From d8154514fc3f8a014e46518e4d2cfd0a3ddfaad5 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 10:57:22 -0800 Subject: [PATCH 01/26] added yaml files for hunting queries and analytic rules --- .../SetPolicyConfigInCloudAppEvents.yaml | 32 ++++++++++ ...ivitiesRelatedToConfidentialDocuments.yaml | 46 +++++++++++++ .../DomainEntity_CloudAppEvents.yaml | 64 +++++++++++++++++++ .../EmailEntity_CloudAppEvents.yaml | 48 ++++++++++++++ .../FileHashEntity_CloudAppEvents.yaml | 54 ++++++++++++++++ .../IPEntity_CloudAppEvents.yaml | 63 ++++++++++++++++++ .../URLEntity_CloudAppEvents.yaml | 36 +++++++++++ 7 files changed, 343 insertions(+) create mode 100644 Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml create mode 100644 Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml create mode 100644 Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml create mode 100644 Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml create mode 100644 Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml create mode 100644 Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml create mode 100644 Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml diff --git a/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml b/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml new file mode 100644 index 00000000000..29ffc4bcb80 --- /dev/null +++ b/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml @@ -0,0 +1,32 @@ +id: fcd4d774-a0c2-4d12-9e9f-f51dfc310873 +name: +description: | + "We search for any action type with high frequency that involves adding/modifying/removing something in cloud app policies. We want to see where the properties are modified such that the old value and new value are different, and exclude DisplayName as changing Display Name is a minor property change." +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + CloudAppEvents + | where ActionType in ("Update policy.", "Add policy.", "Remove-CrossTenantAccessPolicy", "Add policy to service principal.", "Write PolicyAssignments", "Update authorization policy.", "Delete policy.", "Add owner to policy.", "Write PolicyExemptions", "Remove-LabelPolicy") + | mv-expand ActivityObjects + | where ActivityObjects.Name != "DisplayName" + | summarize Count = count() by AccountDisplayName, IPAddress, ActionType, ActivityType +entityMappings: + - entityType: Account + fieldMappings: + - identifier: DisplayName + columnName: AccountDisplayName + - entityType: IP + fieldMappings: + - identifier: Address + columnName: IPAddress +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml b/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml new file mode 100644 index 00000000000..a331c35e18c --- /dev/null +++ b/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml @@ -0,0 +1,46 @@ +id: a1adce9c-5945-4a20-984e-d95b6071a791 +name: +description: | + "MDCA allows us to automatically apply sensitivity labels from Purview. We can apply encryption for protection and scan files for Microsoft Information Protection sensitivity labels. + We allow users to apply sensitivity labels and search for any policy description with the word "confidential." +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents + - connectorId: + dataTypes: + - SecurityAlert +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + SecurityAlert + | where TimeGenerated >= ago(30d) + | extend EntitiesDynamicArray = parse_json(Entities) + | mv-expand EntitiesDynamicArray + | extend Entitytype = tostring(parse_json(EntitiesDynamicArray).Type), EntityName = tostring(parse_json(EntitiesDynamicArray).Name), + EntityUPNSuffix = tostring(parse_json(EntitiesDynamicArray).UPNSuffix) + | where Entitytype =~ "file" and EntityName != "" + | join kind=inner(CloudAppEvents + | extend ActivityObjectsDynamicArray = parse_json(ActivityObjects) + | mv-expand ActivityObjectsDynamicArray + | extend Entitytype = tostring(parse_json(ActivityObjectsDynamicArray).Type), EntityName = tostring(RawEventData.SourceFileName), + EntityUPNSuffix = tostring(parse_json(ActivityObjectsDynamicArray).UPNSuffix) + | where Entitytype =~ "file") on $left.EntityName == $right.EntityName +entityMappings: + - entityType: Account + fieldMappings: + - identifier: DisplayName + columnName: EntityName + - identifier: UPNSuffix + columnName: EntityUPNSuffix + - identifier: DisplayName + columnName: DisplayName + - identifier: IPAddress + columnName: IPAddress +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml new file mode 100644 index 00000000000..051e6407d57 --- /dev/null +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml @@ -0,0 +1,64 @@ +id: b97e118c-b7fa-42a6-84de-2e13443fbb8f +name: Preview - TI map Domain entity to Cloud App Events +description: | + 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's domain entity.' +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents + - connectorId: MicrosoftDefenderThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + let dt_lookBack = 1h; + let ioc_lookBack = 14d; + let list_tlds = + ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true and ExpirationDateTime > now() + | where isnotempty(DomainName) + | extend DomainName = tolower(DomainName) + | extend parts = split(DomainName, '.') + | extend tld = parts[(array_length(parts) - 1)] + | summarize count() by tostring(tld) + | summarize make_list(tld); + let Domain_Indicators = + ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true and ExpirationDateTime > now() + | extend TI_DomainEntity = DomainName; + Domain_Indicators + | join kind=innerunique ( + CloudAppEvents + | extend IngestionTime = ingestion_time() + | where IngestionTime > ago(dt_lookBack) + | extend PAUrl = columnifexists("RequestURL", "None") + | extend Domain = trim('"', tostring(parseurl(PAUrl).Host)) + | extend Domain = tolower(Domain) + | extend parts = split(Domain, '.') + | extend tld = parts[(array_length(parts) - 1)] + | extend CloudAppEvents_TimeGenerated = TimeGenerated) on $left.TI_DomainEntity == $right.Domain + | where CloudAppEvents_TimeGenerated < ExpirationDateTime + | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId + | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, DomainName = max_CloudAppEvents_TimeGenerated_DomainName, ProviderName = max_CloudAppEvents_TimeGenerated_IndicatorProvider, AlertSeverity = max_CloudAppEvents_TimeGenerated_ThreatSeverity, IPAddress = max_CloudAppEvents_TimeGenerated_IPAddress + | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, ProviderName, AlertSeverity, IPAddress +entityMappings: + - entityType: DNS Resolution + fieldMappings: + - identifier: DomainName + columnName: DomainName + - entityType: IP + fieldMappings: + - identifier: Address + columnName: IPAddress +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml new file mode 100644 index 00000000000..021a86ce8bb --- /dev/null +++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml @@ -0,0 +1,48 @@ +id: 47b9bb10-d216-4359-8cef-08ca2c67e5be +name: Preview - TI map Email entity to Cloud App Events +description: | + 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's email entity.' +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents + - connectorId: MicrosoftDefenderThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + let dt_lookBack = 10d; + let ioc_lookBack = 30d; + let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$'; + ThreatIntelligenceIndicator + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true + | where isnotempty(EmailSenderAddress) + | join kind=innerunique (CloudAppEvents + | extend User_Id = tostring(RawEventData.UserId) + | where User_Id != "" + | where TimeGenerated >= ago(dt_lookBack) and isnotempty(Application) + | extend CloudAppEvents_TimeGenerated = TimeGenerated + | extend User_id = tostring(User_Id) + | where User_id matches regex emailregex) on $left.EmailSenderAddress == $right.User_id + | where CloudAppEvents_TimeGenerated < ExpirationDateTime + | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, User_id + | extend Name = tostring(split(User_id, '@', 0)[0]), UPNSuffix = tostring(split(User_id, '@', 1)[0]) + | extend timestamp = CloudAppEvents_TimeGenerated +entityMappings: + - entityType: Account + fieldMappings: + - identifier: DisplayName + columnName: Name + - identifier: AadUserId + columnName: User_Id + - identifier: UPNSuffix + columnName: UPNSuffix +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml new file mode 100644 index 00000000000..4defb568a77 --- /dev/null +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -0,0 +1,54 @@ +id: 2f6bbf88-f5b0-49a3-b2b5-97fc3664e4d4 +name: Preview - TI map File Hash entity to Cloud App Events +description: | + 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's file hash entity.' +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents + - connectorId: MicrosoftDefenderThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator + - connectorId: MicrosoftThreatProtection + dataTypes: + - DeviceFileEvents +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + let dt_lookBack = 1h; + let ioc_lookBack = 14d; + ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true + | extend FileHashValue = toupper(FileHashValue) + | join kind=innerunique (union isfuzzy=true + (CloudAppEvents + | join kind=innerunique (union isfuzzy=true(DeviceFileEvents + | extend CloudAppEvents_TimeGenerated = TimeGenerated, Event = ReportId, FileHash = toupper(MD5))) on $left.TenantId == $right.TenantId)) + on $left.FileHashValue == $right.MD5 + | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, FileHash + | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, SourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, SourcePort = max_CloudAppEvents_TimeGenerated_NetworkSourcePort, DestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, DestinationPort = max_CloudAppEvents_TimeGenerated_NetworkDestinationPort, DeviceName = max_CloudAppEvents_TimeGenerated_DeviceName + | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + - columnName: SourceIP + - identifier: Address + - columnName: DestinationIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - entityType: FileHash + fieldMappings: + - identifier: Algorithm+Value + columnName: FileHash +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml new file mode 100644 index 00000000000..c71d20dfd9a --- /dev/null +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -0,0 +1,63 @@ +id: 4e0a6fc8-697e-4455-be47-831b41ea91ac +name: Preview - TI map IP entity to Cloud App Events +description: | + 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's IP entity.' +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents + - connectorId: MicrosoftDefenderThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + let dt_lookBack = 1d; + let ioc_lookBack = 14d; + let IP_Indicators = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true and ExpirationDateTime > now() + | where isnotempty(NetworkIP) + or isnotempty(EmailSourceIpAddress) + or isnotempty(NetworkDestinationIP) + or isnotempty(NetworkSourceIP) + | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP) + | extend TIipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity) + | extend TIipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity); + IP_Indicators + | join kind=innerunique ( + CloudAppEvents + | where TimeGenerated >= ago(dt_lookBack) + | extend CloudAppEvents_TimeGenerated = TimeGenerated) on $left.TI_ipEntity == $right.IPAddress + | where CloudAppEvents_TimeGenerated < ExpirationDateTime + | summarize CloudAppEventsTimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, IPAddress + | extend + Description = max_CloudAppEvents_TimeGenerated_Description, + ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, + ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, + ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, + ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, + TI_ipEntity = max_CloudAppEvents_TimeGenerated_TI_ipEntity, + NetworkDestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, + NetworkSourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, + EmailSourceIPAddress = max_CloudAppEvents_TimeGenerated_EmailSourceIpAddress + | project CloudAppEventsTimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, TI_ipEntity, NetworkDestinationIP, NetworkSourceIP, EmailSourceIPAddress +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + - columnName: TI_ipEntity + - identifier: Address + - columnName: NetworkDestinationIP + - identifier: Address + - columnName: NetworkSourceIP + - identifier: Address + - columnName: EmailSourceIPAddress +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml new file mode 100644 index 00000000000..2572a9534ab --- /dev/null +++ b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml @@ -0,0 +1,36 @@ +id: e8ae92dd-1d41-4530-8be8-85c5014c7b47 +name: Preview - TI map URL entity to Cloud App Events +description: | + 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's URL entity.' +severity: Medium +requiredDataConnectors: + - connectorId: MicrosoftThreatProtection + dataTypes: + - CloudAppEvents + - connectorId: MicrosoftDefenderThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Privilege Escalation +query: | + let dt_lookBack = 1h; + let ioc_lookBack = 14d; + ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true + | join kind=innerunique (CloudAppEvents + | extend Url = extract("(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+);", 1, tostring(ActivityObjects)) + | extend userPrincipalName = tostring(parse_json(tostring(AccountId)).userPrincipalName) + | extend TargetResourceDisplayName = tostring(ActivityObjects[0].displayName) + | extend CloudApps_TimeGenerated = TimeGenerated) on Url + | where CloudApps_TimeGenerated < ExpirationDateTime + | summarize CloudApps_TimeGenerated = argmax(CloudApps_TimeGenerated, *) by IndicatorId, Url + | extend Description = max_CloudApps_TimeGenerated_Description, ActivityGroupNames = max_CloudApps_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudApps_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudApps_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudApps_TimeGenerated_ConfidenceScore + | project CloudApps_TimeGenerated, Description, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore +version: 1.0.0 +kind: Scheduled \ No newline at end of file From 96bcc158efe3e76f69ae35ad5b9ec144205a6019 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 11:37:58 -0800 Subject: [PATCH 02/26] changed URLEntity_CloudAppEvents to be latest Threat Intelligence data --- .../URLEntity_CloudAppEvents.yaml | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml index 2572a9534ab..adf082ef55b 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml @@ -20,17 +20,17 @@ query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() - | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId - | where Active == true - | join kind=innerunique (CloudAppEvents - | extend Url = extract("(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+);", 1, tostring(ActivityObjects)) - | extend userPrincipalName = tostring(parse_json(tostring(AccountId)).userPrincipalName) - | extend TargetResourceDisplayName = tostring(ActivityObjects[0].displayName) - | extend CloudApps_TimeGenerated = TimeGenerated) on Url - | where CloudApps_TimeGenerated < ExpirationDateTime - | summarize CloudApps_TimeGenerated = argmax(CloudApps_TimeGenerated, *) by IndicatorId, Url - | extend Description = max_CloudApps_TimeGenerated_Description, ActivityGroupNames = max_CloudApps_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudApps_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudApps_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudApps_TimeGenerated_ConfidenceScore - | project CloudApps_TimeGenerated, Description, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore + | where TimeGenerated >= ago(ioc_lookBack) + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | where Active == true and ExpirationDateTime > now() + | join kind=innerunique (CloudAppEvents + | extend Url = extract("(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+);", 1, tostring(ActivityObjects)) + | extend userPrincipalName = tostring(parse_json(tostring(AccountId)).userPrincipalName) + | extend TargetResourceDisplayName = tostring(ActivityObjects[0].displayName) + | extend CloudApps_TimeGenerated = TimeGenerated) on Url + | where CloudApps_TimeGenerated < ExpirationDateTime + | summarize CloudApps_TimeGenerated = argmax(CloudApps_TimeGenerated, *) by IndicatorId, Url + | extend Description = max_CloudApps_TimeGenerated_Description, ActivityGroupNames = max_CloudApps_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudApps_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudApps_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudApps_TimeGenerated_ConfidenceScore + | project CloudApps_TimeGenerated, Description, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore version: 1.0.0 kind: Scheduled \ No newline at end of file From 165f423b8814d31dbfa72efe7a2110ba7442fa18 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 12:06:29 -0800 Subject: [PATCH 03/26] updated email entity cloud apps and file hash entity for cloud apps for latest threat intelligence data --- .../Analytic Rules/EmailEntity_CloudAppEvents.yaml | 3 ++- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml index 021a86ce8bb..4ff6f000690 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml @@ -21,8 +21,9 @@ query: | let ioc_lookBack = 30d; let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$'; ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId - | where Active == true + | where Active == true and ExpirationDateTime > now() | where isnotempty(EmailSenderAddress) | join kind=innerunique (CloudAppEvents | extend User_Id = tostring(RawEventData.UserId) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index 4defb568a77..d8730d360d2 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -23,9 +23,9 @@ query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() + | where TimeGenerated >= ago(ioc_lookBack) | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId - | where Active == true + | where Active == true and ExpirationDateTime > now() | extend FileHashValue = toupper(FileHashValue) | join kind=innerunique (union isfuzzy=true (CloudAppEvents From 998298bf2518f1309128123c462bb91ff061c285 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 14:44:55 -0800 Subject: [PATCH 04/26] fixing syntax changes in analytic rules files --- .../Analytic Rules/DomainEntity_EmailEvents.yaml | 2 +- .../Analytic Rules/EmailEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/IPEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/URLEntity_CloudAppEvents.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml index 96ab3a9ff03..dc82166f65b 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml @@ -1,7 +1,7 @@ id: 96307710-8bb9-4b45-8363-a90c72ebf86f name: TI map Domain entity to EmailEvents description: | - 'Identifies a match in EmailEvents table from any Domain IOC from TI' + Identifies a match in EmailEvents table from any Domain IOC from TI severity: Medium requiredDataConnectors: - connectorId: Office365 diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml index 4ff6f000690..6d5d7c0777b 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: 47b9bb10-d216-4359-8cef-08ca2c67e5be name: Preview - TI map Email entity to Cloud App Events description: | - 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's email entity.' + We use threat intelligence to identify compromises and attacks and detect malicious activities in one's email entity severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index d8730d360d2..9db111009db 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: 2f6bbf88-f5b0-49a3-b2b5-97fc3664e4d4 name: Preview - TI map File Hash entity to Cloud App Events description: | - 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's file hash entity.' + We use threat intelligence to identify compromises and attacks and detect malicious activities in one's file hash entity severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index c71d20dfd9a..8f5f27f70a1 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: 4e0a6fc8-697e-4455-be47-831b41ea91ac name: Preview - TI map IP entity to Cloud App Events description: | - 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's IP entity.' + We use threat intelligence to identify compromises and attacks and detect malicious activities in one's IP entity severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml index adf082ef55b..a47c42abcbb 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: e8ae92dd-1d41-4530-8be8-85c5014c7b47 name: Preview - TI map URL entity to Cloud App Events description: | - 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's URL entity.' + We use threat intelligence to identify compromises and attacks and detect malicious activities in one's URL entity severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection From 94d94712a02efcbfafdaf9b995054f5e92c9033d Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 14:53:38 -0800 Subject: [PATCH 05/26] changed version --- .../Analytic Rules/DomainEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/EmailEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/IPEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/URLEntity_CloudAppEvents.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml index 051e6407d57..6b766440aa6 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml @@ -60,5 +60,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPAddress -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml index 6d5d7c0777b..29290455503 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml @@ -45,5 +45,5 @@ entityMappings: columnName: User_Id - identifier: UPNSuffix columnName: UPNSuffix -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index 9db111009db..1112ab54bcc 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -50,5 +50,5 @@ entityMappings: fieldMappings: - identifier: Algorithm+Value columnName: FileHash -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index 8f5f27f70a1..401bbad2083 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -59,5 +59,5 @@ entityMappings: - columnName: NetworkSourceIP - identifier: Address - columnName: EmailSourceIPAddress -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml index a47c42abcbb..121481b12f5 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml @@ -32,5 +32,5 @@ query: | | summarize CloudApps_TimeGenerated = argmax(CloudApps_TimeGenerated, *) by IndicatorId, Url | extend Description = max_CloudApps_TimeGenerated_Description, ActivityGroupNames = max_CloudApps_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudApps_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudApps_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudApps_TimeGenerated_ConfidenceScore | project CloudApps_TimeGenerated, Description, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file From 5d6baacd8ae1eb004c1246b27170dfdf2624804f Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 15:28:33 -0800 Subject: [PATCH 06/26] changed indentation --- ...mainEntity_EmailEvents.yaml => DomainEntity_EmailEvent.yaml} | 2 +- ...ntity_CloudAppEvents.yaml => EmailEntity_CloudAppEvent.yaml} | 0 ...ty_CloudAppEvents.yaml => FileHashEntity_CloudAppEvent.yaml} | 0 ...IPEntity_CloudAppEvents.yaml => IPEntity_CloudAppEvent.yaml} | 0 ...LEntity_CloudAppEvents.yaml => URLEntity_CloudAppEvent.yaml} | 0 5 files changed, 1 insertion(+), 1 deletion(-) rename Solutions/Threat Intelligence/Analytic Rules/{DomainEntity_EmailEvents.yaml => DomainEntity_EmailEvent.yaml} (99%) rename Solutions/Threat Intelligence/Analytic Rules/{EmailEntity_CloudAppEvents.yaml => EmailEntity_CloudAppEvent.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{FileHashEntity_CloudAppEvents.yaml => FileHashEntity_CloudAppEvent.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{IPEntity_CloudAppEvents.yaml => IPEntity_CloudAppEvent.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{URLEntity_CloudAppEvents.yaml => URLEntity_CloudAppEvent.yaml} (100%) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvent.yaml similarity index 99% rename from Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml rename to Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvent.yaml index dc82166f65b..8a474b95edc 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvent.yaml @@ -51,5 +51,5 @@ entityMappings: columnName: Name - identifier: UPNSuffix columnName: UPNSuffix -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvent.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml rename to Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvent.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvent.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml rename to Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvent.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvent.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml rename to Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvent.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvent.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml rename to Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvent.yaml From 71a0b1ce4e49bc6f1d2dadb5499c2f92d2a75350 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 27 Feb 2024 15:44:32 -0800 Subject: [PATCH 07/26] reverted back file names --- ...DomainEntity_EmailEvent.yaml => DomainEntity_EmailEvents.yaml} | 0 ...lEntity_CloudAppEvent.yaml => EmailEntity_CloudAppEvents.yaml} | 0 ...tity_CloudAppEvent.yaml => FileHashEntity_CloudAppEvents.yaml} | 0 .../{IPEntity_CloudAppEvent.yaml => IPEntity_CloudAppEvents.yaml} | 0 ...URLEntity_CloudAppEvent.yaml => URLEntity_CloudAppEvents.yaml} | 0 5 files changed, 0 insertions(+), 0 deletions(-) rename Solutions/Threat Intelligence/Analytic Rules/{DomainEntity_EmailEvent.yaml => DomainEntity_EmailEvents.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{EmailEntity_CloudAppEvent.yaml => EmailEntity_CloudAppEvents.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{FileHashEntity_CloudAppEvent.yaml => FileHashEntity_CloudAppEvents.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{IPEntity_CloudAppEvent.yaml => IPEntity_CloudAppEvents.yaml} (100%) rename Solutions/Threat Intelligence/Analytic Rules/{URLEntity_CloudAppEvent.yaml => URLEntity_CloudAppEvents.yaml} (100%) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvent.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvent.yaml rename to Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvent.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvent.yaml rename to Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvent.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvent.yaml rename to Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvent.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvent.yaml rename to Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvent.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml similarity index 100% rename from Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvent.yaml rename to Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml From 3f6d50894d02c3aa0d9dd2f38b84ca97221cb39a Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Thu, 29 Feb 2024 10:07:55 -0800 Subject: [PATCH 08/26] changed tactics name and fixed typos --- .../Analytic Rules/DomainEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/EmailEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/IPEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/URLEntity_CloudAppEvents.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml index 6b766440aa6..7010b5b0262 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - Privilege Escalation + - PrivilegeEscalation query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml index 29290455503..dfed4c9d0e6 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - Privilege Escalation + - PrivilegeEscalation query: | let dt_lookBack = 10d; let ioc_lookBack = 30d; diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index 1112ab54bcc..e4e5721846f 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -18,7 +18,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - Privilege Escalation + - PrivilegeEscalation query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index 401bbad2083..251cbfc633f 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - Privilege Escalation + - PrivilegeEscalation query: | let dt_lookBack = 1d; let ioc_lookBack = 14d; diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml index 121481b12f5..2a7b8c8e06a 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - Privilege Escalation + - PrivilegeEscalation query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; From 41ab1e6cdce1b509bef7c0b8af4191e24435aaa6 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Thu, 29 Feb 2024 11:46:36 -0800 Subject: [PATCH 09/26] DNS resolution on e word --- .../DomainEntity_CloudAppEvents.yaml | 2 +- .../FileHashEntity_CloudAppEvents.yaml | 30 +++++++++---------- .../IPEntity_CloudAppEvents.yaml | 22 +++++++------- 3 files changed, 27 insertions(+), 27 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml index 7010b5b0262..f0c7b244f1e 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml @@ -52,7 +52,7 @@ query: | | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, DomainName = max_CloudAppEvents_TimeGenerated_DomainName, ProviderName = max_CloudAppEvents_TimeGenerated_IndicatorProvider, AlertSeverity = max_CloudAppEvents_TimeGenerated_ThreatSeverity, IPAddress = max_CloudAppEvents_TimeGenerated_IPAddress | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, ProviderName, AlertSeverity, IPAddress entityMappings: - - entityType: DNS Resolution + - entityType: DNSResolution fieldMappings: - identifier: DomainName columnName: DomainName diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index e4e5721846f..e26f39d621e 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -35,20 +35,20 @@ query: | | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, FileHash | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, SourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, SourcePort = max_CloudAppEvents_TimeGenerated_NetworkSourcePort, DestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, DestinationPort = max_CloudAppEvents_TimeGenerated_NetworkDestinationPort, DeviceName = max_CloudAppEvents_TimeGenerated_DeviceName | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash -entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - - columnName: SourceIP - - identifier: Address - - columnName: DestinationIP - - entityType: Host - fieldMappings: - - identifier: HostName - columnName: DeviceName - - entityType: FileHash - fieldMappings: - - identifier: Algorithm+Value - columnName: FileHash +# entityMappings: +# - entityType: IP +# fieldMappings: +# - identifier: Address +# - columnName: SourceIP +# - identifier: Address +# - columnName: DestinationIP +# - entityType: Host +# fieldMappings: +# - identifier: HostName +# columnName: DeviceName +# - entityType: FileHash +# fieldMappings: +# - identifier: Algorithm+Value +# columnName: FileHash version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index 251cbfc633f..c040109fa72 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -48,16 +48,16 @@ query: | NetworkSourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, EmailSourceIPAddress = max_CloudAppEvents_TimeGenerated_EmailSourceIpAddress | project CloudAppEventsTimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, TI_ipEntity, NetworkDestinationIP, NetworkSourceIP, EmailSourceIPAddress -entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - - columnName: TI_ipEntity - - identifier: Address - - columnName: NetworkDestinationIP - - identifier: Address - - columnName: NetworkSourceIP - - identifier: Address - - columnName: EmailSourceIPAddress +# entityMappings: +# - entityType: IP +# fieldMappings: +# - identifier: Address +# - columnName: TI_ipEntity +# - identifier: Address +# - columnName: NetworkDestinationIP +# - identifier: Address +# - columnName: NetworkSourceIP +# - identifier: Address +# - columnName: EmailSourceIPAddress version: 1.0.1 kind: Scheduled \ No newline at end of file From c1361154a2490a97bb0081aaa2ba30c8fed00bbe Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Thu, 29 Feb 2024 12:07:09 -0800 Subject: [PATCH 10/26] DNSResolution changed to DNS --- .../Analytic Rules/DomainEntity_CloudAppEvents.