From c4e2e45e5f14247ff87ae1a7aca78b15195488c6 Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Fri, 24 Nov 2023 16:48:19 +0530 Subject: [PATCH] Repackage - Microsoft Defender XDR --- .../Microsoft Defender XDR/Package/3.0.1.zip | Bin 29417 -> 29796 bytes .../Package/createUiDefinition.json | 2 +- .../Package/mainTemplate.json | 824 +++++++++--------- .../MicrosoftDefenderForEndPoint.json | 2 +- 4 files changed, 417 insertions(+), 411 deletions(-) diff --git a/Solutions/Microsoft Defender XDR/Package/3.0.1.zip b/Solutions/Microsoft Defender XDR/Package/3.0.1.zip index 668574f0117b6e0902ea61928f789867c92ba106..d600832401d5ce133bdfe02596715c660e72aec5 100644 GIT binary patch literal 29796 zcmX`RV~{AYvNbxkZQHhO+umc_wr$(y9^1BU+uuIto%^ctt5fMpTC1}X1!-Uq6aWAK z2mtILclDU9Mr~6>0Dw|?008uVQe#I`LuXS}3lUQ@3tJ0k3p-mnOD8+qYn^Y$O^(Fh z-^v$Ug--ZMO2uT{&HG|oS9xPE<{l}d8d`EU)3Q3#S4A1k=*5a(Wi*G}$jUHT;JiS;S|#Ar)b56>y0T*qnA4WFdZ%wFlvUaEv2rz+!* z%sH0mjG>;LI{_$CqV4OfRx8@}31u==mf#fZoQ_e<6c$4)D#4iDdI%`s1Tk+NQ~^Zw z+jnv*VTx$;YK<~)rou?@NGoB^nv%O*87erq<419U#_s_W1 zbC-{+b?t)n$v?AW1ZFCXM4Ce+^MPlO#0lZXjECpx(HbNq#5}5*BaEqgPNWAo;7^G< z(vCTaz2Cd~;~n#+hm0Lue_CCxWPHrgiCc?w`9)|ksYg8av6Ou|2Y)*^gEUPo#z?;2 z^+!*8E=QdgWe2XMs`rBfz94f36~>ljsmv(%rH)-3&R`9c-zQx3!|P;hv^}y+WGtaH zL{Rfn+lfNVaT95&88ugQ(OKbv5~>_2iZLJp3{{Y(&6;eLfHu-0p&iGcx4`552J?YY2I+V2a`CUc3amW3GU4OHRCLiV$Y@H6(kYqHIicVanL^@h;)>zXN>ltY z!FYnzQ2>jG0kn{!8i*25A~IYMNTz_@d4krDDK&Y;3LR?|Dd*-JDa3@o8CcNdjUSw1 zkBuMFvL)e=2BfKGnFv{3#SPb#&4vwcMu)lsgheY>Bo)g^@+pakkvN+J<9&voXW!2@ z>o0~t6}SSh(?cXH2;I7%*FX>?Qz3_2;+>cZ^0krt@7EzoiHLp=#qb&_qeMr9m@?T> zPRY)*DaA|~7&kN+M+y8A%QTR2qmPK8?`vJa(kK*p#D`UH;WQZ}L1ma;;A<&C+zb(6 zjMAW%o_A z!t@ysqM-TBjIlmvTD&x{vf_n};Y%T=aIOS}O$Y$uL2!wu`~&9#dFP=#Rv@NGB!E2A zmUtn87cNLI0$j&a0D(P-m9hmN9_={@Mpcv@O~?@^K7tmd?i4^Q1#OwpKKg|*p!j7TM zLf~KOud7!53zA9BTF)eoJV6svw@MMa?{YSe{Kg%rOW=FIj~DI(Gh4NDv=CI^%kf05 z?osiCfQixou_YKm;Y|--RlC6|nu3~)=$5k*W8X|?pY>L|B@P!=2pyC8fm5oY!3@qd z=ey+R^|4}h7qp5XnXTGXLN#WAm6?H}lxjSO;g{oPT~daL@~M|Wal(jN(eMd!4hS^} z7n1Wl!T~6;&f_tOjlskUsl(tYK($*Tfa~Hz92JTcQ|L!Q7@@-N|TypULnaOt?u&4 zcw+Vq&Q%?nZVL_%!x5in@?}0?RFZi*Ky??$Q9%wh7Ge*c;C1675Q7w9bOxreZida> z`k=P{wzP(*vmT|vy_D=K7I(a!J)Y-lgL3QYk~Fp5xd7Cp)s;jkl$wMw8U z9NbAvlAPM7+@h7KY|KI9EpD9d$Q%GUy@3{QV}*BJQwnHp<5s58Ev(aR^Kgg{8{|)? zq8+t5SLi%zaMH$IOragoYg0Z4_LG+GYA{@)u~}e#*=AMsc)2opxuOa!mVXWp%^_;-G(KR8uehploOqFfGslOr1AM0YB6=F2$4YVdV97!Yaw}G% zC?m{vv?1YSC2PhxtyHY-d{#xe2}t&&NI#s_^1>Lr!7oVBuIVXi!e&Vqf@BT%NdchW zK4HXK3{$8`qcqV{&r|XEO!sc5kwu_BO3)m-2;Q-PkjX%k5!!EUAll?Oth}L__C)M| z(+O%DwgwA8;vu1ZEj3>IgBA=PriZxWFe97^7TTkgsfcKHRI;t6tebbqpT+oiS-J!~ zZ|92dDbjp%SH-;Q}q~JlYIom7!*{Yfh_6hf#Ek^$Md&r=@58=G2s5 zadja+UfhGDlM12DtV6>eit)a&Y|dq>QSL7c){NrtRStp!kng zt+UuroqAVGSCV{npA(_wNEX6i(-Pwaf{gaZjNKT<5XuU((U2Wip=tw0ZPKG*E!5P- zc(iaU?k&;F->3r8c03yU@!3CApK>St5SaSMmaG@EXoa(#1rFM^4ewRo%W>pxQ1K`A;=NoUB8_a4w+%diZ9Y)r~w7vRf6!%(^P z=H@W{`*2jhuo*v%C+_DEX;cu}J&k@eMwz6=e#S67f9^22hOd3)f04Qf*w@}s0N*W)AgXghX@7Zy zaUe#p)C)L`xY>HSaSqXoWb+|fI9>gy2FoD5wg4%P7Oon!uVkIFvINuq_}pRA*l#|rm&!A72SgqcnEzE-iPbMjasu(#} zl&FTf2NhExuUdy$oX1CizvZSHI`7c3hA~XYhW&PzK5kHYowjXX;KVK502<5AEE66$ zMkml35fAqDI|Eh37p6ZqGkUl6uLlkRy^^_n2|k&_=clT<)Y{}vE4v`lfB`@gjkGETM-Z*Lk_oek{aP-;BMlutAWSa^XY>Sf-j-k zE_>jNq|qiFAXJy$^z5^jFDjt0i;5D#?T1^;qZRH`nT#C{k87W{Cx)we zh$oV|;pr2vJg}%8Hg`u)S7Qix)l_EM=~5?m?hlMnpbC-doGF9_wx`!zyrV2)U{yv_ zPL?A95N{A!t498lLdkUBQ=>^J zU(S{fdt;g?S=fQdgb0b>j*vU(lrXM!Zc8lyrxi!oZ4(4Dvv0z2XrLx(p1 zWlsJDzJLdRM#m2J{MB_q3#s~Ct6uhZ)7vqaK)d;y*_U?&MwWKP=~?t78=is{+HN$aIHr1AT?r*K_&m`n@gOt5M-8+LQSZ z_zq!z3sY<$s%Oi6KYn;{d&hXkUaX{~ikD}L;}_=l=S{mVla5n2g?ynQi`G_uPA{Es z!}?hN&_NL4l<>`KaI&HFdHaZ#)=sdmleIB|qQGON;ZlkEqpsdar3GDnQKJ1saEJg5 z9d9;DgqmpTJ7VL7K#@}qMp3lQSZ4eR0q!@zCR!5$8ce5IN;DnLesQ7J><>{GYON%; zZo9NH*@EWdJlQ$eE3@oQTF1bP;_9-wSh!_?EwNBp{etNIyvbzwb0cCyCYrXc-@u;f zwHy3lO6#NYjo|*q<{)>7A>Lpg3y(6M`G8)S(iAhGT=CCg<~@9z;Rre=-7h^EP3(9V zj~tP;t4p-vHWckqX>1P|w^IW!B|{H+p+vSw@ zJ>yR?zNz~KmMPuyqq9QRQ_Ac^zECq*PS5=_j+lnFA{i-&b0kIH*>w0;=um~_X*Y8i zN#pwh`mw8+$~NmrJBn3UB2OJrsRojazb44rB+%|7ib>ia^hfK~2w0&=aj?@NUp&Wi zRQtm{IqOb+ZuGPAT{m3bgmfAG)S7&e1?pye6bv8*^Q6%yNBleG62Jg*0fNIAc~eO6 zpjEgZ>la{?&lh}pTC*v=k6*((Gdue;KmCt8a&>KPYnRJxKNsTHZgyixgPq2iT~+TA zcGRI9EH@SkzV1f%R4Sh!DejcU!Y0%3U80g;?uYQq1BSY=156EfV@a;-6}=HuvtOjN|2D3uB`B!#S(>-k86{;w!D_X_{9n zDx%OXfN%zYWJC~={37w;8Qqc?qfGG8F!$>?YcmOj){Gz^DUA!JdEa^a+>#=&-9qUR zju)Lt_&$C!%F=6s)bG0Bf%b0GP8zWKh8z3LJYoZYYeudtQF&#rRQW4gD!+^VdeJ-P z98ce3s_47lS?+RL=!)u4ZU2nSV$HEw?;b9K;qK+Ks10LltWkF6sq)f$1NVE6=3@vS zVuRI;j78#Ki={N`D*q9+8y;njmfQEcyZr@L`2U$1u7Au-Y?IOypb-E7ju$Y%KY|9p z#?Zo6#ni^$`X4{@Ury#q*T-p-E$R2yEce#`-o?^Ou9;LR@p$Iw#^Jj7c}dPYA&JMS zVKhWS!bmuQO8=^pe)dl&eehH`Hs0PYaUM?k4owF-&c*di!^(~2^-O{2N$jh{dF{CM z&0ajt7n1vp-%YayaOr8N{Vnf3@TQXmcTN!7H+=^`F=4B{1m|0jp1(8)R9UXPB)!ez zE07%y5iIDu_s#o0|DP``Q;OPPR^}oakmjX1r$PiQVZ#9gEHA!^3oc^g1Fa$PUoNjM z;mKdrCZ9o8xraCeg&? z-f=nMDW7LaeNo;?UwdBj-gdwKZI09{E%_P6wS7<59s`RrR`eo@0@Y|(qJ)l+4dEd| z@Y4VPvB{?8Zmvx5+At(y}HO>L96w>P)D z6Q;8fe?=NCn<*o{0@}iK43gIeLf8e#>0I%IH(~PWBjiCoF#-wK=^V^o!APP{q(w13 zcFJPKs`P50C$EuobGzT;m+0E)Sw;Vz94Mzdu9P&M%TsSsoBx(r>3Xzc+p04ho`Z6? zQ8*8bPD6?Pk_f-?zS!_MhI0fC2AgurRF*K0=}Nsa)|lF*>27WJPLI8D+;gevf%>AK zhhWb6zt<%x*#|mB?HD`R#A_JvJX(I0jYzhrfE4XEC7PjUMO&c^kKcqdiM~{v#$Jzi zERRb%^FBku)p^rLgLhSj2thVL?x(JSU0b*B3(4mCVR3_AT+>q0w(1J1jf2+(et{)7 zyX}w}|8}&T{?T_+hJ)XkikJ;`zseSl7-xZjTLk1?vmtcglCbOZo)Z$H6*dy%Ta(lh zjiuI#Ay7%VvreR3jhA7abROt#-_K4*IdqU6Z`LH#wR*LWu&BZ+_kyZI-&avGy)85 z0FcB@8P=RlA~Gy7^w5Z;OQ1zeD`eL}xQe@=r_R|z62$Y37n zvDk~XGE?R7lc5T=nVLruDxVBJ`D*boi@OwXSNR zFW?&xQX_!>DSAdN)sUA|RIR)s#QLHx=5nE>q<5gTWD<$JW$GUVO7lh+g|K3Zu(C`z zCE*3e$@XEU4;;IxwR&;3(RYTmVeY@Vt(OPW`Qbns{QOKu+j!^ zNSdMMUr!iRUjVnC?#yzNB-dN^9A03h+bzq&a}nFp8Uo(E0{|~p?1{p*5>_wud4a&z z3S!7gX(_O_#uuDoq6Ijhiy7R7Gr&t3jCr2G$YFVDENyk@i;uw?*DPo^w;Dc=*X9Lm z%!8361>v^(|EajKg&eR{TJpDd`$SMnl=QckM;zeA4EDkq(EX={(wzl_R^3n!v-gumP)jNV3;x^; zt51{x3jT~l;7b&IqX@M>6-X0GPl)~a7Q8KYE5;lG5);494fP_HUX-;qn#6gM#Z?!2 zGxve0YOaIZFZ$nZ_%{Ay6)8d(f92pi0kC~Q{E%aWSjjjr-bs#ymiha1|50ZD^TN2# z%mD6{K8Aa9YZod)9u52fs_QCY_j*!@DoI7)fuL()4M{RX6t$4M2AF}-3k0*`kuj!d zIlFw!!xxBBXe0lcmeGxbiZ+KoEEvr(f~3K5|1&M$4pQ)PaXH}r;eS+=q7uNwR$Q%% zWd*gGn zpF32OiNWHWlCHzWrvxMUZ_$B1uoT99kpE&M{x)1;=D73!M%N~VHAtlQrzd8jvBkkM zt$6x0)wp;SHMq*e?%_MJ*cw-D<2MgCXjGe1!;h8r(g8?_f`~p}Fg;&fTr8_DSvk8D zRh93?@N{bm_R4^Xf?_j)rtxo6sMZ%0?)ldF75`^WOGB_%<=-k-(~IlMsjsO#ea-?!@;m?`+8 z!joamrsPMRF{KVVeyQSF=-Kx1!d5hv9I%NLFJ;>kcl%b+C%pmQx`W}i$-;0Nz$Q@ttDb{#I@ zvU(V}(;hdwAW^Weh|Yx?cn5xCTj+o%Pi^)C78aYEB(E$Uh+;`sVHcFAz{TWUE<~mz zSH9HD#MI-@a8O#NumV!|Lo-Xm)i!*y8Hey`d3T{mhZ7w^g4Q*NiEB&wweNX6}bX(VIGi-0BF@vX!so5_x269Mpt6vZT{ zQqx5V#^B0{^6fPQXjflIpLsO5h8f+PfCJ7wSeq>T%b?ra$ftUaSV_r9&CuXY*0{YFfZn-?{ZrTVD3TSC9-TD6v9zV%*r=eT*8rTTYsKHha@$ zt^#(!Ec2);Py`N=3!^nayXLWb$8KFG5#C zPMPvDLQVOTo2I6?OoaCYjyIVwb)>|qQoI9zhT4|aOOjzH?F0g6vm_R;RG1)|g-227 zXJQPZ00J91?A+YPHs7lKgHF@|yt|b(fNE6qd@kh~Ppw^U%4`TZ8n0`t{c6b4V++uB zu3GHe87*TJ^5w{c#1j}2G2jk2&>-(W>vkI8_YDx;f9rylnbUV=k<#9iV!!w1*ZVm> zzF$Yt3-A$9kpDK~a?ZcQgqB0YYdcC|B&2Tj+>zx{*Br4zR`BObky{|!1L{c;)WqZp z14!SAQxdAKQ$90{Sl<*(v%@e&P%Z;cNpl&}Bj#@VopPsKn1PTJ%0Me~tVN0a5q zpv%FPQ#pUC3kbxC-gZ89@_kk6qw! z6jjxI&GglQr8s`!*cGX>@<=MZb;7Kz@y9N0e-^d$-Sk@>7cHv%jG@iv&ZDCK%5k_9 zY&)d`479d6p+Bz{9enPZC9S zM4>gdr{@SMmBBS(An`$FB%- znxX`^8+{6wJFnC-!g-t%H0=FLGhn=frVFaQR8AzDv*np*GTWZ|?+iJ4=D1|KwG?ZL z`cTuFqppgSN3UF>v66W8&BF~+`u_O%v9M_5j25L$$D%+bla8HqsDGm&y%(-&2LUvW z8iVSGXG7Q1w^8I2$t{EODOiptUvi(cbGBpa6R1UqkU^9bW)MqJ)I!O4hXeLIOg+=N zDRK3iGDd-DO@DbGQjVWiAgi2m!m3wWJcysRS|+$p8d?cE^@JoNRjMRdAfdD&+8gVG zI0j#Td_VP@B%9Hd1{=)v+kH!8#zSSD;~zqmMvY>v zI>sV)PqI2b6hjZyl2L@}%voI@-~O~yzG{9jiS3Y$QsPuvH+T|TL0Y%`9_;um?tekG z?p((=eTr3;zH%vZ+EVJU{-o=*Ay;-dVR#=QMovm_8m;%u5a|+n^LHA`rItrS6`xCy zH#Q?Xs8X2h0vD;knPX^Gn6L*A>i!)UijWh=$YIbdR^mp=bZ8h_l{n=h-XI(T!W$1PC`JVI>Z2FRJ9>081+o+>d zs)dG6pKSf)@ZnO5Jf=4-qP?X3bHgzeEKM?G(||@(HzHL`avWq+$XZ4Bo#g(W39=0d zy|*yBD!>Wa;nw9iX{c?IWJ^lNOBd7h{*sBX4Y^HEU8>~GIip-VT3S8L&Em_W=wQZb zLIqQQr@H+iQ)&EQ6dRLWPgyMG?QUcwq-wGf<(D?@*{0d92xXTx%>mkB``I*k#BTC< zOKGdMv%2x^s&v@2N}4R9*H&Zexly*`C?fajXkJv6BA2D}iYFP1JPNIF@R+y6*Ktw_ zZkf%H?(PwPsj-h8iFee@sr)Z|qbXaK`+)wyOK|1QoH_LNTsZn3Sv5Lg4J?4;ZOH}HwSpW( zf*)>yr&sjn4Rua5kDo=?9gr^bKIlEe!(4M#Q*F}=S9fwfw#96mlD46Xg+Zu=Y>YE` zXe^2tBAxlZMX1UtLQ;zKVb*luj}$r1v4XmQKNd*LS8Ju$qJW;SFF+Z0z_x32ndGg= z?4Xvhav(1^D^c zuii3ATHeV}F*I=?w&A63xdgKzzoRtbz*onNu~RbkpgiAL0jnmAoN}S3X=88!SBSC( zxk$*o^+Dmci|m~8HcpW;SA~dz{}{XA+=xp-(vsT)no`)u0MPpcQbaHJ{s&tmLPa9e za}O%+p_2CEGYn&L0#lOShwhufK|_?O!=HfVEy`afN^R0h8Vom z?b08Fgk0bu0ad`|(h%mDQKf<%3KS{D)fz-u^-JI)sS6cL;>%_mPS_U_>V2u8K_&z` zv0>x|rd+Z9&}KpGsU`CB&rHXM*kOGF9SRup=392&T$Xs*>80q$m%2g9Dg&0#q&6_K zvlHuJ#JiLHAbY%C1Gy?Dyr12-ydXopeF@T|(^l|b2x$TJM~t!)KRw}q$r1NPcVbJAw(N+W-RyWV`*qAe?9}1d|y^SR5qN z=n*l;S0R3ipJ7rKzy>-gF+6Q6Fx=@EFO+2Vw72$P&Gv^GjP_d;b^0WYnVsXY96P9zddQWY_m8kU>pc2s9FOI?p5{&mVt&Ch2C1Abz<=#GP*`szT=Eq?