \"ServicePrincipal\", tostring(TargetResource.displayName), tostring(TargetResource.userPrincipalName)),\n props = TargetResource.modifiedProperties\n )\n | mv-apply Property = props on\n (\n where Property.displayName =~ \"Role.DisplayName\"\n | extend RoleName = trim('\"', tostring(Property.newValue))\n )\n | where RoleName contains \"Admin\" and Result == \"success\"\n};\n// Query for audit events in the current day\nlet EventInfo_CurrentDay = awsFunc(starttime, endtime);\n// Query for audit events in the historical period (lookback)\nlet EventInfo_historical = awsFunc(lookback, starttime);\n// Find unseen events by performing a left anti-join\nlet EventInfo_Unseen = (EventInfo_CurrentDay\n | join kind=leftanti(EventInfo_historical) on Target, RoleName, OperationName\n);\n// Extend and clean up the results\nEventInfo_Unseen\n| extend InitiatingApp = tostring(InitiatedBy.app.displayName)\n| extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))\n// You can uncomment the lines below to filter out PIM activations\n// | where Initiator != \"MS-PIM\"\n// | summarize StartTime=min(TimeGenerated), EndTime=min(TimeGenerated) by OperationName, RoleName, Target, Initiator, Result\n// Project specific columns and split them for further analysis\n| project TimeGenerated, OperationName, RoleName, Target, Initiator, Result\n| extend TargetName = tostring(split(Target, '@', 0)[0]),\n TargetUPNSuffix = tostring(split(Target, '@', 1)[0]),\n InitiatorName = tostring(split(Initiator, '@', 0)[0]),\n InitiatorUPNSuffix = tostring(split(Initiator, '@', 1)[0])\n", "queryFrequency": "PT1H", "queryPeriod": "P14D", "severity": "High", @@ -8735,7 +8735,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Block-EntraIDUser-Alert Playbook with template version 3.0.7", + "description": "Block-EntraIDUser-Alert Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -9178,7 +9178,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Block-EntraIDUser-Incident Playbook with template version 3.0.7", + "description": "Block-EntraIDUser-Incident Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -9604,7 +9604,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Prompt-User-Alert Playbook with template version 3.0.7", + "description": "Prompt-User-Alert Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -10040,7 +10040,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Prompt-User-Incident Playbook with template version 3.0.7", + "description": "Prompt-User-Incident Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -10459,7 +10459,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Reset-EntraIDPassword-AlertTrigger Playbook with template version 3.0.7", + "description": "Reset-EntraIDPassword-AlertTrigger Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -10859,7 +10859,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Reset-EntraIDPassword-IncidentTrigger Playbook with template version 3.0.7", + "description": "Reset-EntraIDPassword-IncidentTrigger Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion6')]", @@ -11242,7 +11242,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Block-EntraIDUser-EntityTrigger Playbook with template version 3.0.7", + "description": "Block-EntraIDUser-EntityTrigger Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion7')]", @@ -11703,7 +11703,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Reset-EntraIDUserPassword-EntityTrigger Playbook with template version 3.0.7", + "description": "Reset-EntraIDUserPassword-EntityTrigger Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion8')]", @@ -12108,7 +12108,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Revoke-EntraIDSignInSessions-alert Playbook with template version 3.0.7", + "description": "Revoke-EntraIDSignInSessions-alert Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion9')]", @@ -12436,7 +12436,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Revoke-EntraIDSignInSessions-incident Playbook with template version 3.0.7", + "description": "Revoke-EntraIDSignInSessions-incident Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion10')]", @@ -12760,7 +12760,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Revoke-EntraIDSignIn-Session-entityTrigger Playbook with template version 3.0.7", + "description": "Revoke-EntraIDSignIn-Session-entityTrigger Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion11')]", @@ -12971,7 +12971,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.7", + "version": "3.0.8", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Entra ID", diff --git a/Solutions/Microsoft Entra ID/ReleaseNotes.md b/Solutions/Microsoft Entra ID/ReleaseNotes.md index 1635f419212..ffadbf1fa53 100644 --- a/Solutions/Microsoft Entra ID/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID/ReleaseNotes.md @@ -1,11 +1,12 @@ -| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | -|-------------|--------------------------------|----------------------------------------------------------------------------------------------------------------------------------------| -| 3.0.7 | 06-11-2023 | Changes for rebranding from Azure Active Directory to Microsoft Entra ID | -| 3.0.6 | 30-10-2023 | 1 **Data Connector** added back in the solution | -| 3.0.5 | 19-10-2023 | 1 **Analytic Rules** updated in the solution (PIMElevationRequestRejected) | -| 3.0.4 | 16-10-2023 | 1 **Analytic Rules** got added in the solution (SuspiciousSignInFollowedByMFAModification), modified workbook query to fix duplicate locations for the query. | -| 3.0.3 | 22-09-2023 | 2 **Analytic Rules** updated in the solution (PIM Elevation Request Rejected),(NRT Authentication Methods Changed for VIP Users) | -| 3.0.2 | 08-08-2023 | 1 **Analytic Rules** updated in the solution (Credential added after admin consented to Application) | -| 3.0.1 | 01-08-2023 | Added new **Analytic Rule** (New onmicrosoft domain added to tenant) | -| 3.0.0 | 19-07-2023 | 2 **Analytic Rules** updated in the solution (User Assigned Privileged Role,Successful logon from IP and failure from a different IP) | +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 3.0.8 | 21-11-2023 | 1 **Analytic Rules** Fixed issue that was causing multiple triggers for the same event | +| 3.0.7 | 06-11-2023 | Changes for rebranding from Azure Active Directory to Microsoft Entra ID | +| 3.0.6 | 30-10-2023 | 1 **Data Connector** added back in the solution | +| 3.0.5 | 19-10-2023 | 1 **Analytic Rules** updated in the solution (PIMElevationRequestRejected) | +| 3.0.4 | 16-10-2023 | 1 **Analytic Rules** got added in the solution (SuspiciousSignInFollowedByMFAModification), modified workbook query to fix duplicate locations for the query. | +| 3.0.3 | 22-09-2023 | 2 **Analytic Rules** updated in the solution (PIM Elevation Request Rejected),(NRT Authentication Methods Changed for VIP Users) | +| 3.0.2 | 08-08-2023 | 1 **Analytic Rules** updated in the solution (Credential added after admin consented to Application) | +| 3.0.1 | 01-08-2023 | Added new **Analytic Rule** (New onmicrosoft domain added to tenant) | +| 3.0.0 | 19-07-2023 | 2 **Analytic Rules** updated in the solution (User Assigned Privileged Role,Successful logon from IP and failure from a different IP) |