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml index f0c7b244f1e..6fd120d00c6 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml @@ -52,7 +52,7 @@ query: | | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, DomainName = max_CloudAppEvents_TimeGenerated_DomainName, ProviderName = max_CloudAppEvents_TimeGenerated_IndicatorProvider, AlertSeverity = max_CloudAppEvents_TimeGenerated_ThreatSeverity, IPAddress = max_CloudAppEvents_TimeGenerated_IPAddress | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, ProviderName, AlertSeverity, IPAddress entityMappings: - - entityType: DNSResolution + - entityType: DNS fieldMappings: - identifier: DomainName columnName: DomainName From cfe22cfcbccf508eb3b95fc8fc0cfb58a92a2c87 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Thu, 29 Feb 2024 22:15:52 -0500 Subject: [PATCH 11/26] fixed columnName --- .../FileHashEntity_CloudAppEvents.yaml | 30 +++++++++---------- .../IPEntity_CloudAppEvents.yaml | 22 +++++++------- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index e26f39d621e..f969293e822 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -35,20 +35,20 @@ query: | | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, FileHash | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, SourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, SourcePort = max_CloudAppEvents_TimeGenerated_NetworkSourcePort, DestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, DestinationPort = max_CloudAppEvents_TimeGenerated_NetworkDestinationPort, DeviceName = max_CloudAppEvents_TimeGenerated_DeviceName | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash -# entityMappings: -# - entityType: IP -# fieldMappings: -# - identifier: Address -# - columnName: SourceIP -# - identifier: Address -# - columnName: DestinationIP -# - entityType: Host -# fieldMappings: -# - identifier: HostName -# columnName: DeviceName -# - entityType: FileHash -# fieldMappings: -# - identifier: Algorithm+Value -# columnName: FileHash +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - identifier: Address + columnName: DestinationIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - entityType: FileHash + fieldMappings: + - identifier: Algorithm+Value + columnName: FileHash version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index c040109fa72..a9f17f51f98 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -48,16 +48,16 @@ query: | NetworkSourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, EmailSourceIPAddress = max_CloudAppEvents_TimeGenerated_EmailSourceIpAddress | project CloudAppEventsTimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, TI_ipEntity, NetworkDestinationIP, NetworkSourceIP, EmailSourceIPAddress -# entityMappings: -# - entityType: IP -# fieldMappings: -# - identifier: Address -# - columnName: TI_ipEntity -# - identifier: Address -# - columnName: NetworkDestinationIP -# - identifier: Address -# - columnName: NetworkSourceIP -# - identifier: Address -# - columnName: EmailSourceIPAddress +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: TI_ipEntity + - identifier: Address + columnName: NetworkDestinationIP + - identifier: Address + columnName: NetworkSourceIP + - identifier: Address + columnName: EmailSourceIPAddress version: 1.0.1 kind: Scheduled \ No newline at end of file From 2dfe52f4829499de0e0174a47a8494f390250ab4 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Thu, 29 Feb 2024 22:38:29 -0500 Subject: [PATCH 12/26] changed columnName issues --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 4 +--- .../Analytic Rules/IPEntity_CloudAppEvents.yaml | 8 +------- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index f969293e822..cd593c6e5f7 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -39,9 +39,7 @@ entityMappings: - entityType: IP fieldMappings: - identifier: Address - columnName: SourceIP - - identifier: Address - columnName: DestinationIP + columnName: SourceIP, DestinationIP - entityType: Host fieldMappings: - identifier: HostName diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index a9f17f51f98..aa8d4935668 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -52,12 +52,6 @@ entityMappings: - entityType: IP fieldMappings: - identifier: Address - columnName: TI_ipEntity - - identifier: Address - columnName: NetworkDestinationIP - - identifier: Address - columnName: NetworkSourceIP - - identifier: Address - columnName: EmailSourceIPAddress + columnName: TI_ipEntity, NetworkDestinationIP, NetworkSourceIP, EmailSourceIPAddress version: 1.0.1 kind: Scheduled \ No newline at end of file From fdbc1294b14f27d40510bf3c2c1f53268fd78692 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 07:48:05 -0500 Subject: [PATCH 13/26] columnName fix for IPEntity and FileHashEntity --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- .../Analytic Rules/IPEntity_CloudAppEvents.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index cd593c6e5f7..d51e08ebe97 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -39,7 +39,7 @@ entityMappings: - entityType: IP fieldMappings: - identifier: Address - columnName: SourceIP, DestinationIP + columnName: SourceIP - entityType: Host fieldMappings: - identifier: HostName diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index aa8d4935668..dde00de4cb2 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -52,6 +52,6 @@ entityMappings: - entityType: IP fieldMappings: - identifier: Address - columnName: TI_ipEntity, NetworkDestinationIP, NetworkSourceIP, EmailSourceIPAddress + columnName: NetworkDestinationIP version: 1.0.1 kind: Scheduled \ No newline at end of file From 17531b979d16dfe9995b672e6b155fc18077a933 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 08:11:40 -0500 Subject: [PATCH 14/26] fixed typo on identifier for FileHashEntity --- .../FileHashEntity_CloudAppEvents.yaml | 6 +++++- .../Analytic Rules/IPEntity_CloudAppEvents.yaml | 12 ++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index d51e08ebe97..e0ff35f2cba 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -40,13 +40,17 @@ entityMappings: fieldMappings: - identifier: Address columnName: SourceIP + - entityType: IP + fieldMappings: + - identifier: Address + columnName: DestinationIP - entityType: Host fieldMappings: - identifier: HostName columnName: DeviceName - entityType: FileHash fieldMappings: - - identifier: Algorithm+Value + - identifier: [Algorithm, Value] columnName: FileHash version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index dde00de4cb2..0d5e444fbd0 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -49,9 +49,21 @@ query: | EmailSourceIPAddress = max_CloudAppEvents_TimeGenerated_EmailSourceIpAddress | project CloudAppEventsTimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, TI_ipEntity, NetworkDestinationIP, NetworkSourceIP, EmailSourceIPAddress entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: TI_ipEntity - entityType: IP fieldMappings: - identifier: Address columnName: NetworkDestinationIP + - entityType: IP + fieldMappings: + - identifier: Address + columnName: NetworkSourceIP + - entityType: IP + fieldMappings: + - identifier: Address + columnName: EmailSourceIPAddress version: 1.0.1 kind: Scheduled \ No newline at end of file From 4336d5b7fb042f77a668a26924a16f7d1234d512 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 08:36:44 -0500 Subject: [PATCH 15/26] changed filehash identifier --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index e0ff35f2cba..0a4ce113253 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -50,7 +50,7 @@ entityMappings: columnName: DeviceName - entityType: FileHash fieldMappings: - - identifier: [Algorithm, Value] + - identifier: Algorithm columnName: FileHash version: 1.0.1 kind: Scheduled \ No newline at end of file From 65c047464a8bf112cf9dd3db3b2a26676376b81b Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 09:10:06 -0500 Subject: [PATCH 16/26] changed FileHashEntity projection values --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index 0a4ce113253..cf3051df69e 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -32,9 +32,9 @@ query: | | join kind=innerunique (union isfuzzy=true(DeviceFileEvents | extend CloudAppEvents_TimeGenerated = TimeGenerated, Event = ReportId, FileHash = toupper(MD5))) on $left.TenantId == $right.TenantId)) on $left.FileHashValue == $right.MD5 - | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, FileHash + | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, FileHash, FileHashType, FileHashValue | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, SourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, SourcePort = max_CloudAppEvents_TimeGenerated_NetworkSourcePort, DestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, DestinationPort = max_CloudAppEvents_TimeGenerated_NetworkDestinationPort, DeviceName = max_CloudAppEvents_TimeGenerated_DeviceName - | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash + | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash, FileHashType, FileHashValue entityMappings: - entityType: IP fieldMappings: @@ -50,7 +50,9 @@ entityMappings: columnName: DeviceName - entityType: FileHash fieldMappings: + - identifier: Value + columnName: FileHashValue - identifier: Algorithm - columnName: FileHash + columnName: FileHashType version: 1.0.1 kind: Scheduled \ No newline at end of file From d9ee6ee801ec2b2d385952d2fd1b1630141d518c Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 10:13:56 -0500 Subject: [PATCH 17/26] added space --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index cf3051df69e..2303702f5fe 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -37,7 +37,7 @@ query: | | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash, FileHashType, FileHashValue entityMappings: - entityType: IP - fieldMappings: + fieldMappings: - identifier: Address columnName: SourceIP - entityType: IP From db43c9d9b12fccaaca544a6d93d9dff9d408082e Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 10:32:10 -0500 Subject: [PATCH 18/26] changed filehash projection --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index 2303702f5fe..aa533363f5d 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -34,7 +34,7 @@ query: | on $left.FileHashValue == $right.MD5 | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId, FileHash, FileHashType, FileHashValue | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, SourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, SourcePort = max_CloudAppEvents_TimeGenerated_NetworkSourcePort, DestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, DestinationPort = max_CloudAppEvents_TimeGenerated_NetworkDestinationPort, DeviceName = max_CloudAppEvents_TimeGenerated_DeviceName - | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHash, FileHashType, FileHashValue + | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHashType, FileHashValue, FileHash entityMappings: - entityType: IP fieldMappings: From 78c4630ed590d38bad48a8a865b798a07ca71cc3 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Fri, 1 Mar 2024 10:38:54 -0500 Subject: [PATCH 19/26] changed SourceIP and DestinationIP in FileHashEntity --- .../Analytic Rules/FileHashEntity_CloudAppEvents.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index aa533363f5d..9c554e36003 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -36,14 +36,14 @@ query: | | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, SourceIP = max_CloudAppEvents_TimeGenerated_NetworkSourceIP, SourcePort = max_CloudAppEvents_TimeGenerated_NetworkSourcePort, DestinationIP = max_CloudAppEvents_TimeGenerated_NetworkDestinationIP, DestinationPort = max_CloudAppEvents_TimeGenerated_NetworkDestinationPort, DeviceName = max_CloudAppEvents_TimeGenerated_DeviceName | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceName, FileHashType, FileHashValue, FileHash entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - columnName: SourceIP - entityType: IP fieldMappings: - identifier: Address columnName: DestinationIP + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP - entityType: Host fieldMappings: - identifier: HostName From 4f2008107ea1de49d6aada2729dad7a2dfeed385 Mon Sep 17 00:00:00 2001 From: Jamie Huang Date: Tue, 26 Mar 2024 16:48:47 -0700 Subject: [PATCH 20/26] Added strong identifiers in mappings, projected more values, small corrections --- .../SetPolicyConfigInCloudAppEvents.yaml | 23 +++++++++------- ...ivitiesRelatedToConfidentialDocuments.yaml | 27 +++++++++---------- .../DomainEntity_CloudAppEvents.yaml | 6 ++--- .../EmailEntity_CloudAppEvents.yaml | 6 ++--- .../FileHashEntity_CloudAppEvents.yaml | 4 +-- .../IPEntity_CloudAppEvents.yaml | 4 +-- .../URLEntity_CloudAppEvents.yaml | 4 +-- 7 files changed, 38 insertions(+), 36 deletions(-) diff --git a/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml b/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml index 29ffc4bcb80..52a031e885c 100644 --- a/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml +++ b/Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml @@ -1,29 +1,32 @@ id: fcd4d774-a0c2-4d12-9e9f-f51dfc310873 -name: +name: Policy configuration changes for CloudApp Events description: | - "We search for any action type with high frequency that involves adding/modifying/removing something in cloud app policies. We want to see where the properties are modified such that the old value and new value are different, and exclude DisplayName as changing Display Name is a minor property change." -severity: Medium + "This query searches for any action type with high frequency that involves adding, modifying, or removing something in cloud app policies. It sees where the properties are modified such that the old value and new value are different for every property except for minor property changes such as Display Name." requiredDataConnectors: - connectorId: MicrosoftThreatProtection dataTypes: - CloudAppEvents -queryFrequency: 1h -queryPeriod: 14d -triggerOperator: gt -triggerThreshold: 0 tactics: - - Privilege Escalation + - DomainPolicyModification +relevantTechniques: + - T1484 query: | CloudAppEvents | where ActionType in ("Update policy.", "Add policy.", "Remove-CrossTenantAccessPolicy", "Add policy to service principal.", "Write PolicyAssignments", "Update authorization policy.", "Delete policy.", "Add owner to policy.", "Write PolicyExemptions", "Remove-LabelPolicy") | mv-expand ActivityObjects | where ActivityObjects.Name != "DisplayName" - | summarize Count = count() by AccountDisplayName, IPAddress, ActionType, ActivityType + | where RawEventData["status"] == "Succeeded" + | extend