#AvFKWxhMSo*w-?=o_fB znmh-Xwc<~cC@b*!4xdW^)PTyGazzJ?u-{I4rK~w63v+SGU;~J`A5kk;GlDoNZqMjp zcQm&B7*MkpKvXLM7H9#y45XX(HQHYE*GYt^mH?d9z|}y{oPs5bi*}{?X)o6&?H#!5 z5F3)95PbzHABsuEkK1p@rsb`l_3nVy%l7i6Aqd~N9re<@q03fst|KS67gs_M*eQj<@jC%gTLm3?@7 z?yac&_7_?PrczV63wrTqA*T2Z*Pe>r@Lf!X) z+1?m%F(q4JN;d_uuj*xWIJbtz)_(q)SZGcLQ1EMQ;YZ)pk=^ks6BirlB!3t4L;`h8 zv5^UL`an~5eqkE3d&Bhk@IvCu1`IZqIz^24>)BCyKe>$67#nJOZ7)KZjGb2O;a zsf%JrD_yTP{X9CKEBZDkfwyy_ zy6gqGG%Q&~A<=??-Q}Aj&yfGH!S_m`ql*+$i-%UKl)^1g0_z3NyEg>N3+chivR~S+iVdo zX+)?Th}2b>&;`HuTVxRV%|Y|J^omD=ReBeJv(=vV)b0eGYSKC=XDcotyhVeDhX*GU zkeN9+c2Bkk)zQBN-BRpGyYm;MYFPsv%++3_JW^?{uWAew0Ch$T-YaZsi^Uh@W1nUR zAdFJI$gmfS)D$*`XtN+wfyq3H^4 zTUOqw)hm?Lc{U7^e6-D~XjWw(L=PX}H3_Qly2>=KT zd4m&^MVl7a8dpye}YzJK~&o|xNb z;&y&ajebO?#vId^&&tKCz4nGePw&iNfHbGV39=QDyk_mb2K3q6rhzAhwqA)|L8^K@ zL0zulSh$}H&!a*ydDN|-JC1dAc}4uH*Vqp3eR)7Ys!6DF+W1GkqrOaMEos`EGD|E~ zCQ&1)NG=8YS6OWY?Bf!NTW3}sM=XY)J6>yBPS3+RZb)_9>&w&~Ui6wAKLy~q7Qn^P z6_EI{47^->qCN*dUk%0RkALUdQVez5`z$iKAOcqr=W&CO76;V&UWMpz zg0=&ss)qxy!bN9SMVJKz3lT#%kODT4CW&+FI`~*ELHHYV`Y9%m$vHHxx})vI#pUbc zv|jRXd^H%9iYKXbibZ3zmc$q*ooQibO&2+F+ejfrhx&ucCo z?^!LrLAIecZGGTWt-FfNhQJ39V&0JduSS z_~9~jt)B57`~Tg4V|y;@?d|<#7@F`;?D(Pt-V%&~zBlEmBT1aG{T;say0zbAq`t#x z4%4TooYuy1`|3Pt#J#5cJ@ssgKI}MtZ=ATg+^;o|$q_j+_V45vrmmhdF8xT$KRLY4 zWVMu3s)xo5D>0@yQ5;Aey|-CRVtqZ34h4gFmc!@37r3dAM~)kAbf)k+X|+g|t6t@g z;qv}^gl-;zdd$Oj_K_k>^+{eEr+r^>&_R|-FC|6lx)JsjIH>>gr#PU2YF9+e*DsJjh65r!H~BAYV@D z4Juw>O~A@kevVfTqOaJiL-*c6#|Un80wT)xhTwVTUdw&cTc9P*cslWQh#Hfv1_y7Y1I^z;6m?_D@+N#Pbo86Mj7!T9iU8EHCdb zRVb0(;Tbfu4P+9Od^C`fAr&fpVodngsYUhJ{lo~J!Ik1KMI(PY#k0zoayJs|#EgYP za${k**nR5H#Eh^49FkNeQ|>XXa!LcDaOx0)%TiN{iK(PoVq!In-$Nf}N5j~vq#D_L zDRj~IlSzpuRBm3i%D(Vk1wJcbY@iA)OXq4}3{2`v9|?tF3v?4wb6A#H{4Od7%>Gm0GF_|7#1fmt9NR23jFUYds!djm3X@e80qI1Zy9;qeP^YvEy>o_d-!oUHa9M^J^aA_^nu)z)P6bviv& z`dn*+`H)$n6e?GURXs0YwGHdptV+&~b+)ra71plvLvZ^72ayQ|O%)zh{B1Q#Im~m- zG?JHLXCk*+XSR-r^AAU?cGi1TM>Ucjk$RTU#&U24NaA$H$ww@2O&*KvA_G?^+qsNq zrmgdHge^;pm>mH92dy$^wfxf!Jf>PkFT`j0P9zZ`DuhogoCs}$)W>qe;0bGUDI4of zkl*(n%7__I2=tS!%TPb3!zja(NT7ZNfANnc=ig zYTW$nVP0?TjnVZ}pux>Bcv!yL{FnBu&?N5s-@8Xm=F+FlZMH{DpgJza2$4yCKS+{~ zcl+Zfvyyy1j)aWSt;GVK%-sR^0?;sXH?p8e%HlaDqjGo z;TxeIM_ayTY6Z8XTT1a$w`O)aa*j-J$O`3Wubq>H3%<5u3lX@TxQERyjuhK-vLzxA zv>mzcok`o29l0yKv3*o#9x1lucKRAw+mg_~*8^wA7kE(;D1`9%%F3sBMP>yyq)(kX zvEQ<7$4@o9PMkt_eSLnfE!}aqy44;yDd|x#yVxN+>Jnzp&A=W_?lb0Ar%yp_f-rCb za}{8x5SciE{-oZPQAuX4{W#cm@A(Sb_VDKTl108=Urbgsn_5<^D}VsM4jN{Nfu|q_ z`I2Xfmu+k%;90fpTnpuKQxkie2z|SEnhgRBHWnrGaa0zKCSff-1#$De3tK!Y50Eyx zj(S7T%VO59)!;LEq3E_*u8S*Kq=2WCNaUX$_#=QpIpDtC?61ac4<-V7s^5sY8{*8p zw853)^C6?6^eRx)X?djQpX6uVPlsjX+m@xN!)q}KR^$m8G(BX!U#T())&)R%Zd94S z*&n~#7OeLxFqC_GO858G`d2VKJ7t}7rVp>#H~M$yMrZ~1+X9kGo86l-MoDU%4V>}u zHkCWq15FkFa{+VIFaz-e#gviUlw3G%#;|*5q9#qouu4x1AJwS`iW#Gw!Fs0V6tJRg zKb6_}KPWBF3se1XTK@-1HHUY=)Ed+qBUg+YB7fm}^>X#UKQ>>R7-tBiJQ9HnnmkoFf+TkYdM*wW%Fzpu5RD5#Xm!aMI{;JT+3bG;{umhTFSSsT1mAlwya&# z5i2GUTAt$AEZAC2tQcpZV%l0^u3bUC`c@eP*^MIKa&fJ4&3bJmE*4Hka?zoN7}q^3 zSD2o?tELfLW>IpU`6_L!bJ#V$UJDo4F?3|sY_hZ*Oo?ew-W#sAtTZcU`J0P`W%K4N zSz^B?3q`nxARk7D!I|H-x5eySZ|4QZV1nUOIslZr|a;PV45(s+_`(uPv*FD_E^9%~TucNbC&%{)mpa58(Kc#@Kv z5e}t3N%81P)+Ikl{a-`WoycB)C0BP8YSK!e-6(|^DS<);zpkWmf_Gp}a9xr_OO8F3 znv`hW@FLin?ZaLUK+cm^7y`Td{xY~slXYMV9#qtAmu)5KSv2PEm=yns)sdPsb@yL~ zYPF-Cd)A&AF%DxqTyaNeDcGZ9be%0^xG!}dtB=>0hR_bUt&tMP1K>x6s$s7O>nJjJ zPFU@Cc%rVS4zcQ)&w3WA+C5)ZOYuxrh4v^fuOeTlf$}5c0BGpm$1O!T#^;<_9S$QR z0=A%4A|b;6>v)g|c4tO}biPI^JIul_D}2K;{VP8~S@z+3%<;+(EZx3l3yift z+{oQO1(~CtZ_$qS{PJjZt$fk8T%N~)kbUNT!};m0jgQ}Jo8XlEiWMw+-nb4~ARx8S ztyJC!2*~L~SHnk$%YKd8f7YK#Z+Ztr0;Bf`?#L;&yr-4Lu;crZc)3OpT%2c=l>fGg za$GpjW;|>BcuLip{zl=5vhl`RB(#5#a?PzF90eVirK%8}Q>8y~`x47sc<96&Ei-6e z+}EScdg{xJm;8mGBV8%a3zF#25U4BpczF2|FWa4_j=M=1b+>fx**X)3dNX@agk-#h zVkG|q%z)(U8U8MU8TcqX6)AKD!-$?m6)zr;?j*MyyoO{HTSiTIf@CCjym?mSnEOxu z2$otycw$r9t?fVcKUfAg`A;kSUsx7A`2maX&<~ti@fA3+;?WuYyl+)JD(;Gi{>}>C zS`8<9WhQoSe3Lob6iX=i5ogH;P^nFT)}G)WswkE{MFpc8C4h~4)4((_0e{W*`a-jo z8DDKf3NB?`_-VK{QWTCO+XdeeT2a;I%bE z^E0c5<%9hR8L*-tD+P6~vM3uM1NA9m4h|Q_SWas5!y^jF!&88JWP~5JJ)iRBqIy6F zIszj=q?GX&nez8Q6Di4M7Pfzn-=L3!>edghoFQz)>Wh@`+*M&(RPer&+O%kM4qy1g z*f;!QKl%w1Dw5}VglSddTMP7b)WOTA3Iunkckv8B>O_mah5;w+pV*<8JaDnxX@G?V z1qS>gR3=92;t|(GvcO1XnxWSHMr+e4CKUxYOX927eSX%XgUK{9;{znVJ6zDjcIxBQ zOz^0SXRVJDMWm?6pB|(t(GP>~miHF3I?$dAK&2a(8CH>IiQX!XYF&8D8PV0nKSMny_s4YC(xjjW2_muxSupFn^r+{5JopE*y)D^vep}SRK`X zWhnA!dXqID)sPH`S_&MwvWm;N81>7T>Shmbgbo;WQPsZA8euY`K_i}lM5*qxtROpT zbj54j#f?%;3`SN8F;|aJRdMNRhJqDh#MvUtQDp<ofxUq`4?b(Mq|G-|I?x>UPcKWq#i{!Y-n8(UJ1^>d$Z*hxBr$)=3bj(>I7e zZy%pda`89jWOTgfUg;(6;bzBD|twr$wkr|6i5%^ z{yDv@p7r6My`ND(DJ$v{Kcsl5D(ZAA>PWl+m0!!sdXmHB(eisxLe?@qs6uVx#S3~I zjiiOFC4Gh$QU6^A(MUAZB7_hl0*?v%BPX_mWnhcD zosp{7*ZKlku}NXgu7kk3oOxz}DtZ^kAHFA83?t!v&1Z7D+NL8)codGJIq{OdurwLf zJY9n2G5sTaTK=Y=gkhJae%*vYahEc+Lq<0SeMFpdMVTi@m~3>|(BMwKMDPP+Lfgoa zv6zf=kg^(H$8Z$(_lL<$o}5Pby!q;xIy5idwpf7_&RN3c^&5{`kAlMzBml}ThS779 z)q*rQPihK6IZ$cHa`wnMH|=ZwQUK>f=2)SrKfnPAODRj>Eh@Y>5P8dX<0XX|FmG_t zz{Rn#mcs0~1&I`tW5_drIRGleP7`MvWO2ITDY**9@O`0<<3P*i3Br0z z0SoB$RPL>o?wKDKDZHuVKdrV!71Vd~q#L$#ZIBZP^KA*01$hsi5vWP|B4CyVMLyGN zzY4$omL+sIHkiEw8_N6EhzKAJ(bd7@kYoJ&CQ@Io)i0bOM5wFQ^!i{R9k{8Tw9C9Sf0(c4Nr@LKX-6-ZZ5nnn~JTPKZ07S@gJ#n zih6Op5R@6%TBv?fS{!-xg#l99?Ekx`LZ8CZX(JED1!~y!qyIr;O-`V3z#D0AU+NCt z64;qEiupsmrO*7WFXAnVSrGoPh+?7RII_aWaoBXcpv}eCk*$db_cFe2ay);3I`%{m z7|st_6{$XqX7}{8(HHTs^M4Kcp0noY6F{O@)mV>ChvVxWw)z z`xc~X)sP|b3F6)LdHAqKbdZ(`YXG?Rw zDMB_!rE5upk;4zk1`Fw0THVs)n!xdsigmVBj{#S(+Nw7U24EMSic~$8%qp7nbml?o z>@$*j#ocrc9~N+%QfMchXE3aE#7LSea>Cx`GAR8cufzbQc5_?egZPx~!E2_;??-RQ zfZqw~kd-LX$^?D14O`{(*YH=bgV%Y5R;$XPHT< zWiI)0VSN;M&x_upd7W^14L6uZnq5p}29zkbZFyg?>Hn+in`3-|{bd(tZQHhO+qUif z?pfQmZR4zM+dgaC);qtv`;wd7ciSdSlTQC^rZf3;FdtwK95>UI8Ct|(HYi6XDqYKJ zq#BO1&?u2&kJsxUbM}7@>1_5LX2S+pOXv*NERXoYa7i$k%f5calBoLEK3JS0;f(sR z+UFB|xxQT>hK8^Bd{@h*s=YV#`H#fZ&jJ6Gc{BLYed2-#-Nw(LS&>CGpdQ)i!gE$4A z-GT8is%9Q+PivCi!AAfrC<>u$_-Mq76CowjwB_wg8ykL|C-RIn4CPR5!=i>#dcaAG z_=Vw!`F)>f@JC9Sa>F>F@j;%SM+s*2F+`t%H`&oKIeOyeVu4-RI8Hqw$(Yp13G=QS zrH00_ig9S(Ar8Jr< zbyLu^TQxYTFgHzr|8Q{1NE=u}SYE2)`|0WWB$UCP^XNz4b1V}v>Rv#mQn3Rc-DTvu zrQGccU(O+_$Ol3K_|(gi0IKOAaIL8@YYf@v#qr|j*%7&3kUo75d@p~2W@#&_bo|9jAP z!gpL<%?)(R9m!iNSuQ6@Q@FRXs_NgUs*=}ypqLKCn#~nt=QGOn9tMOsfoe6RlS7Ai z?t?V&;NkBzk?16vp9I|_TxR%}`wRS8h*^jee7&N|z;6$r*A2cImwx$bbE$OYA2%Hk zVR1BFYQiCn6*QC6Q5KWh8+NpTjwN$go9WB;Vi6ZHDX%q$stk!976|ihZUrXyeP-{= zX#rkgiGz9iXaz0}`{_i$F~rASX#qZV@ik!Y3w$powg&zCSaIxx1qt|rgS|lg??SO4)b-HM3_zS_Y`Cn)fy9A<4UXv!nA-{ti046< zIy2IJV;FHH{K}p7cbY(f!?`i}x}NrLCBUY_tDcB9f`Ex*+GGQr@fPP*{BC{2><;2f z_w?+0N`VWgFz4gI{BWsp^D0ljE!H7!E$BuKKj07R28E{#t9Mg8$D?Fafu8KPyTWOy z8Sfh9SjAj1I-O;nvce+GVLy#jujtm2{j8?$doiyce$E#!P5j&D*Qhx$GkQHrn;I6{ zJZ;RCvy-M(o&QbNv6VIa=;_tCwoRLA*%~jt%&x-}g_c6|Vvep;ek4FYs0r^&&}?LT zRxOuV2L2eX6|w^5tIBCN8TvMWm4Nco5ltD4J|Jfn*Q^UF|7#t zJ0#}mz zTRg5f?VsC05ZhIqX?+JOX!zWo|@Dw;;Q) z0pf@t-rwhO1qG-}tTEgDX_M_}$V+-RyL_zSj8vuP8?3^UR%{!ttv0IDp3|0^K8vTS zICe!!6*_XA+bx?{+%cMv)sD5)zf_6MH-&>C9K^J_Um3Gz@GkM>SeKZq=~#vxtJ@BG zI9hX5W`lY?oa48F&AoX~@Qv4O_eDk36n~8Il);)I8xBOFCF!%i<(O z#Y%N%$)e%%k1MriLW(x7jqfVtxu<{B&&&hxpVO6Bs$H?Q%&uHJ$tDzOGjdOMvZsTv zLhT``{t#9uA@pCa9Jnw#@i7o$69V4UNGH{f^DB`w#tQeAvUStS5(t+?-AMU_{55_9 z>(`_>leYb}r~FZq>`YFe3?8Z1Bc_w@y`D;9M*V7bfD84c=6D6nURK*x{*uJs)@bljE5XvFZ3Eea|2tmtXNv#^nFKqkDp@q3X?oZGhh6}s31 z$=G5;{7b-YUJYX%*7xF2HGyWbt|5OBULFV^P5QTEjxi+(!&)=D$$c7<*Iu)pGVFGC zEhYg=zbbl@|JA_1lm5PUW_%_n!+3@0c%!Ha*8plzKK4Y-z*j7*g8}!M}U8VSK;w6J=4qHCWBZ#%yNbOet-#StQO{r0-}$ zVy&*YG36p?DS>?Oi>rEs5FJka~`y|%?GL; z6aS5}D`*O|sC18vqaP>c_eJ9w@_%TrSu~jH8I@IQp~<;BrjOf0_Lc?!P1>NLZZ z^lbExeO|^M7sqf^8uE zl~j5cW;4q#6)ZY)DFFtHGe-AZ{ZU z?~FU2!I8gU?wIdNa`lvTGbccW%@zg0nLJyrTD;ZjG3U9jg6$ptvtQ}TU7s{hKPztl zzi#SmE@S>gic~^uPiE1Xm-^!^^#&EUt-XX*r6)|##NCoOPXZj7>Q_5&Bho(hU=EX6qveVaq>rAp0aPAjy)<&kc0dna|CYMo9iNSJ?m2NGo8a#A*S~-^A~Yf_67W z;V1!%oPLdUkFd3?lpc4*LN5n^;*jJue{iHf@^F;v-4~7Kti`+B$Y2fP9oGE*sRww) zyW!Pp&LBbkggV$?smCI}gJLJbd9;{+Yapt!-gg&DosXG}OMVD3uFw=4R+u``Iet^F zEbYArBvez|YT}iAWrI-(JzlN8|1#D%<5=92IY~O8+5`6-!u*a|Q85*jG4qUU= z32?zIz!wBs15Ai`TF2@7K7?o;aS$W5EosxjyGp_an}>E|zP1earIrX8^R(KdGzc9n zM~+lExJPToHCnI5hbWWnKb2@L)emytYqHF>rS=N$*{*^$kcwq>da_~L>z<#?iEm0Ve*yG12Fl9%9kw84 ztZC7LwJ@Mm#k?Or5HoV>*`Y;Bv!m{WB5qXfYtZ|}I6Es|8|20v{L!zETPqYHnDI&I zQ%2D>9jk1!6(;*a)g!%=GGVxHSrAR_vLQ$((M+Ar{y~0gNJCQa5I$qG)Yn0jnWS>{ z5HCji_4hfs$1}F0nXf*Rqf+v@A;T$i{eZS%*ll5S5Juh*dltTMmeAw9NAaid-k{9I zCiG(bZ1SYb$+=J?TJmMu+Z;H{`97B$r5tE2&N7^N`eEd+0xV^n^Gk^*#V_@Kqq*&5 z7HDlEcBU~~YwT~Abhat5xh5L>6PRe!4vW$kb^<@#4~~QA?QIL&92i?>1VIq#>bb{= zNQoP<`Bc7z+1#CUxxFCj^1_|IJGUi$ad~+O8Ag?u`LD)yUhGKis>m}#I znKN7S=eoO;$%$GCT?3h$@2#ax>D~&R+wKcD8%npD+(*lGV$uN!QBeOLsJaq~i>Ulk zcap8&NoQM${c6rE?e#w|z26Fun(FWzdO62S**V!YqhQM7X$ z(Htvg?I56f$j3Ns*OaWEvArC|fFD>TW>;hiyKzHxj`s>7n!?29Npu{Sw}}dw^zjO0 zpfGinkDp^ZqlZKW5rs^wk1Oc;#RdR*SqGAYOER0hQaHpdX5_yocWVT(r0P$iaC9B8 zumG!X=!Ws{HkjFFu((NU49_sO!P2nrW-kGN)7hZ6h<;1$RoIQ)AK&RFXGPcPJmY-;-$jW zLs(DOJ15t0F#`epurfYGUZ?<5NmY_W#wTbg5UCJ$KUWEw^N3}qKzkS13O3$Du)JT- z$+95>!C>CEi;$iW8-qBZ7HC9ovS%QY0^_>M5ruf=uoSd5V^UEIJqwZDHZnFp7sm1B zyQmzrDDy6bq8;rv)xgjj;rY+CyAZbqYL2{iC2I_7n(WT25IcVo8}moJhwWh(22^9o zJw(K@Ze$4y^k$iH({lx83KR6qwtBD#Idt(JngpMZPcAUVpA*;z5Ij>-+nFh5TnnN0 zr)m z?Y`M&?}_B=vWoTi_7iQo70?I``L4^VW#`Zgsg4hh2fob*Z(P>I1Eo;>`4GVGeR8em zR;c2e{+@ruSa!H4q$_S*N@-K=jr4MN@18%GnM(?mg~k*iw^dd;(&X(yYsCp+%tQFl z+uDzL)bTcn>Y|{CLvWHZY|YQ?@HZN#3#t>07hkn2`8sppQGdY?F3<7Cblre>t2v!WF% z&9wTkBlvRaJmYk&(Td!rB?q_M=Cyjqw7eHs=I8VsIW?F1oj4gC3K=vms^QZ4EW_bf z-x<2Ehp^xGU;(Zz+52FT3*#MgI%<$cTsw<}&!owt;&}T*bz_fHg(?H^T!96HULT~_gBQ78n zcV4)R&x|&}Xl-i>>QdCegzxUd%w;XqE^)hGPFE1>(&vWW&-_HC??gk;@O6NGw~`yJ zqhCS^^d(Sc4i*=L1Xp>Nncv(Ssx9FY*_;VsZ8eR)ngT)+!aP`IKo*G8^cL-FsR~W= z5y=wwrWBuL{0fOW-ir5c?tW3&DZii3IQ>abz(|CYK!U6Ek|m$qLl_&&}Smq zIo&$UE%8pR#%iG=wTg#v%k{S6OVDd5FZ%Qp8E9nqL*41g5;VEenUu$erOiV#@gThN zV;5}kEh}yDBDFf~KXhs_zBMbq-`N(i!*$1Tvf#_IlgG=!xDa*J31)miD4mTdO@y8WCa06@ay9#sk*t<*JO>vBk?A0`;vk)CQexA;!uUv02Zr zQuQuu(T{I)Qs5mQ+cn8s-$|Ul4?RrUZJmSqKkIt!*P%r4g8X<6heEWdGtNbRrN1#U z3nXbA*Ue!51|6mUY9%S{y^oEgbi#2Xis=~YO;0>#=e3JcZFNR*8U1SlDg*CP>cQ*N z-L5JV`)625DoAH;y|gbbUxT|;>Tp{4`uF@i&T=eLo=!YS^V&v8)~fj4N{4>1uTq8* zzshIy%ajWR98WolYeMXUonYPXZb;9F=bkyj$bq=(9=P2iUkssGHj&~q!HW7bERr9X zlU);Qt?yv^{LSaf^{(Hc`LrPw)g0U;-8W*5+$t54IVjG9sxHI%6iY}d=JyK(?+13W zB4_UNxVKUj0TGCWYK&~7KbIkd91&?fRt_f6^)nc92cJhWq43!WHd4@ioBoZM?qw}Y z0bnk$9PPCFd?FdrO-=Q7(iR(QKvDS`l{PpSid@-QqlBKPhXbuNXE`*UA1DF~R%qeO zywwehSUf|~QusnLbUTBV*ryF;j{1xViO~918Qbl(N#_XJZq??gQe{<4AISK%*X0bu zKuu#(?m_Ai3nSewT!X9W+|l`qyC+GOAk{X6W6{@kn# z2ndlu?I-=*T;V4$)?wo2*UM*~T{sO(CEP`>9Q$3@{YKxYeY-eZ(MUjGHX9{$yrD-L zokN8i0>Dlt7?HRM?Oh5>aUFfix?4r^Toz-Hyht}1S0p~Da$DhXsWr#Na2=QF;fc{m zD8lwNcgfQX{Q4`Qoh$AgGl&Gt5;|Hos&ZE`2$?nZb&RDQ9+3f(v=2e*?0Wq@?D~bO z1##uH?Wsyy)Z0b-tiSM(c7IT=G~G`;_XF|y%)q=8er8K3z^Yy?~Jvr}C>SCgV%c!it<82Bz#Fl=KcbpHL{pr1HL~r#imq~uI=fl-D zP}2Y6GHV<;0lReYUq7SG$D!q(<~tJ;7|tqTOH{pG5h}aDP_FD_&{8>K7NZ5=^D}$7 zb0kb3fyN|)xJKxGyK39CydKjSE9n<567@QgG`dH0L!K(ZPJBhpg=Og5i;d2}Dnov# zNePhz)lEHo#XUrnnppC>4+&3GZ3rRL8aKg}yI%3r4h0~2K+OPimQBQ@vaH$LI@2%xq#>NNpueRwoomi}FjocHFzOG-Pj zi8K-`NUfGG2{Ap}@~1Z!6^ca)Gbd1)L?RSm^S@n>?WNE62dRM2_Za6dU&Ro8JMWLc zKIes%C%Y?m)UHS?tU>*%(L#*f%6~tIRw>&MZ}eqN!pvsx{ffJ%(!OL!h@a%azMb6% ziEsHt86k+OtXzy66)43+CuV#~Du_No!d|zQYX( z^s^5o&5HfgptUzY76Fddbio zw_@K`nP0))AxjP6m2N9f<+>xUbJ0bZX%vJSe+f64((t%P2M>_Z{&J#cE91TA;1bzS z`LBOZW8O61#iF4pSgZ)3<7&`P`px5^>v)`sLJwMsh_*mKB<;_64)g-xCpd_uf(Fkp z+4jzOAv^o)4mtBBLp4sOU-51yR!UUyWJ>!9FBIEyEK_sJ2b3a8vY>#b@>D-Fh@QbK z>mmbt0-Q(U_7t4{%qO^)6N1xpXLN|TeXd|}E>^Jka6H8_ZWvmV(eh4+)QTc|A0)wU zR`^kyq$GluLvlnE!bB1g(FC^@ZgG&#Bg*|Mm*3#8gV>c?7$xr_h(T4cH)Yi&xTA?R zx846d|J9?R)gBE$pT~K#2Eg}+&;%bXH4NG_KTwc@S+2q2svn>SxMS=nT}|CN%+EB4 z9k>u-Avcoef-fq%Q#RkOJE}tDA(f9zJ8NZ=m}BnCbOAB8Z4-W3kD(YXmqJLxS*J2JN`}s6!wdeOjx~95dNZVyyq+;K1-$w7S91oWK+C{Az3r0 zcX9S1#b-w%dl~>{Nui2WIEhFWUVZdUcKLfWuWZCGeZ=5~X~=yn0ylp-S$Lbh!xfcr zv=)J*n%vwnyovr5J{sSQ>UvEmVqOSz3)}$<-~X7f5Q`aMPc}RRV8=CEczo#4ejcbF zP0=M~`7qPROSGwveS)Q#T1Y>@bR*yr5BxXRL-6NaI9%FjT**1oC?lJwr@JUB_jQOE z>WltQZs#Hp{M^i|X>n;WC}Te27lKEI^*~JfqS)f%^7b!4RJrTKJzz`<4lX2h=VrD{ z(apcfUyM{vHkofGU9O9(Ba~5Nj3TFB#lRdI(CgMabwZ@bE#1U#1;!Ui|Q2nR?nh=lH-aFFRQ z?r>A+%Rq)LH$7X9>qYSyrW|vkIBEOTk*!qDCuw)reJPMs-Nb&U_xr)3!9 zjs}75Y%#g2)c{j7 zTSgI~`KNkdPGS`T#Tu<9$9E2ajCvF<a{rF~I{V{&;OjD(CJ3Ic zS?H}*;d(BhJDwYea0B8|7?g`B2LhOUT(cMF^XERrUQL(xJooE~G1Ol&fK+~~)V^{l z9M2fsh57(K)-)DSyy<;Qg1N-`=Eupqi=-kB81_ag1l>?EhyNPvnBIb6&H+j1`BrcZ zAN7DeKJzATq>0<%0O7^Tem50r@^;8s_l6GkZ@pPHcbqO7yd@#nn)FvKIP2@5#ag_Y zt`QjRJzap2D<+9ie?!9@0Udf>DLvT@!KBpw3jqvyFxLTBH~d;W_YumKXVj8A7Ygb} zdUGdniI~iSSx2Rl5Rto6PBbJjDrH2)+L>&_&uoxp3ie6E*)LPwH?QZFMQVj|s?Lie zTu=qyvdddD)m&P))uhjs$5J zF-_@E8Y~S0S*{1PoWngz7dy4R%GW8}Cw3hL zpOqy%Ywa}U`K+{}HS{dEWIoY_1*XY@hRq+kai)J3NxnX3n~3E5rDk5ySqw*-`k6R` z0do`~iJNw8i3+zp{zbQ~uocSiv1KIEJ;v1SD|tZNqzG<&hT2PJQa10ktW){4ZvJpu+y zE-RJQ*RP`QyfXt@mbegu9BAZl3Zu5**E(!AT8wYta3r81^vzI>^sRL^1a z$~8yFGV-5x;LFu2jJ-c12G2VZAUA1(y6!iy@lMB$P=1r`sjuM2K==9kaFu5(ejLZb zw4K`iUUiXgZMtQ-6(Sw07{MLeMO(ae;S{IFwOKD@rgOQr8D!);-dRvgg9TJC0hlG( z>wOxr#e(8z+`%<+1Ii2JLzBo^iO#{`ffHdw*cPA@T;KQBF9vCI=>KW(Ye;Zvkkqbc5cts1R9%v7V^ zti>b-l6qt*2BAGCZ31jFtfZ>P5wZ1>l59VUJj?ZE-K}MpF1~5S9v!+>j-8WghvlDW z-nqhV0}4nP0+d;zs#ZiY&r(4PF(l8w8RG)F&BE_tLswMRot#2HSR%>JYr?*)^8A8C z6c4k$ds-7now=fG2&p#|l4dPh{ch6B>}XXvf|t=zxjn{qUr~Mp<`l!nfftq&C!|}2 zkpj@V5cY$MfdzdaU*zC!bflnGtXgNToc9*byAij4W<{Nmr z*#$!Q(5KFmlb~%mb52VGN{7D+qA}Nc7-T4Vw0=N zOYO7;yH()h95EBDNkx;RwrPzOqC>0w-2tE{WTZgv^YRVOvwmc;seF#xBjIG`2VB z8R#8@E@sVskskJBc5MS|mdi&fO>rg0MGfN9quu4Nsv3naA@t+FP=+4yy*g_Ka*oS45j@BYhTnR`3_oD9nl)oE=~yF_)VDyPbyUyqYRR|}& zpWpkJX$Y63(3=DZuP(Aw?)A@1buoTDaT5MLo+@2+RU96CIZi7h`nvJIBIwI`#T@$_ z!n)|75Po}-fprB_2DlQ;pn@@~cn4GRktI(Ap##ha^BnX*qZywF8%pM7)95CiV)%(P za|$N4s<`&nCCN);`o)?ZGR>5tdy;S`YYr`lPm3Mha1q{gLcMz??XXV-kAgcE45Kz3 zB2FHVRH>QkYr?}g(!5-Ea67}ehg$odEL6fa()IfU-JI-dLCG@=)@RXg{)D()4C|q- zRj=-DzN*(;F0E&``6DeVWj5;xsF(hIFcr!j!pu1g^d4v#%YB(tB0eUSw?P7+Sx_qB z!bnUB5RgL*0bz>w74hiFAw5!(2TXsp@5+FY2o$W~ghuaM*%zK%DNv3b;dv&|5ES(C zfb-moesN}JUcbh=dip4XL>RHVnXwJHTq`A+kwI*{dKmLBU6l2lAo->C!07qmaj8h3 zaq5Oz7oM1Vf)>|^>N$(*Lcpewst~SchI=<9GK(G4k~AbbN51!D1MIL=^ke@5W9XKc zmYXy)gOO0rr=65uaJd$YbWu0UanOebBKWTx&0|1h6GH*&%YqRj4)qhtNrUqhMFNGk z!FGDW7bUF+mE}v?&^khWPL26<+%vu;qB?RhujoUM^ovi8oje%8O{PWEf-X=+I`j^L zMp+dOv~&A>1UsD~MHSi=4Rk`L)g(#`o04%}lTC7oeLT7zw~~9-RTK{$HKmXS=Q*PF zF;rC27L>)N=+AGNJU^-lD}PthqPu=IPpeyXhstPb9@~qr)~Kxpd7&s{fA_c+gjxN( zs~dE!FD00&q&Q!l==3~KbnFrSdl@7CqzHJNc@qmb(*G=S_{ZqVoxt=JI?F`Vy|fjp z;W~N1j1O9KmUG-6E)BzV*U_+j$QViFC>e|()kdxM-m|*BjUq@FrlA(z> z4nt~k3x0*;6PA8JT#e4)+~9aYrE);n;CAExW2kTIjPm=JV>&GDao&5IhaVlpNSM)^ zGVqo)16m6?+O>v|TvzmpA<1$gU#{Em1e3-{U6I6+GWPwZ9ocX5bQ0{KuJQ7o7Rl#{ z!r<_8Ik)25!xFE3Uscw3n9ft+tje<7I=6RsJkTup)%n)+Q-Tl7nZp#6U&o5J!1FvW z62vDO@kdoz`;^JDBTr$X_nu`>#G%c&l<3!#FQ)4oRH+D94@v#gK7Gp1bcFp^1mA(! zIF9ED@Wr1~b?AsRw>Mr;H_Zf7s_DqHQccIbLUuC=R6T4Biru?oR(h(QVm0_lw+jX8 zv_VLz!kvbi94a|Jz&H#?WkZ!-87+aV37q;0#b}C&91Qc7FU3vca4aesgHO8bc#@c| zC}Eprp!2@ZXM*aI5X!wbE`*8ys1`&+vtUmgd4fc6o7TK2{vIg-eS(Ciq*aS*{Pz?; zd-@m&0G2*;p(5`J#Y6K$6n_E}%))_YfCL3h*R2?hhx7k=LMHwMq{5?3^#?d@7BV~F^H}KMQs-OP7g_&g>fAXt`kHb-)!psjTRg|4P z)6Hg-<>F(E_-=;0a`J!tEW-L9KU?cCtD+;XY)6z*BSuUcS823Hj=4;x&2w2;P^mmT zBa>0Ij1EMvVt`0$KWgu9X5pK)rbe4a)@kdk8jad9C)wD_lh5UYGgtBB^$tzLRLD&o zHn^-{@pKgfZ%y!+qz&U^TYp-@$`&0pc_{MWg`T*FrOM!Z{io@T*dr>oy;?kC9Qg6m zWz8~vTu!-+(kl>4o*+i7A!oVALWLn>Le2>d&p?V37fprm-_^TNjEr2==A9gR0` zW0nFrmioH^07W*aKvWnPW;XbS{Ac;RBsi3c=}iHtgXrSj%dEEb%#3l5M}=798H?kT zM~HnaMi9(s>;jS@BRalLh{*>2&_N$Yg1!SP58w#Dfm>hq3Ty|oc=BZhuQ_RIj2R)w zz(@Q867zAxIHUe{4kpKzW917WYeUDtj-qnyLXk^+63vEi8vLSzLH(y&bBQBkzXE&@ za&&2jmxRkSzWqc7^u!HRtkjWiztgnE1aWf?_i$)&K7V+%+YGkW9RM&G=js1s3b~vJ zf;N{uUptT%Edqk)`Fj)eJ3naFwbM%I{lLV`s&drH=M^a2$4IiJ;%ZL={4dPN@CqBJ z>+n=T=WU)}OPylD;#-O{?gW&5XcfyO+p4Gd<|xEiMTC2{!XdBdN->ixw@jNrOxX)I z5f&W-Kz(UK{R@N`SbRNzK}PK+?QkW;VtM|{AXa+sj}?$?c^ zmn}O8#`%jbuRk#f0^-VxQ_Vvg*)wQPNI))TM;qEUmNKGeRTfda8xeOz0ZcY{bq} z$hW}=R7XbJ3;~y;w!y?)xjgE~0(7UVmwX}@%zrrz#TGi!Iz{@NB6g3h96UN*THwh8 z!Zm2~1JUd^PBQyd+*nQfo9gnxiocjJ0{YHX=9OAlQ3Da<(uBCIt}gKU@Qr3`jr`fW zam-fX?^R!48Ur%{E&91;)e}~U_McjYk6IIJja>;6JX|F>ztOP(kvL9G{mjwqlbANC z%nP*4GqiTe^X5qw!Q&h~hnRYaX|U%WJg8ZoeyR*vg=~WWcf#t@vW zDqRmt!eRn3uOL#-l#A><;--@bXP?uj&=+n?4L#G~qwjK^^9B#onf7t9jg4GKD*xGr zylh7<*V+5O67VvGjvkaGdsF$2`jujwvn2b=q2jEJB>P&nGxPW2tbZ`|<6@nEuoV8Y zm4C1tuCr(DB>R7`Zj_|!f3U`tVxF_4>wmD$jHK&-F#Gr7&VMj#G98|ZYBsxbF0<{m zt4b6M3-b;J9rNu~X&x~u6@j|qn%T?y!YzP&B` zKt~Ji%?0Uww^+$}@5=#igz?34v!59g9Lzz=5-%wY1R!p^;16A5MedQkf9l&&8%&p` zE7}qiA(FqFCRBm2B*K4fs4lmU8x%>|PuL|^M3rf82@fsqdT&E~d$VWET6WxGrSAVH zF9H|@73hD@^86PX0R#+0_@C)t`(Khh|N9~Tzu1ZYK>zO{ng3EK{znLfq6`@Lf3|@9 N>%sr#3BZ3={|C=&wWt69 literal 29417 zcmV*2KzF}TO9KQH000080DO38SK<`T^lcFU0Gv+%02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?Oc0v+c=W{|El&opmY!0DN&T4@uY5cPh)#CzKUb5Ehl$nr=}nhlrSa< z9so*F=2CT^Wk1?}lIsS*mmW?W%Z_(yr)H)s5Cj^HUw8iiH2B*e{)v#*zo=l$654u2 zT4Sv<^~(2cNhhHx9kGO^xeeb#}~fq$8^(4!mUcI!I**k37x@E$n|Y1rYYe{<#loBEnrjm z%5`6euS{)Qd5dIBY6@6H6`+>5B86yek}WDRS=3zzH4g%j>vAZh7zlx3R1!_6(@s(X z+L#Foa>@0~2ate}O8I(>2nP_upaT@cFW>NX5B9y#wY*i$2gpOJt_yV&meOI&6q$(} zg$GHQ!pF8p(gO?A%0Ep59>Ob%fYA{EEs4cQkw}Wf%sL1X<^epO!tC;tEFU9LIoGHZ z=x9+CqoH0H8jGhf`8mh(5&28bBnJuMC6#BHkQ%$AFzgAl;xPAP?B2kkqExG-C{z;A z6p;~$99luhzUKPpeE4lxb>adjoxlyu!lcxYyVU_~0*EBbgyLGr85vX1EeXK*?1T~# zk^gZc57~spB4Z&L&KinylXSrpqcRv9Z7i8%kUz;&tcear@}Y%z$2x;6lqjB|;;MHC zEEuN(CK>w&*A#-gum}dRO9g6r%TVl)WjL-hn4ub*UPRYgY8wfaNEi+e>Ve&q?