AccountMoniker = RawEventData["AccountMoniker"], AccountMonikerLocation = RawEventData["AccountMonikerLocation"], EventName = RawEventData["EventName"], EventNamespace = RawEventData["EventNamespace"], Role = RawEventData["Role"], RoleInstance = RawEventData["RoleInstance"], RoleLocation = RawEventData["RoleLocation"], HttpRequest = RawEventData["httpRequest"] + | summarize Count = count() by tostring(AccountMoniker), tostring(AccountMonikerLocation), AccountDisplayName, IPAddress, ActionType, ActivityType, tostring(EventName), tostring(EventNamespace), tostring(Role), tostring(RoleInstance), tostring(RoleLocation), tostring(HttpRequest) entityMappings: - entityType: Account fieldMappings: - - identifier: DisplayName + - identifier: Name columnName: AccountDisplayName + - identifier: UPNSuffix + columnName: EntityUPNSuffix + - identifier: FullName + columnName: UserId - entityType: IP fieldMappings: - identifier: Address diff --git a/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml b/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml index a331c35e18c..928563a9154 100644 --- a/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml +++ b/Hunting Queries/MultipleDataSources/SuspiciousActivitiesRelatedToConfidentialDocuments.yaml @@ -1,22 +1,19 @@ id: a1adce9c-5945-4a20-984e-d95b6071a791 -name: +name: Integrate Purview with Cloud App Events description: | - "MDCA allows us to automatically apply sensitivity labels from Purview. We can apply encryption for protection and scan files for Microsoft Information Protection sensitivity labels. - We allow users to apply sensitivity labels and search for any policy description with the word "confidential." + "This query searches for any files in Cloud App Events that have trigger a security alert." severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection dataTypes: - CloudAppEvents - - connectorId: + - connectorId: MicrosoftCloudAppSecurity dataTypes: - SecurityAlert -queryFrequency: 1h -queryPeriod: 14d -triggerOperator: gt -triggerThreshold: 0 tactics: - - Privilege Escalation + - Collection +relevantTechniques: + - T1074 query: | SecurityAlert | where TimeGenerated >= ago(30d) @@ -34,13 +31,15 @@ query: | entityMappings: - entityType: Account fieldMappings: - - identifier: DisplayName + - identifier: Name columnName: EntityName - identifier: UPNSuffix columnName: EntityUPNSuffix - - identifier: DisplayName - columnName: DisplayName - - identifier: IPAddress - columnName: IPAddress + - identifier: FullName + columnName: UserId + - entityType: IP + fieldMappings: + - identifier: Address + columnName: ClientIP version: 1.0.0 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml index 6fd120d00c6..cff272d3516 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: b97e118c-b7fa-42a6-84de-2e13443fbb8f name: Preview - TI map Domain entity to Cloud App Events description: | - 'We use threat intelligence to identify compromises and attacks and detect malicious activities in one's domain entity.' + 'Identifies compromises and attacks and detect malicious activities in one's domain entity from TI.' severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation + - Impact query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; @@ -29,7 +29,7 @@ query: | | extend parts = split(DomainName, '.') | extend tld = parts[(array_length(parts) - 1)] | summarize count() by tostring(tld) - | summarize make_list(tld); + | summarize make_set(tld); let Domain_Indicators = ThreatIntelligenceIndicator | where TimeGenerated >= ago(ioc_lookBack) diff --git a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml index dfed4c9d0e6..607e3244003 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: 47b9bb10-d216-4359-8cef-08ca2c67e5be name: Preview - TI map Email entity to Cloud App Events description: | - We use threat intelligence to identify compromises and attacks and detect malicious activities in one's email entity + 'Identifies compromises and attacks and detect malicious activities in one's email entity from TI' severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation + - Impact query: | let dt_lookBack = 10d; let ioc_lookBack = 30d; @@ -41,7 +41,7 @@ entityMappings: fieldMappings: - identifier: DisplayName columnName: Name - - identifier: AadUserId + - identifier: FullName columnName: User_Id - identifier: UPNSuffix columnName: UPNSuffix diff --git a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml index 9c554e36003..3994297fdf8 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: 2f6bbf88-f5b0-49a3-b2b5-97fc3664e4d4 name: Preview - TI map File Hash entity to Cloud App Events description: | - We use threat intelligence to identify compromises and attacks and detect malicious activities in one's file hash entity + 'Identifies compromises and attacks and detect malicious activities in one's file hash entity from TI' severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection @@ -18,7 +18,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation + - Impact query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml index 0d5e444fbd0..17ccc3e0fe7 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: 4e0a6fc8-697e-4455-be47-831b41ea91ac name: Preview - TI map IP entity to Cloud App Events description: | - We use threat intelligence to identify compromises and attacks and detect malicious activities in one's IP entity + 'Identifies compromises and attacks and detect malicious activities in one's IP entity from TI' severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation + - Impact query: | let dt_lookBack = 1d; let ioc_lookBack = 14d; diff --git a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml index 2a7b8c8e06a..144664daf1c 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml @@ -1,7 +1,7 @@ id: e8ae92dd-1d41-4530-8be8-85c5014c7b47 name: Preview - TI map URL entity to Cloud App Events description: | - We use threat intelligence to identify compromises and attacks and detect malicious activities in one's URL entity + 'Identifies compromises and attacks and detect malicious activities in one's URL entity from TI' severity: Medium requiredDataConnectors: - connectorId: MicrosoftThreatProtection @@ -15,7 +15,7 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation + - Impact query: | let dt_lookBack = 1h; let ioc_lookBack = 14d; From 91606511463acfb1b7c5a8f4958297f77b74cf78 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 18 Apr 2024 15:54:25 +0000 Subject: [PATCH 21/26] Bump aiohttp in /Solutions/Rapid7InsightVM/Data Connectors Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.9.2 to 3.9.4. - [Release notes](https://github.com/aio-libs/aiohttp/releases) - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](https://github.com/aio-libs/aiohttp/compare/v3.9.2...v3.9.4) --- updated-dependencies: - dependency-name: aiohttp dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Solutions/Rapid7InsightVM/Data Connectors/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt b/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt index b25fb0be8f0..85b08a06ba1 100644 --- a/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt +++ b/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt @@ -2,7 +2,7 @@ # The Python Worker is managed by Azure Functions platform # Manually managing azure-functions-worker may cause unexpected issues -aiohttp==3.9.2 +aiohttp==3.9.4 azure-functions==1.6.0 azure-storage-file-share==12.4.1 python-dateutil==2.8.2 From 16473d1b2d7058a98833fcce25b828f2d1d8f282 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 18 Apr 2024 15:54:42 +0000 Subject: [PATCH 22/26] Bump aiohttp in /Solutions/PaloAltoPrismaCloud/Data Connectors Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.9.2 to 3.9.4. - [Release notes](https://github.com/aio-libs/aiohttp/releases) - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](https://github.com/aio-libs/aiohttp/compare/v3.9.2...v3.9.4) --- updated-dependencies: - dependency-name: aiohttp dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt b/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt index 4e11a7127a8..d403fe9dce5 100644 --- a/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt +++ b/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt @@ -1,3 +1,3 @@ azure-functions -aiohttp==3.9.2 +aiohttp==3.9.4 azure-storage-file-share==12.4.1 \ No newline at end of file From cc29156ab57b06fbe7ae1473ab5cf75fcf8df1a1 Mon Sep 17 00:00:00 2001 From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com> Date: Thu, 25 Apr 2024 12:11:35 +0530 Subject: [PATCH 23/26] Update requirements.txt --- Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt b/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt index d403fe9dce5..16d87cd725e 100644 --- a/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt +++ b/Solutions/PaloAltoPrismaCloud/Data Connectors/requirements.txt @@ -1,3 +1,3 @@ azure-functions aiohttp==3.9.4 -azure-storage-file-share==12.4.1 \ No newline at end of file +azure-storage-file-share==12.4.1 \ No newline at end of file From fd007133ce7dc2225a33099a2841e637d002e3e4 Mon Sep 17 00:00:00 2001 From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com> Date: Thu, 25 Apr 2024 15:01:02 +0530 Subject: [PATCH 24/26] Update requirements.txt --- Solutions/Rapid7InsightVM/Data Connectors/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt b/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt index 85b08a06ba1..3d58663f1e9 100644 --- a/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt +++ b/Solutions/Rapid7InsightVM/Data Connectors/requirements.txt @@ -2,7 +2,7 @@ # The Python Worker is managed by Azure Functions platform # Manually managing azure-functions-worker may cause unexpected issues -aiohttp==3.9.4 +aiohttp==3.9.4 azure-functions==1.6.0 azure-storage-file-share==12.4.1 python-dateutil==2.8.2 From 29c5dd59e1f0e9cbee2b96d3edbe93916fa23647 Mon Sep 17 00:00:00 2001 From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com> Date: Thu, 9 May 2024 10:29:45 +0530 Subject: [PATCH 25/26] Update PrismaCloudConn.zip --- .../Data Connectors/PrismaCloudConn.zip | Bin 10255827 -> 10264057 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/PaloAltoPrismaCloud/Data Connectors/PrismaCloudConn.zip b/Solutions/PaloAltoPrismaCloud/Data Connectors/PrismaCloudConn.zip index 40826dedddd773c10eb289c5445ceb7630ee7ec6..87e04068ae40c3fa1898875de9ddfd04980c0ed6 100644 GIT binary patch delta 34443 zcmZ6T1z1!~7l7d|oePMR!Xn+>4I(LFfoxIO^?eSUkr)IaHYr&7|s8{(n7H*yVZe(3ePlmJERE;CA2V?#9 zjfZ6H2EU#w4UfJ$C1-WP()sZYo3AK5$$!$ia>=yCN=0`!OsLS87L_e9W%e50Kfhoo z&qvnJb(eV3)F0!b>lNc2)I6`|36}C(o;Y0ap}jufMuozro5InT3ImIp=s!0O&Aa5X zQ+)o0#g-cDhes5?U6)(^_3Tu~MM}M|Hyo2)>u|_%(HY{Sm!PEF6sfbNYxG7gxI6uN zd*$_p2|6?Kuj?GqYU-Zfzl-%@_xKU!^gq$Zd#^iL)hA?a7Zq7Bw=7R=;{d;-Qo)`x zBOw7T!G|wM$9z-&`l&)I{nM#MCzSVDJfCrMPou59b7&ExdC66i@(m%nE0y^NGOy+C zJar+^FXY4I!&_vAl>Dw7bK4YgVcD5WOU_hTmL9w*EqQ84w)B9?Gh^ePZpqqLoAD-@RPUdailjFh6ASwi_ZRj2C&oe(83^Sngbz*N&4dqB-g67rG1h z>!M9%YIaX=iMbs$Vv(_*{mR0;qHwX2`EJ_np1PgPw7t(B?*BeWms0gDcUAi}#Clb* zt7^IM78@EZ>Ux4$F68-AJ94!^##PpLsowSDNti_ov%&Sx(9qmn39oMh~I z!DHS<#hrF1w+;V#_$M(b>B;+f)m2)^U()F6h6YuY%?%6n3mckusj7-g1UfYw6U&=9 zJnLtjN5$v8%n>PV78wx}9=r%8X#vj!U$Y=bPNNy-E6>rrKgFmw(b+zkj{)8OBxx8%%fTpWtcNf#~0cqW`)WQHN!do+!&mXQ(md z9EZ(r$X`6_D|kwTRy@?u@Loo}<( zr48jzyl?G2HIQR@ZA#?!#bLuQr_tl2gX0?Rp=aITU@Y;cG>s>{GH!C3;m`w&qodqBb9fvOu`t%dO}g z{EHbf&^7Y%Mar7*2eRCAO~Y5PS5B34 z-+fQy#@2#N&%sSMWEC&np|SlYU2kSL`IHO9xZe1&QaXE9z)Mr)ZhA&udeeek0*?8) zQzhm-$&9eO;TaaScShr^4dqKR>(<}(=9BrpGn2VYL^C^vz0dba?&klT&9{DBQC-y z0iW=uNWQb*o-rfp#1<|-W4oua)^}ddw4ezht&^R?Ygq$!%x@AJt=Y`DtR=EldSx5t zAHAEtbzFOk{J52(PHJ=P$2-{CdAHrUwWSu$&2QoxzuOOa(6 z(r>ozrRMC8lE^T}?7mE|-jz!_zl<{$`Sw_M!Lh7q zX;YV2jK3@PP&Hw&*DGBMj#-&aAOZQ;I;q8c$8*-K zD}HFOLV}k2jQ`}hGlNQrl~%&VX}ukfB{ue*i`_VZcBHAZwRqW5k~<2CzZH>9@a&U!pa*ynK=^HJNw#kBpB6O87>uBz!7`gXTyGv}xQk$qsp!kwSB z65W(z@4D>BJSS1-uQhvy!{Z$D$cTbXlWX0J&P_~xDe>+z$My3iB{|_U2N+eSYMC>| zgeH7ja^^)ek)o1jc-tbwznwFn6 z;ll$rB~yp%3s>Fr_+@wK(W$R>F28GUvd;9_x^=F+_IQQI4u6Fm8*Z(O*Wz=V&i=IQ zd}x%4*?EWPVekIBnImdJel&q`e0+Q&d~2plRD^_GI8v`A#mAS-Kp8V#cxyM;0EPl{ zXU4aQow1YNEKwcb$d@VL%`g+aoEM=gxWP>#u&4gbjf<5>y4J-`kh;>6@2K-C{y+WK zXO&&kgIqe)+#aoSoipVwQy}!e*DngD+pKtgQE|j&P0u%VHoB`xT#a*{Yo?TYa>~5Z zTeb8h)3p172G(B-*l5$w{DXcf3Q--$m5!;L(`}4`w zMONj+q%$uqsu({tC0}z+lZExuo-^9*tFGysyrccWjB~|^?&oYZ?!B16WkL3@%yWuA zx_!TR(blh!-PbQfJZqYM?#Q}LgEHfnIqa8q9XIcO(`&))OMP;6>+C;DA2@X6zD$fm z;jR-8GexEyw|?pH)5S%$ZtBR3;Zt3;k)QUdX76cothf-xG_mUH()10mdTj6|QR)@V zJFJ<8aKr7Nm$$E)_3&wb>;qjRnvQ7qQ|YC0=Z-Gf`NhoeAg8g^rXpkQnuO`Y z4WdHwh^95I$XhLUIIv&S@J)3z^Um}i{BJwo_lK_N>k4@nwLSk?$H<$brCAjvR@PmX z!Te!D$1mCaNq9HR5!kuuv#KGaG_w?l~qY{)y>~k7aoh+(x>$KmiS5Obxxw?Oi$^lkACwzX%tFp z=c#?>kBB`gE2Z0h?Al_T`GlO9YG~b7FS(fyrwz*`i!`1d`c(Z>lIfqRaZh0*Yv3%u zYQJ{wMA_5bTRj>2mCrLzOmRIo!e1ib5s)o){QZO_&zyqqPwf2hrvKb(hvoS@bVS;|XT2Hlc=fvQ z%3SdrhOp~$qe5%V`c1WhvjUmt-|CdVXlPD%TI(~D5D_p^`#3x4<)x(ipPG{Itm*2g z;2b&n>&Wnt?cw_)AEte%mD`pck`O)fbkDe772P&b?7=5FUu<&os+P^_extp-tJgZ9 z=fD*kfmZX+=Z<_o>soXuvM)W9afChh>AHd0?SCXPs&@a@(MbC;Jaj3cZNz0Bb5ZHd z^BP0GIz2mn6g@hxJIzpSc*t{;{>Yoox#97zSHCiO8+LAb@RjbC4BotM8e|HY5!?@>S3PM;_g`8n#> z^P@esZ|c9G?1A^g-xdx`)%V>TXEwiaLv9bV;AbAEX=2j>x1gNtbE$6}7W5on5^L^v zrC*_y8Tj(2bjOUeZ;OA&wtV*M9A2H%;A8lDP{r(vcBjpi+jsA;to!xZ=t7mkt@4FYP9xgp!qFd}z*5o3u?(sQPGOHYKZe>1b$#G^${_!GbO zayJL}Dtn#1^v7TSE36eQ3_mFTvw1=7`{xx|(#M;0{YGT0og?SZqZgEBY})@KeSA4f zdq+je#fPqu1;2gr__umR-F)^rQAxdJE$7$QZ!>HEB&Qf2UUzk=U7wgn~ z*1uNVQ?&lsTh;nZA2Bayjh?v~O-JUdX{DjfDRzq{TRhDD#JYQ7(NkK|>9_k9uRA8$ zqos2#uwUo^Lt>;=XV#pZbNg)9>eMThJ08BZ{dv`+dD>nEA}iJ~pYtsmx8Y{@x#KFa zK}2ZNrL&#ikKUN#pB%CLY=qxzk3LV@!K9I_hCJl)!+XaAi6z79>=K?=yT!fCzM&>` z@|)cb*^PP!QWdYqYrojueEqmtRFAQEKvzqpd{_%O^R^zIV(T5u! zqeuH%Y`6Y*LS&s(*SRGFl}zs?dsL%W-57XOxTYXN~`L=R=;ekZ!$7-m8sI|T+^Ra9uT7FHk4cGnsGjJ!5aJf z_3GYd;xg(tFLgL~-0LxiFOs%0dxx!i+T!EOK8UyOk2!oQWc;EFMv=O2RuwUom`A$8 zwrXF=ki7CJd&KiV=&mP00#klX`E6y=m@y+^vs2C&MURI&4A&;{InAyWR@FXUyyo=F z@%KXnmVdqZ{1aUydpPzo^I(O-jv^tujAgPjD@qcw&3fNFDr?I(y1-gK-lVEWhe<;qYVqi{;;T%+mTV^pPu_ zSZMG#cISf|u34*n*Co7qboy1)FI1-$^>S0XiGy>E^l6SxcKPJW!&5&CW#4=F$?9O^ z(kC4r3=cE6)JwV<+ji=4I`*CQoS*J&+)J~6n(4%Uv&P0+F)w4;r3UF$CXY4RlxKDj zD$LfrG|iQ(N~djW6rHS?zTr*Ue??nAoD$ljvUz6ExKOQ*Z!#Y|Pu@{&eP38OP%`8D z#MB2Cx3u2P8@a8OrEe=0qTV|H_sXv}w)~a1AGwHc*SRheHDiHo^I^qhu>%GxQoM7# zjvRG13{h5|YB#Gm%_=MY{C?#`d9^C#kBc5^+)dVCnr!~r8h!iKmS?Fd?SWr|>=XU9 z4g1zB=_lV=D_|ocQTbnU*Pc^N@1;kYlWQ1vSN>$ou@#q|dn)jno`%1xJlirjAyjDF z$XZ%3{fErwSGHZ7@5`!N)XH~wL}-r7o#%UQ@VPkCe9?s(1(jvTcFXTtW_W-v&&8}~ zS?kUO{?m&mFmDZqW{jJ;TEywU7P-AG4Q>0qYxX=`ab)mXmab@gHeJy-ov4(1y;I5e z<#t4$up(jb1@XYfy~FE3w_J-}(D&_H?GE#tdoG`yX>FP*yQe7CMC-$qjW1<31s1yo z+ioLT-*s+m2rU1+^ z#kZ@ zU-`juoq1&wQ&cX*s2vvSe7bwC(`PqB4|#>oD`n%(=*xZZ__eus;fSa8fAOt7((jzB zL@pJlBogNHmPtG>H`NI078)t3y(^SmFmvIrlEK-PQ{I1iU%7wf^a}U?c4rR?tO{GoLJX`qPvl%<%atxsrR!oxLS$ zki`hUlYLMA=NY@i3$AV7B%i024y|_-5IET4&@`LDuW`rq?XxY7V$$FFEVKt=8BB@r zB}3mDFK)J$bv#+?RULHr^m`e<)pml;hNsKoCzxH{dToN`jTgEf@~#|waJKTi(ZsL` zCpOACRoSi0>sWuJW2seW=M!i4j%M$vm*(#K)4#lH3?XCNd=*W)?4wfF%p1V;#!AFl3 zd_UsR{<^zP{L`xUvqRgPtv^M#T|ZJ6z3Ba`CqQu4cKO8^1RIEVYN5K!XPD#zn;%VC_KT@3OCivk*!;OtM@0dM4k<&M6 zqxo*_`$No-OcmK2=bC$*?K92Ku)FJT%GKs9f7b0W(5tuUO~1CMbI+DDi~TAG>QcND z3J*xnMJ3Y9b|}!Bln-}o@-&^HSMg9x_Kxf2LmO1bJ&d^6cx17z+*`N(M&+kx)C69B zB^y;#uxirI8y<-U?GNu|9oT!jv{!D4zpZa#^zAJjNy3Iq>zRv`>UDQ$I@6dIVkYf^ zGP?ta{YU+dj$=H%%{X{qDQofSXIdN1Drf$F+R#-w|BZD(sU->N#Pq)|IS9_tLy=u69U0<$)eB{&k;ai>qVyeL}T2gHn zjZcV}&38c~DK2F@^Xw_j+q&O{vScRwy8d%X!b#r)hurI}*zHOAzg8^w;a6f@Ov#Cq zag3cPvv_%UeCzL#(+>o$x!AQ`yV7=}PO`|U1_j)m+tzB{NfQ!(tX1UQAHuSHzEZoF z?J&LO+r5h#wj(k>%b7YGPM7iBdotHr#H^CPc)@-&<5-YH(n`0tKE5x7PfSksO7WA{ zJry9`RP26qQM>QL0@}1(%adCI8tWuRoGV^T_b<6?py%ZJ{lQV26Q=7WMVkbN{t$oP zGWp;w6HX2y1R40`piGdVDng=r+n)!bfp8a-zo!Mk<*tgzS%V=fNt!c#I@==QEp;)9 zjBwHa>r-&r-jOi7x4v^e14JEU5{L$fCWsb@Hi!<0E{Gn8K8OK`A&3!