_y63 z6b`fGOcsE2-M40liD=9t1*Z^$PVsJLKAcft-mHXOR3n81%_8)s!6BNrbXq|FjZ3 z6oHzP+lS5VK^pqL#W&f zrvqY?Komnaz`{n`;K{AO!q%@xhVaVGn582<-fSpwbE|_R+-i5XKD3&uh5)1VGLVb~ zQry<-lR*=iK$P{^^a%X}JT~jb2_5mUy-~AhLW*}L%aI8H1h*ta7EX1Ct$1#a<-bEVMAW=hvx+f%*mcUcBT9{K~I4pceW0-O?feFnvEg(0od2DVp4Paxd zGr{U@;_7XYAOC0=1azS`wRi(9O7{$AeydH2vZeUjf(o0!{}R&R?Z)c- zruFKkwb3S6&Ainn8#k@?P0L8K{ORWnX!^q(P7&K&vT)Hy)HPPQqv=4>%0D6~w z(RrX(4a&H@98Gh2(94sL9R4}CJala zVK5t5(JWo@ly=r3y$GPYYJuA(b^`!O9@193QnIVRIpM*fSA=(z^N^;2p|6%^RD>CM zX{Xgx*XR1rX3YG$DfK|~+nvXrQtV{egF3($$e$Au)nZg;-NFLhF|EK_rd8WFT1l4+ z#^}4oJwuj@mggJ(+$?A+yZTWwsV@hY1;W-07mJS}M!s=1nob!OD&UX-EkztZDglQ; zT)_@oux8ZF_l`wcr(O*o*K{n)CA_aoDJ6S)XQCFINg>Rp+QL18F^e;^n=yhgg|!UX zu$vC3Rc!{V<*Zn2!?L=uV^Qu$e91jPvD5^&WJZnodPKvo6mQJ&krjVGlV6Wf>l|Df zhXuP^4}0jwjfvmSwC|=?5C2)F`~~rsnxUzB ze?*wq?m&fY)|upMv@!UbftgKMVQtpfO#BscL{t9Bc&ZJxEP7+$KaU~~0kenOc(_dk z@zg9XKY?l4J)=NK$zp0E37ep@IyY&-3xMD{cPnDWnblo;@s8p4}t()B8au34Y<>k9{HWWT+hJFZMvao;>gc`+k7> z*GW11LYaLm(l2Na9>bEO%QpsLZ<$742n!pf__A}3Z*}(NSiYOHH%5xbq%#uZvdFk^ zAc8#LB3I<<;tdJl$E`7_k`%H8Xatcg5F_BG?pXEs9P5-kQ>0FbM%?14^^F**P0;HW zFbJnsr`3X$lAH82vfQ`Y&|M3dR&ZJYwAo(d#6-msf8u`{#p_(~qedFF8_s zC~&_YzpVi`S8V0Ns3fxnB|u~l<>tw$I07Q9ln6LQ-eSOtpqf{m8dGT@ek8>-R9f;| z28*XN+@*7j`W0r(5RcSTP=Z=*bh5)(jC_@+DihjsjeF*Bp9kPYEyLo^`lj?5)vM1}D9Xa)nP(1B@o+U`a_#1^_ub6Hu0JEpj=B^vmG5~PDstE0$?5r#Av{=BOgAur%;E9m zV-^db6t8nCLqgqt+f90b$%_nD#hBgHi~|wy5jLyE0GE3xUDBD4=k@;fj?X3(Hvv7W zH4Sc=^kSey5|%Iupb3IcQSc@>gVL)xpAPY5m`kO-Av6&RAvkX2g4xTrrm=d;KAX}BAtI!tnaT8>k!m`y1KX=kkoPc zA;SZ}^)sUVXNL1~;Gsxxui1{fMEEhA@PIiceqtE-Kft`Q-~nJhcnmP(;`H*We{%8m z{9TU}T6!$9fACzPy+RGhdyFpT(EevA{|D3`59%-12=(5(>I4c`_pw>40q?xJ#Y8RK zc{O`eYX|$w?*{gzTQW8NKGk|@^@9y|JhkmhA^@=Ptsq^dkLT|52` z|IYBYS~VSVx-2`SZ8uxozM#D(L$uk-zro{zAkIVZ_lB2aP3ybKTUy?IfOTtR(@#S4 ztZmn&R`g$C#i(j8o~Ds-&4Y+R3@$vL73oz(m|GLI?Lne)ybhv@Zbz7i*(MzR1KSv} z5Ecx$XqAdE9pI*=UCmBK4l7)fEIN0Crc9r+=A%uj4en=}Y%g%i8ZA#w%^-r`&_WwYP^i3Bx>wfoXWAJkW%_1f`f~ z0-Q+wr#0grp2CbTGhF^(j#(U&cX^yb+#d3Hod>$*aQ=P`+8An0QIoo&?r+}TV%sKA z4c2eoVZ*#n`wQmXw)Xvm#{CfMhJTfrD1{T{L2ULKljRk;wZ^`S+mGqUqnPXm^b@GG zJN3iT09Y+H?d|ORaIpWx_P^a-qXRhk2>LQJ5BMrJ`br>M)J)khBf~txYp9s)gx7_z z`q8@+)WWW}cX+V4RsB%Eu-$z=j)Cejl)6n?n>eq7A@YqaJLVe+MQQy zh?mnXM{Ov$gI6{37;nnL45dPY1W+mD0mV#ln2&0wxnPcf+(k z4Hf9-ZVEOkHS;{~s(IgRkEUeLFXf|18*&1EG1Wun<_3>q^KTj_3q|g_vRMbN%=?&M zgEY|ab&hFHvA@^s4>!z5NZqI@aJJ6$jb4`Fp=y=A(Zi2Htj$w5#C{IW8Z-34&T<)H zZbX@t5zr)~e3UL8YZnTlsF%*b7?a82KwplR7*lQ865dR!8btKD>y=x4n0`y??OV-R^ex z4!hmj#$WxY{r(MEVpw-fGj|~$>21Xj2gW`1%g;^BUx3;?K_ymO0mA}yv8`5gYEKaD?2Mw z6-tZ4lluh?3CTx1wW<3?TdL5OJ=3ut4IwlK1B3SLrE?Migz)nKoi9MtULEKS`pY5t zY*4t)B#~qMQc;52$Cr74G&jm)aDc}w=0H!u36+uL#Cl2aL|SC9J|sQs=GJ(;(ir4( zgJ>h;4`L20IQ|sB45aGX3k&VFYwDtfx&Vi;025J!#Gm3PL(Gk2%p%!`MMn5*j;m&f z5VjaXLdsZZb5DK`@Lgx(#=YSSMENuwijV$(<|$_D;KlpSqX78(rFkp|aIq|~S)L={ zK+7?^Tt&|ld)1F>t!n=$Z`_MqXL<802Gw^RyxP}ITGtVmN^gGS#|&s1Za(0H25sP; zG*-nMSlBMQpH@B3efhwAy`UIFk2vn~f^fHzu&olHQ6>W*D8q|KQ*M2T)4` z1QY-O00;mWX=qm;p(#FoU;qG;Zvy}k0001OVQFquWo>Y5VRU6KYIARH>|OtJ+qRPb z{bufe!1y|~Jtx`{sc-H~?w)HWt*3V4i=6c4;*1NCki>=}RerJSetCcUEkJ@_K@yZL ziOGxKyv8OM!0zI+zyeq-|NQrVLul_CPhXHF-un*iEqs6FeRq5uJ~>)q8_&s-*!~gz zBXG%)?kuBs-m%*4ohaSD((N4^WMw&zl6~e54>RSgjn_|HqO)qYQB8 z|8YfVOP=qV_M9_8r7`VGV$b~ryzM2A4Kl-l<-f;Pz{-7aiRT2aPJVEmV0CbK#9R58 zuB)J#s4h=;%~izH-fPE4fk%uEng%|y2{DL)d9QTvA!a7kno4=rkg{d!)=^@ag zc@Is_TxZG1FHcciV2|_tclgWSyt|53%IP<+$j0jW0CL{2sd|o?0Y5g2RMm zT1=|S8RRae`w-W1u+JXuAAU^8_&D)8R9*>wi}a}(P=ooe7gKP83xmF6bFCLyU^w$C z{7;3GDzOOKa9~8u7Ml!fOpBAeNy`+NXO2BH=NCpVBhk&mCD^}q9X}lGk`{6$(oLjZ zrQ4vL4KHk{$#Ks@r$D~Fiqh$}OUO$3;8l>{fs*#l+i2{+Fb>@0*Zr8oqcPoocFd!o9f3 zis%&MVNKDrSt4C$|F}Z9{Z3tJ#n6@gPGFnA1tc7M4&)SYSSCeeZH)O|;%*i+6}hK? zIU~?xNJaem_!G%6k~W{tpi4R5@9Z1;KKliQ0!%^yqB=^8v!dr|Ucy?W1P|LQ>s~H= zPC+=D@!tj($?K;lq|!5%Hq_8Qn;&4;I6hG?y4Nz^I{7~G)cIJbko_8^o9dvKr~h9t6ietX@9144LlwU z#&|p>b)&l`1$V6+?%KxTu1UjPYbo5dCUDo<4|h!t?s>5VBz+F|K{ebN-AEgcy6VhO zx_CGQxa%WjJQxoZqIGB8!C0G(XQT%1eJQy2%i-SNINbZvaPPMi?)@fk@3$ZBeL1-2 z#TJkZINbZyaA$Pjn-jqMKp78*y3+5>H05O49VJ zt*7cIy>1QMhf;7KmcxCxakvkq;XZ6B+=orzK5ReShjMVwi!C4-g>dg3snu|2bkpH* zJQxi|ibf28`?Nby@L*~vs*ZJR=;NWT;u^S*q~Ja(hx=&ba34v-ebiF8kD9=J)PA^+ z!6z#TJm9NWz`bX;VYfdV{f|&AL-?W{3u(dv~UcbhV3n z)A6{gjcee3A_e!8a=4#t9PTI5a6f4&+)tXo{iOYHKaqobUTgsgINRUl&*6kkhJ@;n zjC)F)QD*b+6Rq&{f;XkACctB2uC%wAyJ*=n}@x5-vQB!y0n5WH4fORTTW-;d^3C2zK>F9`Yp|?w6@-C+Dk+ z->MK_DnSPD0;(sSuP%OD8}C1+SSiB2Oq>GRMM$m(yDABGRR-)@U)B0GXfK?vimA%c zUUk0uENEAy(Y}@A)iuywI9{zn`#Q&~+eN$RbX5f9dbA5pSA{KVGH4$ThNBv=7fx5j zROMi=I$eDhuxrv_-^$_Y8elIRu2zA4ox|1bf?agBDnfES*!z-T?@NKbr)o7|FPyE4 zsmj4#b+-B}VDC$VeJe++Yk<9Qv|0uBb&giI3wF`TstCzBsi_)iSb2HGD5p5fIN5>= z3NdB18=VOprsO%i72DevF}xFZ`C(cGGa=_0h>3Oip+@?w@Qj-zQoEq(Wu>A2%xkEM z))sJ_H;8o{`-kb;2EnmbGzO8v3WktJd9@L!5=OviVleT$53d|If4e1R6;e_N={kP&c0elfpYtfptBE(5mvRjuJ!@?tC()ClkOf*KdK*a> z2}fm%ZrH`QV?mw|q0GhmgVnBf3`_5L?ZWRSU14 zD=U}Wo8%!y8r^6tzxh;fno>wFXlWDUtd*TC;{_a9RQf3-4L5%x% z(WO{19Z;HutGekswn7eBIq+dDiEGHYQmbHUncjkAlWdd_r|kR+yPpi_p~~J(4`DiA z%}kn;!Uo;l6YCMddVtJnA_aH|fKU*&4YYDRUzxfD>k9GB!(R2+g9Wix9(r^FsFl{hTE8c(0{b2u zA#)B)MTG<3S<=qN7H|yKw{mQjOT%+k3)7=7e41Q?-BR|BZtYvULrVHur<;dICFljv ztrm3u#}tjD{6}b%^oJ%Ya7~?G_P=p_Y=v{0OLRgrpNQLKWi2u%;UIEh>kO}gkt(L1 zVvn$mDmLoGLvvUVAoN$1sN*^s1X*%~7cbCl$`kL^dC6H!N$Fc2FL;@sy5vi)<| zvJT>75qf#w1gqyTzw0C{^A{ca!J{+1S@6dnk1u>TASfhwWm@$_7fTqTE*)&tQ^JT; z@%qx4J9cd)uZd6n0a?15HUSslrFgZq(cD9@1b?h0q$)e39>$E#J+%3jK_)V#W`KD~ zC+rI0+52~{RjO`AaO%Ufu%L5IHQhCM8Rx_Tk+{ZNrb9lzH`F38R)=&>#|lc&otrM3 zY1^r+aEJvzuc5YBIT)E+DO56XvB~Zwo!?=?k(G^=iVKy9CVKo)*Z^O)nD>B&GnmD| zdBSTsPke#Ly~CeiO;y!n_fdYSl7<*fJed}<1(g;0_*|XM#kugJr6)1MK6si$>G|{4 zPQUsKRuao4tO@@h=n{KAnEKlYSLg*=;@=N$%q97OP$wUlIn0-aWz(;~CQ30392>N`wGrd{0PH)O>cC}OLWbZsKJePY%WfyPQU`)yqILDqWT(1qx)AIRucL=Xo6K$1L2A?aDLRna zyKbuv@-bsi(1Y~0c-wT5i!fV51+tsjZIe73f3}9;k~`2Fl3Vmxu;E;w%RR{Jub{W5 z+;>{??xwm9|Vakg^-D9|c2zXxK|WK`j=fz+nkf!cU6c#orW_WG4D;DjbA`YbrEUz;8(owxzMLDjk-Y&XlD=+)P5+r1q0?G}QGs1_{;2|MoTlVn?_J>% z{6|q~9`r3NN?(?gtHo%#Of(Qo*cIj!zgjx)MVfN$A%j=&Q{9NMXP7Xw7>hw-GdspppiS!+zrUg9pY)fZn~GB<};0zOzTai^G4Hn-Spjf+K#8= z(qZwLMkgsCXN+Dx8O2kE?ySwG>RfxUDo;95K91>}gR&$O&5}e&C5QN$6yj@Ah|e!6 zL`^b?;)cx{w>#yMK5RbOL;Y^l(}XKa=I}3{#9`BluT9eMH913Dk~3@?3N^_WTAg%Z z)4Hims?dgH3Y%6!eX@iGNfI{AtaK6t`Q!)L4a1xVi%ahV6eZ&enfmzu`Z)F{&GOqi z9INl_yh=*q`|I`bCHn^L>#npv(4@E0<=QG$ReXM(WZRF+Zz^4F{C%B>JBqt+ET=HI ztX8-!#*#Ias4_~bPOu%sMm3eMCO*DS!kxs$uPNht;M_sndsF#p;@j&a+(}$}QyJ^x z*XxAbP274@DW&4m>qOmQT)MoxmGS4TiaT#8Q)zs8yW+|lN>vv>-paV~hBC^;hqpE^ zTwYeG`0x5y-&XrJQt{pOGVUO*ySa?D@!R!s?kH|sUe>z!?6$>a%S%=hf8DaU>#9w; z=tQqB^Jq~Ol9@)U@}V@yESifBukR`O%q^81%5B12;>{;&De#Tbo@2W?l->u~F`I2n zw$@}*Vz(?x?kco`$u@VjEUAqlN+XDVZi{Wi3M%06iREPN;q{Gu!xcl@kG`qD4J^W||N05n=l+B%%+Q_*wO%hwZ(-VV`mxrt$>q1v zDrEx80HC}(jXDEcv^zY+|Mn35`-}R-YZ`aE{=#d~FbhCo<5}89L|b5W_N7-}DleL{ zTAObmzSaWWWIz+bK)^NaHm;xyj2* ziz{UMK=z2{Fx8~*YG4Zy*QFn0UYPm<>DWe7f;>E9cXH;o1C7KSFn*L-eg?Oqri^p-3gpV0U4_E!h6aIiJ5 zt^ki$pkWvkOSp^rAtJf}g@LyMsEY__8H3(rvY}8ciKtj4TWYlqh!oPv)JN5(n=2FQ z2^X=30pp>Udi-We1xd9`#}V+NOmL`@8&Gt~OZoW5A}}Tv3L_d&`;AKn$fHwTcY_pbBc5%&@YHXS!_9B?me213C}OU(XZ z8UrXXlkXqjL1hz@a+1gjBaUtQCX5UAJlg5w0+=97v`Y#0&VQ#O7K+e~t&pg!Hu{$1 zF6^j8PpJ;7V1^ATypJRHQzZq0X1aHc{uOmExcLd=9g%vUU1@)z1Vt|xh5$jgc6u;G z0q8;x8G)fA08O#^h)zGqi{>Ag<>r94!labOOJ+^OxqlBslH>BfuEX$b{$~hU`WIC+ zn_tdt@7$r@UFPY~yYX^k`AblGC_M_wZp*kWeP%LQvG`YM9_(|J&)SU?g zlG-bj_KMmfoj_r#CifU-Ry&%eyl9%bweK#Lci9;_G18RDoqPVpielw3c?~ZQ%+-DW z&h+k9u6Yl7Owk=y=z8MnAr<@e+Hw8Y!E#Ed-g$ZUYwpeWkKpC8BJ8(FN0E{;>Q5O< zTq8O@zNyd!_yu%Uk2nTwQT~&4F$3wrA$5Ur!j#yP&|Ip}pEag(6RLz}f;2H41wi`? zu|=POI4bGzJ)0dQ+<-&oq5UIRi+RD+^Ic#n^|sUP0M5woPP#}3$YH6MJUC1>6dO&` zmP*?B&)#7N{DHl68<8Ns6V(#t^{CYU{y+9R-NO&vkFZ32cl~-2fKT%K8g=wo9k;@C zM4^NCiu$kMDlt#*x_4eqc}-l?F{;QsaH#3%#+FOOFau#mBbGG54Uv8xxbf=a`lk0| z9sSFCw-xj=pA$FS6JS{-_I{vo1;o8sV6h^iA~gQMTR0Z2zAI$J$9_PUIeVw~U|*CK zVSRi_aGp(6Q1Ss3!J3KwBnbw>v>N4M5&{-j1r=AVQdF{81S_LHW2&@wSV5Nd#A?a1 zaqePb;g@Ri8=B#dq`v>p(=n*#iP|kp`&;Ax6--zrOe~+R0A~xLf4Zi3u0LB5uCe8u zTD}t@xD@KG7v%Kk$waH<-mm2z>Ue*B_R4Y|w#N3)FiXQ?4ou+zy9TNGgo^5|LHGz7Z${d)4l6S-#9oSS%VJ2aQg z_GUHK@Rb98qvIaDzv5firJqiel;{0bEs_O3S zvXKzQhaUyZ?D<${eO^BI7KuKgn zMx8>+lEk@E5hhU;U(@Sn>Ei6Sb$NIBkC2(K>Gef_rbf=R*1o3KUvI$R<$tOhFP<^R zhPQcLns#5n`gN16`;E#s8~}OAFDFn{{TitHOo6JCcdsYcZ*G3X-hz1l;_;|z&d$&m z8;@F)l$HMi<52?-U|bRv80Y_G!Jodvf>*Pt|o;e$PM{i5AlwQxalQC5*a@Iut`**091j%y?89$pemGCIlc$MSY?gq+kQQz3RB?Pq?H4{k~#rA=+s#h zRl|e6>kEz%!ejTnXNadVqvQ((Xmlo)?3YXqt`f74yaS#+H^h5 zSpTAwEVFENPJ^%sM!d@+=fqlr-`nQ#AHyTF-7))P%jj9-rqw=cOqvs`VVUM>yK9;4 zcE5Mpr{j)E`$oUrGtU~Q-G1w|VN4q1Q#xsOd&8p&86Guy%|0mTk7@g?-)yx^(A7I@ zpVDr--8gH2cC&9Z&0eQvP5MU9gdAF@@VehsFN181ondZfw5SgC)OaT*YKp4t;mau*b19)sf)ZC zCzc63i1(49sF8O%ru6ZOs6qijp1hGHu|V6voj1g9m88=xSQvdPlIYRhL(hCGx8<-xlr=hXe-e%qUT*5o+!Z8p zO^9R6)L>UD9WRV8lsk(L?g7v6od=NvuKE7PKZ)%aJ+M6mU`c1eExEMpfXjl6xV$v! zK;SXpHWpXH-i+cm384FW!0Nq5zfz7_TW;XcApZOFo3{gO3@Dk$pE67u%(xOc+kt+Ye-uS?f< z4|ga_t@EtH0$yC)%R;4D594vke2mv;x*MToR&lS5O-s0#BGh+#J1z(H;GTl_BzeooW`LFXtk&}&$pMa51gX6gV zp^7q3g+A3Q(V}d(zoL{CMQ@ah^aI;fuN)+3HZLjilG(h(h#^m7lsf*hX+BT$d5Is* z=OxoW1x`FXKJRoNe4cu`U5w9D!$71oJfEv)7kplBW}44Srqg_$=JPUg8+}xk*%_ag zj^VBOylrsAr!jmP(@QdZ8TpbuUnqGv3}0I_e9y%2L3d+#covO6y1Tr%eRuoY%}7K< z_3F2`FMWSTI~985VEMglNtyhi@OxL`EX*gd%ahRM$$~CiZ(U{ho&~CxctkO{KjOFi zq^4IsvBFW^Th# zGiTt;twz1ss?&SJx9@4yz*~X7P_H^i5DEK$s*i>vLh2{kH8c8hiJcVw${DXbKd2&q zWx1|bn+1!xY!Y6$RhvTE)tH$CnkO^E3tVSfKWk1Vmen?maeLe~Osiv#O{-}%x_x-j zYfY3R>C{K|v5Hm7mm%oX8yX}mAJM_#k!U5>NWZ#H6iEYn>QL(q_}3SX@^9uCxI+Kl zM5vf^TMTASCHR#F0~)NBgL|`P&Bb}+>75SbJV|;)hfZIzNx8r}rITv&;Q3EW=Oq6C zR(SjP>8vLev>x|laQ*}AAAGoICX9Z$n=d{(^eUp zRi|K3fe%G6*hjXgU4`)5cFtjo@UGG6=f7*66}98L!+lF)zKO1PNARjX5-a*CZr6{6 zlkd9~FXmGhzFe~$AWX<4YfJw6@3bjDvpd|18>ZSy+T2l-hLxb{kG;?z?S0T6ZRN11 z82zE1C6m%y*(Y5F6XPSYQn{>aE}^if%6XY@xphPS3aiXt;lqdYR^mZUr~ z@+Et_Q1WmnkB+81o}cm zW5cIYW9~|ijeGxoVd7o!(W42pk8c_deCKT^P8oosx@Iz|MJGXc-ynY|ZJ|lIMBW~Y zx6uU-gB81hKqgq?s~>IWSSqdZM5qi;vM-th@qq|nfqY+Gzw5lxB*|;Nru_$_Nw&WM zE&Fg!Y)SHRlcHu7AxoP5PEMYWlO>&Yx2PRdlO@?7O_n^}E=`t{sjc$YV(@XxH@^{M z-xUP|wbGS@GP|iI7$<(8)wB)ymKam+v~PGa`v#-k9kr+?-}Xwrb@oBNDF;~v$u~7# zLrP=mxq5a%zU5}7$+u)WO}=UJEhD$lM`f9vk#Ff3-kN+X0v|q&c*~etl6cF=m+a|6 z$-^Pux|(>~A@TMf@axUx?XSOmz8K+nP&06@(@n)7IamfRTT&+fLKryQK@xdC2{|o( zst}$snOc=dxu9P+A$Tq!RLD*-t_LI zABc9_@8M9Ib2|jiZAS>~p|Nf88i^fM*muloZNWmMzI5Le50U)T?x;C61F=^IqPq_U zqN^NN6k{ON^HowBP|Ve{3kD)LGtEFG(`g1mGY}cMjXo;N?2Lg($MDk`h{ABm)A)#t z;U)QqjC{#{FO)nSKH^OC5zoX&Tzs~unCSZ+#X7bE_tO{8upNqv>n)C)zH~a`EER&} zVCjf#Ntyhi&=JyALGdL=iecNuXA%cScrOvV`_3Kv)Vt@`TCj*gM-ND>U8kL(mP0pxy`9aJ7K1mMZ7%DS~!SwfgwSfcm!pu=RG4^p8ei zca6fH?E{59Q+Bt-P+0XaosD|1E+Kg@ROxvOP` z*zoV%oldD$g)}Q48iLTktf9%Q-X7R3=;AJL$UIwa!f|4DBk#<($BTYFN|F!m^k9V&tX8=V92Pv;m>MDy@hdr+nwEh4+|DEg3U;l19-F981{oD0`1Iww` zAML3-cj4_VfBl9+vQ0 z3JE{Kd$j*Crw}u8Go6!vuy&|rWHJ|-zl;69B9*CcrX&p`LWaKvbs4TNH zS|=UD&rj<-g4{ff*2$P&lGe${m+bjM$-|*_`kK~xHd<$}LJ3TJx0ArOPw_5#f z=V?rk>_DGoo0MA1azb*qt>lI7Johidd402nnSoQ6lH--@oYWDQuPf3Ba!71Ae0}rb zrp}L!X4PE#EOtQ10?$PZ+2Fx1jT2Hd<|Dk2Dz)Z@G&fY#3e63rQ)_N0RPcjvL%Tfg zs!>!Q)$CBtk7kE5KgDZHvqRfKQHRG4_4mOJDNpn($PTG-1yUO9&DFCDb|^P9%?>5g zX?94nLm9b^J}S%Xj2%kH@bj}nh0vU*@kE(Il;nvr@+JGgQ1WniqGm%AMbAVO-MBEB z2Ccu-@$$`TGJ)ALxYuOvKD=<&DCJ{J$$`>FilQn}H}h zF`P_1cM*^3kZihitfgx^0SRWHV_~exm_{rTr)j&Gt z?rDuc*Rq;JHh8#`;|5>>B(fmh0?5go;DQC)wA~e?5N9vdl;hddr!G2l9Ce`ku+yWG zMm|8aXDo%}2@92(mEkk$^@KhIW3jHI;_xn{#*D#>H;_mZ4dV+$J*fbiapf$H0G(^- z)az2i`ZM>zM@lPf(Z_Rw4u))f5y1{^WG69%6P6#MReF%Y#b4=5P! zjP(XV;uAA;zKi>AYe>6;=# zh3J*XQXx)QC1kE>cCYV@ zsoyW?{C+i`m#i)6KAs&_*LQvMh3JB=6eCwjCI!?-GP|iTq5p6yEHlD*nN=qZnMzb% zcD%KZy30OPe?Rc6`wOm0Lzs;Qfv7z-NNh}}9-XqWSOkrNz?|kW(rR2B6ThPY432z6 zGd!sE{481GcnbBN4I5eU1vEk^Ur%L(ld6rgq)07awsj-VSN~9q7nG%dkw5bm7`jdD zX*@zz7h@`_xKL_>lW_M79y~7(eLKoE8Z0?e|7LwDR?s{;lzaTzq+H)y;Jgk>a7}|5 zALtM0oGqQqwaTMVvCiAM>r?AWRM%1dpq$C1Ca}f(g(H)V-_!XhS~LAfv!zdAOA(#= z_H=2pq4K(dd}$7#MoRM^`HFVInC9oEDbr*+O_^%SG$XgsM`f9vQKp$7-kLMr36T6W zDm7cUl3Z$5LD}vx6#cQ-)Y%I6bxi*ck<<*Es>#%6B2zDxOMmGG&V5Qgf+%N(WtVQg+cTEu&65M@{N0H4cOi6N)A;qW^Oj1z8)DXM;VU7(ai`( zH=z@ZSmlgV3bqZrNWsRDFugOTsQo{cgS_;T8KpC;N44NCQiy=aFIHmIsUPj)1r@xKZfEF`ESn#Qq63horc`XG*`4pI;4! z<3EPOhvBgL=Rd2K8&t(#!(r{uf5Lx+I`|D04#%&U5toim@GL;F|>ltPI?m7uovCCv0d)489DRhyy}!a?TNV!Q?VKsE37$v3T6!41trU{ zBIBxB8on>JqNo=ieC>_l({7tk$8;^IUB1;OQB|ng^&$htOkl(XM$tATrCn^x55(wS z;Nex{!B~@Y%Qq`fA{oMpqLxutq_eN%8Iz_V|# zu{IkgUu=70dt=+SZQI5d+qP|IW81dQ{_m|@b*s)fJr7+|J<|_e{Vx$TkXv| zK`d6%0?iZJAY7&{c}n%Z?RNF1K#zD^jiGM8 z+cWPUbDzW`8I6ZZlp6`-Fs+D;^+|1g&`|=^PxU=W zC|^iOA$oTx(Sc_~HoPydOIa|?A?-dr!{z1*iB8KjQX8(AzYjAs!1xcxH)fMlb1Ie5sU1kYxLT?v+p@LE&JJiT@P zXjCh}drANg6jrKfFU}JaLkTO481_=@(O-76E*UzSND*|YFmR(;x1d+?`q#=l1_Dd3 zbRgkT$3>)u)>?$&U4T&##BM5+Wv(mQ$sDQ$<1#+SQq*IiMG?q4IO{L43C zj}QaIDI}tyKW@em86u_<^5_yc2afliv^e!CSKY%zG|3AS`i7|h%HF1)8?CTdmBXby zf~acB@OZ%`Xmz9~$x^!qfze+5ok!{l6o0Mvv zLH9*Y(q#3#!h3M;F})Oh9eF%0xUAY}uA@F`nPItLWRgpJ2AYn4M6zg*`ZRyub;CE7 zH$gT2VQeN4nJd4rlMYMG@;*9S1=UE-Ockw2IAzf&nk$dm5XDb6b_r1_GIY~yw1||L zSlFrf7t-xk{J)Uy@d|SAiqW1`JuVEqvq*wg~q|n`GMJF3VmwuEH`spp;V@ zf@qE(4NN)0T3a*Js8Daewgpu#SUjYqcL5!e`u9{urQM_I#V4{ep`c!82-e51tQ@VN z>KeRzUYMab%ixmX845;Kf3EbM@t>gzTGB&x)VD8LPCkEf6;Bl#v2=)YODuhy;h^~H zYt#jHjqgA#Lnr|`dUb|b1pd3d@5ryIwWYnByb{rcVoEP>0eyb}Ug6lgq=XFgrj#jB zyFmhEDk`rm+_)#8z=2eu1=y~9q9KC^tUF76D>WyB$|F#H_5FAjAS_8FSR`M}-k*K0 zbo}V+3(RefP4Mml-q>=??nK-}=-Y(*CM_PWURQ_v`4<@`;IJ!8cVhhdNkRSO^bODn z-Zt`@`&sSVd`GreiL@{0pABUg|AoajB~^VnreMA=ME(qP<*rxB;3#nz2)B)jyP_|C>eI0YIs;lG!%Zk zmNJ}>=t%zX2J%B(U;0-kh`D+lt0}MXx8AotpK*^-MR|w6O(%3W$#~wh1Wlgq(vtGh zKT_VV-4s6h-PzSw(kx_~qE9tOaM~!K+Q@z(jkjm24EnXq;Ld{AcMxAMQkPE_dr(cE zLGKY zXYeyno@EiedKHqGy~5ofD?hbgoXG%)NTS;$z@Q!qi@pW>X zXQKSR_eWxkh8toSJlh@ePQ!=+!>s?;>zHsnQTV0AzrW1ZIM}}1uNp1kAcW)z4ah}} z>J{YRu1%!pX|sJm%zi}Na$|<-pj3^eHWIS;Uk0am1E(Sa_SY;a$TFdSKy1g~mp-~~ z)AqV_EnPg4h3NNwdqO?WA`41do7NUi>al(RqL-p$i@@HWePifIVRgW=2xp-M{bbWR zVOWyDGK=T9UL06k1OwWyaXUjHk;#UXv@=D`II2X~uUw+b)oZX2Dr~WV76sNURL&LV z%j+&3+9k+v{%F(6!G3=Rtu(`KcB;f1!0=7JHu|=1TV-em)|l=%Mk2UQV~?60IkEe; zxiy@xL6|Xtjx$KFXpAur;(NOd{AIL6EO_z6Pvwjc76v1bt#|wo_xX$Z%u~ zCT!~}+juMp3#Z`Okie9=Dwa3V3Td)n9xHfC9AJV6Ht! zzw7wyYmv<6%#B8o?dQzi^7b^UBMX_TEi5NX(T@2`oM?+7rgrBNgGQ0Q9Qpbzx|Ru+#3Q{oK&H+d@}AJ+*wsrfJH&P{Cw#$(;p&X zau3VpdV*5c4)sq;6j>*=3a18sBu^(6!ZiX z3h)9}H^UbC7ICA&@@~rq4`%vg2z)q9U0>cp-wRujb_t5`lPh>&1QA`UEO<#@zd|~ zUZh%OY4(yo3=Z`!wq@yWk(`dDRgky3>lKbXP}6Z9;wQMK|SDm!_9x;K`xn%v*qP0bx?&POQ%T z<;E*#5#nvUd^8iB^xFXHlXe5{+bt(fI@xQr(QIV+auVUF^eTgS?3j6SnIb64^1K6c z=DLK!|3mr15*}1CdPeZ}m&)aBSJJn)04(st+5)U@hJ99O+n&tUz5t?ZQsjlAId~p6 zyKIk=x1A*NU9zY%$K(rkaOIy`{;Lb+hT$9ho>p9?sXM+ zW<>SMF5r4-a_nLQx4nUXwt~WEH*>I3U;Xk+=S+w$0I9)Kz@KMd=Dzz;W{Og~xvZrW~68S%Q*(+hCRtN9`T7E%~ zn?99T^y3y`o=fR$cORG{;t4(euOK&G4r=rj1>vS#i^#V&@Q`y8#*pg20wfk*Hk(Yd zOv;nf=*H-^5mfxYr#nx9FHmbe^ou$dt2Axq|B{C7LVJZ}HmfxoV`A1bF;2L%80!Upu8Pq6Ol-U5tFeJUW?Qv*~lk z<|JYwyVMH~qDoH-xZ9NMc8-$f#a>AM!^3akxjOdkj}{G>0K#&!}T%Eo-M$SeK{F3nMbflM5hpm?ff1@Vkr^EJB#7M`R%*H2U0=Wvd#S zIs1TTMhCb>8VaeimewkKqb(@GzoGO={#c;&AHxh3Y8KP~MA=?V%uFA&x(WdX13AYPYxD^*91Ph}9Sg)aMe7m)$7tzY%;`y!@KPC7oWiuDmR zgzb21tFu*zz*C^~DCFm>VYk(2c?P>qoUzmX9r2-8o*I>k{4L7;Yl?e!Qu*n1JAt^e zG8-+@FW&0@q`cSGa<85h>!*JFZUTrC69QiQ!p7VlO+yIyrHxe(aS69uVEOvr;uFrl-tuQRpQ~<@ves z@Mh>}wjoJ?_%%zkORrY0s9inO1#~faLMX+{Nu)w&Jx`ZP?(s9SKWd%t{d{hufH^&c zl&j%Gd67X>>(#SBK9h{hEu{$|Qu1zr5p#xN7e1(@6y9&;$WbjOWPQx-We)cVh8X1_@p{{gG zRsKF(n2GG&acWYgpjwsl!Vxs9h|q2OV2!AdX?t~(dK~Z=;x&jw^k#n+0h2^f$R@1V ztA|N`U|4pfziXZsPU*D7Pcu|YnacY9^-7b9EbA_KieRRr`BQR&(#2i05bejtQ&P7_ zOnVbgT?Sh@^h!^Dj9x}Ou5gaP-2+eFm&jqyi<4!@`Pk{iey6=d zzG{^CvjJ~|pEQU2`!p&Q$P+PkzEo`|<1-5Qc*TZq*%q9?vK?k4+hJ6IN|-b})4lY- zeW?0?7MOI$o=bPHc%G+;hwc5?NVqH4*vX~$@ZYvxvU_Nf+`%7GIi+qO+Njp6#Gfp8 zZ}<%(eS;wRPF4ChK;}pt!9w$i=P?DEZc6=gONA#A`4GphYgd6EYqy0 z&2PM?@2~ssAV1^7-MJ-mnW~vduY2TZpFhek7Q15s$w>eoK!r8vn7BtUam#uidNw62sv*mX5juJ5Ja_BYyY^Kw$W)NZt622Oq@T_FPtpU z$vrk89O7)K!_Z}i){R`@9|Cl5%TMZFp@lFQrX7g)lX6wjqSGN=!gOcFt#SwmE*EwX zh(rG*6eq(AdHc0E3A14cPQWU4N!7v^uNl?VUtXB*&V7 z70WBCJQS#jg|TDIuZ#Qs1_^?<#ZXK;R*lrB*6nE0ZlfU zc&5?uz?_8L+^T8m`(G3*F&C{Pbdgjs%Bj+GiJOGc9&V)=#dDh(Jc5RURJuv#?@zA~ zE5f4((&(OF)#UGH$L2jV|7b z;zCfGlX5Ozswvm^<=mt!kvbEYCqqYnh_Gtp(*Aub;_~Twd?ie{g1<6~<8gPke}J0U z?bZ5A(jDN1{neXPEt73@hm-~u_rv_hagxqxdhX@d!5N~OrI(k$@I2qvy+v)R?2hb= zuAHje)C8mWU;aJ%qHMjvM5?3RH~)AG`-A{=DfH5+2`TZ+mY@*X=^~B}4*5jzc=#7k zC7ejt2nKuJu(uvQowzj=k&?s|cq!r`V-%$EVbgk16MUxF=&WZV{br>vg1IcoIww*6 zccZ|+ysNoPqJ69D5q6`({w$q)r6so0%sXIDS^7G;fl&ut=~$-wG!!k_3&>Uor-Aas z5;wG5)Fa8(v&p}3X(CQRn4ZV`@S>o{>GiYr^TJdlqomTJ90GJ++ zKeVf!E>~i!+&YY)rhm3Z`mIw}(v2!?iMI`{bFS?bU-3wx6@YHLuY9r>l1NDwW6Zwc zAF)lCj&-(#--Zqfi!RDOFkEh(AF(ADfA<@qO?e3eZdQyHYycCPGxajw{7Z_37A_XP zOyqW7iDPql1#kq$sA3mAOb*?!0M2N}$g4#P2vqIruIiQy`I@|#8@qq??~e2x#=*;7 z($sUYE`~Wn+xkq)Vf}M!Ry5Dp}6_FKACD0&4MtA{d1Ff<}89HlH7 z$tD#B?12^&W@#qN4ClqxjX1z!Ygg(`laekl>94b>Vk!=mTXa&|cajJ!RL#YIiJpVo z-cxiRcTwN3fxJ#j(l=TmN5q;-*p`v9nYyC<} z&AI1}*SFoUX6h@N%N}#HJ#6MLt|y1RDc!37E^3I4XNh-vzc(8&XaI$QAHJBc0pOSd zm=hG^F{bg?Us;@_yb#tk~$!_q4 z;PIc00r8cN;{SwBPD;h6@vgwQ^X#+i@+HAkK0ya!M%s`rs5j`dW&N2dZK7H5^M+1j zTBa6lnX~yzV>xT4eCEZZ0ZB*s?&sN`4QH~K5D)~;q3URFE@Jo4lhO_J$n3N-s|8=m zk{KxFlAbVYJW~d5E-Ig^S!$Q*G0^~z$9Fee*iA}g!fGObGMG3UXe(J@tn_FxWPz+| z*Kg8SbUp)eW`&-mDBD`08}uDe5?GRQFmN@SvrdW*oIFU+O42r1sKs1@ygF$Figs<* zTLP#00o_&epfS7{6I&|2M2I=usx+z6HVkRsugADt`lW_9wxLA5yLD@ETfgAb{j^2nr?`!)sgsV^9c3hN={mhoFEHUU>bp5}UEgfn!pq1BPp zO$X4LfMk|d2%t6W2ee0#VTSM)&4CUEZmawy=6xFkrCel{cB_jus!i3o$O%R=)*-{t zj9ZJ;^K5M(r#{9h`!?i*#&TqCs@XLhLO#XE=-E05@0ly|ff}>02TT%nW;Wejj~yaj zapK|35m>waO!kzfDfGBPTDM05^ZdIGO9gXs#3BbF+eIZ_lvCmGX2<+cRNliDHi5i!1 zktSb|yZ+rmk0KC4y_!trL)t*C?jB{%>i<8V){-=BAFml=D3*c)Z#XRFzeGfVXwMaG4;! zyt)HzLA_F^*pN9iCsFS=##-Ht&*LBj&zfmy?U=NaXb6%T#?dqV%i_D*9_%*E7aR{G z5?`5S(k>TjiZFwb6*1X{?}_|VdTp?~WqB5jZ$gZ; z5jIU~ODj^SxJmEVV3Ak2I*F9Js>lx`4s#txC<-4cZ@GLi3mm5KdJ{2w;@SNT`3w09@a8P;0=74@3$5f z5(z;?gHUVA{6!jFangq*FO2z-^yRK}LwqJ4G^jaUOyUGrYW~1t zV|f`9&%CqeSa6062a3@wX656O)PaqIQFs-o#^%1>lH||ZdFO)f>1Ks!k<7Z9xJ8C- z6SebdSgeh8B`^?