(F^CC>DTo<} zIfw;_C5RP>HHZy}Er=b6J%|H{BZw1-Gl&a_D~KD2JBSC!WDrk~DIi`T-XK08z94=e z{vcC90zd*mfSpl*VBo-tNWEIG2kToFjAZtO^fh2$=f+T??gQS3@f~0|@ zgD^odKr%tHK(aw{KypFyK-Pn70NDt#31l;TybQV3E6QVfDX zcGY#xXDu@lnE`EqF!oeHlQ*;M`JdG>H?w~F2#uakg&=whOBu26vUE{g2TL4IoC*$e z82G4a_f3{E5fg?wAG5UoTFFx@qzY$K46=od9a{16c|c1e|M2rM;BSYBe}c)>vDHRH zjBSqNn+&Q4DJKy zNgHcC5t#f>4C-gtuv>E%0!yV}10#naf!gk}tcg2J3bDP%3LwnZQ^?tSEDK`i7@3Hs z=5dse-+hSe4;34oWGkQxBz}x|;U^--1C}{)e>a5$)Ud~+;}5{Gzl?|V5#tn_j`SV^ zUQo`%6VVEh5_wcg;z@f+Y=|Oq8KP+5Axod|I6xtRk5~poeho=%P){>k8$Emkp;Av{ zV%WuUB;wCwW!rv^7P{I6W~CdLC_QGm5XWy~- zd3ra?jhGfmDyc;EV)EA-4g07o;V`?OK$y6d7!N*Sc@W>$V8vy&`grVfb&fh+0yhZq z?~4i8L2T|{2hpbx$?g=4OWv|HkZUnZ2z`y`hQrNhsDN}ZKqhO|g^*P}B=~GH&w-5i zG@>{dKZ6q5xeJqy6m?OQ{|rjeZyzRo&!DEo4`5}=bEvi*C$Q39q%Mq(JqO=g%E+vj zrH@2M)FqJA3m^@XFi8`gL`U%?ant4z8Pr9R&s<_EHc1jWzXY<)5c`Z0?^i4tbcj9) zmk7?;J|oh>1`ULj(2;yE6vjDIk}M!Tnc<*Ky(~*&zyd33eJm@Y+7c@neUSDMuJWW0 z+%jyi#rYMu_1a=(&nuPY4C?KN^xX;|aU#(lO#a&722m}?mO+nSvy_OZ(=dk9J`du-bgV4vfx)KZ4TQci z1Cy~9;PV!6!%U2!1$Yp(v(U4*Pyzw7NoauL-a!WXxyqe)kk8Z*Y_WO|CD6)M3g3ez zJQQ0>9H9!1y@Hk^I{@*24@KnzEJqYG00qOCM=G&I?&z;03i!Y>BNm3E%nz)U#N8F> z;|JDqqBkCg80lnBM8-xX5_A``P~Z>$=-)HfVmtjK%Y=|whul80qKG$1d+hr!j_Hu~jOO$0&$iSjWYPc(LK7sfCE&tl+sQU*? z809NiNTJa>(EAK^aE?Xs%J>YuxSmZRe?GH33B!FnqKzL=`2`;ExB_Fw)=8R(@fDhI z@d+N0M<0qN$z$*OuVivg^CA&L^lwmi=Q=4w^wcCp)T~}2gU)_~WJNup*k*0vsG|-Q zwjlDpK1rG~MtJm6ytWOqrVumVQOLgbNeVaxcHddbG=Dw~q#mGQg0{VY3itAXUX;{7 zi7tsNiUB`s1-Tvr-&xMIUJ@HxL(HnfR>TrJ#O zLjtw`X6e&bgpMLpRPCrCLdH)=lSd$1Wf7y?9=-R_fJtB-^v+t6OD!Aab8!hc{sBa+ z8%3UI&uI-g%rB5!DU-`Xh1hyU{%mF1maUi+RkEFFEd^Y&B|m#I?Q!9#W`}C|*=Dq` zJzVWbmWCuUCfNEk$0J-+NU+Um7pu6M)J_d4M5lqnoLUX^Y^kO@V$#@_G|Mwwtw|6H zXnRD7HqsY>B;0DCa<$_Sx+>008YlZA>2bd0|2#BMkRZhG{NEV&;V(pyBJ3apS@WQE zJRP%0p!Y(Moo_FxDCD}vB>aS0VR%B-d#aJ%sljbeoGy*O?S^bUX!!r!M2a74a2x*< z5r}8@Z>ocjDBGD3Qb09g>_GHDls%a^rA{hAXr&n2jcA`tDqD%W-sGGAzkpijJ-;g89T25_=*&CAJ?CS3oM0(RpRIC~A*~NN*`Yq(4h3c#1NV=Zq>I zu_q3lBNa0=_+3jFnX9m^_*WzTi4f=LOmasBp5kzU;?l5JOA=X4V0#kDH~$}Bn80=+ z%pX&5YLk``&T_&;i0R@BicR90mJYTNs$l#1hhm$h%C@J?5!FT?RoJ$uRh4Z)J3f9? zvq83MY!}*GRjzh`Ut1bAt3hX#w$LU=Wm7bf0j+nT1T_|3)r8tZ=pTp{qy6`C!o6sbv@pYjTvS|`j!0lKHx#6fSi(Kopg^|m2 zZ7Jlc0V&v%%ySrRHrl9L1LFRkhOvnzdpdDHhv&m>EJK>$Be{WxrO?7<+A_H0)@Xq( zeHX=cCqa%4G%`BcjJTP`Yr*xkq(cnx=OX!QgG}lmZc82LqJ97I zh%#<-%FX`-9p8=P4r|tyBikAs+3CU~nqXMnA?Qx@>!*;2l=t^q{J$ ze()3l)J+mIQN(Y|Hbt)b;Ja2DE64QNR)iLVRP0b3O-BqlslYR>4Ipweb&U5Ivc+-B zZ3N7}r`VWnk4E7{L$(*;XTo#yB~+|!zpCY?C<1PY6h7oi~QF% zpNL%iFOfi}eRR0%J$-*}D#^)+k548344O&9R7v)p%@zpwV=#3TB>pCk){rdunZK^d}6}_^8rg?Jjzc`r4 zJ;)<=gxxVz;{^J1IxS0Z&^Xs&+Vu+Xah52^dH-Ov?pNR;9oti;vpN}#5Lt_mo^ zhpo>K8$W)~%z*0QBENS1pQK*u#lgn6=*pmYUq}#Rh$Q|f{jRP!a#3MRAwfSVj)GB) zh{K;q^K3M_bz=?7cEXhpT?k;$LWljKDc@JaiVIC|B7R`(RPgDC?F`Zt2z{PGU$MWd?!ou|TLr&$(D}p7OVHqJkjc!yFRtB;K7QfBjHoFpQ*f z=dcpDTVEW#3x>Sxx1-QX>Kv~2VLH5Xtlq-a+F}ia(P>YJOMzqXcR|j85m2t4>k-Q_5J54G;PLg`KORF5 zxE=uw5XZ`yuo9W|dlXrrj+wCBddG*{BG^{QZWhdJe+03zGn}o08fHPRXNr=<6)Db! z3eOiCRf^|956_P%(Lpml7*Kmnki?k1@`C~Q)oW@9#PdaZ%+$CGMqm1F82GwLQ;*D; z$?41AP)kF>v{z-!)Da5r41?-pAbbvhr&?oRU=FPN=1dy{&~Y`8puHhAjr_C!+I@-8 zIe-5xf%b&!D&hTti}PS&>kc0?jrLNyIqdcX%m>rc1!JbMHu7*jq*o?x)P$_UpfKO8 z!iwWeLkV=f49cuI4Bl&|tihNO4n8}Qu>u8dMa)dciWt-fu_A+1l8Ckvu6u@|F#0+j zdcJoSH$%ARPu_zaVk4oiN}=FIFb0=78H%Hb979Po7zu5X1sfY=CC*y_6~5pARys&U z`#7msqm|nY<;ZbGpO{rc5-U`>5XOUe*vudml|_)E*z;Hks)YPls<4&Nu|<&QuqGZJ zj~6%gQGjU|C^%xjp*rrGw@KTs>;KxMkYhA7iDiqyCfdrg+2SAqO90#5!Z@Sa&;nzz z23|2hPv8@J$P33nD;oZGU8AKC_*56qHXa#8v!&6#rO?qEU;c}y66&ugB>je=0ScM` zZ(jFX4e@piF7ey_JTEacKL*|^k_RZHI|kO@QG*oHvy3fsp+k(TAede~|u zpV+2gB!V8tK?D`nBr!nE6O6_ouT?NcX4~AK-e;BWAl{rMb;W0?iHBJ|0I` znF!Ivx?@|Dma!CCS_or=b`s!DPmD8?pt0YYkCop^(3P37SZSXI0Wy-I+V<@ti4Ph{ zF&0CANHT?u$?;SexiV6qO?PuBL?IOx`*X{AWEznGi`+E!1|s?hhIi7S6qdm1AqS@R zdFk-j?kcP>GT4&jJMJV@mc=RtBpa}@Y>)AH6rKiI zys?*CSh!POZNd(LnQR9l_Y$duqQQg4uvM4|xiPy!l11d|di1HP#K)_cEIDGVfy;7s zHl#!J8OG3XR52FJ0laHG%FJblAl2=Vbm|JF zSeXxTd_6Q~w80q;-42|2bBs%%mhEge+VO5GiYQ<^659#H&m#MCuc-m9IfWfioRyM1 ztbp|5{?@#Ks2QBr?O=-$I@;JlU?+^Jn$X?JNY?FyLGvh_8Ij6QE7)zY-wRbu6he$F zI22;BUC{hO=uYbJ^38&c)BA<+mVIk2R)UHkJtpf(#S48+hFN-`2mo49z;%DD6F5|F8kbgI9b&s~MMI&a^!7oAueca9VEapHfZ5{a= z!7UC%;Hx`oLQj*;B+y8Bwg@^UZmxi1i7o*LLofO*&pCphtgAie2bNB*tDRgxYj5Fc|JR*)(#G8wvjAKxF zbITyIvn*_DD1)WdvJ$M=mBVXQSru05%Ax8#E@Q=PFDQ4eU}fZ@xd=MB7j_p8_3+5( zW~&4mOoKtxdmlW(=ry)g?1K^i{2*40_QN!%HH?+iE^}pcb3b%cLBawB$C<&7?6A2o zntTBI=o0xcL?<`ZxN$!?06pQ2`l!(Zxe8j0L;eRLiti>CYJ_=xB68gY^Q3eITZuL| zYRqVe10Ak_K$$zoxCD|t0w*3H_E6E-NY{D<{5vbC#*U*fOgS87d(v#L{~w=DJNTH3 zel%Gqk=3bB+xU@-29CjOV@#mVI@o=pr<%&4j&&A-XvJ|T@;zGrk3SrT1egd`E>x8lb>xxKQz-3c^>75icSSF0=5=MusJd z=wmg+Ga-+HW1}sFQ1x1PWn5GPwvHl-%_)Z=iEm{*A#JY36dT;ikVX!NIkITp3APk5 z!nFi+yagObXEU08f?^Q`6EjO zuvq;UsEt~`zJ4U5tPvY)65hzq<#S|*bH`A3ZoYdP_HYkFrh2isGyR= z93>Rj2$^^=h9{vxT{wi^rDF4UWki-vp)DocyH(I0LeE3En@$w0rf$P+qc=&Liz~$@ z@sI_{Zh~U0p<=@`u&Y|%1m3INNN+v#yNT^hB*6yS1-2o6Z{5-i=2vATv8I%f;03@H zdr7>S`0yB;(^lq)AeUyFzsDA&&s-%Gc?E*{UW7AEQ4OqIB^57StmKQ^a*y|xUV;E4 zvoSt<3C4xMxmYp13;{kY#LBVDP?<4NSUKTs%iR_fi?*d!n@}F+&+j94| z?61OOx}RXYwLOMI5*Ln`4iIYLC&JNUzHdp6j2jfRj zWJkhCC5137Ab*{aVHd3YWD7~f4$V(+;P$-sF34YWJ;s`kp)h^UVP!w5G+n@o*Z~Lb zh~V1|0sia9cuzM(dUpgXjOTv~)%OYbe33vOdmtB+2jN*6rEpX3))UCZ2+Zarp85;Q za`adzum`-Ov@ky01D$`W1*v2aXWTIq(RSpX-aL8=zSDy-ws;09yc$j_4(QY~Xd2S6 z;O&9@&GB~R9=}9BhXD357@vL)W2ph$2P1v#UO?LQ!;g&q@3}2jjQ0Oi|?83x%Hs>uA!kp%)TmUX1wrU@x>CkqNZ<-a8c$JWMAaB_|fC1^H`?G6x}FjBn6IgPcuK-yqw8mZ9j3wHY7byraf~tDXM{aFMJit)(vELjB;Dma9-m6>`U0*-!($xIe7>;# zXcNBw9}+`xkDa+4Zq9%+Eu~vcG2o+(;1$U=jJVu%7&2XA&egi)UB;m!!;qZI9#AP>Slp7$rz6*>wFfA76ainOsDOed#bt`{>yR8@1eRQsSLh|V4 zR6auA2J5Jw@YvO>xx9L&ivnKqpZ^K|eX0NWlb1|GB3$U`=6a48ZAKc^sQQ&7kK`l& zDKVM!Q4d}8bOgrx`H?Q8H^u3wZV}H7x(MIN%rQ4O;{VFgLA!p#)9HCs?jR1^gvui% zFCF6(P|670{E@C2L-T0LEn}JriaX}Qo%as?fzb2YDaImUjsxvUFO_WIxX_}1Q3z`4 zff^ef)y?=hu;hg!H5$hjeHek4le8p9?i^A_+Oj3FO`PDE606{3jC2g7yNaT8f@47l z8u5rej!}ySq4?}cyo5OAN&eau>$%c#>*f~#tKyWuR1nP-;P?@8UjG0wG$_FFAoymE zQnXT#V^6GtvoeSYHMqNqq4$CueWC;||B{Ib7J_sP!5J5+oEPGl5IP&Nq9Y8JHwY_* z!W?sA%C1qRSOosvU5*XQML2M?8CK+C93S-fJFL$XL^)D~@jguAL?Mzgt}-CXF(a}L zl9m)=1DtA)hPlO(MG-Zy%=s+_x#K^NF}yp#QSm7#(#_%!Umh2azB_yu2S@ljN0^KcxN_?!KoV@RaGK7wg%X!8^Atq{H^KFg z?lD*D!b!7*;&4og<3fDCOCe(?je*h-_mt<@_O#7a0+mX0Y=|RpnngZslnh*hRxmm@ zsnfyx@LQfu6)zW+I=BzVFT(QgvBO}eD+Av?Q<8yj^>D65#tGOQH=$AzpW;U~3ea?V zU4_wi8L00zX%e`jC9)hVLRJPVPh~k%iCS5n0_|50nvM+I0VRC}#zCUvbxFk^Z5#(R zxmS-=W}(=4I9hg)hX)PoV-g|dCWo5k;YnZ2F_}N!Z9EE!hMpcho})xeEWr5Dc#bO} zx(6$>EIAseNCD#UIY1INu@Y`^DsX0_`+^Cg6JB1x~JHS=!5G4qj4!3Q{ zMBPy0I1uaZVWrIx3ME?^%$uHIvdoF2iIh};l=oq>S%ov1DD6j`Dx4zX(g6888#PVf zI1*A{u*bRwZrnv}@-aAM$fMclay?I;G=dUQxz3c&|+HTkr8GVWq1{v>QfEKmot(khIv zt3wA^l!BG!Fn3`TI0@<^nu*DkNgP|^ESzMJQTS*;FaNm_E0;B3WGaC5vnIz6xoL8Y z37b+I=#u3*Jl7Y2`aEm*15g*NrN4J#IU5W%I}Sg9tJLAa>F;MgOEAx9Kx>q8Eo z+@+8``W%0v?;eGi8gT4rou3w=kM-{EsM3IAO_=4O0uyMN8+kTcqHr^*jP?a3au$;<=Fo;k8nF^nmcYG-7iqUwL6nQ?RQr9u!EE}gcs?;N~tw;X7iV%5{yi3U__ieKq>{qpCR(s6ZzOe zt10=6m20-pZ?1gB%7jM=bQGiyOPUxvNNnME5>H0eKNBR;eLH9vsXs9Zvgd>lCr5Z@ z1;lusz`eh!?EpcQ#LzQm&RkUL0MXA;#0rcC>PST{k(vhuQ*4950nSRTumaxqD~)90J8Q1%j`X*5`tUh8!t$mF?<|Ik}z+`*zTiP5y?;F zzDcV3fKTvAjN3wB{5wSwW)n$@iH=tC*B=>IB?_YkUr294CnlDD(2C~V#mX5!NXV`( ztl0WPdh?!>iYKb^hiuL2#me#PiPC5|6?V_Prouz&`^aoeMp8EtMN#!sh&=QiCX4`x zZ{`QY9|WDUGypPY{gG5=;JY$Y10nRtCrlaxIqv-9Q1CR)OqAS{$Q`LGdjDx=2M82A z3m(Oo$q_)??<7hf@xDavl2IZUViT68IK&0R8jcQe{u^Z7x4%<|^)v_)ru6>~2d6eu1fm1TCByP97F$cNLAC{C$;weQ;gRLbRmjkgXn!p7I@VpwGfh0Cd9)MXvIQU+6DVl z$U&226+~YInKcffVCEvo+?-_;QWcQQ&0*2PWL$lC_$$buc=atz=GI1W6wiy?^w^O_ zdMzbB7GZDuBzSJxVtB3#eD6x8`{`on-)|eS610S4N8WQCwe%cJ7Dg>gz;|6cCQT=R zjDAk5fBv7xXm??U*z?IksAMSwx%-$TX2|ssq^$8aOCB+zIjV$PHwDuxI0}dz4W$+L zgn|cSI3kEYh8#}@{vW5uaEypYAOFQx#P6>>qD;O=(^1wkh<5%6#%0fv74f_DH^8(| zS=fKu?+V{2kcq4Ol015xCq|x^2%$C0!K3T1NAq%y8?90<1wIl@(?WwQVI^a-f@48b zksm{J+`aOCB>&yYAYY}k6vjMc(aj&+3M$f1p?Yagq<9s@rEu%IawR0fUv11bmBun3 z)97ezETk(wn2H8sIqtN@v#6-jE=2{m$(?Z!VfbvS@sNEAcN0c(6&UG5Tw}FlssQr8 zn<9eduHxv^^1e`c%__)z5qzIIS{|dW^wk_Q+8H91f>x~NSkY)YROBL-DuEuYh6oe& z$G9AFSp(=f1qmWGsZ>$4XAMV}W@<3zDu9+tK@@*T|La#VFFum0g7;cd;~@)r*LYYK zb;NTlX-95Qi1S*GIql&?3VF{k% zC4V@Q&g2-Q-Ls%92ht&~oynxt3I#G@hPaSUDlRDKBy3l`VM1UclO&$VF9TMkn>S#k zEdwU)ckus9WpZ)}yTjz~WR$--O&$$qLX;WkRxqZ}Th$KHi4Z(MJ+zT#SH$c|?VG|=Cnz-p_+@3Y??L?7{ zU>l-iThK;MFj1w*bCgAYenRn*7nq8crc>7*izf1%B#WxjC*Zp(>o-AUrm(BQdr;RV z&J^AFC(QQzBo0~9^$cGh@D}3Ne#+QCPolbt;O-HPg+^pg| zjzt}$!$M*Qd^|)tcAQU_LP6W1UD!Rxo-)XF-1`zfUSlh@4lX2V9yeh0*p38`ALk z=NKve4#^x#M+^r>{gd(;sC*gIU^ECgOu~)$6KT_%_^(Y8%`Sma-caNJvBFMxrc@~e zDKz=lCV^H8!-m%A?LU@5#^2))a%oZIJ?82`+Y~sa(NW}Xn0gP-q@u638FXCypLdh9 zRrr`u8u{%3|L1GCh%q}u4At*}32Z{bDAGsLWgJgh)?ck@PR0aOS_TgDlDQ6mWD#7W zg1M&-wvtuL;Tda-sm9T1c4Ik5mF7@N<>#$8b5~x!%Q+0%;eU)KHk-NEexft~$$ixB z(KxhFP+^8Rip$R6p7Gz`3lBCb`#+-?GTsNNHQvYN8T&Z1Xjcx5d5uS7Ul4BI!hI51 z%6xq5E2wVpft3r*=ja$>Ao&9vCz@i-7&61Ft#bz;Df+ErTnq^x?8$zcW$iVHo~{4#9LZl*3ctn(ZOjeyA?MWH3HU3@Im-!0ocb zu!kkPgTyYp1-Ae?br>Q`9>sCQ+(K;b-sn1d+yt+R6=0sg!FX&rBz^?&Z1~TK$jJV0 zft*d+TDUgTugTn6`b6T=J?P_6jwy0E3Y{(+b}^5_9%6e=7I!E2?osfG+)v^p;$R~- zA3O%*mFh*T#2m=tu2`oY2jA@LBsNCqIK=noAy$GeW{rOCu7W01g3s+P3SLnO+v;>U z$tFXAqcUnc593bW-7M<6Q`QjAK?cQE!6rb65Gpv$aY8GqV8Cf_g6UMh8scu1py2#! zc#AtGMH#HnF;#vU3!Q})jx9n$<#0Qm* z%N@Ot4__3JAHMq8Wm6OFHH-9`PA+rY2-6U(^qqvQ&bozI$*6@1u6YGkM)!D}PeF=i zCu1_`mdpJF@DYhwsU)6R9FfhvD6#f5(1G~@CX#32U3>intZY9EgQ;$*ARCnP3eVmd7c8ciguK4Y4|ahfI-H^H2=!Hz!-i!%c;p2Yg`;f%>@IPmfj-$;d`ZAEWCou^?Ioy{4;VXcjoWnT& z3Z%`Ug;Yw3th*RGD~brCcl9~ke&2JId|)4G^F*%Kpuc;(#mcp7&{~FtQ1DI2S;Q51 z@prin1?DPAA!sm19`4pbfp;rXuwM(rGf9I&l7w<)Nk=-GGA@^zdv`O^i`u~k_1J=F z%?&8yv#|em6L%{eB+?2AwYS0qx|1Q=N0L8In2Z+6VZDFi-am!36%(OB*yp@OE;rW; zZ$Z$_a6yoaeysETA+aj_pDb;#kr~$pxz&j!m15#oBK9q5hlZV-Nh)6GZx5rR`!WAK z_`mho;a~?8VZ|1#FgjsPGq4jYWu4Hy;&x*Nx}pQ|Y#&za*XN4=udM5itK!(gx))Kn zbWxF_*bN{>rFbELs1a1K#fk+(0wN+v6oXjy@9gqTj9&w>8zL)t~o8gg2uJ|8x?bJYpy(A z!gX~4bHGj!79@SKv9Bbtp_HpglB;IUY;T|B8j|GH82)2lJ4aPXAR8d=Wx%Jo>QSK2iS}B`@fg$mJ-!*XHaGo4>zlU9sX3a9NxT`8`1Wfm zt&`uOH2*hw&;1Ry{tK@I_mr5(B-Kc#2YiXLIm~x6E|o6mH;3AiI$$3 z$bmPRJ;2^d@*)9hqTye?;sJ8cTFRLrbn*edI$SdWoPp=g%*hXN198iZI`*`0W}dR( zZs4-kY?W+ce4gUQAN>fjuws?0I6Y5(Lvp2)kI*&ts%5R|dCJmz*k4GuNKc8b#>NAuwc_Z;te zp3Q<;d_3Qh{9b^Gy(5@{7w|80dMLn?7Z_8Io0aclJ{0>BpDT}alm9>R63@G%r~Lmb zt!P6R66F7jTT!XnRQ&HxPx=4H`2S%du7^Bs-kQ2zG%Yb1{gwv#D#^DPmvBny$Ph%e zOiuE0#d>9{##Um8esoA?7vaRWW_$MysIpM{odXva4u(?P%k}0Ir(qtN`$2*^tYO17 zR-pn6HeDKGL!Q zbg~ZJ$laXb{YK5?_-(W!obz#_1Lmx!G<1SWTgdoHC9lr7k8ni!G+KhJyV!4GT($&J zJ=HQhGQIiBdoEqOK&$B=TBc6`Yq`R|5qC+;e5omLqk5%#gUg=Ba+ywyuWwp_iF!*g zUs$lwl6Rs2I!hKQeY%K)U^;Bc!lk>p9ArpiiUnD#Wg$}IW})t7#X_ZqDjAr3_P@7+ z`Q)uar7j=0Dz|{-Z5!2tOX9aeLH1@lYK5fuWUKZfuw*^{Ce1Vt7zCCbHI*CROVnZmo z2h&OY5x0ed(>-v5PvI!aL9i3bXBosnAZ>Sosf-Z<>~m&#zcYTti0lb_hl7nWd)n0# z&&@MJ#rQk32q|f%k(ng@F~qbIJ&wR@J4nJtwdMv77F-islQ>lzi)>#ag%;Jwrf#yVjAY1E$38wEa? zr(&*i=DiInCd-|@CLJkMF&;|`mC-+>4=mQ`RkB@u(6U_&f|-<4h|qL>ac3E2f~o2Y z^YNQh;zOB*S_sf^XRyVK2enIspVgVU8okUGzO7hjLKVbLHiB_{n5vq4x#r4BICxL0(cb` zTG6vX3;_vmV3&BnAY@kk1(&5t6^HmWlv)O{;nLDm90bshuV7Jv!>2tdcQACXsA&wT zJvO}p*6plHSw4!oiqqqpjr2%Ft@+sty=>oSh0ewkoXTD`4>L?T9?YhrUZvD_2Gw1f zahn!+VVaU7lgD|&@?nLsJ5ktK96bDm(-zN!B8o6n+JFJb8_OTRo? zDCmZx8Z%FV_ZiX0Jp5H-5wpkNMeDN;5#V*_EV`Iw-? zwZ%%mKF8^x9|Y|agcZUUS2+l#y+N>C+f4SsY%Cq}LwRP6fUf;b!5kccS#H`r0Zet3 zq=Qc5LqY$bgS{+-Wg3MJ2{b=$By4-f6|2^ zY5hn}2UAHHCL*iR0<>~)8{dGqBqbcP#>4RfG=;N3=|rpmu3^Pmnl}C_r!otgKulz|IJC!a5uy#?r2fkyF#lp1$RE|N}T-OOOZy}zq94YT{O0l}{J=nk%{OIl1pk1LC;L_WO zZHB_bJ79G??Z6MXLV`4ImoU2%Nu}1k0$4?|0Lg$Unipjm2N8z_xD<&JI~)@rJPK(t ze-z-OC`g{15J0!T*qYANVFvF%4%Hudh0{KiIu1JZSNY8kq%9Lrs#^(_SURl3q5CJ} zn2qLsfS%TDDH_0qeQ4r%tbFGOswqDF($(?IS+i?wJD#s*=S~3cFy6#Z*3?fhp+4e= z7huHO_{h+T*ny;i)4dB-48`3yDxUJM(pu}wBn$|qKj ziBOdmD|}qC-jVM1GAI#FcW`0ve3MX##p^K%{JdI|F-yvx#71dS>lJF>4!!K8Y)?Jw z^tN)$b1~#Oo;GP%QRZY8rV090ZRf#clyl4@HKjj~FiY~v_x&lzH>XuCyf@sS433Ud z@$ByOqmHo{isw#6i+tTrfcmLuV>e{rOJ1*I?wlXRCB9VpI@V>j%Qy(2VJ;sylj}5C zNmiJg=}aruWBO_6QHZQBE6VhXX>7do-8)7mT58QV0xg^+u_)S&$fVpdPq1lui83x9 zoPjL5?lp<1=S;jU=+CN{k7r`cyLd$~&a(jiy2e2yO*&ShL}xrO3wGkKb9##K{FyWx zOlq@WzMPE`e2XYAv8+rp)vA=YATP?9!7NBW3yrxUmicSy-TuM5bu6`_ggJN*+~#8v z!iC%c{IqY;OEP+wsvBT>h+6IQ-lZttTqGYnO3hczWdR!JnQF><9t+WAzpJKl=CPp~ zzdVIXTU079)jc#TOB8DCeDtzsl?vK9ANTOn76rA&;c+>|LBX@iM0MlK+L0P3g#46i z09unZo+lKPy?{k(N>!*EY2RSuHKiv_3NnQwSNltqruO|CXos^-n>4yoO&xAquAPW@ z2rbT;a30 zi`=}+6hA_@r6}cVh+nGE4z%n2-dg#$j_|V$aBnE(3SluqVYOeG;%;h|4mufuCyeRl zr6Z$IQZYZJV=CXRW@Hz_*>Cft?{mcgr2ki0XNt=zQ<~TTF6&#-UM9OV*pb^Z$b$ZD zlsQn^GJMe3xY@|`q?TnEZ)a5rX3}ytP102x#SYZC9PjiO@feh>&1wDt*awb-7Q44VAB8p3>G( zBV$X?R^TD^jxsWc%J>fRk*X&OX8${A2_2RSV3&z^u~-@CD4T;X6>u*T&7l&pg;%o0 zQb94l>d55D(6kb@WN8re|9LWGWV9=8x}w!sjW3>`uVTG4QDqg>v<5$o^>7sn)O0FW zP-GUqto^WAM*chkI6h@$F?Y?ak7de*o@U|Ayk#5dR%75evz?Z%X3p+yKfo1?zRG_Z f#*TMd{0TR)kR4P5Et|gPea%B3NgcNCsDSK$r|uU; delta 28764 zcmZvl1z1&C*T>~tMY>S|2|)yD5Tw%<106fD6$={_1qA^`N`)o&UKMlf9vwSo>>g`u z?9NfgF~9#l`*81p_nYV0b6vl+cK1H}9RAz;zUHN`?`mdb>0}96imaMhwX$@xYG>(X z>1P>a8D<$}8E2VfnP!<~nP*vKS!P*fS!dPBs+(0W%O=Y<%Py;amVK5(mg5d5qkcJc zra8eifOCd(follo3fBnE4bB~|F`NgSC!80YH=GZgFPtBoKU@G@6SzRQAh@P*!EhmP zp>Sbv;cyXfk#JFP(Qq+vv2by4&ET5DwSa30*9xvRTpPHyaPe^M;M&7=fa?gC0M`kw zGu$t5UEsRHb%W~;*8{F6TrarZaDCwV!m+&fhf9PT05=eB5Zqw6A#g+ChQSSo8v&OD zHxh0X+-SHlaAV<;;l{y@hnoO55pELPWVk7CDR8N9Q{kq;rNK>yn*o;&mjO2uZWdf7 zTo&AHxNNu_xLmk7aC71E;O4>Q!xg|4!WF?4!_9|V0JjjX1g;d0;1=zwGp)?eTW|fq z*d9Aiv_3-})|7?m+}|~4P1)BrRQ|EdiB`TZbEkx9PW4JZm3auK2GYH^WsMjxr501w zo;2@MnUmm_q`}6Nk>jLK@i9t$@@%ZKpo;rtCc+%ap!{>0J&lf6+t9dw%WQ>@a(v<6 zGJoN(sXQdn@XRG;J?i%vhG%DLaC_lSrbe)*>21|@DdCDzmpc9j!yZ{O-KPJ_e1&?m zIjNY|K$k{+DbuHo&MGr%_yyLXxm9(6!t8|_Vn+S+m2UKt8ICWL;d48kEGcGtnHf#| z3SH7NneNWoj5=KRlIcu0%5+iR%3_2Sn`PwZ87J$~E-G`n^{vcCSanFI^8Q{HB}@vV znL0{ON<8IcL@U3S#R{#P%ZS5|vKGSXHk=gwDC-~$?W9o~(x#f~#uWV%$#~UGhCRDD zOG(_tbienK>Fm2ox)NWdt+244O!anJ0~;}CCF`JiI+3ZosH2XuR>{9g4`IVp4e%4@ zOk+YnAvT-tv0t5BiWQW7h1?Pz;AuhWFZ}VH3yl@ZAYofATBfgTOm7rQb5bf0V6eW1 zLD3>8o*ESyq**uB0DDZCa;wpwzNj9M^x zX2pevwGi*aI$UV3t86N)uFHj0y2>WP2T4%WhS_9Wt{GGtW;gA)(7zQTaW_$#k$Wp= zGou>#Plx@lhM9-Pz?7QmAv3kT8S$n>?gTP}slwGDZYWmmbOU7VTvJXi7${?eL&03oR3nWwgw3`Pj!nBci&bbqj|`Pg z!n#m~J?U#VXJb~V9zydlPD+iG!NMI$@a=(Q)-;BCd^lJ4HdY1*hb3W;u`*ET8o@Po zCh+)16g()pm$N;oOyIFjG*gSjg8DVY_+VzGHlzBcNZd5J?v<^oF6A-YGfw8EubrwM zeP#G`f()OtQ`MmnX23VQbG+G1*+z)(A+uRus96bl>MW zn^L_6N;`5|TUL_}GXv$=ss;_Y=MGlTZB5hYx(l18YlJ#vrgFBU7;BWYbG8hxu~xPe z{+cHvueUiHQuI2+D~?~?>LA#8B{G9eb(C!dWf><gwXd>RbooR4=Jt5>;_7*z8!*9=}-d)r5_EqL;tN1xNzPM1AvYp7sBc* z!-OzPE)@B>n9!Opm>FD~x>R;%C-gpJ8*X4`uZ$A%?6{C&k9KYuz=db_Nb{fwCJYiv zo3USiD))BPqk|5JyJiO&@pV+T7e4o>N{q>;iPD9hI3n4mgRAS(8(~~j=4%qgMub_( z)vaFVyIAo`{p^Hb4o<9Y;5pyLmK!`@s0oW@@UJN{)9Ve;wY$uck(SQN5FsF6Ms_=6 z5c_?;jJUa=SQChoipEMyTI~WG54DCkkW*(B)(s7jwm+82@ZN^XR>F=ARf!1&pK`J0 zsm*qUm%yDe1F^8I8UfEeAj2r9X2P*QWF-7vWtJn|VEyX2Ot;2O*-lt>K|`FV{_Dyp zN4di~|E5fL-Cfy2XkVcrE_D36i`0p%>Nc!wFRW_5{im@SD6FqZ7k!n@$oHO$5jiEneI@Qn-#sSr8cK{Pv}m2a^0!U4NWNNpwg5#>{Fgd*nl974wHo! zdKX4tF_z6rbne%NMzq)uW|w~D#K<45NOvO> zLMdU1t05(yYG^=Eb6Yn|13jT$ko8UuYg80RW25Wh5q=j1@9Yfim_F;m`Z&4tUs zsH-Cbx!{%ID%I8S5P0~S#PNv`RL`2RT<8#r;ut!S3l*U#gm)QSxKNC=jtWDOx1BE| zufh<+;w9u1t{g24U(SBR=)xIPMt?R9ehEiR{wq07h)^a7$(uDcPCS!Fk+5+;sKEww zcb7_+7Tt2ibi)?Fi~oFh#G`r0kqixJ|0IaJruR-G@@kjm5DMm$9L&g--488SnPb5mr z?!7qpJkk08GfPmE^p*39=9rDpfMOJH690!M&S-?edMtW-VRNO8;_R?$7M&G}k#dBL znbFwX%4C$aKr$vyt7hTC)9BC=%H8>LWpYat)pU}hTMT_%B}WHaDJ`g1E2X#M*3N3Y zg~I5N7MaqsP^B&PZ;gnC{we2Zg!Skz#@n9O@;VgQ1~r;cvjG+p1#j52y+F3xU?utvU@_+M=?o!TkLyggd-G$%KGdb?9)#D~T{@o0%|HJPqC z-?%+sq@)%nKb_s|DX|?IUaSQt7uqSK1@n4L$QBaq*>8J#+#c|TGZR87u>;lzO+A?q zLYF&WLi^&+g&rN6Ir%xD(pS&Uz}?$$d}yef zw9I_MaQ${1V}+?t9e+`F5dI!em0;V6oOU0^=u9Dh4EqhHuU*i2dyVHpYFCUg4<>RU zX1-ekGV6vMubr(S4hW<+E$XK95~j`J^m{jDfQ~Q4cE#Q>V}qMD`E&dMGo6r1ji(cuy=$XKv%dv-57!irb+VvMc<~aau2B ztk4u|0v7m^n{Lt|Z17Zyfeq9(YP>(i4WgSVYf=BFl~(I|Bc$?cGM#ZB6u_FtoS4;g zm)2MDy6*CkzsWPnpfA>kqu+2Lq0Fx~-7<2w;5EFrFT#HHo$JJ@UK~y$`vJce=;B~y zQ%dfoG$ds|L@5}`h;4u5>4BMyEa{Ju*i@Gjr$nqLqZ~DY8TEDcvY>?77`OgT#5^|z zD+x{TcUrqkWzu~BqP`U<)9o05^iPSCkvsh>t$PfF^?zMuy2J^rIG!Sw-f8Zp;@+2+ zZd`wv)qylDUHcD$XPP9#9j7ZBQU$}wsT>CkR{9Cf8C;mL*xiuM48aERzok-9>(p>U z@b_jhgNefa9Bw#$2o~PKScR|*z8HeR!Lxu1J%(cLySk7IzQa(_!NYM*bbBb`Jfha% zroz0{Tv$8|)8|zzUxq1%>#U>(LzTg$C*6%{#&9(G)jPRS#c<5WCRn4e_#hZl+7)*L z8ao12WchnlEcI=#B*eJ;ghppbPLJJj!jYu((5XXPN1&l5@AWXC70xPK@*JtO)ya|3 znAskNd@$SjPnAZuTc} z`|U>GlhLs6mog!qa>ikd(_g}cse6&fAWIDPt1o+0CV8mT$Bihm|SHNX3iy67sX~vLU}i{?a*vA{F*mK4_I5Je&f?7yZz38>-)5=}Puf z!5`Q3V#yCAB&9C(aK`_{@nr*3Ue%K;U(La}to<})gd!nG;ziSxT@?R@%B@Cp_mT#? zVZFS}j8PfVe;p&`X6W9{6qn-U2wgi$akYgUb+{TM1@?0~(o_2vNtrMMsi^3pH8rGj zGn7pg5#8jdWjg90x33(%o?2NEm(vko`~bPqFGCrm7&J(ZPG)$S(w6}kPmX24{?Bx| z(s?Gr51S=N?