>C<=~AZIa}pFB&#?4?Ks0xi&|-#8lZrMaHb{CZULJMKN%mdCEH+ zj&kmyM^n_#VXVV^dh?)Je2l$vi!d9V6cV&gPydw;*WzY}=p_P>W#IO}_uDRKclz;Z zh+DL&K6aD?NtCU3Vw;F$FA$q-vdxq&q=hkCTiXHY%vn3~ydsgGq`w^8#lXMRwLs=m zeEVO(<&~Y^zFyuN_d)*^Mah3>Y6cuF72lX2jPAEHO(VZwS7K8iZAWMQhO8)_Jm251mnf01o zx%xbzyf;M-s~DM>$b#$TN(|%k7j5PEEi-?xE0pO~ShT&nohB zZF9434PO)iR!$^%RAGI8FuJ*%$ZdiC`|mN|)A+dhL4AvV)ZCInwZchWhRLy-6~C2+ zsYnszkZpd6q@uD3szBR|bl8gL6J|im0ULRAka`mfW2N2ruqlf-M$KAz_f!E>D}%2~ zFkUtF4p_MPeD+&)$J{4~weT_0ppXMo!}k(!OI27Lw|&(PZWuYTmy@@)bJO)A`%Z*d zzZ%H0A$=&glQdqG*vkWFpq2Jb+GwVcnc>e#bwDt+Y~y@b4r&9AOy)o~iX1Tv%<+iD151v-R+lK-$S0gJJ*8eYQ{5q#$qpr@5Q zRymQa?t1emWeo3$0fcD~U~8DubDC@suLoR03*_WI>o_gG;J$$?V$w0u0wv6OWVq08 zM*v{+WH?zJDTh`d$+1vh8auq6{J$Oy)imoZ2s33o*dkb-=+Qy=pVQnA-r`ic@ppb` zP1<{DbBmK8rO>p?iCn)$_Ia&N8Gc*MqGTW_Tx0bciaJsmntF-Gqcb5@7NUpBCMJFa z>8j2jIoSBWnI{jMF$InFow4VXt$ly&FTS`gyxjAIpdoR@gEwXn~&-Qfx%vVrzNXjx$BQp)Ny*|k&=dBYL?18Jq zsK)OFT}#i3T4Hemfke&!CZt!CZe?_BH}hy;%ha<$9+Oe`LF6dQ%bUG>`)osUh7yNU z6P_OwUfq{kabgi${&@uZTFC4cVN;nH<&Z31nlQS+9`spCC_0<3vD+4r^#UVQkuhYb z4pjwRMFm~dcw6XF9f;n8yT~>jJj3Fuomp;c1hvT(c7ZFrhtt0$V02B8&wpQwNR$rN zu_O7cjjV2OL@8ziVcDe&Xa^g)N+ zP%LqrK6vjNBDXWxk$5zELN@w7^DD{6a?ZA9s#|J}#tI_nO+ntSUY(Mwe5BfOh72JV zr=VmpQ`~v1UNrzG%_jnaW3^eoxUqcIHL*D}RPDzcmx!Z1MU5=w(%bs&LW(hFzt8{r z3bUh3Hin+GQ)pP0ECVpoE2$RZLh9NN@`k(>#5p};*zGgBdp!>#Qx&%h*vhdOuRmhe z`iP&hk)mLeXONbvxQ0W-+)I^R^BFSD(i&@jxxu5JagAj2(QLQlZ{DHBfs!Rs=qi^3 z-&~jLOLhi2__I%P$%PYpH<);uGv$$T5!;6misPQTW?YdcBj4ZzsB~2;fHEu`j+oqr z+kF7Z3$C+IRa=j6?}2U8L}ndE5t7<8dO;_C&*{lLSGATlPk~}Z5J&RwKEzx0*gkIH zjFHRX?fbAFd7xqrO<2lx6?5i0KeXGsk0B%*Hzz#b-CP&EI9diG;3ErWb8Exh@gtJ1 zYgU-^uUWFLzdkpAl(}^bpz|lVNaQ;Kh(18Wb+-vK2i0Sn;a}Cmg`{z}7iYrrgOTgU zA^foAxQbE!F`EVS?VP=W8tfF^VMgraGO0S~H>}LfFKRodn+{``kplu1ECPgP>Ss96BLZ6q>c>Rp$2r^`7q#a@T{8vBKi)^`8U3tG|50d(C9=ZT$zHXM1c=7rwH zY?r1vr`EwzwoO$g9us*xq>4S4Ch)K1@#~imVgbExG^}-+(}HLc55oujpfkTD|%NglZ>relBT%LGoL1xjy;ryg_AyW=p|omvUtr7ceU)_jfXFX>v(0`OJP_%B07A>-2z4TbOX*u8ES2Rlc z`B2e@HvhAQ)?tSc-bw?zVDtm!?_c^kcW&=vCzi9*nWEs1m=BMdbw>C7C=%5n+H8wv zsE*aRTU!M}2iYFX{-=ur zzLy~xd1ifCJ^TtNI})G=3PF9#E;K)TS0Me_{MIw#Rta6IMTHmPCw?~#sN{p&S08#? zVWw7mfumG)z1d0TLZ(9_Ja*M$mPQxz$=@iKqIEXxr3hoEbD1GCWx#@kaweMMfv$Rt zic>B`6$^T;3P5DZ*>UBw$zlFdZHuEsw~DO-VZn@RDrBw}N4a33o)%ng-fDTx#9FU9 z!SxE&I)F-9evdI?X}7Cv*P9xvk8{e!bVmtcUASp92)Je8lqtGxj+CWQaNUdV#jD{^!gf?rI}#uP zbYSvF_$<@ONWHJvb2?u#Sw2zAE%ZAv!vbm;gY+~3P+W4mwXJO-cT~4-1dB-|f;r>~ zp)Pz1n9N!L>nFcyp!{&*;VYIJquzRdpC|v#{adr13HrV*hkoD>ER74jl<8Su%yc%K zZ7vrrFbVw9YS9!e+AeeAdMq{^U!QUA<8>8)-?cpCo>ini^wVXu2C3gruOsY3^3G!T(nTHn>4=F@@tw;A-#&Yf>1cJSoL(^hA+i~ zD*uPQFpN_l36rS*j`WAxvh|z`?H~uWpE#PGtdL_PMp*VmQ$hMAytBk(EX!N17(QbE76O6pni?#YvruYEq4vv0-5!n*Pa9!taad@KDU{;p(&}yz)}P zRgcEQ`Tjp2hkvbD)i>8dDyP*NgF0gXoA(gSdonr1b*uG6noc-D*K)3Q%FBPA+dw6v zp>J$-cd2LbG(LArlt`uqh&(ipLH!$<&>B%KMHQwjP^rUDzA4wD*GS)6Ad|hwTToKzT8_2jK(`dYa^Y%zg~IqK;GW+-E@~R+2L9oj2y~yx&I@dbu5~zn4K1 zCu=TDBVAYeJ0AC{VXgjJ-dKB8sJNV2$!PV4ol;D#Rp(GCUb)v3$Qp#nI0*3SYZ}dj z9#SAX{3>Y*Yl~n`qKFY8KFUE#1ULAABi`u)R(t>8ftAp6^rd@I=EuIT#l^xz6s3;a28D^j-jNEXdTz{vlwLI;yS|O`GDesINTW$Kjiq2=(Z? zjusuvDe4KT?up5wEOG+S39-&OGIxQ_tK`#h5LJVR{7ImUvyv9(RhLL7a!f&1m*5cb z)}3l=j>4iJx$=XnR$!X1(?~Z!PCl7{TfpUT$s6vZYLaH73kg8-Th*V#fXV`cajYv5 z{uzFt6Q4^Glq)9`Ag~3o-5s_dZZV)BQ`Cyq9^!rCa3w32{wWsOo{f1)7jh_2cw%7x zN&sm%C8Qj9j!N9Vxf3|TBD=4V-RmvfVILtZ+a{;089b#dR;1UMg!7VQm`&vE-ukea z)V-=GcVMR`fjltB2CsvmsF*shATmmKc0=j$UP(~yTuFoO^4T<{V%`-Zsit;hBf4Cr zyd3C>qJaI?ZJ!6#-!ij+0+{eYlH zth(?DR$IEE(0|TDYmNq`6)!IzPgEE&h`e}!7i5o7i*2qT6gPVQ{MIlc*&u zFE$|#Pu4ws?<%M$S@?b*dd*YtBLt7I$UV$*SPF2N=^2sK0%Z;4!dGXY|J@eO3C2DN zfqpORz1G>20=~ar>s97w)07IUnFxzikxQl{YFQg^F_t~uVQ`p6y}vR?Y(a_edfA-7 z!7POwEwE+u&#DI=#`3(vkHuUHZg=%O_Iy;>pGDdae$q>dGs|4woiYB>CFduaQV+7+ z@TPZbFkp@p&3-4qca->h>e0I;X?xT^WczPIMDAS+9>@b4h^TO`Nl^7xm#7n=QLke= zN4$EJ?}%|bPe{I^(Fp91;!p}cN2+jPXfMxQLC?c*CR9@4$0Qo}x_Q5kM^U%2)k}5k z4jSpGy7Ex}-D(GQU(2GE^ev4aFO89Jx15z@N1M8y=Y_py3K&MF}#maNA$F*$Jxfp5*{(UFL38Z9KVC7 zOlSW$xY>r>=BHfi3;rqn@VA%FZ{NX#2Id7|D|aXXP>94p(u&hTian^8-w%<>Wtia& zq#?K?t;Ffa_`uDJJ65l!PWIPIW-ltpH0q6wt*vu37{Q@Im(>)w6gh5^sS!8?Y~t@( zhn4=)mW&Wu709FbZY>sK4o6O`A^?~h(FMOr{}EK#tlI=VV!)lGoW30&{HW{-o9(R} zhFv5+-gt3V6ZrU#1DW}JPjG%a22fJSVL$(bTtFy$RLUI~ zGO-WBnP7I^AGC0&;i=sm0>7}`9DVkIS~Nq8f+eb7zC!)lqPmLaD#$lqsTv~u0N}xH zW)O%E1g74ukG*NnG_6*tp-c4Q5tkyp-D&^l@DHm7Ufzp>!x56bZ&b6|Ic2m#h(i`t zdCHW_Dirn;G|5s4^~Y}RH%3(CZcF>CuoQlWEv_G~PNC4z?RiPJcyfN!Oci3CWwSh! zWWr3M0{yE&u(!DR*r}#F`puvQ>_yAJWQ*~NWJVr<5lmA6H54_8zHghg`dcM=M!Nk* zMLZ56M(1#=jf>a#=rzVw^SS{P-ST$s~wQiiepnt6}(&?$!;e ziRLtUt*CSFaj|@UE*TO*Fsdsb3)JZzEaRaE2LTaX#W|&>FPG#BBl4*rC8G{*7Ab1Q zLsR_uoxW~rdrV-sNJk}Kg!!+ufsM>z0^`;nnsmo-t;+v|@>?_>Ad5>Ko`e2i`IMdK zjAa9;B{JWf*d*L(6}G!?Z0XeI)PzdpAEZW?>w{&xbe!607By# zL}Pm}CnIwz3KSX6+7ks>*TNS}F%4%FMX^LiF-zhYH?AIF>EA`ubBLxMkOq2eAr2L9 z;V(@Tn@!yS@SrPB%bu8Gq%`ma_iM;5og=TM4x9?1k>rBtnQ;|a23HQJRK!u z5xNGoEIOD|qk`gwjup0nZ7hF*l7_BF^IEQSQ=93MmYZ#jE~a#s&d2jxz&59ULeqaj zZCAR@f5N8vD<$gG%fcf zlg3p*-v&o@n`7DZ2@NjaX2*V}XTFJBiHi^;TD(>GkBM7R_^+lH1Lhn05hQmurH_)? zu9M!!z*W*7IsbcN-1;^l^@Y+!B|F6a_42@#bR`aMv7GG+>BEVUB*WTEeUi4M&WBxR zX66K$)itH1wlUoT37da!rLxEp4H?0~g&nUgs4cJGz!|gl8?4^9Z#hX&FjSEL9Z>Qg zVgU#!2*H2YKl)$bCI5dV{}blHf3E&tCHem#5dIqif}A7-= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\\r\\n| summarize FileCount = count() by DeviceName\\r\\n| order by FileCount desc\",\"size\":1,\"title\":\"Device where files are copied to USB Drive from TimeTange {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mvexpand ConnectedNetworks\\r\\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)\",\"size\":1,\"title\":\"Device Internet Connectivity Status from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\\r\\n| extend DeviceMachineName = split(DeviceName, '.')[0]\\r\\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\\r\\n| summarize count() by DeviceDomain\",\"size\":1,\"title\":\"Device Count by DNS Suffix\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by tostring(IsAzureADJoined)\",\"size\":1,\"title\":\"Device EntraID Join status\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by ClientVersion\",\"size\":1,\"title\":\"Device ClientVersion\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"groupOverview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\\r\\n//\\r\\n//Get the list of AV detections\\r\\nlet avDetections =\\r\\nDeviceEvents\\r\\n| where ActionType == \\\"AntivirusDetection\\\" and isnotempty(MD5)\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\\r\\n//Get a list of file creations\\r\\nlet fileCreations =\\r\\nDeviceFileEvents \\r\\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\\r\\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\\r\\n//Join the file creations and AV detections on the MD5 of the file\\r\\navDetections | join kind=inner (fileCreations) on MD5\\r\\n| project-away MD51 //Remove the duplicated MD5 field\\r\\n| sort by Timestamp desc \",\"size\":0,\"title\":\"Source of the AV detections for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Audited\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR audit events - count events and machines per rule for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Blocked\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR blocks - count events and machines per rule for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query make a best-guess detection regarding which removable media device caused an AV detection\\r\\n//The query is best run over 30 days to get the full USB history\\r\\n//\\r\\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\\r\\nlet usbDetections =\\r\\n DeviceEvents\\r\\n | where ActionType == \\\"AntivirusDetection\\\" and FolderPath !startswith \\\"c\\\" and FolderPath matches regex \\\"^[A-Za-z]{1}\\\"\\r\\n | extend ParsedFields=parse_json(AdditionalFields)\\r\\n | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\\r\\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\\r\\nlet usbConnections = \\r\\n DeviceEvents\\r\\n | where ActionType == \\\"PnpDeviceConnected\\\"\\r\\n | extend parsed=parse_json(AdditionalFields)\\r\\n | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\\r\\n | where ClassName == \\\"DiskDrive\\\"\\r\\n | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\\r\\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\\r\\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\\r\\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\\r\\n| sort by DetectionTime desc\",\"size\":0,\"title\":\"AV Detections with USB Disk Drive for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\",\"size\":0,\"title\":\"List files copied to USB mounted drives for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Device\"},\"name\":\"groupDevice\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mv-apply ConnectedNetworks on \\r\\n(\\r\\nwhere ConnectedNetworks.IsConnectedToInternet == true\\r\\n)\\r\\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet\",\"size\":0,\"title\":\"Internet Connected Devices for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by MachineGroup\",\"size\":0,\"title\":\"Count By Machine Group for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus\",\"size\":0,\"title\":\"Count By Network Adaptor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)\",\"size\":0,\"title\":\"TimeSeries on Network Activity for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| where isnotempty(RemoteUrl)\\r\\n| summarize count() by RemoteUrl\\r\\n| order by count_ desc\\r\\n| limit 10\",\"size\":0,\"title\":\"Top 10 RemoteUrl accessed over TimeRange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query looks for Tor client, or for a common Tor plugin called Meek.