{mMhYo-y9`^F&75^D3MZtQxm;TvU;r`qxN6DwXoVmS64(xrm$d%=1 zz3kc9jX536!4mb`UbzxJ4ahead0Brz%cUm&G8chuKd$9=RFIFu+R#T{COo?AIk2dE zN^4<8^PYG~Bc}UYC{LW0l-|$0tZB}1j1FrUPrj(-CS;z6GVgs!LWkaZ)gfgbid+AR z78#J~Jk)T=Z8^%D2an!&Mbw^*^I_2au_&c0BA$x>h@)Bs$`*?5&!n0|JE=>H3Xq2L zuO;-X0HI`klBBzq-nFS`A)*f!ym@!rQwW2bm6A&lq=|Zx?!2qFwlV3_+9HHJy{@GE z0#jkB4VjfHqiJ+8M$6RtOlT{fNS3a}l4@O~w|o^c--+u}<|~^EX|7zD(az6+KE-)k zi#~!EU|d$W;Ht$7FlYVRiwjFmV(Ec{NJr|j5H{b6I3Bgh+e-9#htXz>IX!aDg>(Rc&47R42Rmz%lev=R8=i`WN@e=sHG+(AG-|Az`cG}K#XaP(^mcqbi zq1<38&Ku5@$qDmn5~iJyt4t8!#G_div43MSfjaLE4blMs&_7 zZxQvECF~sIpM4~*EyYd139TiJBJ?4*%|NH7i6}!%<7Gx(&J{@_^<4#{^esS>HjC&N zdb33tt5|VJlI-vJN#(g_E3C2~abBwMx8}thxea*bTglwP#NU!}55ZoaE^b#wk;irn zDYh0|nBnWMPs($so!y=NnBCNP=f_4)qxV!04W zLGu+yI-UnJZ<}{vT$@;;5e#YVNsL32e@7U*mUHZL$iJQ#hT(3|8!I_Y*^PDUKl`{~ zf=mf_ZZM%Ub^Gkk$G4+#5G%MB}=+`0C8RJC86k) z0CO6B5Hrb-0TQ}%P#L1onW&Wv+2f8TiY;jpvQq{a(d$F-Gay|;{SRZ2TsmKpZXbqu z=&z#Gf_famTy$!UD0QS;N8oSq5m9PKW)%VY)b9@5=J4)N&_` zDJPYSgejA`=EZ_0wxa#OQ?P$Di&M;I(Zcb0T8?j*T zg;+f3!bL1u#LE^w7l2pEv1uD@hZpwK#LIeHTCB|9&kGnYEJn!4rbqd@bm2*v5mnf! zYSP?`2=iEq#-M}HG*u(iCEUF*rR2ZxnE8W*w_H-zr$h>r9{x_FDv=MG$~}u#=P9r@ zU1)^!(UF&MhS3`nH_H%o9fV(JYlQk#Elr8KsDlGc>sJuS4ouE0-tuc0YEY2Y)c&f{LGV(_aKBuq+7$B^XW^Ha&UUd(SGXro zj}qP?O)-a2V!f`R#O5E<7<3i3U(yI}bm%gkoAv%1fw*1PU{`j*#fBa*yh@IdRBIY` z9U)GY`tphX(o0iSE9wYMYjqE9;GN1WvR)*YpvBFIIKI^M;o_G=X+ zKH|S~7ruu#6iwY}S8T8Y#a19;V`l|ZgNL}~P*#Bf@OGvs1@Vk~-h-c|vnAx>fDL$`1IrP07VlUnks(6g< z@cja(8=qjT3w?rJ^lU{a%VZD%HCK4KOH$*fSVFW87bOoW>k(>9E1#lFC{{vWpJG~h z*HMxZpJ6*1H8hk}aAPXS4ArIM&tR^eFCqKq%5cT@ZIYDr9G*|_mL$7tp(fOG2v(!I zFHnR}_Dj6o3+!r_KbNEpFEH=4c_~Q-FA>7@_mVW`B^F)}{*k29FERdP>(R28=zxu1 zp&=LIo(~i5dW9KL*(l++FHc)di^9|NLz1A|JF?Bc|W^>7T+HbBI}D=df8*HUQkWyX zeT_jlp}o2$#lA;NYq3-2MeGb48MfZVFrKVl57Vd5@6qcY?$r?KSSkM>7$zUmU`slG zJ4`w~(*FS6kM}ZNzYm!9Zhhn=u|arUs`!AVwBAn*v86Hf!=-Bm#UJ6{3de)r*t3+6 zm`GoJ#AMqT-Gz}{_wWY%IAGBy7@jrb_|+%aw81kPX0yh(GO*?W;gxmC3KoX~qCs9j zxOBE;@EL)$vgNq{XLO=aCobIjj1Kt2g$sRSD??2G4<3pebNsetxb#5b8^in1U0M9V zwaBSYxO5d^+85}`W4Z3a7sTN_Q6to%?BYtpDPLizH-+i2e_t3b9lB5XUCIQ@LX8^z zRm@<95WR$o+3#;F$^1Kd{mIkpH;fuTtIXWj&D)i#J-@ z!8n3n(WCc2;Ninptt$Q}2A%H-wX)SVloPmFNjEuwZ!1RL0o<32SJY>RYr(^W zi5%ar1snHNE+p!zVuYhpncz+5byY!v{%>69^H&7UZELGM1l8~K&OqfuZ>~gG&;~|g zk8m>PVT3Lj>8U~l+v6HyO163`1FHDDOqbfel(NE~Pz0RkR(D@U)S|qX5z-yAuX;#c zo>te0XLFi9aPkF>7gM^dkEGwc%8BoX2s7$#faLsslM!Ds{x8CkjxuuK9wUiD(nD^0 zKqu0e3JjrX{FG-etyZKSyHZ~kDZ5pXh?M)Ej#a}pCYl7lV?9K#l z8l#TXB}-G4zhIZHA!1RQ(R@>cvvwB8-GT<(9uE_E_6xY!hQ=?s9-jo2?69`iTs4CnUEwH>}S8e)c*!z5KF_x3c2|92gBaf z@m`b#$5{+FJ<0J|D^-M`ILn0)YvkhC4K6G-jMk?W)`-F7ri_@?QMDH=ZdD~lH1)qI zX}~&J2f?>{tue4Bx4OvgV;w5CQ+ZL5TXao|aEz8px|>_HJkL=E8Y@e>YlT8Fu7}`k zP~*(=NbhJ9o{4n*Q$-6oE?l@CQ)wOEqKdVPJ2xn>LGFATGa<72gz96f zG7(NlI_(wFmaQ})vBAQ}gL}qY>M!)~$OYUE4G@NRWx{CTR(}qor$-yhCdyHFF=-F2 zk2u;UaszRqJW(IHtv!H|##H2@GNt<@;I|ysYIlS@el{a*s<+_C z#%Ns)v$<~c{8`dIcXMN;wN%352FTL`BxMdaEb>6(ouTG}u_w~{Z#fsz=BdOt8!V{& zKuk^9_42f3%pgUGTTbRasz4g+g-oqn!G#}(P(R{xqxW8j<}%h4KB_2c=Z$H7$Z9U& zfwdcb^oDx(uZ+wTY&UStjFU0a9R05k)X#tCSo;WXk}q(?Q7ZOTjS$L@Gj#y@_@SJZ zoZ~{Gd2DU^{sM)C>wY-*@Ph|K>{ytgs55>OW6baTMf*dy>0(u#Bfm}jr#~9&`iC-I zy#Vz2Ki_MJ1r-J$UcC<*(u6mt&?X3W-A4_sPY#x`QiD1JouYQlSZZJq7fWLs#2Qm@ zpvps$WGJF|+8n5AqF7`kN?rLjQP(q8{tWcBv7}7$jI}HsjthnV2B~ZmFRUeuO=E2u z+f)^*u$;(IX|O6r@pGo6PwS#`p}oOKM|7@)yhBvY6@%wWQpK;a=7fjq=JX;20pk%L zOKn%`6RL_(Ok6EVZ$nk#icz~IslYEq>cnfq5OT(0iGRBjD=mM^ls{H9&FkUlQXfIi2fkM_a^eNi39CJNlhk5kPOw&3=C zoGPA@o2h(+ccZxQqM6E9$eGB^hc<`coxz30ixJw3<_PUn7AFH*ptIt!kQnsc7Fa6j z=W$_BOEkp~1zfn_5|MtJ&xQW2Frkbqt zYL2RoNci?NhP#oka*EWdcdnWuFQFy5%pjgjS5LvM{RE_liWzB34xP{*-l&)mO67;9 z7*p@vQ}k)G3lj71ZcQL;F>zO|v8ucj{y7R$)?&RC28SSllJe!)&8c7=un;!MUv zDE(Cf>JmD4q+qf^M(|WZkLI16B6Y(rr=&En6x673f1}K_eT2%DPIN^9cAvG0i; zs(Ux+e(aa&Cf=+pp=V6zew^zrbXV1*r4Ogz9Q`qRU0Qe4c-Tdau7~jPiY5?T9QX&t zl-2`znSV`&U-dwz+k0I`l6#_^%)P})On=1jy(emO{2dK(=0oO=UP#Q^dot|V8;cgx zS29v$kRpu}!|SD(8S?UA|4$(QUaCISrw@D>Tar#62!(zr(!}&4D8-CC`l<|cE|vCC z^`-B3Ffxgw<-G6|`AxJ54s@}vN+swwWI^;Maa$nla`P8|EEXztkoTeV`iBOMul(d9uqF2oJQ zP~g~w3x5oR=4c`p!e*pkyE6#Y@naAtCkCO1IS%7O{9v^3q9mF*Sd}h3pUh$Zg(-UM z_zgS56izM=fgj~mE|@M#(Wk_rP~*KJF)cTTV({3H_3AKH2kJ8nwb*_Z6Uu~!S?sq5 zvFVN8UcpqbW;n`gVFAZ>BhW2cm2$y%Os164nJGz;Km`3m5 z!rhB0#x!gs5|Z${L`Fhga6lAFZy^^$M?ss0CB`sS3%WK6rPK~Fj8vx#M{*v>by#;{W18vQ?@s?R|qBi|e3UV~{eh%Nm{ZUgw0dz#p#4@R$!N(w@pN z89IZzGTpRf^lQ~488I1$Jbr&CBU4OMr8ate9Q^D4tI@gg`LNG;;4a@Z*o@BEq)G$a z4u@3v0H@ZWcaxDz{Q49mlihS-IHPTm*vdO+&N7l@2lg8+Rk7t58fC6=I{+htZ`XJJBKdS2y5^=Bctgo9OeZG`=g zsuCmmK137+ZdisZu$e$YN1;km+`h ztkkug4PDM4neJ`IRB3`Z&2+g#xXvLPrSk+29}CC^e?kVpV`5?Qcms^KqI!RTN|Ykat}|P3Nop z6`LPP(oZ4Hke19xvHhn{#S2s()W$8%s1*MY#uzi;Ne4aBOlSxre~YA#(8z?F+APHC z^#HCqEmVyZ9M`em5So5G&7iad*5w;H_;D&td`xRbX(cGa^ZPiyP=c1x7>$8>s@#n0 zQuk8W6iOI}NWMbz!z?zuSbQhVf{%Zn9;8(c=BxwWIi@ktrwo_rxH3M{1=}V{g48!3yh6f1xD|LE|hJ&u5-1c~t()7Uc9`(vE!RK>5$ zFpe&IUmYhYG1*!Ctcp$Ou@Ymfr!Fm1VQGz(Rh%%)hzTh|9V_Y-pztV`!xl@>&1$vh!Wt%Y z?ZySerD)%C`cm;qRTKJ@pvFbhr6{poIL~9mEPc95X*tUH^B@l1F2iCbxg43BiOGSP zRFazXCU?5j)@_#|jQbO028q9*dnFWC8njv?WsB8qjT*jr8q)+}O_4@0r|jj3DrS+4 ztoyAp5U&-8C8(U~LMUSea&_TXjez7Z60(JpUMo>7KaVg0%@~b|`I-J;dTokah3o~K zX$Qnl6v6Wki2O4SrOxGiW)gaq%up08Bmj*L%w}^d!W8P{cz~-h5i%;RdGyD)Q zU~8(*Femv-5QmHa8$&&nQAn{f*lP> z*JXN{&X6y<qe$p^;M(t5%2hT zt;2ZLtHunPX+NWjNH#Lk$XF!7gg4{e`7Jc>_29M^632HHTsdFI_zZiA|5%R$n$9kg zv?WH0d{XNf@{^&yo{|B3@m-9y!A6AAdzOT8U%oaSS~{bSsI%EBdFCID&{-&1_1`KP z)ZYZp?>Y9Q!JBZRl&2PrJn8oC8K!i{uCf%LGt-&NCFP}qtdiL!*k3k-H{B?4)n-+g zB5!+T5Eo_`li3ywy}1V@bmQg>6PnDB?@HHq=_#M#y>BRMZTXBKIF)H1F&h9`j*yk$4KEGjd z@bsxlbZK5Zvbfj`{*G-=)<`bg$xRpEpv6i2 zeLR2MyP!&}D<(55Z`!aM!-w${CU{Z*h3Vq!lu|-H_aJK8!*$QDrJM6Bn+qA9iuZe% zm$zLrOzFiQWcm3W8OgBE5SPT#4bGyy@Ur%ERRd$1Vw}$Vrp-R+9cxg+epM?fbji@A z{o8QICd?&6-sPQjH3s|&XyAT$n~Rs&_N#Igd7e0pdy*bTFI#6AkmCWg&5QsE{p^Y$ z=N(Y_DVBt2kvXe9GqOF1rqw)7;^Pjgf)syu%U}b7CwWXnSa%L0EQ?+u@}T4+xb?NP zb)G&Y90E_N!Z$2(#G4!o@eJeqA(exob6>e9uftf-j7*iIbEQa_cvWumVc7d;$d%%S zF4rUAOJqD&(R*eF#h%UZr7VBEUHknAlJAl!p*DXY`3pV>z8VLvQEBW)+`$LTc$S+I*s~C&61?I`)6T~ zHA(G8Ur!?$-E-u8y)WL16;JafpMg?cE-4S4L8V%)lAE?Zi)D1`dI{}6i(&WUK2Zv! zgd4M@&34>51asnm#21`XwO8mK5v2%nJdbpxT#+QFj+x@#FILgvnH=rc%|wzep#BcO zk#j%eOlgOA=K|tb{zPZd@P zdfWJFmgUzlxkaXEr~$1n$;20}{zhaYGd0+T?DkYHqW}6Exv|O9==AB#TRa$ScOBT1 zI4<0gX-kK$BapU>WQMzb%QT~F=2)1O9G23>yYTdtGOOo@GY#3L61-!417Tj@d0{=gMvZZUGzM*j-bqYoK`x!p zz|Y)Ayn9D-^0qijYO0A3fX&8eFeZ%$h-fyx$iuuQKE%|14{y0M;q60Jcj599jja*I z@5_>&{-1t?aQyLQ9MO;kFRmY>ALEQ71#i4-@S7`H4rDeCyYR-3vnr47Sklc-GOO7_ z=sEV=irzfIZuK?ZS7%;()}C!$`V93p_bK9O`j*odPw_Ohp^9OUB&C_N~!toJCu;Wq6@r-+PuYv`D79o(1rYkrDM5Zlt0^;-Lo>ILGR$<;be}Fy;BA03?-en zs@AkYruu2QQ5W0;S2KA(UX${t+TD!H?=&3hyI+{e?{*e*o+H{zoJGg+j7DA z8{%x&g$a?gd0e(J9ry;17l(7=_8lh`Iy1Sj@;e&c#C$H)`GIoXU(AFMO5Tx;3!9s> zrKxfG4`l5aZr^BhUw_~_)r5r_VoDWTv!x3y>wdyIxkRJ05gT+#l-gFXAPw~?Ii&Uw zESG8kUgO+{Ai{KjFRf(QxAalAF8Lg(OvX+f1hIIPR`vNvws<6NK=IaCcD5AMCPF=I z|G8Han)WC1UoNQKg)|wx`)5^O3iz75rqY)s-8l+h;!T@>k7mn9y}L4_^z+$9{P;;+ zgM2ww#q$1IZE&I`HpI<@y10VGlV(YvUVQm7u9n(X2cKBbQ8%S6#yQ4xzLq*(Sd8Nd zZtF;||5DjdrYiRN2#;kJ(bc{Q9LzMjqVO8pZ3YgM_UQDuET@BMW$0ihUjONv#}tL7m6J84^$B zW@<;Oe+-=(ebkJG8X(#q&t$p_2I}@g{g*OQq@Uwm+66gVZ-|_A#Zj9kAgHkQGEzqh z4QkRjGj#_N$!;Tcb77T%jPx{C<2IeCjA(nQoe9$L-BPBT?w?bi*TjCNJ5ZPF&?jA~ zohis9TTbeJ!Fu5=Bgecr32U2U!tP0!(a82y3g8z%W-wD&637kFU+t)`IlMY!wZ@W; zPU}QZ80itlNE{vNo+GUQMpyuUYsK+#3w0A=Y+EMy;O3+{P-g%oo2h-Nz)~G5jPJq} z-sCkt$6WJ8NDtw<7T06P?q*bMg)qDIkXef#gH%`pe;mkhJ8N~U5QMcB3vr*dy0x%M z62#!en|?j(z(e8$X5(5~S8YVA>mYs3Sc-AbUD!3f^51pIMwKHym)lzx{)QH4RVUWx zNc*CwdQi0~s#MjXbsKY}Z)vD@NX5#g;TknEu}++|wdu-9*7J5@BJ9Rjj*`Wzp1~Xy0Fg1ol!}{tN zA!Roc{OH`(Tm#CfkHPBCqny}2$i?H5=a{`hALUkd2PY)E!3l2A!5&4`={ysBY4yuo zb1J!s&eQ0F#+qf)w9%&TdgIR^X!Urk43=U-#$=%V-_L&to+T#R|w|-&jXtHjgju0A+=R#iLoXRR& zIEUwgrK(1a6;rr@UdbG3iyY*PK-|h1P7@aY$9`kT)CGZ=|6oEB9MY@(6p!rY(mm@r zK9u2%^WUh@xd!ycMeU&w8pwHvhA{2ZR*tqeRQoG>ZkHn)SDb3rik=SQCt zaFA@=7+&5-F%rg?fO8p%Zp}$WV+?Z*+j1e%1D$hCdoJjW%#+4-Lr-{kfLlf^2=P6v zOh&@TbD}EDlg{S9F?@L@$AL@pq=nv#@+!%@l*tY7E{Q9pu99>t;WcUuz|A2RODk{m ziN343Abw8wr8mO9yNQu-iaC>Kfr;Lne*Y^^eyL>XZ%m&e^!r`%>4ed?moI!8JmO@F zF9xH|Pq^Ui2Vto`z4KE?&;~!ur91Ip-Vc5Afi3$DBkk47bN&crPaB4D$9~v6BWe_Y zUTPE1h%b#9J`W50!Dutf17J9(J;Oe9J87OF{mTqb59Gu#V;-JTH36AFf|IRH)c(S- zNnEf9ME9(i%!P@8=wJ_1xo|BIZO#>sz*)HALF!=P^L#EW4?+Nc;i)#$D4HUG#bsO= z(i8#Y9OlB!J4g#|pPSLzih1((Qv3%u@D4^#_rn8b7S8-&%mcPBxiCgQ-%dVT8*DVjkefjk41!6LvKcapVk;D_cgXV-=eQ%hBy91o3H@93{`rmoBR) zqY=cmB)QTnw^A7p1Lf4wa^;7)`O>=K98>N|mMf!T)lrIN6XeLQIA7{!jTcCz$WIZ> zCrf4ti}UR$eL=oH&0dVk&stc;Y}6FF*|j(}Hm1r^=Vt04#rbJ+6j_GAZZuPS=m_*K zQjKqLsPZvlHpl4uJzZ<)MmHGBo~cE4)S-nsOffH0j{a(aW)z++M;%%MmE}mtsTI2V zp_WM6<#}4vLQ%e0E1A-YR;cR2ayhbUt!}Cqwo^hV2wbyzo-aLO+t3>2d+mRfc=_62 zVY&N%JY`(XmmWm-d{m_fV^92#ZMCOzwrvqr&9l|aq-S$@RS<7OwpE)bva4H&Pw2!K zwJpdY9v1D-Nnw<~K&6WFO?EuO{!Pa54R7|=v$#I{%#=TGX+2r+w|Pgl1J8IQ=hc#Y zi&<=Z&Mivy3bgMvI_NmivUtqNo7<~>b#AkNH=;e6$VBB!?nczR47;Ck#x%1d22t(% zB6B-n^tdeHiVhgI)|hdd_8l>7d0H_cN%&;VVPt)kJxyv-ARnyy*5NvF*|<3Y;nl56 z4SK0P*(2s4p|lx4&7jU*jY*i7WLh+;kmg^Mj}sCT7PHOKAUB_qB8~3QS*!*&}})Y(cz3g zrcjFIKc-uEg6UeZLXH$_pJ759n*6N5oNtC|^@2_OMTT>Q%h$N=`(7yT@$a~B*Q8Kd zccfYr%2$d5K5~O|7KPFhzeyhi)?Akk_eO-;Qryk(Z3B+QZ29#?-T0euqRq^izA#*A z$+2%gto&Eh;euIUWu|WQgUvl>hFkKyVu$P@>}|+MQ*ugF*P>nh(UJu>4QVRe!+SK6 zx;B+0VitbxBa+eqSjQfX(r9Z@>Hsv`q*xhwF#uEVwze`dU?3t$ZZ9L}2co}h>?k8q zgRmqJevy%FgJ5IPRYv}~Syqoi2O~!pdTDS?@=GbiC)JYBgF{lKB9|T}^`YV+SnnW% z_%gr{_-i_lkpL=4FEpkhLr@a^hA=Wju)tXmvvnVea(p&g6iSDobQTXq;tO$O16qI} z!FxKl95zhdRER0$!uesa`iR3I7RKG3g|#SQOJQw_8jdLDlxeULg%86rWan_CB?R|b znRUTIB;Q~J4E5G=((gFDj%H*mE@?2ElOs?TuW?es1n(piRn(tM@THO@X!agu#nFf^ zj6@;)Oj3I*9@*eVVQ_&fLk;+yjDnFE61&=Jd1u9P53SUIOj{R8GeqVnnCkh+mDR@A zZ_Hw^uiT>lXtl2}(T|Eos|N};K~ynLEqw!`%NS%g53dn0^1OSI)c!9sT&n}e8yDfz zJ>s7#NEi$JS;DWv7f4&B!gnz>|z(>OvfgOYL*XFdVXmlRu9ZNeiyl zb_y z(}u++>@Qbf$;^0LD~T`hFE*eu8!T0HCxYJw*O{=u3*R6wHl{ukv7+eer9}pGa3bdG zTHPh&I7uC;7*HvhPR3_J$|tE~6!ASI1EBtjgT1wq6*WpNmIl%5lM&;`k#c39ImOa= z)OQMw)K<{DiRutsf>pOu=+BoMCT}j5UXUK0f>5$|%ayOL7E7b#Yo@&Tr=*O2SgcPm zsaV#%Jf=mst;W7cd@mKIJ&#NL;8bijJ5I&&bI1uT8micRODkbRH4SUvHgB|H*^nX) zoo;UpDxQu_`=Lk0=9H0!o`>(eiR2X%hC6bh7iM*`A0?C_abQ#3#qmel&RX(oZyQ*T`>CZ&!e(siGENc9OGdDSL{BJ&9lFULORJ`XTBMUpSyI;8Q zAPdW6FPjCdtu~-i|*ZpS2P z(*yWvTY%Bv$!!Tme_c=;cVvN{e~^%IA+~0bKO`xm5JS^yUFuYVo>WnY5$u2k7Y_Zo zz?ixgp}G&a%E;~_OiEX9c*i_A#V>T`OYSc53oF~Y6PAw=_~eshU_<5c3k`8xUM774 znnC{DAfv;=2JAZ`ctd7B@PKhLfB2XVzK_XpAilMv2@W?~?dgsgZj#wAK=WTA z*Nt3&`C{_P?&YPncSDqrUMWH5tZ{x=5pEktZHXEG8+ zbxKe+9W$9QRq)H_X8G$DN{4dKu4=N(Lb{0K$`Y)8{YYJ#CYGwbg?f86#E`C+q7qDY zl#u`GS`G19T$u@l5EjkkL=9Bl+!SXNoDER(aaNM|9vQ6lOZlbJA17%u*X5pJFM3ei(&nHm>cGZvN^lbae@`6`hy zYP6gqGnqP3sK{Zz^~rHD#;eD3C~>hmDB|?ovKq|4E;*$fJvk)wU*fx^}wG?}ZwwyfWzi4 Date: Thu, 9 May 2024 11:37:47 +0530 Subject: [PATCH 26/26] Update InsightVMCloudAPISentinelConn.zip --- .../InsightVMCloudAPISentinelConn.zip | Bin 10620623 -> 10628853 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/Rapid7InsightVM/Data Connectors/InsightVMCloudAPISentinelConn.zip b/Solutions/Rapid7InsightVM/Data Connectors/InsightVMCloudAPISentinelConn.zip index 4406e65b14feb6732fe5ac514a8c53f2c24f7ff7..fb76209c5da32b912c76b77c13a50b9e53b317bd 100644 GIT binary patch delta 42767 zcmZUb2V9Nc8^G(m?Y;N7Y45$XB}&pFAt@A*mXS1W+ianZQup2vGRnxTR5mGPQ_0?n ztgQM!?>*P;_WS#M9@q1Io-^OG&-=PrwSoUz-v<87T;5zFmy*ku%bzQdE0`;kE1WBm zE1D~oE1oNnE14^mE1fHoE1N5qE1#>7tC*{ltDLKntD39UpuUM$fQKh3xHc4(Tv2o5 zwL#ri)Fz0p1hC0m(s~6i56>LLTfD^xF%PJTP#n!{5bq2Ng;Rc4)slH7NVkzip z@bD;Uprhwg4afYt^-E-F&2#=H^_-R-U0}UVaB_KN&7BD=^xyWqJ+!BATbT3fN|&;p zReCEuJ#`Fr=?M$)m>$2s^R4Gs;omxa{O%>cjzqmKy1uAj@`sT%NBc8fE&a3)y!{kE z-N7b?Gp^SvZn_~Db78xGX^YhFjYDA< z+_s6%-wu>FVW&P42-FK z?!Se%OxevOX~_$#4=-ZNpXuB;DGHrjcwOk2*<$avFFX#I$u=^lZascYI5$J9t*?al zRE&l6QF`#TWw)Y6tTXpiytcNg-5#xMMW@{AKedgPzU%43JwHE5NoY)~cGvtfRQ|eT zM}4f|7JCXM>T0q`WbmY3l~SXs4Sy^fhTmS=t=y!kadYVT^EuytoXc7=s=8L9EXB;L z%`@!0(l*EAg~NXyj;>8fdHgZ#NWCtaE^c~xLz9N;=B7nP+nZWC#DR(o!3WXTq(7C8UA_Bj9{rFgCA1`-^8DKi7hw_czeKiA?>_%_b7 z!&+||&$^eH->>@bvCtEVi~XXre$RTdcjZPaFKB13r5)5&m!{3KP$-`K0jrkR(0uu+~UCV!zR2re}6_LE@#|G*|Y6C zrQ%(*MD{(SfTOg&>b~^8It~8qw6tgbF*b_|G%Btu-0qX_NC=si=8c!xf>& z-M8O%o<8tkYU+shy;(<^PGnU-lD~FRy|3s&P?J{Lp<5w2r?<;bGd!R|`x95Q>A;g{ z1EUXo$2_Wn4=B$({^i}DT=)KSmlqB!Yo9ND-5^)W`b&^#W0cFC+qCBamupLo%xOFE zcE$YTqEb`MBI&K=A0B+CFT(oO@xt6NsriRLngdu$yoz}Eh5B)}O zG$?PVe(c?`>%>5=&6O#U#nIuzFM^~JBm)zg?x6)A)RZJlo|`dm=GazT$oO(mqZj3U zP;(aVSAF>HU~$5)!5<$Sm!r-PYKpq;Gal@E@N>lxGZo3hi>JS-OzQje{6SBP@4I=@ zvkb)Nv~2ml;O|K!@=?uDd1LF*c}9D$)D*6F3!S@L*)ffHsd23!zg`$k|EQ+Iw}Age z0a^zCqJ<9hjJ$Zh>`5-aVbPq>JVR?FNWH#vqGj#<&XV0~0zR9xO%3G-vM1$PELc$y z=O;UfeoyFnK}nX^r%l&olrG$%RQOJ~+FH@#Q_Z)`{rays$()cGFD%d`i!<_)n-=ci zb1usB6AOEs72$Z@D?Dn~%;t~{)l0HYt-tHdBmHw*7HzqZPR_E5-P0cDZNBYlRq%Pm zk-Ar5eTUzKWf@G)p0;H3OX66~R=-VWhD5H37-Wd;((?6gg2v_7Z>4(8NGZI} z=*gX7yy5w?@=toy{g9 z)|uI-sAGNfrDwz(n&g`MFP|OMii(_&*(6c?QLJT=&PccSQW3*YEujQkp&MG}LPuWk zx6N>Rz$3URlIQG?r?iMuB8#HWI56rOriJwf1*i$NPj*?*P(I*D`yr;?oULsR( z$lNgh;N6S@xtrJI<>G{0H0MrKaB^_;?!3X1_(rAg-qwB6S{6d9tE{ia`_kXl-1}|t z!0?#h)pNP)%wA2OltmBe&z&2(Mrc&vM9rI z@x&RK8XE<#xy98=Z4B`{G}+~=-gwR_Z#;e3tn9VPeCv^|vdc7O>>Zy6e*Jl2#+kqi zk<3g5$xLd9TRf%Jv*^^Y|D{!PwXQ6AW4Y#q&g`zr$Z+SJS6NeE#x3doCTAw}qt{^J zq3ob^za`cRcSRm*B-5=#qIq*lUdKIkpHU zcjcP0hsGBpHBd%sTH$L%b|Im-SrJHviG$wLtHZ0oq zRd=n2O8i~7tyzs?r<`{GIUicRv^P_^!S{W*^{-qzx9Ue7Ugc9-X&te8!QOB4TNcDG zbY(1JoL*!6raDWQPvT2dl~Zr7Rb)iTrpXPHN*mSFUWk48y3_sZ1!Y;mGd0xu6AiRk zA_8hZR{ErG%$~xu-@flvn82;2>8tbHcns_EVtz^*C>y*rZNH$iJL!z!lj}aQNtB{& zwZR7-$`(#n7bV{C{NuRq(TVS;-2OJ)C_mHh;L#m-rFVtr*6E5{H*~C7rOV?HT=8Z3 zxj9j)mgk&ehP~gMnl+*s;7j3?7uX* zJoi~mk+v=KhkAGXgm+6c6q!WZ)+H261oi23)Qes}$R-GQDp@oEy6t`#}! zzg~6Q=JXO`T<2LT z=N+FCcCtX%NIYHdRlvadD>F9QzoCty---i)50Z{u{!4pvdB8_wi<-gI??DH6!WUkZ zyFDlAXjjT*p0uq2A2-cjS$Ij_uUb_tccin-p(;A2Dr2_e#-&9zr_`S~O)S`zlu`C% zXMl=|T8Q0C^+^+L)HfcJ?9HdP(z@rqJgHyW7d!GXcVR+B=h2%*yZPD;S5Fz*@`@-l z>z&Rcdn&R%cUcDQ!s1#5ztkd~xh>XqPx{a3-AufqfBcT#pykd>rc%DHwsIdu_%8BS z{K;xm`qek>+f>T>6*9Zu2oO(Of*TL4+4M$zic_ApB*=&;=jr{8XFGN=4To)4esX^8x?TO)_j;#}JnMKibU>Cu@s!?xG> z+ggd&6z|AWJPj7|S^JxA{k~Y781nGRoA?I?rWAeQz9*7PWg8DJ+4jxSWbe-AD*M{Z z)hm;Ohns{2)?tF|<3uzj)twe|$4%#jBps4^hQMPrF9m9jwZ( zt+ci4u?gf27dU*uaWwhEFpXFANZ@gAIYlrA@$u%y*)if_jzej(0 zU9`7L>g8*G<&B6xC?jET^U#%O{rQBfh{l{#1yf~bJq#L_T_@Cha_GyE-{Q3CS=#p$ zHjU&93d~OSdDS?s0$4fS6`0ZWtJ1gPX z)4Zb73a=-q9<)x=Owwy84$^x1j?$fY%j%=rlBX_#_tm?9y?fJ`XnxAK5c z`ycaX^U~b+a&}&s!GTRz?z;{7)|$I5e|^8xzWMuW-E;DH=0E=x^E2xA>R@$& z$gfdY*BBi@d(JxX-s?Pw6Op1 zl6WiMOK%k0Y5p&MOLomn{}KH+{@PdH?%|}|CLfcxpHwZs>2=#*x^?${+^IibP21`f zJF1rrjpj7J``e$oQteY}z|P?p7ppuabuE5co;^xzw4Sx|$2A2_O7i`pB+6#_E6iDj-l>)Uagk+;Bqa)~&>N z-a@nZp}H8&`{70VmTk^A`k=Y&X6_}etwPZ}NhuS>9#NO*r#z#HUh9uAnBGcjHTS$G zEBJ+1FV@3pQvF2zT~fW@Z*Ol9-o9Y3=%MY8g=98*R{%8*H-WR^Zm!HhS7DYCi~Z1Uh4QtNm19n zl_$MvuKlI6CuM4xXlx zZ|Mb1a=`0_Ssjk}n^DjSYR!)qLqpB?c? zc#(5mQ{eay$E`9O4QtYruCCI1Ufg>1uw`V&1y9>c$~`^Zt6~=gCQ2t!o=Saw)?8p# z|2bxVb1!>fAHW zWi4De@&0Ko?=uORr#CNkYCJr(cPCFIB`#;H!=&`+!^;On+xINneC9Kbi_&y>Hm=FOQilQ+BMepB*%xYcBJ3XjX|20;zI z!(}T^zEHRy$`||n#Wk#RdblU{N-Ue0a{E{%-#g`g|V02+V=Mvov;3}HAMIJ zoJa0b#3JL~_-zlayJsg&Ta*0y(aG0Qf6yu2s27_u%$;11N}k-QpHn@#Zol7Gft-5} zzu4|=Ui!Gplj>>dk#@l#vv8Z?&aT~Oz2;}Qn!Th$55kCG#;>yA?I#{H(wbr6-Dcf$XQq4sol`3jrB zX;|u9c z{$=ig4uwSfhwhC{{?%U#&cE7%j0^5)btBWn&$2>u%75IqX&maOsT}K0;X5&PR!pEx z@#5khp2YfzjkWAq3o$#XkH$+cGBzgvNuvQ4Snh2e++hM>2I^M$gMY->+hCP zSm-a4bVjVqW2fT4LTOW{>9bGTSUN?Vyz{KN!FzDm^OHj2vN!H8|6a7{7tQymx0-SD z)Wy6i4`TJhnChvjZOb(G3v@rB&vW_eVd5#T*nNp9cg9F|(DTpcvPC0acDGlx_e*|o ztrxmbmb#X(3R^DrtlC05pif|=vf-{kPRXoAe=0xCuAB1l%g4Gsaly5dZqu_45iR1{ z`g1?VY<|b%G<)i*nApR&Woo5_57QpUx{S7D3Q~Q(3vcBgPH!)53N5*EC2rHjtZQY? z5o&zd0`vWvb(GIm@4wq~cn!t;k$Oqr?=oVOsr!jjJ7>+jqIE#|P|rjyu{GBe9M5(L z8)s7&+{w8o|ND&N+BWyjAL7r_s)p7(^YQJy=F~Eq%By|H{r%G|%_5RNd93vY;;A&T z1xtp0G@svWC*yp)Vd{~9{U<+4`zAT^yPBM2u2QqSSa3zn=K6Dk!Td{mADpc_XR02q zc5I`pOTFXj{I2x}x|Z6`>3-~5v9;CP@4~#@qiW0St_ZeR& z=dJtTzPU#>tuabegm>`p*`*>Se7{P5S$2!