\\r\\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\\r\\n// To read more about this technique, see:\\r\\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\\r\\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\\r\\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\\r\\n// Tags: #Tor, #MultiHopProxy, #CnC\\r\\nDeviceNetworkEvents \\r\\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\\\"tor.exe\\\", \\\"meek-client.exe\\\")\\r\\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\\r\\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\\r\\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\\r\\n| order by MachineCount desc\",\"size\":0,\"title\":\"Tor Clients for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Network\"},\"name\":\"groupNetwork\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize FileActivityCount = count() by DeviceName\",\"size\":0,\"title\":\"FileActivityCount per Device for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize count() by InitiatingProcessAccountUpn\",\"size\":0,\"title\":\"Count by InitiatingProcessAccountUpn for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"File\"},\"name\":\"groupFile\"}],\"fromTemplateId\":\"sentinel-MicrosoftDefenderForEndPoint\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Microsoft Defender for Endpoint (Preview)\\n---\\n\\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\\n\\n\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b22a3bd7-19b3-495d-a0df-95a7a59d98ff\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"value\":{\"durationMs\":172800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"f0450560-ef16-4aa9-a3ad-7485dd909587\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"type\":10,\"isRequired\":true,\"jsonData\":\"[{ \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }]\",\"label\":\"Show Help\",\"value\":\"Yes\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":1,\"content\":{\"json\":\"\\r\\n|Overview|Device|Network|File|\\r\\n|--------|------|-------|----|\\r\\n|MDE Tables Last Data Received|Source of the AV detections|Internet Connected Devices|FileActivityCount per Device|\\r\\n|Daily Data Flow on MDE Tables|Get stats on ASR audit events|Count By Machine Group|Count by InitiatingProcessAccountUpn|\\r\\n|Device Heartbeat|Get stats on ASR blocks|Count By Network Adaptor||\\r\\n|Device where files are copied to USB Drive|AV Detections with USB Disk Drive|TimeSeries on Network Activity||\\r\\n|Device Internet Connectivity Status |List files copied to USB mounted drives|Top 10 RemoteUrl accessed over TimeRange||\\r\\n|Device Count by DNS Suffix ||Tor Clients||\\r\\n|Device Microsoft Entra ID Join status ||||\\r\\n|Device ClientVersion ||||\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 8\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"454d4e02-26ba-4195-ae30-94752bbf4603\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"preText\":\"Overview\",\"style\":\"link\"},{\"id\":\"3d902e84-3e5b-4631-85d1-c229ec2abf75\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Device\",\"subTarget\":\"Device\",\"style\":\"link\"},{\"id\":\"bbc20288-b398-4f63-b7a9-e3830213bb34\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Network\",\"subTarget\":\"Network\",\"style\":\"link\"},{\"id\":\"edab4a44-8ca3-4ba1-bede-4186f4376d28\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"File\",\"subTarget\":\"File\",\"style\":\"link\"}]},\"name\":\"links - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\r\\nisfuzzy = true\\r\\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \\\"DeviceInfo\\\" | extend Description = \\\"Machine information (including OS information)\\\"),\\r\\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceNetworkInfo\\\" | extend Description = \\\"Network properties of machines\\\"),\\r\\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceProcessEvents\\\" | extend Description = \\\"Process creation and related events\\\"),\\r\\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceNetworkEvents\\\" | extend Description = \\\"Network connection and related events\\\"),\\r\\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceFileEvents\\\" | extend Description = \\\"File creation, modification, and other file system events\\\"),\\r\\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceRegistryEvents\\\" | extend Description = \\\"Creation and modification of registry entries\\\"),\\r\\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceLogonEvents\\\" | extend Description = \\\"Sign-ins and other authentication events\\\"),\\r\\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceImageLoadEvents\\\" | extend Description = \\\"DLL loading events\\\"),\\r\\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceEvents\\\" | extend Description = \\\"Additional events types\\\"),\\r\\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceFileCertificateInfo\\\" | extend Description = \\\"Certificate information of signed files)\\\")\\r\\n| extend [\\\"Last Log Received At (Local Time)\\\"] = TimeGenerated\\r\\n| project Type, Description, [\\\"Last Log Received At (Local Time)\\\"]\",\"size\":0,\"title\":\"MDE Tables Last Data Received based on {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Type\",\"formatter\":0,\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Last Log Received At\",\"formatter\":6,\"dateFormat\":{\"formatName\":\"fullDateTimePattern\"}}],\"filter\":true}},\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\\nlet DeviceEventSummary = DeviceEvents | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceLogonEventsSummary = DeviceLogonEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceProcessEventsSummary = DeviceProcessEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\n(DeviceEventSummary\\n| union DeviceNetworkEventsSummary,\\nDeviceNetworkEventsSummary,\\nDeviceNetworkInfoSummary,\\nDeviceLogonEventsSummary,\\nDeviceRegistryEventsSummary,\\nDeviceProcessEventsSummary)\\n| join kind=inner ( \\nAllDeviceNames\\n)\\non $left.DeviceId == $right.DeviceId\\n| project-reorder Type, TimeGenerated, count_\\n//| project-away DeviceId, DeviceId1\",\"size\":1,\"title\":\"Daily Data Flow on MDE Tables over {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"xAxis\":\"count_\"}},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo \\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\\r\\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\\r\\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\\r\\n| order by DurationAtLeast asc\",\"size\":0,\"title\":\"Device Heartbeat from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\\r\\n| summarize FileCount = count() by DeviceName\\r\\n| order by FileCount desc\",\"size\":1,\"title\":\"Device where files are copied to USB Drive from TimeTange {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mvexpand ConnectedNetworks\\r\\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)\",\"size\":1,\"title\":\"Device Internet Connectivity Status from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\\r\\n| extend DeviceMachineName = split(DeviceName, '.')