-Tog?&p8QB@mIwdfv8L-AZ``r$J(l}w z!bU5)-u)q3XqKu>uItfzJBw#oovG+MeM7b(H}+|t=fF$DP4C|5dAas)ITP($H*hM| zJ9&GJ@lrAIrFIh z#n&=Xr6q|Iwq5sJYkc$Jz3iG@x2j&sE}8ByZEei0EnO*sCN#TQi{KDkBRTeGx0I_atIhO;VJf1fn<)XjfqHzQ5YRnfwHLZp3dvgWUQ zLrjG`Pp??!R4kjFA0T(5uxaNr$Dx}+Mlbxmn0vbRT(p#xI3@2-Kv`+Alj>2>is6P+~!%F z-pdN7;G;k8o!534k^Wsx)8BBC$#d`VJUb!FI^ME{d(g~70b(g}9`C)Uy%0P$dEL}h zUrB=#GbCHeCLLUSbK0U3N>HB7@hvl&Pl=7V);uEDx5xL5qlUx>8h6-{N-d|6GJ<&@>q-5Ci^ z(L6}nM|aGLSKWp8-gLl7enV-OP%QxG!{ za}WyPS7K22AM1w2=Sqc&ZvJ7N7NG!+-kT{TdkOYuKkR*_mAge%DgRB8b23ZS|0+l*$Gk!QgzCom!9ti?$A2lY*(o6v3_$ky`Iy*Q;kVB^Ey zpA{RzlBTJ(eY?NScvVD1+RdAczagJiWj}u_=DMc(JKx&F<#z%WU2(m%%Qbj}*?YOQ zQ&B06Y8aBRhOgebQSRwS`@o2c8x-F?P0zoOo%PyDU~i`L9%r*gb0y<^i_sV9O@ESC zT~wZUD33YiSH=G40zYcpW*P-~XSq7Qy7uUB#+}B!qd|xI-ZY2z|2=PbYVgi2clq_@ zb6ek3J@&TjtJtqmZuC3iaJS^6-apG_moNGnzA66H6<@lq>%Z%`CpmN#WVMNIgxuHD zh2c!bV?Uirf$oG>tf#9IZ+H>!X1c*YBY7!@{CRhYQODoO@$h&;HzNP=@=)RLGn8?` zv});^tPo@8Ks-Diq&xh$81HfP1%rx|HbKxW8e~vQbdy(I7{x(N5XDq3@{qDi z1|8&6mlVU|8K@Hhya};qz z6VOn_j^&~nxO&J(!NXH(!0{48eWDu5*h_o|L>FSgWm~X=?n(67a*;9nAkE%5_|MG6{6UGmt8*G$o348wuMCR7aYor0Xe?^4J(BV zx-C)u9V>$j$l7bR;>QHHn4j2kms=RzsO6!YFG$-4G>I(;bOlqNHMk zR6lEop~8hwjL+3jjDB$r7DtaLyQI+BFXQreQVKg1?}pN74$-x7`|8{UfxBh7Y^)aG z?!=HrzPstl#5FmNEr4i~=O~cM4!Rz4+XLZ`D{$el7Et?3Lki8^O&1|*6uBJ!J$w;l zRzs%}RZ7^lu7>VF*ehe@F{yO374g3sqR4MA)I^jDHt*gG9jk$@d?L-_`@rn2ip`7m zLFi{J#Ti+Qg82n$7S>Aa)H9tw`tLV!*?Hr7^W4R%tX;`?oaulu2dR zU*j2Y%kal>N}Z+q5{X zd=EV*u|E>O0+`h`ufC;9iIaUD|G6ljg*^PJ4(QWXssf6?NOz^&5E(-v=+qCYMA;>} zDP^JDf3PB2<_~Rc?g%?VyzUH9<#rpsM7N|2YICEw%XE86lOY>DxlEr#5jN*`2$#`P zK%5=+=~z9{)iCDDEooOH;?V3>vr!p@YK55Ofz0En&3$8r_ID z8cAQLd!eT3TB2yS9dx1xFrev0Em|nB8~E1>d5^Z@1)oc2VR4mXFb8SKN{UMA~4~IEK1~;&>zHxcq z`isk9tfeXTKmkmIQ1x@V9Xev7Erv4R|7(RiNt>1Gc$;8ZFFbxh4K6Cx2Tx!HuQt1V zE>+a#9t0QLjCTzrEZjJR)dJm#jgz>D(_>itFZJON1NM!)4zcB)AjuM<@&frg5lwyp(C8MaSfJPw+EVDF zBQ$_3FCb%a4=_H`s4a>#UP5Elc#BEI4Q*LeKoX;Om?XTS%i|}j^9q8Nzvtk2#N=U) zB8Mt^wApi|^3!ooLVkqHOXCf6WyWi0S&Jzs>l@t|WeVzuqXkbPu>KpU#(p6#%zOi- zcar8J@^7Kljl!yz6V&H7w4TDZkmY`LE^NrFBSZFU5hU>r7Q;`pIW}2jA*dsYGy`D{ zUH=Zs8*m8h^U0kd-vp;BaF253HjM8`uTI!>VpK zc7VF2q9JLdZUSK-sC#=}ty~B!2 zr;ZXUpu{h5Ngcwp^DaB!nWy8DJ28UogTG*;QxQT({y^ICzo97l@>u!w8!Yh#SV{N; zmNS;5l1qqtV;EtqE5}N4=UH&6?qqXnq`n-QMPb-d+Q*?xD?Kq}X3WsW4_%lKB70WJ z9f;+T%Exf0tgHP$F3ZoDM3KGrfBY~%V=AHJk4gj>A&4%kq0GwaY5|4{5xa_{7+glb%-#Wh`}zb_%`T^lSe7+{+uWZiA?)|ZTCeP_Cyl}l}IscQG_(K zthr(gOX8R<7m-jl5JZo~AOpdXT)2L+0X!pdz*gB@xG)O59|GnrL&Z`IJJh$)K$vSd z36_B5O%C7?dn6z+w|cCINiuAS(qmZZEj3`ZHY4KFNlZRUGVF-wjaZor`6V7-AeCq$ zqfaqkuJJiDNyqZ-3@p#_;WiTjW7|MI9k0rGNv<^Q=s zMyF7S6mA|7hBGRKg0vw}V;Z;dtTtqMUFH~)MgckuYl>d>7_!0-R8kj0zsg~A_a#Pd zn4c&4NY$9X8iIDmk8bdrD5D5HsGu#kxs5QP`cgEXb0b!h+G)iwL|yvOAAE&TqA|l8 zK@Ccw6CaEeQJ*zD_vHp)vryr(^&2ppi3_e=WWEhU7gZR7<8j!faUzj0g2AsRk|cqM zZp5%AWTQzXjCDd%wg$2rV$4t`)R&X=FmZk@wpxT4vwOq~n(@C?4cX|PRB{{ykftfb z-h7cH0Z4Pdu`0S|3d4eBCnjEIkY3Llthn4T7DxBZz`TPWS=usOQSm!tMKt=xSQwug zPkuKpA$LKJmjkYESqmuLZy^qzfQl>_e#EQ^Tx9G4u-2KemJsCTEbQR!ZK924{D4EG zK}#5FJ}u^851hb7EAUR)$cat?^~aj9pTRt9ukLsmZ(wta3R7`3b%&`OHj21_@!`oa zBYP00lRWgn7?(q`t_(Md$IG$!#ZZka!-t|hz>V^|P1#vj?j2Wh`JdcwkKGsnM1&yf zp3Lw167V!48NHgvhaXLb05CwB(a&2nKYUc16xdfO?EhZ zRL|>-9p+h@i6XN}3{!${28X~58witQ>m&x1I1b0BWK1Fx&7eq$uvlH{JT9iibFf3B zvza(L^#UB)JfRJi!?`LM?vuZnFfyJDd2-Go$rMyI8RqkjY*JZAFe}MlKQu}MH`alV z(Z+Gn>%l1}8Bh8~Gg)+K3Jh3{#p4`K9mWn4C1!G@18kd5V4^-1I^xJVtn8o4upuID zVdc~bGbx$Y)`J%3C(Oh%69A+l565ZTZNlDML6&#M(sW-7T8^MT@h_()=xGC#P& zt?+@7XzJiUAdNTXa(CDCoYT-ARNAA%upUF*!-k%!4j<`Rj@1 z`ZFdHhAlW~`Y!Xa_9TG*_(QrC&#-OalDPyv3|t!k*yBCM_X40o!#-o>$Q>xtzxF7A z9N&-6pb!e2#V|s}{N_riD-ag@?n)$qmEuhJyy!o7Un_$kl>^)kT|uz)%~ItG^6x5) z4}}FYRCqrlj}Ta;uwv^MWh$VXK#Be!t`MEIg6n| zq_XfDB55`@L&{df&;qRdyMGfy1?29&HiRKTY+H(LBOy>ff7!}d>P54mzb3|@qq7;S z2?ZMC^Yv)4d_F@z2y;rS{ME5hrq=MLia3j&FK_2s9lk}wq zwasJ9C%)|^3!{skgu_zXFAO#k>-TYyqa;b#&qeAtTWGU(Z{G7E$Bf$XCJDrt&u}Ab z4vxoSh*oHUw{_0p5X`@hV;4q6B^K~kIP~%h&r!(&c+9WE;Ss!lO)4J9wcUz+aXPEr zN{;Idi&<|-ha^J!J$5vyrOTnY5%5TTK4Efb0~{ZAkfdn{6Ulp4tcz1IG&K^i8SH1s zG@4#8}4X#W@7J;w9EKCv{tYvV& z%^-1n5yoAMpdUPHClz}Xu$bXVtiOwuuG7}+o2Bc`*4*>R|Gvi>nquglwZ)BuG z^Ot*o9ReC{C6Gcqv^4d8Ok(39o79(B>5PX|hv67~4ZJ5~LDuFei2CJRBq9;I&zrTFP{ZtW(aTJR8X8H2o>~AW;ABF8<+;Wr z*4qK!!tA)m|Igg6|6Z9gBE-|VVi+4R-Bv<=6=+X&l|^ z?r{!@1K1&Kohf_YgVsX!fAb;fEa;&Nk{RM?B$BCvR8s(V%W>h<6oxw?uYgJTPk3kT zcM7y3J|i|+2YaL)wj4zSJzfXHN692i7N$Z=nKA<_MV9t5__-&O=MaAM*xgmAKiXM{cv=>9vgYcJ2E@Z>?8tKEvJ98ncao4%XuLf|G%7dYA1V&+w zBMY+{>zO>rO>oD5ZR7zZZb8oZ;Bc~=%VASKJlOolT;zJ2J$pCdxE{P8yyMuE@jF|4 zNbLNPgW*1}3o85fdMLrfuNY^J*vq1b4N!u8-?&KE2H5=i{uochQPf5lkbOjuM*%$G z-iE>t3wNhoI_Qx(N-f&}*}V^TQ+l`!_|)nC#EuPm{=!KRBcH$y)58DcW98HPX+ zOH!GRqBhZ$(UvU`z`=?nA&4pOpol(Yz}i!<09Lkz)+F9WY<9wClS1ew4dqx-OLt&z zmfjUY6wG}XhZR9zd3qQtJ|zz9DNVH)eE5%GTu=;C#Li}{P)ne&N;lBw62@#4#~05Y zEAEy+0I7Zwmk~Oz$=^^^c-=t;F&nC-5#Kh*pVJ@?wPqVkzV@(&B+J0KbO%uhA!M+lXhT*vE7S6e-n$RHmU5JK*_M+F`}296IQU6s#O06`owSr2^deH(;f{ z0_NS2O<1ws2|WaD#Y){y7;8)`uwqmRmfNu6BhxY8=qQ5fE8$@$9Khs8fuj&ItpXxj zk4gMiM+wwi0V8``6_lwSo(CCJbh{%g!RX*v(SXTbI^<^8X{?OwbcEe21I&s|nCxLd zE*5oSh0280+=g3Np)+C7$-9pg^=gP^K@V0cNM%bOsZ2zfyI>^DTgX&KM!O&*>mGCP zEF!y~qX;9F-EcCo;?F$Py&E>QmAlDJZ6WH~4NKgNBJ$T8?brkGSTR<_R>cV+wHnB) z*H%o5Yrt%=om3{FBYANmNNO+SQLhve>ONQ+vR)54zZY`iTE@Y1h_GFpP)2yb@GXhs zp17yhaU6tE_}WEN%cDn}7VaLNsrW(VPnd~yc|iy`+za0=br%|&h= zf-}~V+gxPHVK`IidCWz|x{7KYi2ix24TsD_d zSUl7|j^jT3uKA4}(C^1_63G1s)YGKDY;@!ZC;+N3uwlqRdc(?`oNjAaY zGp!ga+nb<2@2SL!d^5PMrDJ6Wsmx?zMfDtXoTa<5!Z-*0Ie9OsOh%(^(4VO-U>4lZ zA#!+L>S}?VSbr@S_9=*GkHyPdp{)K5T(ql-|B_U|z%=!_Rcj^x-V+8xi`$pr_n z!+gMKoi6McEH6Q3Vg@m8xfL&rDlS1xBHu8HcmOfYYJf93k)Cle2@JCw%C5kYX#HiV ztk*yPfk2}E&%b|5p?z0iQFDn8wROO=v$)EbPK1bJMe27vyv{W6uW^093OPBW$g%0* zVQTX=z?alGSQ7od2HSS|30$Q3I<(zzeM}VFVQ(j7f|Ui52_i_Zom~IRByiWn4|D7= zLpA{prEfryFTv}_WF8A|!1B}(UOFa~OpOFFq}T!G=dPGcoRA=nW31_boFz;m@mfON zhy0z4Xr0g&W#I*5Qu)~ltE7hkSfSb_z&p@33Bu%Um=SS3h=VP0NnN`jKF3)ctb$n0 zrH90{P%b>^l)zpVtm`Iii@0r564;$pIe=YYyjGQ8!R3_~kihPt4YweMM}^pCkpvMN z-iF+LDQ0`$fh)O#x1m#-Ar5gT%Bnb#NuY*1(Brg^qw0Hb?P7Nq+JaL9sm#UOtPgh~ zg^Tc76G<$}6WHBlFLPY>b~Td@h!8nX{?0%f?n4V-a0M$Z2NDF4)C0)ZGcJSSmDOMOC(k*$cQODgUR9JcHVVkBcPn$5GucV787`1J_;rIw(^h zNfgzMCbB*YlR|bc!5FH}HYU7+<6hQk={U)IHMn`~x|QrMX8sC{P7}tAArv3&vH01G zsr{l!-1ky@48}a<(I?R)_6wi2uOYJSlempfbd%T}R{ISYX$9QI_Jn`ND$=;BklWar z_|G_P4Lfywa5`n%n41V%_!chi1WLKl<+ltQN(UDbM&c<+!l>*697u^}BuTPf*v63w z?qrAT%1e?#0U6*1=P5>%R+z+DmHg=)V?L#P*O-?TZrvx}LykYZ7~^Wl?P?PHt#GFg zV08XDW|T$+A0VHymhb@>`RE`uc-32Or5Ku11Jl%c?Unx;138@KxU=2h2@9k79~l!V z&a=5u+QgMY=;lYr=hkg(P90!)P#$d`(fM)O@4vVAiA%+<$9%S$#(a$h~ zE`o0$I3(#a%t%HWm^}ClgPr(%toXUF5=J#cFues2K|FI;U|cl>KF?T61QDBvs=vVI zJN662+YHBZUl_SWLN591iI#nZnbQH@VEqEeO3%N-RJ~gZef|Zf?5vtSvIOD}{{~aq z1U(X4;Ehh-H%Kg*MJA%wL%Hnto#%cB9HLJ;PDDq(Gkgf9306KxCbJi!^L~I&y#>Z` z3dw@#^bZ()Cs=a`dzU?L7##C$Iam;xO&4IFmOUhGZcf-{{u9DyxniY5D_I47+5s0{ zVMfW^UwqDhFxtZ%42$d^g$IeoY@9PO zVN&3T6YgWph`Jmu@|Yyg^0~+)3J~Wl95RvkP=FPaM2J+G4VNdOvAbQ6TL`NLQQ**Kmqhk#t!nhHm~!VGjpq#KCb;8QVt1 znbU|;O^zY~Z+Wi!w-l5B$0jWad`s7)4%86^Y7 zTxp1vda+b7#P<%CD9>admN&4~AbkvEnT|w|DOL)lQbo{D23-Qx$bt`(g(G+!khCIG zA0-@0RpoqOsli*$p)v^WT7^)T9MgnQ=^&#rM32v>N+P&0R6;Z4Au69*$v^X62vVF_wF2diQF0FuMK*u294oGFsWD~KXs-Jae6+f zSfJzTFjmZq#7foVG(n`H0V6|dEGEtVK(1=TqNPLwa?!pT<30`Oy`yO;i^{Y`Q#C;` z%_0>yt`qNPnh+p1hs54!3KiPZk4>bKM}%%8f4xxsnl#o#DvkCRq;b!0yAO~Ku;ncH zR|msd5SjWBj6)|dU5FE>u+l>+2U|$R8hzT825T&BD8Q5}93qU`w4wNQH#tNAnd(3t ztbWEJ{HWzp8mvCZ8`1Ks3 z-yYzY!EF;afUfN%L3*2@Wd_i-PfKG(l9JAPr(D0x5CYAIuhd8vpyDXLj?Rw`fB#pz zG}1v;b-aTS8X>g`*h(t}@|ZF*No8@hE94vBb8Ua_Q_BebS5pe|6>x(q+t? zOkADBMP`^V-H1EWxQK>Xx*DRMf%VUW+;r~tal4w!OFb{0eVx9_6jDh!&Siu9Lp?M= z;$;mawnB9%T^PMrgDxY;NayY{aI^&uQN&O9KFtiey+cj96n=M1*Brvv-9R4Z%xHpg z8%KZFoM}(+JjRM^Te<}Dwty$T?*;O(gwWL%(5)grl8QYNvxE-f0v8*W%xq%4Bucag z4`x@o2>0*eJA=ClCcAT7h0tbgco~9W17&jd8pCC_uu3@SHx3A(m9|VoH14@&w=Ty4K6NBN%Mx&baPTnx#i@p3TwvZ1^W_jJ^x6eRC0;m7 zW2Y;HX4ulikeDruN~>HUye6ESaobo`uZlj9wo8#*HcvNr0CU!0QbQ`+Qb@%G4?|Y& z5a1`9{F|j^(ESDMLg3x-%4jS(PORQrIRPDiBMQFk|{$zYG{>Y=4Nf2Kz z6Io7yDMcffCW2ZfLCe{*i;J+9lC>MgrBGADawwb3WPb|W;0Y1A?Ego-iJu4m{aXyB z@iDaULh9gTaBDm~W)d!eheY*)G&da|qZ_{&`uV@OmXw)3@E2bneT-lLYGU1;;ykxiEE87Q4}_ z?#|+F-HNSTUi9fqccSnjCK7(kKw{`RsYDWSy%;8}&K5*J{h$$gJmw-B+OpVh6z`Y; zNz1=Uc%q(1_hW`$BVcR9*zN!w<^F%bK(Zh__nL4t>7BagYvspwn~rveXOt|1Z<1oI-1NXOwtSW!)2 zQqj%=b_Q{~MQ~3|M)Iiuo}0uRsKnZnn8fttNhAFv7>;($ff%ozBC!t=oXd0|eqSJ! zG-6f<_N_aTEsYfCLFnsn2R)bRin8WGU%GgYtZNsPlg3m>l3@_b$v#Y$hQX>??mJdq zhB56Zx{5hSYhkuCnmeCqMQKvaK}Toi+Mo;bnYNVK8f?uxoasl=&}M1QXoWxyyW!jm zXR1&#b=cf|0eD@}V{11BbHvC7ql-Q)0IyLeZq8~utTB6C1Q@>ta~q)b7)Pjlt&xc$YKdoh3AZLzl}oD3mLMZ68S6X=~EvgIa^&#f4?dU?&CtA3!W~Chn}Q)0zC}gi0=) zWG!ck5J&7u=U@a~a|*G>9V@JEXc`M~srdY_t*Z{GDtX&-t~3>$?~VrGQ8&SlG(i zjf#qmtte88N`t^)fcIQu6%$)m1zighbPd+RM#RKcrUwz4tQZn36J?6z&ejm0R2lm}br*=En?mXJOuA zOrTUJ2^Eo?^kq2y+=V{T1Tuqg8_^_z6$Gi53W2zanT6x2L`}k9$6hO81QrF%Ms?TE z#x={{?Hnu>?DjFgIqF4%&QY%3ff>!k!G;&J0A4I?J05FF`$uW!BBEh=M5`BKvRLIK zPxpC{^}DE$AxG8N;dwYNt&0`3l&zro(02c%prt3E#q)7tZ&jh7!>UKg7o=GWU~<%g ziIKP(OWd`r8LPh#jc}x%g0cCzOn&D6Z6UP%nrmhC*qBAU+juLO7mJXw8$A__qy6%l zto#7Z=+VKjpW>&Gy$Qx>UOZ00%v_B0ubHf1J}g%E7p~1A#@jm5l#f)d!jP2;=Iat< zWQAJ6%nwmJ>3m~tmf<8L85M^h{hhP5DuygS6y0#xQbf>u?|Pa>ES59*%=vZT`rw~ zvAQKOv~eBUxv+~ zItyX}0o;b*`SI6q`5@}N9JR21M6%E`Xd`Kay~gR5&)BRe*n397sq1qN)(90?+ZLrB z$|?`Eq!rLLeoM6ON?be}W2cWOb#M0T(7?jJmC%`0&I(ql!-bA2)+ScniKVSV1CGMt zwpcZm(nX_?SVInmEBgM8Xc%rYCR*zDLu1g$kIaaXdVI}T=#a2>C1K)q4K5)I4@RlC&s^Fls zk1iJi=8{(BliH`l|E2J70Vz~YmA;XJa>F7xJwwP%Vq;U)^Z2!kRN8;Gh-{q(-IvKc zEIjsQI9uA!NBq(}=p-)NiB%i2tTw#^HDjPVXK3jm!h75+Xmz}kqUxumBWX8xYuQ?C zQo7n#us9?$YcMkUuZ@ylY?-Zr!v?psvf+Z}y%yAAFV-Ntb?}@i15M@cxWa@@DE&3& z#jJ&?bsw!ven+Rj4m74VN+v~aE96JHMx9qEPbPZ)T0894xK8b@qswwLFvj#rapExsC=!Mq<8rZ~^tT1IaZlMqK`Ysnq zt?65b6pm%W&oVs8;M$EgptzA3COOFHz0!~+Zh+JHS)6g9845;f)Trld&UB>739+1+ zjG>e>M+dKzlW8b|&Q2maK*ZgH10xU?{7dJEW~DL@2XeTAH`CwvOJTVNS01)?SFw{9 zR@k$A4X*Cg4P_J*ys|3$eWTh@HP=H)9ondNRwa2WDVt5udO2B1Irdql&tf;JTd9h# zDS5kt;HB4-!e*4c@TM&6vl&;a1@~mMe>2i{p(oSH!s-8Qo9Nnf=jUP{tvqDf^inFM zsB5!7+x$!6P+zTrHEqb6=kzayGySy+wHa>AYq8JmwF)-4`79fxPnzK8-wdL}g z-dmHo!aQN^O#bW3atHH-P|!fT0DJJ1i$;2wvAk{zg2LMnkiJ5kIc%)jN5tetq+WT)o9mYME? z#1gZhcd17SOL28{SnbaK;iU1O1blbn5o($Y_U=Xz6ONIj$sVY+I6)wB5AONj%b{Ndn$`0b*sagM&7wND{J{XK^3AoRS&SEz!m-i8G;p zk~k5X7vI#2pU;k zB(^+*^fT7#?H20Qz4 z5OWo|ZI0I;SJWOX*CIxjeY=WU&9T=qrfg=ux|NO&%f1QyzLqft>^=y=36J8rQCLkF z^(+9h-HDj&0yKoND*>x(sOdEsSl5riHQzPp2D*`0=Q?zox)Ydj9XTk&W)LZu0>ChQG~th|j^PztP{ayA!BrjX>OQ!1+eJcj02q4LA?#MZo+f zlJ^h~`?)0SCM3~)3B10EV(t487;y^{hrt9w+)&$sTX2~X{@ zO*lA$|9Y_oh47y>k_=-D;br$I0^bVZf15vnN&i4Hbu88Ka2M3E=pT5iKb{!hI}is> zB(VPu>UuhmK=Zqh?7}+-o}84sXhTQ5Qs5wD5TZ1?2QOtZ<2@M6BF^kuKsrVD5MB30 z1p3`a+Dw88oV*XonWY3AA3)-X-4MB70A2RS0|cKFrDduz^C`%4gCaOzvXbb?A{ zVhNNLA+$Y-1j^^2!KXZgE>HMyIs$thVK@m|PvCectXn;X zt{*mEnw6Qk`lu&q&n6Of{Au}sQmZv?|GG2lwZcur( zzm>vO<5vV`=A*K+U%~ph%oM&t3>#jPxZ7*w>)0CthSy_^F=ZUOBd~`hch%$#3VHgC zK*}4OrFVX3K4oYT!?y?#_q7tpDME-#-ojA)Nz9vvsQ(Mjw5Y-w8HpaO|2srgB7+m} z;5SQ$Bo6P9)I(JXYo*o~0{ ze1E`j(I^7@e;^r0#}a5(j#@^HBXG4VV#q8<3@gSHqx%!B-7kQ^df!-V1Njr;sgsBq zQ-S$uAAX|P?}1vzMOZS0Kwh6%V|KR!2A!r7lh8NTB(B4wq3Q4yufV--CVC>V0 znW_ildKm=%(GwknTOxsO`l73_K|`Q)Ir`5jeHcF7Modcs7;eoXkj}x>?F94^(R&fw~h64}w$pq!KzDQtVHAqTjaJ?EFxm+bl7gNMo{5OGprbsfbza)AqRWzOCar3tS&P$NAOV(NP6=Wx=;jXyo)&F&0d?sQ}z=MW(b3xvLp*} zrqH;A)V-@Cn!2wD?5PgT9WwZlkG!<50Y^*TlQ^{o3brUCP}LG(?MDK0EaAoR6A#vz z6G2GoR;?%#hAx|r()+Xdy7MB`dW?!qc8se#y@Mc0BeL+lF3!G~H< zZLdpURBcG6>k~LvTWqWImibtTZp^6;5N8d~%4UkEWH zK~Y`No;7PEy0h-}K<}fd*ouQm z!af`R>&_}vaR$t@A!>fJF)^BkQ0w&@0W&Lr+@>73vBg&KcCZ--?bD3nbXkcN?C>0c z6RfW_y2ZlQ1dduGALDEZG_gV2YSNt?tzY$X8=|tdiBN*0e z&k7o&^mdJ580$tr&B3A$984ExcI3bAEVv1Rt<{OZ^CqILP`wK|>hl{UJG&7${2KyI z>q(%54dZi)!j^dcsqDa1W{6ZqZ~;nekGvzo*Ilx7$#PRQVTGr05}ND}Yn2xq_` z4kimvq+fUD=mysfTflV!EP>jivEn#ziIFV;siq1MgEZY$Z zN4?`rSjSed4;oFYSs z;qsHrc=wLeW6kZr;4!PzjxlzkBW@cXI-`t_b}-&Bg9QHeBGzinB9Lz{y69YHI2gRm0fWwn*1G>DP_vI>Ba0IH}EWLUy`in@!#uZ#%)k(`5u40^y*KGaQVF zA|~5ebkKRlL=S{t&jqSuSCL@*G^i%HKy`F9F?EsHZ^CLUmxZ6qeh11>E$5g5G!P5y|B4{RZ( zVil^`&l3zjS1BcHpC`ucXWIxk#-ZD`^n!TS4r1cGc!)a*ge1mQV^upqT!1Y}d8z|D zpl-g{lC%Lv)vF!E_Coa|T42EZ*TY}$jxcy|TtV;e2&el_DwxLJ=qF1~DVP**=vbXq zFoF+Kmy@SpX8NEHb-$uuihK}{@eKvjuM>3EE1BF*$f@T|g^o*S=v-DZTROwf!a|na zOY~y3x}arn#Vvt|F6c3Vj|h};kn)&7Kv!hawwS=}u8<^`66n#5C-EJD!yI&dPoTLk z>J(WuBK&-SXeLUe8i4E+5%tqLZriLDVR~c z5#f(|3g!xD0B*i@_$Fh#^V9?0MTEF7(tTr9pbS{cL1y- z{AH$dyalT>5X`p#V!XS@>#?Pr$-uK}9^w6gq8+|$VKYW_VLpR!UbCIe8jXQq;~-Sr zZ9W10!D!fGTo!Z5l)+FN7D8ZyKRjL=43A~uoN;IEhX4fNLYafiA<(@g1HGXD{V}hF zOJ)p(OU%QNz%35C;d+`&yoUjtl)<)PuyJ2b5{uyg`(&_)1KTK)Jmg@r40?W&03UrCa14pzzF#YnNW@Ld8P%x@IH3|!2Q!Da8!QK(O`3>uGyBp{k3F&q@h z-~$IEW4L6Ja9jHIWM{{St#t;nv6GP9x3kf@_WmHQD2Ox=Liads=D~h)a7qRf#{zi9 zljI5qI59|S?ZyE(CJ@NvAWH^%;{krdZN?Z3o-^j4-_02>wqjQ%iS5|+@i?eVlGv;O z$h-p3i6bQtAbd#T2CmF>0-AhcG8-F&R#-Rz2fa@^fw;wp{q+PSB4-^j#-Z_8us0D* zw@hOGnh5_VG24z?J50hM@y|8_>nEYG%{vJg1wyUmUIOz2ae&@FNZ?r@)b<`D@N)zA zKNXgLqE~F+VQH8?%nnd2#QE**qNvhd&aiF$2!? ze-H?rfx)_@g23Au$g53N_AU&=P|*jZa`;Rfz*uo#$()%9of}44#(+5nL1&$XmN93W zf>8FPnp(zy8P9@FXafavsRFeMn+3%Yjfqz4CRAgkoSBU!eLMs(hHT($9AzTb^=X-$ z*=Vy_Skfmm*r;U=f^x!=KF%c0!Fla&do3_zx^p3}!16sVmg+TgE?m^|Rxo$DPI?yw z(`_DN_U@@*V(k#m(Rql_1Pk@F&TQr*p@*MX0+53-M%$0sF8B z1zTX@ot7CBjLwiAOpKI`%fTq&6&Buc9f@&Yj1n4QnVpuIJ~6?7?OKfBo~=;OmP>H- zB}6Nj$R%)}hvjuz(|1cy(^Hr^pk++wC+M^BA#i4!uAuWmP--X^#c35?mLf7trLAN% zOHp9|jS9vh6jn>ODwq(?`0h|JFG6wrM($BCS63(Ku`yu?A!I+%C&EzHTM3L2%Kzk~ z3tJJ6*v;^oF9IXe>u{(qkwO0mjLI)%us;Ih*)Y8Pix9^N=TCE6XJ)z;DGQGjTj^kP zhiDK*kx0$mb5xw~GW6@d=Lu|EhO+;bf!T7=OW2f0lAPU0)!Q8iHhwuu?|wl+e^`!O zyizjbqY&<%iwd19QOHH`B`sslI#v03peqW+@Rg#I zPAzsa7L}pER^px=A8peTqgJ6JbMwjOuT}7i?GmNd8+I@OQ+J}_^29x25~C5?@<#+d zM#J#(V*(>$P>rl71ae|f%b2GG^3TId+gNy+@{*X{R}yqt8fVH&iTN0d%rK(kjgMN!l>HqCgMMF#af-(U`^Rqt)bX&M_?>`|fT(nbTuwmq zZ!#ocp9rOp}>GbAn~vzP;)ILw`H(= zEhG!Ano|)}i8097*E39yZ6?5ZJUH-bS}2V3`32x=sYbG7$Q1 z8NA7WgD%b_8I=hKw`Fi46Bo2`n1Ie3(Q5;|)p8}Ua|6^u+7qa!hU@xn1ftZC?2$nk z2VLDs;xEEMR}TXDBC7CS1|AxK<(?$jqJd34F9J0-q9M;pz?se8h;m+a;u2?eXCtEC z)q_B%P3VkudJ!0HpQy*OHX-{5`f&cv+Ln+WdhMRezumy^|bF6c(LiI$LplR`3Tx?{b!dK*8)H|8-@Wt#D*^ ziGy~`Xd41GzD{5c2QLZ<+}(!sPQFK=XBKSwV9z0Lvo{L|q|0LhA!ic}SgY-bWZ!dQ zVz;CD)|L|Zv>h(-hFvlovjZv0!@MsZ@aY{0xLq05r|C{q`zvOy^Bk<$iKuIQBT%wa zY^w^jN@9L{qT4dRU1B>`p|^~V?Go)(zCIFa!Dc2TRc8&u@nI{^-J+Fh`@eXr?G5Bj zi+6EhLKmfxwEu3yJ>U=fSMru@*GfJKmh;X#D*1+d=i(NslwZ`V$KOV(pA^y}=xM6M3W4s6X{(Mh%7fP~x>t0WxuiS<;c zPsqHvCP|)LzMJz|nEMB7H}+{`l02o{X+QYZr)7TCe$huYu}DVJZl)~`Kq04Crj{NM zy;Q@#$msI{v4d*ZHyPa%g5_zZX$N6b{8Q#nr0ZcrnMX!erF%sMuBIwn|3%N5#&niAld?f1(JlTnRa_oIlZ<)}NG+J-fFl*@A!J z#+>;cgLjkD5^u+P|B-CW)*lmFsrnYmRQ$1I>_pC~nnf}-__)|cRf1WTXbn4d=s0@q z_*XKjdjc&x>8*^GoDiK=TdS@n&7u>ct7@^KjC^z8Wss?iw&uW#jk%2c%aWy?@XcA1 zT*PP8UgoFgiY_WkcNtydXx|7Kxt1ol{wa8mOp=f-%Rju@h+Uey zT3X$Nx4@@R#G7QLu;`T7N9C6K9}4@Fo)LA~g1^L$sx9mOr!eib*h%#``+v#wS;y4X z@&fMc(RUJZ?2e)Jm4&Z4X-POf1O2$NjEAfcj`-v z&q3AXb|v4Oy*!5w)$WdxT7P17O_rF2HB(#9i*;3D_hsSR^WtQc=R>9H?mX1D>Jyo= zxgbtgb$hN<*l}UCyu*k7MU-tQXQ|O z-K0yO~}WIz+c7Q72phVB_D6LY%R4wk99A=sjhx) z1#<+7LK*HX3&dbyydD4bWxe@K&x_YY%=~pA#{N3aHkYyA3l~e<&gWc*II%M^*iF7A z>-D#2%HOm|I{%)x`JV-cg_4q8+6}R*;M0{G*s-t{DRo)yY>W#TH{dyDfR?V#P&!ru z-vn)fyGL2OI>iyrX*cZbqNNdxtB|E+Xzk}MC{7;76`L}3*AzXr=N8VV<&nhL1f~4H zZMGe5!^D3XDFodXy9v&?@8kB8cG#2@d2Z>S(^Je@y+YAQIE33kt%83c&gT)a3g*{m z0I)S4W|x|K(MTB#^AgMDDg*I z&V~u@W5}%Xqi#iz_6TB0MTqqEQvU0~JjSKUXQ8PNA+}gfM!63~tkJ zI8S&4ouSx!;Su`m89efTfOn&I|7}cPznlIPGJ6}X zY_OndLcqFqnlT&tOzb4wa?&!5)A-jNS6ZhjXN)iN)XI(7E$cM;=HaU6@LV!XA@cG{ zvy$us1O86^5EpfrYllZW*c+jbcV@ z@i>HA@gCt8V*3%TS=KFd$G#Pq+n&YuAL3&Ht!>z{k+gEl(5H_cCD8l>9^V|nhdH@@ z^ar%19v(V;zyoa8$Nblsh220|(#GWp9}&j{Y%HUtdq2SOoj4dD#;N`ZvWr-Fp_NVh zBz6$o-xE{xN$f7nQDyaC+Fb(>lkmWvL@|robFObz1SoT-U`I!6#9uGF; zz=xH55#5DJ&IFFuPM0sBqpj1G2SOAMgs)FJTDna^d*mUd3i>y z@1Xn6Bs%Cj9v9ip=b$YM8kQ~{>v$Z!l$hQ>aQeC#Mqn=oEwKGP*PS*Y-H6>V#DUqi z9R7k=5*=2K{JO*wcu@|6vzrO@`-#CK?-+q<>hzi{?_^7-)W4CtuHLY2`N+WOR_`TV`%J{6%a8_08F6pPKB`sII1-%50Eqyv<>uKy%pCc+M0~W%mSBtTj z!hVgUg$+IQG(Cm+#h4(aX~`UJWnjsmzQ#caexYD;E@kMlbNU+0peobSW~{XVn9y&; zgc)ess&3TJ)puU0WSyh#Sz)Yb30}mddjQ{`u delta 35314 zcmZr(1z1%}*S_qd(q$q@D4>G0NSEE+-K}5;ihzQRV8Aj@aP7d3Yj-Qyo%h;>-SWS4 z*7mUR`+c5yj_|2SW5Af5-G+hCMl*VW+~<= z7Ack~Rw>pgHYv6#B~wbJlujv=QZ}Vrid{05m z5`rs&8-hDRWrQjSRS`T8JQ1oPcp-Qr_#pTq_#yZs1RzvL2t=rX5QGqn5P}ej5QY$r z5P=Yh5QPwp5Q9(?p%y}IggOXy5$Yk-M`(c15TOx5V}vFMO%a+QG)HKG&=R2)LTiLJ z2yGGCA+$&6fY1@46GCT%E(l!_x*>E&=z-7^p%+4Lggyv;5&9wYM;L%G5MdC)V1ywE zLlI&T;t+-*3`ZD&FcM)D!f1ps2xAe(A&f_eN0@*x5g`F#5<((E5<)ViOh=f3FcV=G!fb>zggFT52pI@-5#}MxM_7Q6iI9ar2n!JwAuL8%g0K`}+0F${ z>c$OC>SRQB`0KHS13l@l_DZbX_E3hdWUnb>R$snx`|INAT}CvjaOmT;VB=9edQ8mC z)%cids3d0V@XoGX4}wmaMDy2 z_1vKLq1S8G!P3%V4Du^Fx>3wPwHbM3YfIYH_)Gb(h6yXpaCbDPyX(|drRjPmnhLgR z%Ttf_u$nJ3PSv#K=%Qe*+KE`vbl1Vpgj~MrY^YO|qm6|yY^1kdtD;bdlSaC-qI#^R zJPjVDv7xXWwUzWprk5?ylp%EvEb82ZVr9CYqpl@Y^fmx%n%Ky(BDBdHNfaDNnU@T};FGpKyu}NKBn)W|*etSn_%H5>)l)6Ox8AUr#Ye(%i!xN|4f69iO z)|RC+Le`;fQJE7RT!V5QI7(B}rk-4^TmTpU(6lAXRcc#$c}8nPC$^vn=G7}|%9c7` z)Y(zMRwVPS9@%bFd(qJTj;8eUx!Q*23)-QPfi|NiyHI^jN7)XYm_MhqkFB zq^7+YtnZ_Br_S4<_BNK8=uw^}=ut?ZwJ1~@x+G*%hqJ8m4t10?eKLb(JJgX#O3->t4j`JqncG<&DIo;1r`!IrDxJ)c(@*h5}ThTYJz*hPP)BwilB12N?Xk4eyW7M?r4g3(uCEV7kXXwKbXULpyOf zV_?Emm(DoRp?6LmwC}Z(CFLAL#UEUX-kAE@$;Ps<=?}e7sAfgM`_-PR$rtrh5ILUH zT98Y+x)`n9ueMh$zM|)Y>6g&DcvX(*_{qtPx*Y&@?s_3*P6q^)enY122`%S?>Z+d>Es0K`?pq#$6JK8x@>Vo$8h8^6=ifPULB{f5 z>ouxUv;|@|zlUC2?l59r$yf4?duweeUhwPR%lv`E>gK8wp9+x`p=Ef`up`hq@L9?0 z+s8}6@BE_VqmQa%RBOH}sqdjqWy$3S+R446>hh{3-;~1Zkxu1#v{+&1T$To*mQ?e< z%Nm+v>QI&U4;f7??`$n<#Ef1aLp4@9j>J#=7WO}`4pMdgDXXrvcebF*$5Ga6e^Xxt z_1`hHopuh+Hk?q@FIhj$0j5#Jo~rA=sl1cwQdDq4T|+APi!L0(*xlo#x~|m6$N)-` zet`XU5>2sIF{Wcqsq0AFN;24V3S;BZ@`?z4r!me4+AA3Sh`ReUOyt|sgIsk0nVi93 zc*;qD2(qfHsY2Q_5MOa&=F1uMtmSSD#-CL;l9DSkh-~0yMz3l+mm!yP=nGT*74(qH zYD>zi*e{#5_4w5>rWsq_SgW;JC z3_e^EBkV2)%da@w(d}O76tgZP_N*gJU%#vllr9_lJ?s6(Z9XBn)yq7E~vM*f$P zM&ebqIk{X_drQA=vJ^~|H1Q6DH&;==#Xd0TWb0x>!Yj=F|~+Wcbr;59MX6{icg z)uH5b9S!WGHG>|tT`bAEuBI|wxQ+H>bsliQTXLFE&sltlyZ$j~CDANsYVbrZxhr#w+>JZ7TIfJUV;qclv3`|G3 zSd*uj#*8-J#_V3JqoBu16}pk_J$3V}S=!2U;1100>ZvElX|{_M&FQFdruKJ1ufe1S zJwdzDCi`q#`g9j<&SRXQXG_UR;_w%Oz&w~JeXp0dn9n`G^ADMLvi81Y6uM0$0zS#5)c zj+5~G54LtcW7^laVriytnpOP0fD&Ww;a8#{YEw1yinbKq9K%fLBgE_Q*+5%S-d(jZ zZFr>ilA8Qt+UYT7w?`$YhlQ_8R9Di{6* zA*=jEAvGq_L+f-76^@!M<7w1-~AZOvpopapwJdcvQBH zLDp0n*h7FYI`skR2lf%5F8BO_AEEobFEghFJkB*7~OfuIk)dLTj=#{f_vprDzk8-{DfF z7ffe3xEfQrBPHa4>yVID{bi8Z)3CDWkd1zzx&8c$biZI})em)JsZ%)vC`pmaV5Ip^ zG~vpX1l?Gaya{QdUFEs#+fSHHbZ1#%6B*OcRXI#{^AZZvr3Jp?w+_V>sKcdVF%0qx zP$+F%W%_FdN#(l;E{LLyG{%`XHQv&iK?Wj3dK$}Mqmd?B%1tx?y`QFrfw2UYTPY`R z^p_YO3Z}Da=ap!tJ0y*#)G^J#n9}~WuKKp(DMc<|dX`EPCdDsg@KdGnm*%Zx@cM|W zIh9Vwv=VZ$NE$BNg@PZQD~70j_AuCe9oiqWpxvgp#$GCYmT7HqO{C;J zqfrUyq@P#NYfEVAOJTPRj0ZQpF2+zaf57x6m760?`sFIu^M69t=`qXvOf+4jD=!T3 zP3eRQ-1GlnU`#08*3Fc{Y%ylGF-6pm-&m$K)kH~G{-Q(X8b7iz)6|i!mS6yfO=ymp zCR7SFF3OakWo~YA_h{tqrtF*nCPFoYGTf1x(;bw^3Uj1(!(7l)qEwEbgM#} zEKoyjN;2bYsc9&cFT)_JftwR)1Kg~|BFmOuSZXjXXd^&D&;{WgQ(8P$5+{m3-fR#^0U_zqah`cWX*1RmQI({L`XE4LBVvla^&ZT@o7<-Tu|J* zlZUZFZYfP8iN*?0pNeI=m16DG(y&-QLC{mAW>Z*qKpD7xFP*`&GMZY_wWSQ=%Ayu~ zYZ#o_>sFerlqm-*OIMJ8IZdkMu#Ls~lG3~6WCyY1KZ34F6YO9-;1GlFcAA<}=@SeR z%frR{XvRX#!XC*Ezrx`9yWhFnWe-#9&{Tzv&&LvSHbNXg+n`|zdaQ}N?AJencKpJ0 z*$POwuQ~a zCv^;DFu_SvL$V8I@YG2YRzg(3hj1oZbac0%LC$CZu~7!5IOTSBFF~{XP;K$u-IeXT zS1s1s-`(AqVq6gKYXfGoT{HoD(}69Su&Jo=(G!zeF%kcpXwr^})g#?4saQ3n(r=O> z72#d8o-)6`v}n za{{0<;Fyd)2cV3GU6xVb>X6O5T9qm`^NFNu)ir^tAva`{_o=Gr>b4EB)MuML9{DX^1LxG`80t!h6@Nri=gx-v&e zoj-%M&$$pyn5sdhlGpr;O~U)$E40eF(HiWAUh=f1H%XqRlvoEISLjPE z>uUPwpRsGyMH;vJ31YMKAxSTwNor3gc46_QB56(D!3tKbH2ze-KBAU6&J5a({J7Q8 zw3@QuYrYf;9q52*wQ^LgE&QL`0P!mSWV+lEuadN>A?PX%LH|>cw9QaW@YsfyG{o9? zjhBM4YpZdkXFZD~aG{P+XhEg1TR?Xj!H8)?W)k~Vll$+4#-K|zGtd^IW=qnl!PVrA zBF`pJ*wtB~fNtbYCj@;pQ9(yH)zp@@u42aHSTzTF(-cKoWwT(~QP6!|DSGy_sDo#O zY?{#=(lkS5bT{>~G*pHSQF9~_^jxSk5HdS`wS=|+`}T!_4d?233R=~;I37WoVJRiF z6?HYQC4|R9ltR=~W7XsON~*A;p0|R2+>k<{1$Anzsi|6)pri^bXyE}bvozND%&ny)$_KXq>h^Us)@l$%D$7Pj%q}!KPYqB+X(~e*6vEaS!Ycx)s>zy z6_e=g&Q)g71(|s>Ua3013u50OCDmfPH+EaQ!o%D}N`6^aR7kTue^3~?uS5SJ;iJ>Q(hchZ)k{=Gnb^V3ru z#4f6*YE7sdv1xBjkg8LJj86B)e4XB0Mh*I)%>?w3(XwP8Q##WJk&pD1DW54m=2X8g zsI0_7%7hN~MZ^j-WGbv5n&pNJ8SU?fRY~cEGD_U;V^3ZC!@>uhOm#otV@B5n)oyzs zWlSvw!03%bda5>^8UQm-bM+{an!G}sYrQeDeS77jY^e|P^coSQedAMt4i1Eg$cu%P zyr(*F5DKWo6N*y^(nAx>7@caZ+7u;|UV4UaaZXD2`^nn+Kv?I%aCKzWxd6eDf6+JX*@f#QtD zEHfLcX)3*!fj%9)Vh@)3H!(!Dr|7f=#VO;YwgN?t(^yF!P3gioO>^q@PFJ4(8RYl7 z$Xu`v(dlI=QhE#4ar%UJ(fh~4VdHpan$^ck@D>^@DH_MaSk-AvFI(!i%o!!nX?VDYW$4$T+p6#40LIVo`h%bx^tPy$nh&l z+b1ERe~#0GNt$lbgVR(qQ8P+vd`A4%q`jjx<;Xfo6u^0AVqaj#2WK5HLnI*=(U+LU z;ee8K{9Qn4`SgP*%`I107SYCsh@aAk6zjJ4&x!-tEf-AR5rRpO@^WO!+3NPZgQQJCw@=u`^o=W^ z^^0qVRK(i5kLjVQniy%+D+YOHf$~#?=~U<(&u6;xRBVv-`^w_AwD6jh1NmO!T$Bv#|a@Y$t#x z9iN5%=~9=$uwFH6soj2zz_n+?bZ}p$XUsulPD9e?)C{cWAhyv81|#R-d9(jY26=O!X10fcPdd~};a!CAYF@e~NGf}h!H0D8 zkk>|(JYVBMkiy4zWRaEcxuWJBgU zO$D1;Xnf)yKW9zp!t%IzXjM;SaBm)bRrO#=;qcaXK8nVom!Jnrtp~6eLkgZs7hps? zB{LY~e5FMLg&1dbmSFK*A`|5vK2*UpFCJ{cjdyh>j4mAhr%d0BJ+p*txC7MLb-*QMfzX(lg6sco%St6l($cc%H+AR z<|4>Wd@d@ppw~_D=IVrynSWKt92TQizTr*V5^M#(tPyNVa~7kt=hzt-Pj1#VmLTdh zcR}};BK*Z~C@pCgY(q&C@%B@HC}by~;t&-cuJl^Jngz=b(o2`Z$l?G4ZJo6YU2JL$ z6O)#q>^?VQ@P3&lP^#2RfDlSbgkyu$XkX*-j3=1$YErYcz{w+#l4KrQO;9S}5?HEV>P6QVt&EFa`$zmoj=Dicy2)(R$&+j$Wt(O zt5Je}*Ot{4WPq!16_d*+J%_&tBq~tL%3yfAuRo&(8^znrAQRs!^vLYIM-S% z6Vle9X)d#%LmRRFEWIAt{HwG8O=!`2=8_ znGJ73S`yd8`r-xe6wSAaY z`^+q2xyevg=(q<%OxkD$m-k?tbWNb-y_&|XyZY&P(9>vr>YJ`H>e-wVM z9%*2#=+RaTWvz}Ok?_$>Z#ssBL}k1@JHZ{OJT*TKafNY$k$aJTq4!kKf#aFplojj1 z9uLZnRd(Q3sX`%3ikvHc8&ghBtQEfm&OV9wL5l_5h)hnQQOsFR$+?<(ROXJlJS{r~ z@uU@kX+aqia6kqpHa(@8EA>p)(O9_)>^>%^$4imy)f~g_c&t1K^*jSZkJd4L?u>XV zyotf4bFp%hJ#(Rm(_66!5XoYX#e{yIMemrlgPF8**dn}eh=J32ELQ(M&S1lNj1T8? z1!zezxlp@zLx8!`lDp!!E_KX9dkeYG;94F!V9$pP&KAVl(4AsvaPb%5tluL+*P$L2 z<1FdP1vE@MtRVEvMNJ2(#dCwW9F5%+V#@^|bO}+ne^kgeTtXV3RP^?$rZZubsYqu+ z;*^!M)q!OgbYi6ViVQH`L`e=+7%Z(5Cl7`ZS7CmO7tmgwI< z>D!0-b%=B8Fx{e8oIIec5_FSBOk*sGl#VtRpgFC-fo?p%Ed#Hc8b704%D;+g*l-hq z(F0lFeG4rmX9$BWx6q(-;~3Pq4N1&M2D@*ge=bgBV7)BPgcs&h)p7xFYl%%}h5dJ6 zr_mG!2efgf)aWi6Teqpq9J`A?J9Gv;cz`YTdiPKvKXJzI0d|=SW@@X@w|mIamD$Y1 z-WQL5#Gv>COif?a4DRM*;5_yKx>eQ*CQBN-Q~WleV-I29X&-}(o2YgD!H4p9i#Tg^ zh!sx#3+?C=3>y3g&%MtJP?rwV-WHP3;XUDMGorF&PQr_9>c(on=*KX zm+k8wV`#f`Tfrnf!!)2jTG90hJYI3{Pnq-2IQdcRqfprM z@mo>4v9zb4C}Tl29EZtGrrvWTU|yVTpK99Bj^}8rZE!H^DK=bUUSNp(WyRp&3uNn6 zNe1CBQ7(Jz8SH$C+&eolNDCikN|CQny*DZ{v-uSoPCx9pJVhCLy@qZnoc(@{9T!u7 z@mrT%-asR_y3nYT^$z`X?Hgzv#J&s@_FPo;+YVE9FW-Azy}Fdm`IyX|v@g8t#lxEK<( z#F0_i&ytxrj`BWLhL^S&t#T-0AYInXE2ga}^(qk2-05K22y@DG%`Q(}io;s7zi4;~ zZ8-I4ut=Vmo;%4#_=(}75i9tW&_+xC#RZrkMVAo2VWe>#A&)6djbUuDIn&>&j*wr0 z<_dbIJJZi=jrjfA+XVDzY}n|Hm}sMDb-k!VDZF5+ActS8WDbzw+OA5g7Y^DvO zIbTQU-&=V~rlqN(6-+vt1+0n+p_ z0`!ye#){wSwCu}Bxx>G*Lh2>s6?8poZH#nrwt_ikt*tE$o5xI~jkc~-=axY%7v~B zQb$Tc>v|E&D|VC#d6&|9s(Q6isAiSXno>q7Z4K4dE`QQC@uTE-^8Tf@_NspU{~rYl z$|$XkQTfCcl{JuMoy- zTO26$l$w}{C}Fg|%2;{rTD%9np$9$1vE_ z73u4jiqCq=CBt19Z`k#2LBWcmdySPl;Zi50TBjk)_O&yWvo&E*kz(!LR4Dk+&Ou{K z(bao+X|rl*5e2+?&?}sGMlFqL&EWJfBo*U=O8B=8GmBlcAyV~r45W(aT+cf)h#EWA znBpoz*P;tEJ;o#UHNlMN$;|OdV{u-k5*W+g%>1f^@ix1X)=OI6&%gvq*9RJaF%5LZ zz#9-}U`o(gS2+1_7&Cru+ED5Aa0X84V{K@S8&dEc#f-`w9{ZqAi|h|}*EW{^8pq(V zJFIj=cNUUHl`$~hnP>ng;>BZ4D7P|94N7Es|I)FhyaugR1%>`0nd#Y8kiwi)0o=)D z^;k>lUKO26f81I>Wj|g~q^QqNFRB_SU72ZMe7NqvR7C>za}Bfwo$=6`QwtAm1J%Tv zyrW0HRKpW}-utc|`A||dypgn0YquS$4b zs9#%E@na#v3Sy+DEID|g=O6g2q*1?G2Xwt$spGs zv(9%6)9f4}oGqlQ6R7pXug`!PschIR!Z%C;jSO69Bv6H4-ew?Z)3W~cNl z<%QzCsQxKup`ablE9h6j7-qxo7?`p&tk}e2G%Q3LCRsfxO3Srn9SS3+FBG!DCKF}Z z93gA_-XLou8Gkf@vNW*dM0r)c$Y~-M1rLVFMx+bVj+Yjih~G&1?mn?Jf0Q^WTw7kc zWF_cOx)_dLJ-Ms^-V_so`YMkv3j{dVY@#u(i_rQ=@%{$Jit0bYV@%~pICV3K>9|Pr z?i_qsAYxsOgo&1Q7=%S({1}cSW{_k>W8tQY!n*Mg&TlgjBz^2oJ?ml#(JW!2IlUQy z1{9uLBpa@MSRua_K1|g=HOEgWqR^|KLBW>JPWfFLvtr=ktDy?nix|{PvoQ*0*L)PR zOL=^gwYVmVWKo(z_O&L;rPO={GpUv~Qd+mzz%-L|*#d-6!2y(1Vr`6r5o?)Qd;-~d zEtut7m}yl9Y{%*-w_4nMUnL}Qt4lc zr_@8PQkAs+J@^2V1Z6L1fkWPMyqZ#pd;_p0y!Cb@>u-2P?A=RiC5=+b^liVPRS`@6 zZ$)Hx8rFT1F=aGB7IN@r^EZ=KGC^Mb3@#-{pv!IX2-%)K6y<n?|$3v`fWCm6i>FTs>@Tfq1B zdCcTmPco+u&#`yexFt+f#}2%(47v>U@c#XUU#^fPyfetEac6Gb3N82eC#IcSYaJ-Q z3qFOo)(YCCjmW4C9s~3rwpvt9lt+}sl_x0&ipi#|wZAp`$6sXxm?DL_(%UweQTDb$ zOAV+hz+g$|Cw{|eQCl>GfDoZsgVNf_u(lJ`(6-;~RR_aChGi6~yw&wHwRKkOj$RIM=83kmB`B zw768HJbhb`tgOt3vaE1J=T=q`g(KsIx#3bulK740MU%%M_;Fy0p7~?zrJ=4!bpI5N zR`?d&b}-@=PZhK~wa88`O$Ehpuu8woA0uQhrW#~;z+Hu0=oeD&h3xcX4#wa!^kDMu4IHpi%BrF)?ZA8*+}t zfE0X4!OV))HkC#nH88Hc^b3eXLQk$4XnRVF!&B0JEZAgYdIon9B*Jzh>&eO*2zd9W z)`nqN%9j56CympvCS;kctxAK3BfZ&nw0R`fZEtE!)?bceLtg~#8)%>{NWY1szsO)u z`^o$eFTc$S6Iu<)F)+oHl4hc56^uaSjp2fB&FiSlkzgoNFbgH;hT^vkxrC(1v+?Os z5La!@5&ULrU8&1xFo(J`lb?oh{fl6V^6qjVg~%-w}}bTuE8B7cG5F&5gD zN3%>bZ?YqghNq}Vd2NoT2V=EK(!Esi+kl$>J=vOek3;39rHQDxbYVOeOqxXun(9(; zSHL{v@Z@-y-@lmYYVlZYzg@{7Cmt2ucoPG!37EYPZWkbmR!zV%Yxh3_M3UpR$(H<1 zxyD48T7QsQPQ;?a>;{X6ewu6{j@#l3fCPvgzA>GY025n&2~eHPD@?KEHq+N>in0|n zHKLZum@QX3O_7&O(Nem9?5Qj<1lM!?eD2OiKaNaS=0lJEq86H14UOo9G0+R9cfGN0_Q@ zBE8e4DAzxNxzou%X zy-X#}(soe|aV=Ev;MQBUVT$qr-^Qy@qb$v6n4-Vy#fDzY#*_Tf8cJbg>lArGmYfFR z=h{jkx>tSG%qB|ekKVL(4k9gRqtvh*@jJQ3=@1U?rWEc@*G8#6_A8`tL(|`raWwe? zT6E``MRHMls8Vgy%oJmKISnO$D+6ZBk5CGu=4yjg-Nq}a{d2KbdVh+N`rS)CRV`;I z`GfPIx_XY1ikc6Du31VdV{3{D1&@ORSLch8S}F^D7huPv$~qan$U zK52_gZ0pv|QSt}Rq{wYl%7WE0XOzN>rz!Gdb%ReuipK9op;~WM>4$~Lj?xQIqxjgt zQ?==XlK)kGs=Ti~bRkmO_){rFwRVx}o6&_O=&C!aq?Vz@i!j)&cV)(UG5Ww6Zw9j# zV+iOG$RM|6D(256(7jt%Fpa5s?^G+w-HdWtH854#MbeuHg+=jjYuWy$?99u)>1EuzqBl~C}_+K7eohNEyntwY&XSY5~#=&(Fk zh!<|GW<|5IF|qtm5Cz%L__X%7Mk&hp8yel$6%qv(;I@9j6R{j6(`)@7BK?WJTp^-u zMMPda-V9s;QJG^!L>9DX_!N0p`-_k}pDL7ZT8;aodaQ&S-gt}0o|hs$t9gnqxCu*+*HoHR z)&MN1a1dx8TqJ|hxb-MUnGXbMoDUorBA`*+|&jxd{&r&Xkt} zLD*(g=-**9d^0Bc8xcaG7DaBs;wzyMg9BUeh?b9zpMz(KN?Y+5_Yl_`2{3glc01m; zqeEMyIU6uxK2eV@oGy1C&?{3FK6Bc)R zWBNP3zRoL>%?G2Y1hU&=DVS zO&jCI)bbw;LW6crm0zEGUXzXUhEvJiLLpIFc!d?MccUb%@I|MHHG8)g>Y=clm;h*6hRTW9|(ZmD!KEs^)VUjoYscRYiW6(S!Yn7jJ_T zh{EUd-qS6_2lDb`)S!XWm1~YxO=Pw82eg5zlr}Q5Ij9X&#k4I%#*{?U<)^K&BV`j@ ze%;#@Q9FbeDOQKH;i^@m{@@#_+~bQ-G+mzBybq&v)@A=8G$WgX(|;fP5E_+!{Ex=8 z@-t)&k0a2?`fCQ~8W|`~ZyaZoph-tirh}Z6{GB7n>oiv-bw38GO^!nKK@%mv?kHa4 z+}*CEY>$D8{il#BMq`elHclLrDTli=%*Ew-p3*^YYIzNZweo4IFc0hIug=Zl}6>JDQAdb{{0-8YN zN$lKq3jI@|!Z@7Mdo>DQKG}r{SyhTTgDCnpDfXvebE=Z|8Hf|@{kqOnj^Zf%@Rg5?L3a`bj4GU4(S zFJU+zy^lO%`936*?!)QJ zdN4#vI?LAYKSQzgcmU@c<0A=?`0)oQk54iPd^f ztbbu;7Cx*HR^I*#D-A9%=>8wTRT-T74{nUO#FDT_D3HpS4+V&o(*6^_xS7^yR%x>MfVKVIk623i6`NH| z|9t(|UoMy)ES?y&Oz6l{w9RSH6innZEK!VKDww^`kl>`(3MTM5+$inTT-mBTB6wCNBYkKA|eE`7v1e36dmCT|!d& zGvc`6V=e)bKSSb3dZ1PMM=*1PrDNEayG zOJESQ1dS|C(s@d{Nz7c8AnupQpuP$b>nAbTDS&x0gDS;ze$oXQEGUM=W=>~`R2-77 z_-I8GNL+DPn>&ZW{o=YP$!Q(~n_cJ}y-VnPBvVo_S4+Uu#>EDvB(*b!cL&tWxa^%} zOXmgCDBGZ8LXjpqU#a~H1#|E)>VCHg6!TXrXb)4EKeXP!V6VUwQR{7D#>@=9SKr29 ztQmCM?_%&sfK~r6Xl;%-CVLqiFh`u+gY?#1H%{txT>RFdjTXpvz!?E>hRhNgc6kia zEm4Yh^2pyx7m;NJJDC^6{|8E2F6ueDZiT2VuQO<54eeWZ7({+YM>}DSJpFx_)Aq4} zWjyEV%X*0oTqL{_6a{Z;3yIUedXSko+n5q;5$`?|^q(!#(Ei7&ZA&7J4Nn+Y6`zf3 zGfG0&<2f^drC@f^O9t7cpd0v>LCMlcWAu9liKSsu^NB%zXdWZ%~ZpmxK7Lo{1nM zJH$SUQzUjM?N~ebyV_BJA<`%}CL5R6c}opF80;vIxCNdJTw2Y>oMR8>j<14QE13O( z2Br*oJHTli4bUf&=>U7(A_WMi0tcjcCYo#=b&(WT0ZlqChQaL$D6UO-@9C(Elg8B* zzY(J*dMSzfI z3a77f+tgZ}vD~a;Lg-AlOv=Y4E)0=@~ z@@!Ko?Fx4q_hn|HE4h21m^oAx;-2`ZR*3yP;G;V}sue)%0n^XZ*|fE%E=cNvkGMoV?aP^MPHCR7 z;y;g>51z2nDU(5uYH-jK*C-0zi`8J|p_W067eLM`2G+;Wg139Y%COb+z)Ke^Rm2Cf z-nzlk!yMN5>WzZ0wuQm$Ty&@rK2X2AlbPr%FmPWmSmx>zdwm0rwekg{J1CgItb4P~ zXs<7vTZwBJnXo25KWI!mtS2bLPghF{IwFJnvrCbKKg6qWQzP^#<38HeG=CIqq)L3&zHQnb;7NUe8)! zCRbqQekhnTf{DYKZV}73HacP7N(|JskqZlV2Ih5;ut^mLBkRD=zdab-t)mMt!gp*U z1C8oJkd7OFgt1qRQDFP(!h8%4g9}F81a5lP17jUX6&oQ!dOeukCW9~aFjYkcv!ri* zQDZn1F4Xb_xG97122e{4Wy$IWND;T>>DA`6PctTmhOmDZ^S+3f)DRIbW3?&3i-xG9 zemF?p2*XCdnl!f&CjM2m1P-I1#_%M#w(MwQw8kfO85lPKpau+vH9>mS8Z)@n1fIN< zLH(vk3VW{loHiSTqTSgPo+RODxybw7LGZ0oGccJgnVH%QqoZ>h1_{H{%*m)Z#7A&^ zTtw*G91bEL5&v3hesC%f44v_xpie=(-Po686>oX->KbL^0*~j-P40X zt5#6^){DV`R>;vl95@&0c(z6+n)aawZBbsCtzjUlFN1>CP`lNi!QeKq)^Z?&O;gd- zZnuH!{|;iNW?SgCAHrZmTj;hKDnOj{1n1O6Iy2iLo%J}CF2IL&(5N($L67!`8#kK4 znf6dCiv#IGtwsl^{Wp<;t^*`f6Bw9xL>!Mv490YX*XB5rF5=u1U}G{RcS3%wG-(#p zwi6s3Jy|eAjmD9G8wjd)MuEmpWi9HAC}!A-6;X`3!1B5or0W7Ov*6vqgFlO>4+7~?Ct?^=`{?h_JoVu*E7iMiOP)H%s_h{t<16)A{y;t zW^^xz=gHu4FZdMj4@)}thUAD0&h~~cv3u!IU#uJ=`d~!GqFN7D_d%|^9b-_wFTl*> z3|{?!%8Lm3adBm4|4of27CG=KlZm6cn&~% z@9r|l8h|9CaSl>=VmuH&I{wEX$!Lx#O&*AmbSiF2LozQ0!XiCmX~#h@^5qqSV}l^^ zf5V{qU{r7Sd@`BMs>YLY8*7)Sqo5|l49l<)0;RX zvaYOx={gK`(WQcdIW3qfuFUui$9(^wibA|%I7SjrUuJAZ=t89HfeLX*t2uZ_HUhaU z8?2x|jX+6s3}dF#NR-|<{EZah*WQu3aA{m^2416d5mJ7A2Fpglk@-y+s750%U0PCd z5>^%cN9(+#N^KdO5)$8z47|s{^xf_ZGR8oyIWG7Sao&wVBY4(FfH3Md77ljm%i!o( zsGXC6*EoQB{aCVK9IPFZ!A}7q`m?0pcz~TU$Q_S3egjw%91pNY1{wh>4P=S&1b`(n zh!ddnAeLMcAWa6*69GyLX2~i65@leWpsOam)q`*vD?pziLM@!`32;{i^(P@tC)`6M zB%1`dDueQg0IgzKGFgE0GI$|Cqd1ndNrJVbdeBdb8pfnsGRR%SaMA}$gaF)RB&>fB zq!?N!gRDG)$)l4&YDdspLE4WLWC+cjf|fT|4}$5(6qKHX>#&k^!PI>&dfMO=RLFRl zIiCXYa~TAtii*eG8EL3Dbt;;9@B{{yQ_()QPht>16_SW#2G6FVu6L#~XgdvRd9xY# zt(}9LD5mK=>BtmaP}U1{Nx$h(cFtsZ;udtgmDAzO`9;k5>_m*xGr+9I%^Jdq_!&sb zZaITzGmx(ns~NPP32=II4GYb|^?q#Xu$YvNo|uV^RRLb4qj1l>V$e1N1u^#n1N?=+>QYy1hYB^nxsZ%5 zV6b#92BDV4X>&Rx7V{t(V8&qFJeVeH2LH~3f&Qf!w3-izM_C5@<|EEU2L>Js0C3n$ zZ!L2Hs>;HZfs_f~=2T%YBohXLyct}}glWm2LA@*(*ieJPmMp}v!I?zi+pzY?y9*)j zW22dwO3*c~#Q@9tKxtHc26+pyHPLS&Vn;VNF#gi@IA> zO!>v|&bT9kl*RCFPFDu6in4WG*wU;77 zDh@Y_Y^+&|CU5|KOpUhVl8!u8SO)PfEL#LKWf|;M!o#*2E#&Pom>P}sh*~$;=m5=K z0tIIsEM8C}O1-IUF<65rqh>MqTY$)P2G&~SbNqY;iCRcT5^dJ%`bdxQn~veSkq!gJ zdo_b~I@DKj9DWoM+idjO5i%H=jS_hvgKOFFs`)Bb3;P?A{W4Jhjk5Az&5{z!kx^V` zrMEV8Ijq%L#~^n((m5>yzdRIa#0tzpi`TPQ&*ZFtw^17ujQTV(?z&Qxy^@}>5)Q1) zQ7C>`iKxRiDwrOt;8$53|Rpc5upY%u^+vRi{>uE`8M zw4#}7;L4z_tn+LQ$^`fR=~HO37Cm;`K?Xb4!tR7)3>?-W=SPk+NL~k%+7k>Ot5Wfcqb1=JXEO>txE}8arXHt{H>n0^oK~z421J;ObKuB<(_nTZyk2MY3;&WUD2E zZvVjVrB)2i|D*FW@~5|((8t4fqvFr=|9!nPO3>!raAGJvaTGS}_8{-LW>^nW_Q0dd zGI+BG-rp?6lCFDUa0~U=41=flBBeHESP-@k@xRNUOLbIH&OVr5QI^GJ_QOb6IR;bq z!{75V$ls58n}WZFD!k}@046Q$8C*I5wUG`CVh+N-Z3P;B5Zh=g^}mtia0q^eI|?#_ zmW3hF^g~EA+=-dbhtL9_I?>$2SSR;BjCMA`S%ATkjSE{1JpzrrdJsrUk06PE-GwBO zB5P+DlgUw7TkgfofTJ*A<-_3gQTVnlfGTc6NB2DjD+91WAi!J!-s7ur0h+W%gZOa_ zR$c@#)A=|ep2J>%5Fb2_?56)sb59~gj}x%}Lk6=>pyuPSRyc{3&ZiS_ENl&fZYNQa z#d8GcFBRV?euK#G6iDpd=t0*@a9w)}iQdCHL5Ra|X5dWUX)xV!KbK&JorW8=aVwVq zn!6cR^jL_i9cQM&86>|3FP(*WivSt93@V&ON_fGmm!zJBV+Zsgke;7~|6W%)XN}LH z6yDrmu;Co4$@C5boAaR2Y-f5WLBRC>zuhJ)bT9dV#i&C zO{=*==0^uEq9qJnC_n`HUD8EMyLAFglC*!*+e^C1QpHsQhtbB%x|&j#BMfj4XoR%= z41+Sy=E}#EPF%t0)BKhk;mch4o`L?~<|>cVG`}M&e48tu5Zrqe@$NogI;sFguD`_~ z8<7ZGgrbk+@ICM8Pze}Z&2hE=_~ z&6AIoJKuzAx!z2VO`7LG88^`oeen%|NFaR%Zr9U0;d~2?s5x?U2$ezg298ngNdn<#M)`x(RWk$^~P=sl=6 ze#<~(HQz+sqO42i_suD_)`c zQ?Aj4SLo}BH>l-n{F>mP@@w>Yt2?Z@>xgI8xExDYUwpw`UFvAVVE=a<6ny&* zMl(w?qyLh7$a^qHDl+32y+HYG?N#d_BKSQT`T^jyH zSCwX#%C@BYpLH(M`+kB6Gu*FXLv6o6v0Z;b50*R!vH15HV^3+rP-f0wuAt2G(yxd$ zE{zi1e}{f>F{>^IDjM~(_mpZp#!(BJccPhGwv zYV~7GYacF<@3~s|u1N7DT@ec7rN_AXPQ=%j$EhEPx(N5*3C8Ou=AKsAy~Hog{)wvn zd{2OQY0x9_8%C$4OnbiU{d<{AW!eAxg%#3vs*TAdT;srh56rOu=C5KC@+St6`~saB zMVHIOOGoh+>y`-FyE5c&l&zQ5m;CV8&jd*Cp2>gqD|1OUF3oK%*l^Mg%as3ER~aMF z|KX3A8D+;y#`v2DBGO}{>^f5EDGcV6%dSkbB&apRyImo^FJ;%1_G}iwhpclmt*E;y z+f#Bqz|23Y>_BOU9(YrQV%fox&ov>@12dXkEF0%-jj{;mE3i0n&N8Qh=eU30rW$Sx zv@V`)uL_g&!Wi)(gezx$zTn+dGM`^OyRm9v2^kf*X4!EutSkYob7f^dFfdF0gMOaI z;NzY3d?qX=Tm=9RYmlWW(81x1vdpqel21B()|zHl zRe6sv&|OubBMkue#bn1C(=M~@FxBj73c8+ob}f~|VrJ-|d3Ie@+B$>WhMHPr2dQHB z{a;sC8`5MHh1Y#8b-20QR;D)H+K1b#%S^4roRxiPR{jY4z@Sn?i(FX|7D0ca2r4Lc zX2gmcMMY5kh@hfRD9VcZQA89-Q9q(DGJ+tg=j^`aaNu5^=bU@)d(XXh_kHEubCXO3 zU13!Hz(4_utkk|fF;L^@SQZ_#$dLBtouXn^StI6VQL`PcE~)rXi=Pg~EGQ>q zA4SsB%WEig(9JAVTGiQdvbY^o;Apn26fs1F*<}@F+5iR(u&9xYu=g`IjEn&Ui?I&q zEDCobUyhzBb8Pd~dW7#H{0$;(la*|CX{KepxEtiJGWz}aXjoa^nxb&C7d0dY_rx5Q ztxT0||0lc7vO;7DHw@zt(l!Pi;^=O^hUx1GRP^1B@p%D}zU-PN2gc`lgw`^+;6ST> z-Jz#WSwZ!}j^zL4>}HSe3@N!8l2XG*~~ zR@REUSXRF0!@W-n%I6(fh&cub_gNEd_$fhStbr4?3KapA{aP}xCJ-bV*L@% z#5p8bLJ_yXM3);Cn_n@AYE=b&JY98)cre2nfljB3;qm_83__F^MF08!FbL9F`^$aic0K*ak%+_IHx|>Cv!r`HZIy&!% zhi;Zi9~GAX)Rif)uPHH^E|;LAFHif=;2ijtgqx~LLH~&;x}h~;p~KAFuVbc5T%E&L zKc%`ocs$+*&HzZ8aP2Jl%+k3)YJ>44?H;xbvlLPV$Q~klnQq%ja j{Kr5gcto~wF?>|X{swv!mU&i3h9l$KZOwGAF#*|MWZ)Lu