[0]\\r\\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\\r\\n| summarize count() by DeviceDomain\",\"size\":1,\"title\":\"Device Count by DNS Suffix\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by tostring(IsAzureADJoined)\",\"size\":1,\"title\":\"Device EntraID Join status\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by ClientVersion\",\"size\":1,\"title\":\"Device ClientVersion\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"groupOverview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\\r\\n//\\r\\n//Get the list of AV detections\\r\\nlet avDetections =\\r\\nDeviceEvents\\r\\n| where ActionType == \\\"AntivirusDetection\\\" and isnotempty(MD5)\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\\r\\n//Get a list of file creations\\r\\nlet fileCreations =\\r\\nDeviceFileEvents \\r\\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\\r\\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\\r\\n//Join the file creations and AV detections on the MD5 of the file\\r\\navDetections | join kind=inner (fileCreations) on MD5\\r\\n| project-away MD51 //Remove the duplicated MD5 field\\r\\n| sort by Timestamp desc \",\"size\":0,\"title\":\"Source of the AV detections for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Audited\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR audit events - count events and machines per rule for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Blocked\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR blocks - count events and machines per rule for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query make a best-guess detection regarding which removable media device caused an AV detection\\r\\n//The query is best run over 30 days to get the full USB history\\r\\n//\\r\\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\\r\\nlet usbDetections =\\r\\n DeviceEvents\\r\\n | where ActionType == \\\"AntivirusDetection\\\" and FolderPath !startswith \\\"c\\\" and FolderPath matches regex \\\"^[A-Za-z]{1}\\\"\\r\\n | extend ParsedFields=parse_json(AdditionalFields)\\r\\n | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\\r\\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\\r\\nlet usbConnections = \\r\\n DeviceEvents\\r\\n | where ActionType == \\\"PnpDeviceConnected\\\"\\r\\n | extend parsed=parse_json(AdditionalFields)\\r\\n | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\\r\\n | where ClassName == \\\"DiskDrive\\\"\\r\\n | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\\r\\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\\r\\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\\r\\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\\r\\n| sort by DetectionTime desc\",\"size\":0,\"title\":\"AV Detections with USB Disk Drive for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\",\"size\":0,\"title\":\"List files copied to USB mounted drives for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Device\"},\"name\":\"groupDevice\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mv-apply ConnectedNetworks on \\r\\n(\\r\\nwhere ConnectedNetworks.IsConnectedToInternet == true\\r\\n)\\r\\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet\",\"size\":0,\"title\":\"Internet Connected Devices for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by MachineGroup\",\"size\":0,\"title\":\"Count By Machine Group for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus\",\"size\":0,\"title\":\"Count By Network Adaptor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)\",\"size\":0,\"title\":\"TimeSeries on Network Activity for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| where isnotempty(RemoteUrl)\\r\\n| summarize count() by RemoteUrl\\r\\n| order by count_ desc\\r\\n| limit 10\",\"size\":0,\"title\":\"Top 10 RemoteUrl accessed over TimeRange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query looks for Tor client, or for a common Tor plugin called Meek.\\r\\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\\r\\n// To read more about this technique, see:\\r\\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\\r\\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\\r\\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\\r\\n// Tags: #Tor, #MultiHopProxy, #CnC\\r\\nDeviceNetworkEvents \\r\\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\\\"tor.exe\\\", \\\"meek-client.exe\\\")\\r\\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\\r\\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\\r\\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\\r\\n| order by MachineCount desc\",\"size\":0,\"title\":\"Tor Clients for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Network\"},\"name\":\"groupNetwork\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize FileActivityCount = count() by DeviceName\",\"size\":0,\"title\":\"FileActivityCount per Device for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize count() by InitiatingProcessAccountUpn\",\"size\":0,\"title\":\"Count by InitiatingProcessAccountUpn for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"File\"},\"name\":\"groupFile\"}],\"fromTemplateId\":\"sentinel-MicrosoftDefenderForEndPoint\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -2457,7 +2463,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", "properties": { - "description": "@{workbookKey=MicrosoftDefenderForEndPoint; logoFileName=Azure_Sentinel.svg; description=A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Defender For EndPoint; templateRelativePath=MicrosoftDefenderForEndPoint.json; subtitle=; provider=Microsoft Sentinel Community}.description", + "description": "@{workbookKey=MicrosoftDefenderForEndPoint; logoFileName=Azure_Sentinel.svg; description=A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Defender For EndPoint; templateRelativePath=MicrosoftDefenderForEndPoint.json; subtitle=; provider=Microsoft Sentinel Community}.description", "parentId": "[variables('workbookId2')]", "contentId": "[variables('_workbookContentId2')]", "kind": "Workbook", @@ -2503,7 +2509,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MicrosoftDefenderForIdentityWorkbook Workbook with template version 3.0.1", + "description": "MicrosoftDefenderForIdentity Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -2600,7 +2606,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Defender XDR", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft Defender XDR solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.

\n

Additional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on GitHub. This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Monitor HTTP Data Collector API
    2. \n
\n

Data Connectors: 1, Workbooks: 3, Analytic Rules: 10, Hunting Queries: 4

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft Defender XDR solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.

\n

Additional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on GitHub. This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Monitor HTTP Data Collector API
    2. \n
\n

Data Connectors: 1, Workbooks: 3, Analytic Rules: 10, Hunting Queries: 4

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2632,73 +2638,73 @@ }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId4')]", - "version": "[variables('analyticRuleVersion4')]" + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId5')]", - "version": "[variables('analyticRuleVersion5')]" + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId6')]", - "version": "[variables('analyticRuleVersion6')]" + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId7')]", - "version": "[variables('analyticRuleVersion7')]" + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId8')]", - "version": "[variables('analyticRuleVersion8')]" + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId9')]", - "version": "[variables('analyticRuleVersion9')]" + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId10')]", - "version": "[variables('analyticRuleVersion10')]" + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId2')]", - "version": "[variables('huntingQueryVersion2')]" + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId4')]", - "version": "[variables('huntingQueryVersion4')]" + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]" }, { "kind": "Workbook", diff --git a/Solutions/Microsoft Defender XDR/Workbooks/MicrosoftDefenderForEndPoint.json b/Solutions/Microsoft Defender XDR/Workbooks/MicrosoftDefenderForEndPoint.json index 3a940997888..297e1d0139c 100644 --- a/Solutions/Microsoft Defender XDR/Workbooks/MicrosoftDefenderForEndPoint.json +++ b/Solutions/Microsoft Defender XDR/Workbooks/MicrosoftDefenderForEndPoint.json @@ -4,7 +4,7 @@ { "type": 1, "content": { - "json": "## Microsoft Defender for Endpoint (Preview)\n---\n\nA wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector.\n\n\n" + "json": "## Microsoft Defender for Endpoint (Preview)\n---\n\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\n\n\n" }, "name": "text - 2" },